BK7231N, TuyaMCU and individually addressable LEDs - effects control, adding buttons, thermometer

p.kaczmarek2 2010 2

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Reply Cool? Ranking DIY | New topic

Notify about new articles

Post #1

20812818 13 Nov 2023 10:35

Here I would like to show how we reverse-engineered an interesting Tuya lamp, based on individually addressable LEDs that can produce various types of animations, such as "waterfall", "fire", etc. The goal of the topic will be to free this lamp from the cloud and replace the original software with our still developed open source equivalent that can operate 100% locally and anonymously.

I've worked on this device together with my friend from Serbia - @DeDaMrAz. He has bought the lamp and he operated it, while I dealt with the firmware side.

Purchase of the device
We ordered the lamp at the request of one user who needed help in freeing it from the cloud, but you can search for it under the phrase Smart Wall Light taya APP RGB Outdoor Porch Colored light Party intelligent remote control Decoration Lighting holiday Wall Lamp . There are many versions to choose from, the longer the strap, the higher the price:

We paid €49.02 for the selected version.
The structure of this lamp is quite specific, the strap is mounted around it. This video from the manufacturer shows it better:

This lamp is controlled via WiFi (Tuya application) and by a remote control, in the version we purchased it is an RF remote control.

Action plan
Our goal is to free the device in question from the cloud, and this consists of individual tasks:
- first we need to examine how this device is built
- in this case, we also need to capture its TuyaMCU communication packets, because here the device consists of a separate WiFi module (which we will change the firmware for) for communication with the outside world and an MCU for controlling addressable LEDs and receiving IR codes from the remote control
- we need to analyze the captured packets to know which dpIDs (TuyaMCU variable identifiers) are responsible for what, we have our own tool for this
- then we need to upload our firmware to the WiFi module through our flasher
- then we need to script OBK to emulate packets sent by TuyaMCU by the original Tuya software and give it some sensible user interface on the OBK panel
Here are some related topics that will explain some of the concepts I use:
- TuyaMCU protocol - communication between the microcontroller and the WiFi module
- AnalyzerTuyaMCU - UART packet decoder for Tuya devices - dpID detector

First impression
The device consists of a front with LEDs, a power supply and a controller module:

You need to use a bit of force to get inside:

The main PCB is hidden in the heat shrink sleeve:

The LEDs are 12V, not WS2812B, but SM16703:

After connecting, the device flashes in pairing mode:

You can easily connect to the Tuya application:

NOTE: pairing is started by pressing the MUSIC button on the remote control.
After connecting the device to Tuya, we captured UART packets and at the same time noted what operation was performed. So, for example, we turn on the capture, turn on the light, and save the results. Then we turn on capture, change the brightness, and save the results. And so with every operation.

Captured communication packets from TuyaMCU
Here are the collected packages, they can be easily analyzed in the mentioned analyzer:
https://www.elektroda.pl/rtvforum/topic3970199.html
https://github.com/openshwprojects/TuyaMCUAnalyzer
Reboot after pairing:


//S 09/03/23 20:46:41 WiFi sent:
55AA00000000FF
//R 09/03/23 20:46:42 WiFi received:
55AA030000010104
//R 09/03/23 20:46:44 WiFi received:
55AA030000010104
//S 09/03/23 20:46:44 WiFi sent:
55AA00000000FF
//S 09/03/23 20:46:58 WiFi sent:
55AA00000000FF
//R 09/03/23 20:46:58 WiFi received:
55AA030000010104
//S 09/03/23 20:46:59 WiFi sent:
55AA0001000000
//R 09/03/23 20:46:59 WiFi received:
55AA0301002A7B2270223A2263756F666E346863726F616D746E6833222C2276223A22312E302E30222C226D223A307D35
//S 09/03/23 20:47:00 WiFi sent:
55AA0002000001
//R 09/03/23 20:47:00 WiFi received:
55AA0302000004
//S 09/03/23 20:47:01 WiFi sent:
55AA0008000007
//R 09/03/23 20:47:01 WiFi received:
55AA03070005140100010125
//R 09/03/23 20:47:02 WiFi received:
55AA03070005150400010129
//R 09/03/23 20:47:02 WiFi received:
55AA030700081A02000400001F4090
//R 09/03/23 20:47:02 WiFi received:
55AA030700093300000500000101F440
//R 09/03/23 20:47:02 WiFi received:
55AA030700093400000500000101F441
//R 09/03/23 20:47:02 WiFi received:
55AA03070008350200040000012C79
//S 09/03/23 20:47:02 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:03 WiFi received:
55AA030000010104
//S 09/03/23 20:47:03 WiFi sent:
55AA000300010407
//R 09/03/23 20:47:04 WiFi received:
55AA0303000005
//S 09/03/23 20:47:06 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:07 WiFi received:
55AA030000010104
//S 09/03/23 20:47:10 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:11 WiFi received:
55AA030000010104
//S 09/03/23 20:47:14 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:15 WiFi received:
55AA030000010104
//S 09/03/23 20:47:18 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:19 WiFi received:
55AA030000010104
//S 09/03/23 20:47:22 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:23 WiFi received:
55AA030000010104
//S 09/03/23 20:47:26 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:27 WiFi received:
55AA030000010104
//S 09/03/23 20:47:30 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:31 WiFi received:
55AA030000010104
//S 09/03/23 20:47:34 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:35 WiFi received:
55AA030000010104
//S 09/03/23 20:47:38 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:39 WiFi received:
55AA030000010104
//S 09/03/23 20:47:42 WiFi sent:
55AA00000000FF
//R 09/03/23 20:47:43 WiFi received:
55AA030000010104

Here we basically get to know the modules for the first time, report the device version, WiFi status, etc. Additionally, the initial values of the variables are also sent, but for now it's hard to guess what they mean, we'll deal with that in a moment:

Blue LED Color:


//S 09/03/23 19:13:29 WiFi sent:
55AA000600191C030015313030643330336330303365383030303030303030F0
//S 09/03/23 19:13:29 WiFi sent:
55AA00060005150400010125
//R 09/03/23 19:13:29 WiFi received:
55AA030700191C030015313030643330336330303365383030303030303030F4
//S 09/03/23 19:13:29 WiFi sent:
55AA000600101803000C30306433303363303033653829
//R 09/03/23 19:13:29 WiFi received:
55AA03070005150400010129
//R 09/03/23 19:13:29 WiFi received:
55AA030700101803000C3030643330336330303365382D

The analyzer already shows that dpID 24 is responsible for the color, although it is a string type. Many Tuya devices have this color coded and also in dpID 24:

Additionally, the analyzer reads the color correctly and shows it in the form of a colored square.

Changing the brightness of the chase animation:


//R 09/03/23 21:52:04 WiFi received:55AA0307000515040001022A//R 09/03/23 21:52:04 WiFi received:55AA030700201903001C3032306430643030303031343033653830336538303030303030303090//R 09/03/23 21:52:07 WiFi received:55AA030000010104//R 09/03/23 21:52:08 WiFi received:55AA0307000515040001022A//R 09/03/23 21:52:08 WiFi received:55AA030700201903001C3032306430643030303031343033653830303061303030303030303081
100-0
//R 09/03/23 21:52:33 WiFi received:55AA0307000515040001022A//R 09/03/23 21:52:34 WiFi received:55AA030700201903001C3032306430643030303031343033653830303061303030303030303081//R 09/03/23 21:52:37 WiFi received:55AA030000010104//R 09/03/23 21:52:38 WiFi received:55AA0307000515040001022A//R 09/03/23 21:52:39 WiFi received:55AA030700201903001C30323064306430303030313430336538303063633030303030303030B6
0-20
//R 09/03/23 21:53:15 WiFi received:55AA0307000515040001022A//R 09/03/23 21:53:15 WiFi received:55AA030700201903001C3032306430643030303031343033653830306333303030303030303086//R 09/03/23 21:53:19 WiFi received:55AA0307000515040001022A//R 09/03/23 21:53:19 WiFi received:55AA030700201903001C303230643064303030303134303365383031386630303030303030308F//R 09/03/23 21:53:22 WiFi received:55AA030000010104
20-40
//R 09/03/23 21:53:44 WiFi received:55AA0307000515040001022A//R 09/03/23 21:53:44 WiFi received:55AA030700201903001C303230643064303030303134303365383031386630303030303030308F//R 09/03/23 21:53:49 WiFi received:55AA0307000515040001022A//R 09/03/23 21:53:49 WiFi received:55AA030700201903001C303230643064303030303134303365383032356430303030303030308B//R 09/03/23 21:53:52 WiFi received:55AA030000010104
40-60
//R 09/03/23 21:54:06 WiFi received:55AA0307000515040001022A//R 09/03/23 21:54:06 WiFi received:55AA030700201903001C303230643064303030303134303365383032356430303030303030308B//R 09/03/23 21:54:07 WiFi received:55AA030000010104//R 09/03/23 21:54:10 WiFi received:55AA0307000515040001022A//R 09/03/23 21:54:10 WiFi received:55AA030700201903001C3032306430643030303031343033653830333231303030303030303056
60-80
//R 09/03/23 21:54:28 WiFi received:55AA0307000515040001022A//R 09/03/23 21:54:28 WiFi received:55AA030700201903001C3032306430643030303031343033653830333231303030303030303056//R 09/03/23 21:54:31 WiFi received:55AA0307000515040001022A//R 09/03/23 21:54:31 WiFi received:55AA030700201903001C3032306430643030303031343033653830336538303030303030303090
80-100

Here we see that, surprisingly, there is no separate dpID responsible for brightness, it is coded in color... this dpID 21 here is the operating mode.

So dpID 25 is an animation described as a string, its length may vary. We saw earlier that the regular color is dpID 24

Chase animation:


//R 09/03/23 18:29:16 WiFi received:
55AA0307000515040001022A
//S 09/03/23 18:29:16 WiFi sent:
55AA00060005150400010226
//S 09/03/23 18:29:16 WiFi sent:
55AA000600201903001C303230653064303030303134303365383033653830303030303030308D
//R 09/03/23 18:29:16 WiFi received:
55AA030700201903001C3032306530643030303031343033653830336538303030303030303091
//S 09/03/23 18:29:17 WiFi sent:
55AA00000000FF
//R 09/03/23 18:29:18 WiFi received:
55AA030000010104

Here again you can see that the operating mode is set (dpID 21) and the animation is sent in dpID 25:

Collision animation:


//S 09/03/23 18:33:07 WiFi sent:
55AA00060005150400010226
//R 09/03/23 18:33:07 WiFi received:
55AA0307000515040001022A
//S 09/03/23 18:33:07 WiFi sent:
55AA000600A21903009E303734363436303230303030303365383033653830303030303030303436343630323030373830336538303365383030303030303030343634363032303066303033653830336538303030303030303034363436303230303364303365383033653830303030303030303436343630323030616530336538303365383030303030303030343634363032303131333033653830336538303030303030303073
//R 09/03/23 18:33:07 WiFi received:
55AA030700A21903009E303734363436303230303030303365383033653830303030303030303436343630323030373830336538303365383030303030303030343634363032303066303033653830336538303030303030303034363436303230303364303365383033653830303030303030303436343630323030616530336538303365383030303030303030343634363032303131333033653830336538303030303030303077

Basically as above, without comment, all animations go through dpID 25.

Draw curtain animation:


//S 09/03/23 18:28:42 WiFi sent:
55AA00060005150400010226
//R 09/03/23 18:28:42 WiFi received:
55AA0307000515040001022A
//S 09/03/23 18:28:42 WiFi sent:
55AA000600201903001C30303065306430303030326530336538303263633030303030303030E5
//R 09/03/23 18:28:42 WiFi received:
55AA030700201903001C30303065306430303030326530336538303263633030303030303030E9
//S 09/03/23 18:28:47 WiFi sent:
55AA00000000FF
//R 09/03/23 18:28:47 WiFi received:
55AA030000010104

Changing the brightness of a fireworks animation:


//R 09/03/23 22:04:53 WiFi received:
55AA030000010104
//R 09/03/23 22:04:56 WiFi received:
55AA0307000515040001022A
//R 09/03/23 22:04:56 WiFi received:
55AA030700A21903009E30353436343630313030303030336538303365383030303030303030343634363031303037383033653830336538303030303030303034363436303130306630303365383033653830303030303030303436343630313030336430336538303365383030303030303030343634363031303061653033653830336538303030303030303034363436303130313133303365383033653830303030303030306F
//R 09/03/23 22:05:02 WiFi received:
55AA0307000515040001022A
//R 09/03/23 22:05:02 WiFi received:
55AA030700A21903009E303534363436303130303030303365383030306130303030303030303436343630313030373830336538303030613030303030303030343634363031303066303033653830303061303030303030303034363436303130303364303365383030306130303030303030303436343630313030616530336538303030613030303030303030343634363031303131333033653830303061303030303030303015
//R 09/03/23 22:05:08 WiFi received:
55AA030000010104
//R 09/03/23 22:05:09 WiFi received:
55AA0307000515040001022A
//R 09/03/23 22:05:09 WiFi received:
55AA030700A21903009E303534363436303130303030303365383031323930303030303030303436343630313030373830336538303132393030303030303030343634363031303066303033653830313239303030303030303034363436303130303364303365383031323930303030303030303436343630313030616530336538303132393030303030303030343634363031303131333033653830313239303030303030303037
//R 09/03/23 22:05:13 WiFi received:
55AA0307000515040001022A
//R 09/03/23 22:05:13 WiFi received:
55AA030700A21903009E303534363436303130303030303365383032353730303030303030303436343630313030373830336538303235373030303030303030343634363031303066303033653830323537303030303030303034363436303130303364303365383032353730303030303030303436343630313030616530336538303235373030303030303030343634363031303131333033653830323537303030303030303043
//R 09/03/23 22:05:16 WiFi received:
55AA0307000515040001022A
//R 09/03/23 22:05:16 WiFi received:
55AA030700A21903009E303534363436303130303030303365383033316530303030303030303436343630313030373830336538303331653030303030303030343634363031303066303033653830333165303030303030303034363436303130303364303365383033316530303030303030303436343630313030616530336538303331653030303030303030343634363031303131333033653830333165303030303030303045
//R 09/03/23 22:05:18 WiFi received:
55AA0307000515040001022A
//R 09/03/23 22:05:18 WiFi received:
55AA030700A21903009E30353436343630313030303030336538303365383030303030303030343634363031303037383033653830336538303030303030303034363436303130306630303365383033653830303030303030303436343630313030336430336538303365383030303030303030343634363031303061653033653830336538303030303030303034363436303130313133303365383033653830303030303030306F
//R 09/03/23 22:05:23 WiFi received:
55AA030000010104
fireworks scene 100-0-30-60-85-100

fireworks animation:


//S 09/03/23 18:32:41 WiFi sent:
55AA00060005150400010226
//R 09/03/23 18:32:41 WiFi received:
55AA0307000515040001022A
//S 09/03/23 18:32:41 WiFi sent:
55AA000600A21903009E30353436343630313030303030336538303365383030303030303030343634363031303037383033653830336538303030303030303034363436303130306630303365383033653830303030303030303436343630313030336430336538303365383030303030303030343634363031303061653033653830336538303030303030303034363436303130313133303365383033653830303030303030306B
//R 09/03/23 18:32:41 WiFi received:
55AA030700A21903009E30353436343630313030303030336538303365383030303030303030343634363031303037383033653830336538303030303030303034363436303130306630303365383033653830303030303030303436343630313030336430336538303365383030303030303030343634363031303061653033653830336538303030303030303034363436303130313133303365383033653830303030303030306F

Green color setting:


//S 09/03/23 19:13:02 WiFi sent:
55AA000600191C030015313030366430333932303365383030303030303030CB
//R 09/03/23 19:13:02 WiFi received:
55AA030700191C030015313030366430333932303365383030303030303030CF
//S 09/03/23 19:13:02 WiFi sent:
55AA00060005150400010125
//S 09/03/23 19:13:02 WiFi sent:
55AA000600101803000C30303664303339323033653804
//R 09/03/23 19:13:02 WiFi received:
55AA03070005150400010129
//R 09/03/23 19:13:02 WiFi received:
55AA030700101803000C30303664303339323033653808
//S 09/03/23 19:13:03 WiFi sent:
55AA00000000FF
//R 09/03/23 19:13:03 WiFi received:
55AA030000010104

Pile up animation:


//S 09/03/23 18:32:02 WiFi sent:
55AA00000000FF
//R 09/03/23 18:32:03 WiFi received:
55AA030000010104
//S 09/03/23 18:32:03 WiFi sent:
55AA00060005150400010226
//S 09/03/23 18:32:03 WiFi sent:
55AA000600201903001C3031306530643030303038343030303030336538303030303030303053
//R 09/03/23 18:32:03 WiFi received:
55AA0307000515040001022A
//R 09/03/23 18:32:03 WiFi received:
55AA030700201903001C3031306530643030303038343030303030336538303030303030303057

rainbow animation:


//R 09/03/23 18:30:20 WiFi received:
55AA0307000515040001022A
//S 09/03/23 18:30:20 WiFi sent:
55AA00060005150400010226
//S 09/03/23 18:30:20 WiFi sent:
55AA00060054190300503036343634363031303030303033653830336538303030303030303034363436303130303738303365383033653830303030303030303436343630313030663030336538303365383030303030303030CF
//R 09/03/23 18:30:20 WiFi received:
55AA03070054190300503036343634363031303030303033653830336538303030303030303034363436303130303738303365383033653830303030303030303436343630313030663030336538303365383030303030303030D3

water animation:


//S 09/03/23 18:32:20 WiFi sent:
55AA00060005150400010226
//S 09/03/23 18:32:20 WiFi sent:
55AA000600201903001C303330653064303030306538303338333033316330303030303030308B
//R 09/03/23 18:32:20 WiFi received:
55AA0307000515040001022A
//R 09/03/23 18:32:20 WiFi received:
55AA030700201903001C303330653064303030306538303338333033316330303030303030308F

White color, brightness change from 0 to 100:


//S 09/03/23 19:17:26 WiFi sent:
55AA00060005150400010125
//R 09/03/23 19:17:26 WiFi received:
55AA03070005150400010129
//S 09/03/23 19:17:26 WiFi sent:
55AA000600101803000C303033643030333030336538F6
//R 09/03/23 19:17:26 WiFi received:
55AA030700101803000C303033643030333030336538FA

As I wrote earlier, brightness is encoded in color, dpID 21 is the operating mode (1 is pure color):

White color, brightness change from 100 to 0:


//S 09/03/23 19:16:48 WiFi sent:
55AA00000000FF
//R 09/03/23 19:16:48 WiFi received:
55AA030000010104
//S 09/03/23 19:16:50 WiFi sent:
55AA00060005150400010125
//S 09/03/23 19:16:50 WiFi sent:
55AA000600101803000C303033643030333030303061E7
//R 09/03/23 19:16:50 WiFi received:
55AA03070005150400010129
//R 09/03/23 19:16:50 WiFi received:
55AA030700101803000C303033643030333030303061EB

As I wrote earlier, brightness is encoded in color, dpID 21 is the operating mode (1 is pure color):

White color:


//S 09/03/23 19:16:15 WiFi sent:
55AA000600191C030015313030336430303330303365383030303030303030BD
//S 09/03/23 19:16:15 WiFi sent:
55AA00060005150400010125
//R 09/03/23 19:16:15 WiFi received:
55AA030700191C030015313030336430303330303365383030303030303030C1
//S 09/03/23 19:16:15 WiFi sent:
55AA000600101803000C303033643030333030336538F6
//R 09/03/23 19:16:15 WiFi received:
55AA03070005150400010129
//R 09/03/23 19:16:16 WiFi received:
55AA030700101803000C303033643030333030336538FA
//S 09/03/23 19:16:18 WiFi sent:
55AA00000000FF
//R 09/03/23 19:16:18 WiFi received:
55AA030000010104

Yellow:


//S 09/03/23 19:05:59 WiFi sent:
55AA000600191C03001531303033633033626230336538303030303030303020
//R 09/03/23 19:05:59 WiFi received:
55AA030700191C03001531303033633033626230336538303030303030303024
//S 09/03/23 19:05:59 WiFi sent:
55AA00060005150400010125
//S 09/03/23 19:05:59 WiFi sent:
55AA000600101803000C30303363303362623033653859
//R 09/03/23 19:05:59 WiFi received:
55AA03070005150400010129
//R 09/03/23 19:05:59 WiFi received:
55AA030700101803000C3030336330336262303365385D
//S 09/03/23 19:06:03 WiFi sent:
55AA00000000FF
//R 09/03/23 19:06:03 WiFi received:
55AA030000010104

Probably no surprises:

Packet analysis results
After analyzing the collected data, we reached the following conclusions:
- dpID 24 - color in the Tuya format, as a string, HSV, or more precisely in the 12-character format, where we have the value H, S and V, H in the range from 0 to 360, the rest from 0 to 1000, all as ASCII hex, i.e. generated as follows:

- dpID 25 - string of different length, somehow encoded animation or its ID (it's hard for us to say at the moment)
- dpID 21 - operating mode, either clear color or animation, 1 is color, 2 is animation, as far as I know, the value 0 would be CW (white temperature)
- dpID 20 - on or off, turning on or off the LEDs

OpenBeken configuration
OpenBeken already supported TuyaMCU base:
OpenBeken and dimmer on TuyaMCU - configuration and demonstration
Radar with WiFi - TuyaMCU, OpenBeken, own configuration page hosted on the device
Most of them were already implemented. Basically, we didn't even have to write C code to add support for this device, we just had to script the dpID role inside in OBK.
Therefore, we have prepared the autoexec.bat script, here I will discuss it one by one:


startDriver TuyaMCU
tuyaMcu_defWiFiState 4
tuyaMcu_setBaudRate 115200

The above section of the OBK script enables the TuyaMCU driver, sets the default WiFI state to 4 (according to the Tuya documentation it is "connected to cloud", so that the MCU thinks it is fully paired and sets the baud rate of TuyaMCU communication.


 
tuyaMCU_setupLED 24 1

The above code snippet runs the TuyaMCU LED driver on dpID 24, the first color format.


startDriver httpButtons
setButtonEnabled 0 1
setButtonLabel 0 "Music mode"
setButtonCommand 0 "tuyaMcu_sendState 21 4 3"

startDriver httpButtons
setButtonEnabled 1 1
setButtonLabel 1 "Light mode"
setButtonCommand 1 "tuyaMcu_sendState 21 4 1" 
 
setButtonEnabled 2 1
setButtonLabel 2 "Curtain"
setButtonCommand 2 "startScript autoexec.bat do_cur"
 
setButtonEnabled 3 1
setButtonLabel 3 "Collision"
setButtonCommand 3 "startScript autoexec.bat do_col"
 
setButtonEnabled 4 1
setButtonLabel 4 "Rainbow"
setButtonCommand 4 "startScript autoexec.bat do_rai"
 
setButtonEnabled 5 1
setButtonLabel 5 "Pile"
setButtonCommand 5 "startScript autoexec.bat do_pil"
 
setButtonEnabled 6 1
setButtonLabel 6 "Firework"
setButtonCommand 6 "startScript autoexec.bat do_fir"
 
setButtonEnabled 7 1
setButtonLabel 7 "Chase"
setButtonCommand 7 "startScript autoexec.bat do_chase"
 
 
// stop execution
return

The above fragment uses the OpenBeken scriptable button driver to create buttons that trigger animations, or more precisely, scripts that play animations, which I will show later. OpenBeken is highly scriptable, so adding a button does not require recompiling the firmware at all.


do_chase:
tuyaMcu_sendState 21 4 2
delay_s 0.1
tuyaMcu_sendState 25 3 020e0d00001403e803e800000000
return
 
 
do_cur:
tuyaMcu_sendState 21 4 2
delay_s 0.1
tuyaMcu_sendState 25 3 000e0d00002e03e802cc00000000
return
 
do_col:
tuyaMcu_sendState 21 4 2
delay_s 0.1
tuyaMcu_sendState 25 3 07464602000003e803e800000000464602007803e803e80000000046460200f003e803e800000000464602003d03e803e80000000046460200ae03e803e800000000464602011303e803e800000000
return
 
do_rai:
tuyaMcu_sendState 21 4 2
delay_s 0.1
tuyaMcu_sendState 25 3 06464601000003e803e800000000464601007803e803e80000000046460100f003e803e800000000
return
 
do_pil:
tuyaMcu_sendState 21 4 2
delay_s 0.1
tuyaMcu_sendState 25 3 010e0d000084000003e800000000
return
 
do_fir:
tuyaMcu_sendState 21 4 2
delay_s 0.1
tuyaMcu_sendState 25 3 05464601000003e803e800000000464601007803e803e80000000046460100f003e803e800000000464601003d03e803e80000000046460100ae03e803e800000000464601011303e803e800000000
return

The above code fragment is the implementation of the animation on the OBK side, here we basically only send packages that trigger a given animation to the MCU. These are the exact same packets we captured earlier. Additionally, we also have to send the dpID value 21, value 2, i.e. animation mode.

If you have any questions about what particular commands are, please refer to:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md

Modification - adding temperature measurement and physical buttons
A firmware change does not only have to reflect the original functionality of the device. It can also add new ones. Therefore, we decided to expand this lamp a bit by adding buttons and a temperature sensor.
We used MCP9808 as the temperature sensor : :


// startDriver MCP9808 [ClkPin] [DatPin] [OptionalTargetChannel]
startDriver MCP9808 7 8  1
MCP9808_Adr 0x30
MCP9808_Cycle 1

The above code fragment configures this sensor on given GPIO pins and sets its address. Communication takes place via I2C. The cycle is 1 second, measurement every second. The sensor configured in this way is also visible in Home Assistant after execution Home Assistant Discovery .

Additionally, we also connected regular physical buttons to a free GPIO, or more precisely, between the GPIO and ground.
In OBK, in the GPIO configuration panel, we simply chose the roles that suited us:
- Button - to switch the power state
- Button_NextDimmer - brightness level control
- Button_NextColor - color change
You could also use one button with multiple functions (double-click and long press): SmartButtonForLEDs
Additionally, we scripted the animation change button, gave it the Btn_ScriptOnly role and prepared the following script:


// use choice to choose effect by index stored in $CH10
alias do_chosen_effect Choice $CH10 cmd_cur cmd_col cmd_rai cmd_pil cmd_fir cmd_chase
// when click on Btn_ScriptOnly on P24 happens, add 1 to $CH10 (wrap to 0-5) and do effect
addEventHandler OnClick 24 backlog addChannel 10 1 0 4 1; do_chosen_effect

The above script uses channel 10 as a variable representing the current animation index, scrolls and loops it (see the addChannel documentation) and then uses the Choice command to fire the selected animation.

You can read about buttons (both general purpose and "specialized" ones such as color change) in OBK here:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/ioRoles.md

Ultimately, this is what the OBK panel of this device looks like:

You can see the temperature reading from the MCP9808 and the scripted animation buttons mentioned above.

And the physical buttons work as in the video:

Summary
The controller of this device consists separately of a WiFi module that communicates with the outside world, and an MCU that controls the LEDs and supports the RF receiver from the remote control. The WiFi module communicates with the MCU via the TuyaMCU protocol on the UART 1 port. To free this device from the cloud, simply change the WiFi module firmware to OBK and script them appropriately. We didn't flash the MCU at all. Changing the firmware also allowed us to expand the functionality of the device to include temperature measurement and physical buttons, which I consider necessary. Why do we need an LED strip that can only be controlled by phone?
After our changes, the device works fully locally, does not connect to the manufacturer's servers and can be controlled from Home Assistant, although at the moment the animation trigger must be written manually in Yaml by sending the appropriate command to MQTT. The rest works through Home Assistant Discovery in OBK.
That's it for now, I will finally add that we are also working on another device that is also based on individually addressable LEDs, but in this case the strip is connected directly to the BK7231, there is no TuyaMCU used there. This means that we will soon be running the WS2812B driver on the BK, most likely based on SPI, but more about that another time...

Cool? Ranking DIY

Helpful post? Buy me a coffee.

About Author

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Offline

p.kaczmarek2 wrote 12319 posts with rating 10202, helped 583 times. Been with us since 2014 year.

ADVERTISEMENT
#2 20814318 14 Nov 2023 09:28

Dark Man Dark Man

Level 13

» | Helpful post? (0)

Post #2
20814318 14 Nov 2023 09:28

Way to go. Well done!
I will be happy to use the support for directly connected LEDs to the Beken pin in your software.
I use it similarly in devices with ESP and Tasmota - I have wall switches, in some of them I installed 1 programmable LED and it controls 3 RGB channels separately, for example the color RED informs about the status of the garage, GREEN about the status of the gate and BLUE about the operation of the electric strike of the gate or gate motor.
Another example of using LED is to show the water temperature in the boiler, which I convert into color in NODERED and send to the switch in the bathroom
#3 20814335 14 Nov 2023 09:38

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

Post #3
20814335 14 Nov 2023 09:38

Great idea with these LEDs, although I think I've already read it somewhere in another of your posts.

But wait...

I see a potential technical problem.
At the moment, we use SPI, or more precisely, the MOSI pin, to directly control LEDs. This is because we need to send data with very precise timings. MOSI on Bekenach is P16:
How to access the hardware SPI port on CB2S? P16 (MOSI) is soldered to QFN
It won't work on another GPIO, and P16 is not available on some CB2S modules, so there may be a problem.

I previously tried to make a simpler driver, based on plain bit-banging, like this:
PIC18F45K50 as WS2812 LED strip driver (theory+library)
but I encountered an interesting problem, namely the timings had unexpected errors, apparently due to some mechanism of reading/caching instructions from flash memory. From what I know, this problem would be solved by placing the pixel sending function in RAM, but only certain sections of RAM allow it and this creates further difficulties...

To sum up, for now you can only use individually addressable LEDs with P16, and as for the rest of the pins, maybe soon....

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

Report a violation of the law

FAQ

TL;DR: Reverse-engineering a €49.02 Tuya wall lamp proves you can replace its BK7231N firmware, keep TuyaMCU messaging, and run it 100 % offline; "our goal is to free the device from the cloud" [Elektroda, p.kaczmarek2, post #20812818]

Quick Facts

• UART speed: 115 200 bps between BK7231N and MCU [Elektroda, p.kaczmarek2, post #20812818]
• Key dpIDs – 20: Power, 21: Mode, 24: HSV colour, 25: Animation [Elektroda, p.kaczmarek2, post #20812818]
• LED type: 12 V SM16703 addressable chips, not WS2812B [Elektroda, p.kaczmarek2, post #20812818]
• Firmware tools: OpenBK7231T_App + BK7231GUIFlashTool [Elektroda, p.kaczmarek2, post #20812818]
• Purchase price for test unit: €49.02 [Elektroda, p.kaczmarek2, post #20812818]

What electronics are inside the Tuya wall lamp?

The lamp houses three boards: a 12 V SM16703 LED strip, a switching PSU, and a control module containing a BK7231N Wi-Fi SoC plus a separate MCU that drives the LEDs and reads the RF remote [Elektroda, p.kaczmarek2, post #20812818]

Which LED driver IC does the strip use?

Although marketed like WS2812B, the strip actually uses SM16703 addressable LEDs that accept 12 V power and one-wire data [Elektroda, p.kaczmarek2, post #20812818]

How do I capture TuyaMCU packets?

Solder UART1 (3.3 V, GND, RX, TX) to the Wi-Fi module, set a logic analyser or USB-TTL adapter to 115 200 bps, start capture, perform one action, stop, then repeat. Save each log for analysis with TuyaMCUAnalyzer [Elektroda, p.kaczmarek2, post #20812818]

What do the main dpIDs mean?

20 toggles power, 21 selects mode (1 = static colour, 2 = animation), 24 carries 12-character HSV strings, and 25 stores variable-length animation payloads [Elektroda, p.kaczmarek2, post #20812818]

How do I flash OpenBeken onto BK7231N?

Connect TX, RX, GND and 3.3 V to a USB-TTL adapter.
Use BK7231GUIFlashTool to write the OpenBK7231T_App image in UART boot mode.
Reboot; the module starts an AP for further setup [Elektroda, p.kaczmarek2, post #20812818]

Can I drop the Tuya cloud entirely?

Yes. OpenBeken sets Wi-Fi state 4 ("connected to cloud") locally, so the MCU believes pairing succeeded. All control then happens on-device or via MQTT; no Internet needed [Elektroda, p.kaczmarek2, post #20812818]

How are animations triggered after reflashing?

An autoexec.bat script sends dpID 21 = 2, waits 0.1 s, then transmits the desired dpID-25 string. Seven preset scripts (Chase, Curtain, Collision, Rainbow, Pile, Firework, Music) are bound to HTTP buttons [Elektroda, p.kaczmarek2, post #20812818]

What limits apply to direct LED drive from BK7231N?

Currently, only pin P16 (MOSI of SPI) can meet the strict 800 kHz timing. "It won’t work on another GPIO" warns the author [Elektroda, p.kaczmarek2, post #20814335] If P16 is not exposed on your module, direct drive fails—use the original MCU instead.

How do I add a MCP9808 temperature sensor?

Start the MCP9808 driver with "startDriver MCP9808 7 8 1", set address 0x30, and sampling 1 s. The reading appears on Channel 1 and is auto-published to Home Assistant via MQTT discovery [Elektroda, p.kaczmarek2, post #20812818]

How are physical buttons wired and configured?

Tie each push-button between a free GPIO and ground. In the GPIO web-panel, assign roles: Button for power, Button_NextDimmer for brightness, Button_NextColor for hue. For animation cycling, set Btn_ScriptOnly and use addEventHandler to increment channel 10 and call Choice [Elektroda, p.kaczmarek2, post #20812818]

Is there a Home Assistant integration?

OpenBeken exposes MQTT topics with autodiscovery. After enabling MQTT, the lamp appears as a light entity; colour and brightness sync automatically. Custom animations require sending the tuyaMcu_sendState command in YAML scripts [Elektroda, p.kaczmarek2, post #20812818]

What statistic proves the protocol overhead is small?

Every TuyaMCU packet starts with a fixed 4-byte header 0x55AA, meaning only 12 % of a typical 32-byte colour command is framing data [Elektroda, p.kaczmarek2, post #20812818]

What happens if the lamp loses power mid-update?

Because dpID states are stored only in volatile RAM, the MCU reboots with default colour and mode, so incomplete writes are ignored rather than bricking the device [Elektroda, p.kaczmarek2, post #20812818]

Can I still use the RF remote after flashing?

Yes. The RF receiver connects to the untouched MCU, so remote commands continue to generate the same dpID traffic the new Wi-Fi firmware understands [Elektroda, p.kaczmarek2, post #20812818]

BK7231N, TuyaMCU and individually addressable LEDs - effects control, adding buttons, thermometer

Didn't find an answer? Ask Artificial Intelligence