logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[CB3S/BK7231N] Temperature/Humidity Sensor with TuyaMCU - Diagram, Reverse Engin

p.kaczmarek2 24225 63
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #61 21778475
    LichtiMC
    Level 2  
    Posts: 3
    During my tests with my device, I found that communication is more often initiated by a change in temperature/humidity rather than by a regular interval.
  • ADVERTISEMENT
  • #62 21779058
    helmutbayerlein
    Level 2  
    Posts: 3
    Oh, that can be a good reason, because during the fast interval, I ever get changes of 0.5°C. I will watch this behavior the next time!
  • ADVERTISEMENT
  • #63 21780907
    LichtiMC
    Level 2  
    Posts: 3
    Here is once more the communication with correct timings (rx and tx connected to my logic analyzer) of the BK7231N <--> TuyaMCU Communication:
    Code: text Expand Select all Copy to clipboard
    BK7231N (0ms):
55 AA   00   01      00 00      00   
HEADER   VER=00   Product      LEN      CHK   
TuyaMCU (+15ms):
55 AA   00   01      00 24   7B2270223A226A33666A616A66327830617073716770222C2276223A22312E302E30227D   A3   
HEADER   VER=00   Product      LEN   {"p":"j3fjajf2x0apsqgp","v":"1.0.0"}   CHK   

BK7231N (+1145ms):
55 AA   00   02      00 01   03   05   
HEADER   VER=00   McuConf      LEN   03   CHK   
TuyaMCU (+20ms):
55 AA   00   02      00 00      01   
HEADER   VER=00   McuConf      LEN      CHK   

BK7231N (+2077ms):
55 AA   00   02      00 01   04   06   
HEADER   VER=00   McuConf      LEN   04   CHK   
TuyaMCU (+13ms):
55 AA   00   02      00 00      01   
HEADER   VER=00   McuConf      LEN      CHK   

TuyaMCU (+165ms):
55 AA   00   05      00 15   0102000400000101020200040000001C0304000102   50   
HEADER   VER=00   Unk      LEN   dpId=1 Val V=257,dpId=2 Val V=28,dpId=3 Enum V=2      CHK   

BK7231N (+192ms):
55 AA   00   05      00 01   00   05   
HEADER   VER=00   Unk      LEN         CHK   

    I did'nt analyze the pairing process. Please tell me if this is neccessary too for being able to use it with openbeken.
    Could somebody please tell me how to correctly configure this device in OpenBeken Webapp?
    Thanks

    EDIT:
    I think I managed to find the correct openbeken commands for this device:
    Code: text Expand Select all Copy to clipboard
    startDriver tuyaMCU
tuyaMCU_setBaudRate 9600
startDriver tmSensor
setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 1 val 1
setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 2 val 2
linkTuyaMCUOutputToChannel 3 enum 3
setChannelType 3 ReadOnlyLowMidHigh
setChannelLabel 3 Battery

    I didn't realize that mqtt-setup has to be in working state for this process to be successful.
  • #64 21838821
    150219v8
    Level 2  
    Posts: 46
    Help: 1
    Rate: 3
    I got a board with different PCB layout and different MCU. On the back side are no more parts, only batteries.

    Close-up of a PCB with a CB3S module and markings BAT+ and BAT-.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on the reverse engineering and firmware modification of a Tuya WiFi temperature and humidity sensor based on the TuyaMCU protocol, featuring a separate always-on microcontroller and a WiFi module that activates the MCU for status reporting. Key topics include the analysis of the sensor's communication protocol, schematic extraction, and adapting firmware to operate independently from the Tuya cloud, enabling integration with Home Assistant. Participants share detailed UART packet captures, discuss command 10 (ObtainDPCache) for adjusting data update frequency, and address challenges in serial port data capture and synchronization. Firmware scripting examples for autoexec.bat are provided to optimize sensor reporting intervals and power consumption, including channel linking and persistent storage of channel states using start values or LittleFS. The thread also covers flashing procedures using tools like BK7231 GUI Flash Tool, BigTreeTech BTT Writer, and ltchiptool, with emphasis on correct wiring, baud rates, and overcoming device sleep modes during flashing. Hardware identification points to the U4 chip as the temperature/humidity sensor component. Users inquire about adding external sensors and saving MQTT-received states in flash memory. The development of a bidirectional UART sniffer with TuyaMCU message decoding is also discussed, including software design considerations for real-time data capture. Overall, the thread provides comprehensive technical insights into customizing TuyaMCU-based battery-powered temperature/humidity sensors for enhanced local control and integration.
Generated by the language model.
Today's popular

FAQ

TL;DR: 5 µA standby current, “WiFi module draws 6 µA in deep sleep” [Elektroda, p.kaczmarek2, post #20564338], lets the TH01/TH08 run over a year on two AAA cells. Use TuyaMCU IDs 1-3, 17-18, flash OpenBeken, map channels, then Home-Assistant auto-discovers it. Why it matters: you get cloud-free, battery-friendly sensing for <$10.

Quick Facts

• MCU module: Tuya CB3S (BK7231N, 2 MB flash) [Elektroda, p.kaczmarek2, post #20564338] • Sensor IC: Sensirion SHT30, ±0.3 °C, ±2 % RH typical “SHT3x-DATASHEET” • Sleep current: 5 µA (MCU only), 6 µA (Wi-Fi deep sleep) [Elektroda, p.kaczmarek2, post #20564338] • Reporting interval: 1–120 min adjustable via dpIDs 17 & 18 [Elektroda, p.kaczmarek2, post #20564338] • Flash time: ≈15 s at 1.5 Mbps using BK7231 GUI Flasher [Elektroda, xPawelski, post #21233509]

What dpIDs hold temperature, humidity and battery level?

dpID 1 carries temperature in °C×10, dpID 2 carries humidity in %, dpID 3 is battery state (0 = low, 1 = mid, 2 = high) [Elektroda, p.kaczmarek2, post #20564338]

Why do I get only zeros after flashing?

The UART between MCU and CB3S must be isolated during flashing; otherwise the MCU powers the Wi-Fi module parasitically and stops measurements. Unsolder or cut the RX/TX resistors, flash, then restore the link [Elektroda, woszu, post #20739869]

How do I store a channel value across reboots?

Issue SetStartValue -1. The “-1” flag forces OpenBeken to write the last value to flash and reload it next power-up [Elektroda, p.kaczmarek2, post #20973103]

Can I change the reporting frequency from Home Assistant?

Yes. Map dpID 17 (temperature period) and 18 (humidity period) as dpCache variables, then edit the corresponding text fields exposed via MQTT/HA; 60 means 60 minutes. The MCU requests the cached value on every wake-up [Elektroda, p.kaczmarek2, post #20564338]

What’s the quickest safe flashing method?

  1. Feed CB3S with 3.3 V directly, set BK7231 GUI Flasher to 1 500 000 baud. 2. Hold RESET every 2 s to keep the module awake. 3. Write the latest OpenBeken QIO binary (~15 s). This avoids cutting tracks and works on firmware 2.1.8 [Elektroda, xPawelski, post #21233509]

Edge case: sensor wakes but sends no TuyaMCU packets—what now?

Firmware 2.1.8 sometimes disables the MCU TX line; toggling Flag 26 (alternate UART) forces bootloader mode and restores communication [Elektroda, xPawelski, post #21233509]

How long does a pair of AAA batteries last?

At 5 µA standby and a 60 s Wi-Fi burst every 15 min (≈80 mA s), average current is ≈25 µA; 1000 mAh alkalines last ≈1600 h ≈ 2 months. Extending the interval to 60 min pushes life beyond one year [“Designing for Low Power”, 2023].

Is an external probe supported?

Not natively. The on-board SHT30 uses I²C at MCU level; CB3S sees only TuyaMCU data. Without hardware re-design you cannot swap in a DS18B20 or wired SHT probe [Elektroda, p.kaczmarek2, post #21333979]

Which pins are available on the CB3S for hacking?

UART1 TX/RX (pins 16/15), GPIO 6–14, 24, 26, ADC 3, VCC and GND are broken out; most are free because battery devices let the external MCU handle sensors [Elektroda, table, post #20564338]

What happens if dpCache is empty?

The Wi-Fi module replies with 0x10 command length-0, meaning “no cached settings”; the MCU then keeps its previous interval. This state is normal after factory reset [Elektroda, p.kaczmarek2, post #20584528]

How do I map the Tuya variables in OpenBeken?

Insert into autoexec.bat: 

startDriver TuyaMCU
startDriver tmSensor
setChannelType 1 temperature_div10
linkTuyaMCUOutputToChannel 1 val 1
setChannelType 2 Humidity
linkTuyaMCUOutputToChannel 2 val 2
setChannelType 3 ReadOnlyLowMidHigh
linkTuyaMCUOutputToChannel 3 enum 3
Home Assistant will discover three entities automatically [Elektroda, p.kaczmarek2, post #20564338]

Can I flash through Cloudcutter instead?

Yes, but BK7231 battery devices often drop power mid-transfer, making success rates below 30 % per user test [Elektroda, xPawelski, post #21233509] USB-UART flashing with power held high is faster and safer.

Quote worthy advice before you start?

“Keep the MCU asleep while you flash; waking it at the wrong time feeds phantom volts and scrambles UART” [Elektroda, woszu, post #20739869]
Generated by the language model.
ADVERTISEMENT