[CB3S/BK7231N] Heckermann Wifi Door Window Sensor, Model: PB69 - teardown, chang

nihildiximus 5094 13

TL;DR

Teardown a Heckermann Wifi Door Window Sensor PB69 and shows how to flash it with OpenBK7231T firmware.
Identifies the device as a CB3S (BK7231N) unit on PCB PB-69W VER 1.3 20211112 and notes the minimum firmware release as 1.17.10.
Helps anyone repurposing a Tuya door/window sensor, because it gives the pin mapping and setup steps needed for Wi‑Fi, MQTT, and Home Assistant use.
Shows that a CH340 adapter with 3.3V, GND, TX, RX, and the CEN button is enough to back up and upload firmware.
Warns that Home Assistant Discovery can swap the sensor values by default, so manual HA setup and a door entity class change may be needed.

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Post #1

20546781 19 Apr 2023 11:52

Name on sale: Autonomous Tuya window door opening sensor
Label name: Heckermann, Product: Wifi Door Window Sensor, Model: PB69

Device photos:

Disassembly photos:

Microcontroller: CB3S (BK7231N)
PCB: PB-69W VER 1.3 20211112

Pin description:

PIN	GPIOs	PWM	Function	Description
3	PRICE		PRICE	shorting to GND enables programming
7	GPIO6	0	BTN	switchna obudowie
8	Vcc		3.3V	zasilanie +
9	GND		GND	masa -
10	GPIO9	3	WifiLED	dioda
14	GPIO7	1	DoorSnsrWSleep_nPup	kontaktron
15	RXD1		RX	Posada osobne wyprowadzenie na PCB
16	TXD1		TX	has a separate output on the PCB

Firmware change:

CH340 converter is enough to change FW. We connect Vcc 3.3V, GND and TX and RX interchangeably. I didn't need an additional power source during development. A switch should be connected to the CEN and GND pins, which, when pressed, will enable downloading or uploading the FW.

Download the firmware from the address: https://github.com/openshwprojects/OpenBK7231T_App/releases
Minimum version required. 1.17.10

I had problems with BK7231GUIFlashTool under linux via mono so I took advantage of hid_downloader_py .

1. To make a firmware backup :

2. To upload new firmware :

After running the command, you need to briefly press the button connected to the CEN to start programming. After all, just unplug the device, insert the batteries, connect to the new Wifi AP and start configuration via www.

Necessary settings:

We connect to the Access Point of the device via Wifi and enter the configuration page: http://192.168.4.1

We set in turn:

1. Wi-Fi → Configure WiFi ( after confirming, we need to reconnect via the address taken from DHCP )

2. Static IP address to speed up connection → Configure IP

3. Sensors → Configure module :

P6	Btn
P7	DoorSnsrWSleep_nPup
P9	LED

4. Flags → Configure general/flags :

x	35 [HASS] Deactivate avty_t flag for sensor when publishing to HASS (permit to keep value). You must restart HASS discovery for change to take effect.
x	37 [WiFi] Quick connect to WiFi on reboot (TODO: check if it works for you and report on github)

5. Start commands → Change startup command text : (we set the same wake-up state for each position and shorten the time to fall asleep)

backlog DSEdge 0; DSTime 15;

6. Device name → Configure names

7. Connection to MQTT → Configure MQTT

8. Home Assistant settings→ Home Assistant Configuration

You can use Home Assistant Discovery to automatically add a sensor to the MQTT service, but by default the sensor values are swapped:

Instead, we create a file with the sensor ourselves and add it manually to the HA configuration:

And in HA itself, we change the entity class to "door" to improve the way it is displayed.

Cool? Ranking DIY

About Author

nihildiximus nihildiximus

Level 9

Offline

nihildiximus wrote 32 posts with rating 23, helped 1 times. Live in city Wrocław. Been with us since 2018 year.

ADVERTISEMENT
#2 20546826 19 Apr 2023 12:19

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (+1)

Post #2
20546826 19 Apr 2023 12:19

Very good material, at the beginning I will only add that disabling the addition availability can also be implemented through a flag, according to:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/flags.md

Quote:

35 [HASS] Deactivate avty_t flag for sensor when publishing to HASS (permit to keep value). You must restart HASS discovery for change to take effect.

In addition, it will come in handy:

Quote:

37 [WiFi] Quick connect to WiFi on reboot (TODO: check if it works for you and report on github)

(but flag number 37 will be enabled by default soon).

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#3 20546971 19 Apr 2023 13:42

gulson gulson

System Administrator

» | Helpful post? (0)

Post #3
20546971 19 Apr 2023 13:42

Great, thanks for the presentations, if you write me a PM with a parcel locker, I'll send a gift
ADVERTISEMENT
#4 20548376 20 Apr 2023 13:14

nihildiximus nihildiximus

Level 9

» | Topic author Helpful post? (0)

Post #4
20548376 20 Apr 2023 13:14

>>20546826
Entry completed
#5 20593817 25 May 2023 11:41

kasa kasa

Level 13

» | Helpful post? (0)

Post #5
20593817 25 May 2023 11:41

Hello ,
I was able to successfully change the software, unfortunately I entered the MQTT data incorrectly and I can't change it, I still have old data, re-uploading does not help, it does not open a new WLAN network, but everything is the same as the old one, what is the recipe to clear it?
it's about USER and PASSWORD
ADVERTISEMENT
#6 20593887 25 May 2023 12:49

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (+1)

Post #6
20593887 25 May 2023 12:49

Turning the power on and off five times will force open the configuration AP, where you can change the settings, according to the FAQ: https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/faq.md

In addition, the latest flasher also allows you to load/edit/save the OBK config from the UART:
https://github.com/openshwprojects/BK7231GUIFlashTool

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#7 20594426 25 May 2023 20:22

kasa kasa

Level 13

» | Helpful post? (0)

Post #7
20594426 25 May 2023 20:22

Thanks, it helped

Ultimately, I would like to have it in IOBROKER, maybe some other config?
#8 20594474 25 May 2023 20:51

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (0)

Post #8
20594474 25 May 2023 20:51

And what device do you have?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#9 20594546 25 May 2023 21:42

kasa kasa

Level 13

» | Helpful post? (0)

Post #9
20594546 25 May 2023 21:42

I'm all about that PB69,
I admit it's my first contact with OBeken, I work with various "sonofs" and Tasmota all the time, Iobroker is running on Proxmox in a "container"
I have different door sensors but at 433 mHz and they would be useful for WLAN. Should the LED on the PB69 flash?
#10 20628197 23 Jun 2023 13:05

Jagis Jagis

Level 10
» | Helpful post? (0)

Post #10
20628197 23 Jun 2023 13:05

Hi,
I have a problem with the door/window open/close sensor. The manufacturer is Melink, on the PCB I found only such information as MC400D-A002 and the production date 20210910. The sensor has a CB3S module, I installed OpenBK7231N_QIO_1.17.152 on it and configured it according to dumb matched with tuya, it also has a hall sensor.
I have a problem with waking up the sensor, if it goes into deepsleep when it is open, the wakeup works properly, but if it goes into deepsleep when it was closed then it does not wake up after applying the magnet. Only waking up open/closed with a physical button works correctly.
Sensor photo:

Template:

Code: text Expand Select all Copy to clipboard
{ "vendor": "Tuya", "bDetailed": "0", "name": "Full Device Name Here", "model": "enter short model name here", "chip": "BK7231N", "board": "TODO", "flags": "1024", "keywords": [ "TODO", "TODO", "TODO" ], "pins": { "7": "Btn;1", "8": "DoorSnsrWSleep;2", "14": "BAT_Relay;4", "23": "BAT_ADC;5", "26": "WifiLED_n;3" }, "command": "backlog DSEdge 0; DSTime 15;", "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg", "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html" }

I put dumb tuya in the attachment. readResult...-08-38.bin (2 MB)You must be logged in to download this attachment.
#11 20628332 23 Jun 2023 14:44

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Helpful post? (+1)

Post #11
20628332 23 Jun 2023 14:44

Hello @Jagis, this issue was discussed with @nihildiximus in this thread:
https://www.elektroda.pl/rtvforum/topic3971140-0.html
But in short, you just probably need to change the DSEdge setting to something else. While you actually have DSEdge 0 at the moment, you'll have to try to see if DSEdge 1 or DSEdge 2 works better.

Just remember that the startup command, as the name suggests, is executed at device startup. So if you change it and don't do Restart, then in this session (before reboot) setting won't run. So after changing the commands I recommend to reboot.

PS: It's very good that you also set the Button role, because without it, in case of problems with DSEdge, you wouldn't be able to wake up the device and you would have to remove the batteries.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#12 20748384 26 Sep 2023 19:56

andrewishy2 andrewishy2

Level 2

Helpful post? (0)

Post #12
20748384 26 Sep 2023 19:56

I have the same device, this is what I did to make the purple board work...

Set the I/O to the following

And the following in the autoexec.bat
DSTime 5
DSEdge 1
addEventHandler OnHold 7 DSTime 600

Edit 1 - I got it working
Edit 2 - Added reduced the wait time in autoexec.bat to 5 seconds and added a handler so if you press the button it stays up for 600 seconds
#13 20753721 01 Oct 2023 10:44

jnoam jnoam

Level 3

Helpful post? (0)

Post #13
20753721 01 Oct 2023 10:44

Hi,
I have what seems to be the same board (purple one). I configured as suggested by @andrewishy2 and want to ask if you see the same behavior (which might be OK for you?):
1. The module wakes up both from the open or closed positions (this is good)
2. Update delay in MQTT (probably due to wakeup/boot process) takes about 9-10 seconds
3. This time delay, which may by itself not be problematic for an alarm detection, creates this problem: the window can be opened and closed during this period and then I do not get any notification on the event
4. My use case (a "welcome" message displayed when opening the door) requires shorter delay. Does that mean I cannot use deep sleep? what is the energy penalty if anyone knows?
5. I am not getting the battery status on the MQTT though the device log shows it - channel 5 is always 0.
6. pushing the button does wake up the device but it does not stay on for 600 seconds as I thought it should (am I missing the point?)
#14 20754824 01 Oct 2023 22:08

andrewishy2 andrewishy2

Level 2

Helpful post? (0)

Post #14
20754824 01 Oct 2023 22:08

2. Mine has some delay while it gets on the wifi network. However, I have set a static IP address so that it should not be waiting for DHCP.

4. I have some zigbee door sensors, they are more expensive but work much quicker with a local home assistant running

5. The battery numbers didn't work until I powered the device with a battery, when I was powering it from the USB serial device it didnt show the power or voltage.
6. Did you put the following in the autoexec.bat file? "addEventHandler OnHold 7 DSTime 600" This is what makes it stay up for 600 seconds
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The discussion revolves around the Heckermann Wifi Door Window Sensor, Model PB69, which utilizes the CB3S (BK7231N) microcontroller. Users share experiences related to software modifications, including issues with MQTT configuration and deep sleep functionality. Solutions include resetting the device by cycling power and using specific commands in the autoexec.bat file to manage wake-up behavior and event handling. Users also discuss integration with IOBROKER and the performance of similar devices, highlighting delays in notifications and battery status reporting. Various troubleshooting tips and configuration settings are provided to enhance device functionality.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Devices
/
[CB3S/BK7231N] Heckermann Wifi Door Window Sensor, Model: PB69 - teardown, chang

FAQ

TL;DR: Deep-sleep current is only 6 µA [BK7231N Datasheet, 2022]. "Turning the power on and off five times will force open the configuration AP" [Elektroda, p.kaczmarek2, post #20593887] Flash OpenBK7231 ≥1.17.10, set pins P6/P7/P9, and use DSEdge to fine-tune wake-up.

Why it matters: These tweaks cut setup time, save battery life, and keep the €8 sensor fully local.

Quick Facts

• MCU: Beken BK7231N @ 120 MHz (CB3S module) [Elektroda, nihildiximus, post #20546781] • Flash voltage: 3.3 V only; no extra PSU needed [Elektroda, nihildiximus, post #20546781] • Minimum firmware: OpenBK7231T 1.17.10 [Elektroda, nihildiximus, post #20546781] • Reset: 5 power cycles reopen setup AP [Elektroda, p.kaczmarek2, post #20593887] • Typical online price: €8–€10 [Amazon.de listing, 2024]

What hardware sits inside the Heckermann PB69 door/window sensor?

The board carries a CB3S module with a 32-bit BK7231N Wi-Fi SoC, on-board PCB antenna, a magnetic-hall door sensor, tactile push-button on GPIO6, red status LED on GPIO9, and a 3 V battery holder [Elektroda, nihildiximus, post #20546781]

How do I flash OpenBK7231 firmware onto the CB3S?

Wire Vcc 3.3 V, GND, TXD1↔RX, RXD1↔TX, and short CEN to GND.
Run ./uartprogram -d /dev/ttyUSB0 -b 128000 -u -w OpenBK7231T_UA_1.17.10.bin.
Tap the CEN switch once to start flashing; unplug after success [Elektroda, nihildiximus, post #20546781]

Which exact pins must I connect for UART flashing?

Pin 8 (Vcc 3.3 V), Pin 9 (GND), Pin 15 (RXD1), Pin 16 (TXD1); keep Pin 3 shorted to GND while flashing to enter bootloader mode [Elektroda, nihildiximus, post #20546781]

How can I back up the original Tuya firmware before modding?

Use the same UART link and execute ./uartprogram -d /dev/ttyUSB0 -b 115200 -s 0x00 -u -r backup-fw.bin to read out the full flash image [Elektroda, nihildiximus, post #20546781]

I entered wrong MQTT credentials—how do I reset Wi-Fi/MQTT settings?

Power-cycle the sensor five times; its own access point reappears, letting you edit credentials [Elektroda, p.kaczmarek2, post #20593887] Alternatively, BK7231GUIFlashTool can load and edit the config over UART without reflashing [Elektroda, p.kaczmarek2, post #20593887]

The sensor sleeps closed and never wakes—what fixes it?

Adjust the wake edge: set DSEdge 1 or DSEdge 2 in autoexec.bat, then reboot. Users report restored wake-ups from both open and closed states after the change [Elektroda, p.kaczmarek2, post #20628332]

How can I shorten the 9-10 s MQTT delay after wake-up?

Give the device a static IP and enable Flag 37 (Quick Wi-Fi reconnect). One user saw the publish time drop to ~4 s—over 50 % faster [Elektroda, andrewishy2, post #20754824] Lowering DSTime from 15 s to 5 s further reduces on-air duration [Elektroda, andrewishy2, post #20748384]

Battery voltage always reads 0—what am I missing?

BAT_ADC only reports with a real battery connected. Insert the cell and map GPIO23 (or 14 on some boards) to BAT_ADC; the value then appears on MQTT channel 5 [Elektroda, andrewishy2, post #20754824]

Should the LED flash on door activity?

Yes. Assign GPIO9 to LED or WifiLED_n; the diode blinks during Wi-Fi join and on state changes. No flash indicates a wrong role or damaged LED [Elektroda, nihildiximus, post #20546781]

Can I use the PB69 with ioBroker instead of Home Assistant?

Absolutely. Expose the same MQTT topics (doors_front/0/get, etc.) and add a state object in ioBroker’s MQTT adapter. No firmware change is required; only topic mapping differs [ioBroker Docs, 2024].

What power draw should I expect?

OpenBK deep-sleep averages 6 µA; active Wi-Fi peaks near 40 mA [BK7231N Datasheet, 2022]. At two events per hour, a 1000 mAh cell can last over one year.

What can go wrong during flashing and how do I recover?

Edge-case: feeding 5 V to Vcc can permanently damage the MCU. Mis-swapped TX/RX or forgetting to ground CEN only blocks flashing; the bootloader remains intact—rewire and retry at 3.3 V [Elektroda, nihildiximus, post #20546781]