Tuya Smart Wi-Fi Smoke Detector: Exploring WiFi Module CB3S & MCU CX32L003F8

arhismece 5820 31

#31 21694358 19 Sep 2025 10:08

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #31
21694358 19 Sep 2025 10:08

Code: text Expand Select all Copy to clipboard
linkTuyaMCUOutputToChannel [dpId] [varType] [channelID] [bDPCache-Optional] [mult-optional] [bInverse-Optional]

for dpCache use 0, for mult 1, and then 1 for bInverse. Then driver should invert value before saving to channel.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#32 21694639 19 Sep 2025 14:53

aleshinalekseya aleshinalekseya

Level 6
Helpful post? (0)

Post #32
21694639 19 Sep 2025 14:53

After I changed the line as you recommended, the meaning is now always zero. fw 1.18.176

Code: text Expand Select all Copy to clipboard
clearIO startDriver TuyaMCU startDriver tmSensor tuyaMCU_setBaudRate 9600 waitFor MQTTState 1 // smoke sensor status, Enum value, dpID 1 setChannelLabel 1 SmokeStatus setChannelType 1 ReadOnly linkTuyaMCUOutputToChannel 1 enum 1 0 1 1

Is it possible to immediately convert to BinarySensor?
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Topic summary

The discussion centers on the Tuya Smart Wi-Fi Smoke Detector featuring the WiFi module CB3S and MCU CX32L003F8, an optical smoke sensor device. Users compare it to a similar device from topic3978070 but note differences in PCB layout and sensor design. The device uses a TuyaMCU architecture where the 32-bit ARM MCU runs original firmware controlling the CB3S WiFi module, which is powered on/off by the MCU via a transistor to conserve battery. Capturing UART communication is essential to identify dpIDs (data points) and their meanings, such as smoke detection (dpID 2, integer 0-100%), battery state (dpID 14 enum, dpID 15 integer percentage), tamper state, and alarm state. Packet captures and UART logs are used to map dpIDs to sensor functions. Flashing alternative firmware like OpenBK7231T requires careful UART data capture and understanding of power control, as the WiFi module is not always powered. Autoexec.bat scripts with TuyaMCU and tmSensor drivers are needed to link dpIDs to channels for integration with Home Assistant. Challenges include failed reflashing attempts, MAC address resets, and ensuring proper power supply during UART capture. Some users report success with 9600 baud rate and partial functionality in Home Assistant, including smoke percentage and battery status. The community suggests referencing existing TuyaMCU sensor configurations and adapting autoexec.bat scripts for this device. Overall, the device requires detailed UART analysis and custom firmware configuration to achieve reliable alternative firmware operation and full sensor integration.
Summary generated by the language model.

FAQ

TL;DR: dpID 2 outputs 0-100 % smoke, peaking at 99 % in dense smoke [Elektroda, aleshinalekseya, post #20719757] “Smoke detection is dpID 2, range 0-100” [Elektroda, p.kaczmarek2, post #20719769] Flash only the CB3S; MCU stays stock. Use 9600 bps, battery power, and an OpenBK autoexec.bat to expose smoke & battery in Home Assistant.

Why it matters: Correct mapping avoids false alarms and bricked modules.

Quick Facts

• Wi-Fi module: Tuya CB3S (BK7231T SoC) [Elektroda, arhismece, post #20690604]
• Control MCU: CX32L003F8, UART at 9600 bps [Elektroda, groove6j, post #21436840]
• Smoke value: Integer 0-100 on dpID 2; alarm often starts ≈20 % [Elektroda, aleshinalekseya, post #20719812]
• Battery: 9 V block; dpID 15 gives 0-100 % while dpID 14 reports low/mid/high [Elektroda, aleshinalekseya, post #20719757]
• Street price: US $9–12 on AliExpress (Oct 2023) [AliExpress Listing]

What chips are inside the Tuya Wi-Fi smoke detector?

The radio is a Tuya CB3S module using a BK7231T Wi-Fi/MCU, while smoke processing and power control run on a separate CX32L003F8 ARM-M0 microcontroller [Elektroda, arhismece, post #20690604]

Which UART baud rate should I use to capture TuyaMCU packets?

Most boards ship at 9600 bps; users saw clean traffic and functioning OpenBK integration at that speed [Elektroda, groove6j, post #21436840] A few early samples responded at 115 200 bps, so test both if silent [Elektroda, p.kaczmarek2, post #20803879]

How are the key dpIDs mapped?

dpID 1 = alarm status (0 = alarm, 1 = normal); dpID 2 = smoke concentration 0-100 %; dpID 14 = battery level enum (low/middle/high); dpID 15 = battery percentage 0-100 % [Elektroda, moustic999, post #20723099]

How do I capture dpID changes quickly?

Leave the 9 V battery in place and wire CB3S GND + RX to a USB-UART.
Set the terminal to 9600 bps, 8-N-1.
Start logging, press tamper and test buttons, then stop logging and note which dpID changed [Elektroda, p.kaczmarek2, post #20719397]

Do I power the Wi-Fi module externally during sniffing or flashing?

No. External 3.3 V keeps BK7231T awake while the CX32L003F8 sleeps, so no packets appear. Always power the whole board through its battery terminals for valid communication [Elektroda, p.kaczmarek2, post #20691641]

What autoexec.bat works with OpenBK?

A minimal script is: startDriver TuyaMCU startDriver tmSensor tuyaMCU_setBaudRate 9600 setChannelLabel 2 Smoke setChannelType 2 SmokePercent linkTuyaMCUOutputToChannel 2 val 2 setChannelLabel 14 Battery setChannelType 14 ReadOnlyLowMidHigh linkTuyaMCUOutputToChannel 14 enum 14 setChannelLabel 15 BatteryPct setChannelType 15 BatteryPercent linkTuyaMCUOutputToChannel 15 val 15 [Elektroda, groove6j, post #21436840]

How can I flash CB3S without desoldering it?

Lift or remove resistors R20 and R23 (they sit on CB3S TX/RX lines), connect 3.3 V, GND, TX, RX, then write the BK7231T image. Replace the resistors afterward to restore MCU control [Elektroda, groove6j, post #21436840]

Why did my module’s MAC change to C8:47:8C:00:00:00 after a failed write?

A full flash erase clears RF calibration. Restore the 2 MB backup or inject a valid RF section to regain the real MAC and stable Wi-Fi [Elektroda, wtv, post #20807426]

What happens if I keep the Wi-Fi module powered permanently?

Continuous power drains the 9 V battery in weeks instead of months and prevents the MCU from sleeping, but packets still stop because the MCU does not issue UART commands while asleep [Elektroda, p.kaczmarek2, post #20691641]

Is there a siren-silencer function?

dpID 16 appears to toggle the buzzer; early tests show the alarm muted when 16 is set, but more validation is needed [Elektroda, groove6j, post #21436840]

How long does the 9 V battery last?

Users report a single 9 V block running for roughly 12 months with two alarm tests per month [User logs, 2024]; low battery is flagged when dpID 15 drops below 33 % [Elektroda, aleshinalekseya, post #20719757]

What edge cases can break communication?

Wrong baud rate—115 200 bps yields gibberish.
External power—MCU sleeps, UART silent.
Cleared RF section—module boots with null MAC and no Wi-Fi [Elektroda, p.kaczmarek2, post #20807459]