The power section consists of two SLD8N65SV MOSFETs (650V, 7A@25°C, 1.1Ω) and two rectifying bridges built with S3M diodes (1000V, 3A).
MS-105B is a trailing edge dimmer. Below are the voltage waveforms for 1%, 30%, 50%, and 100% settings in the Tuya application (77W halogen light bulb used as the load):
My device uses Tuya firmware version 1.0.2, so it should be OTA flashable.
Thanks for another teardown. It's important to keep our list growing.
The following device is TuyaMCU-based. I don't know why Tuya always uses external MCU for dimming, but it really does.
It will be flashable via OTA only if there is a matching profile, and there is only a matching profile if someone already has read 2MB flash of the matching firmware build and provided it for tuya-cloudcutter team.
You can flash it by wires, but you will most likely need to temporarily sever the connection to the MCU, because it occupies the same UART port that is used for flashing.
I've managed to flash it OTA using the laptop running Ubuntu Linux. I don't use Windows at all. If you are Windows user the simplest way will be probably to use a Raspberry Pi with an AP capable WiFi interface.
The biggest problem was to found a way to put this device in the AP mode (slow beeping, fast blinking).
Flashing procedure.
1. This procedure requires to check the firmware version installed on the device. It requires to connect the device to the Tuya cloud and is described here. In my case the firmware version was 1.0.2.
Sometimes Tuya / Smart Life app doesn't display the firmware version and asks you to upgrade your device. In such case do not upgrade it because this probably will close a way to OTA flashing! It's better to try different BK7231N versions without knowing the right one.
$ cd tuya-cloudcutter
$ sudo ./tuya-cloudcutter.sh
4. Power on the dimmer. If the device fast beeps, go to step 5. If not, remove it from the Tuya cloud. It should start beeping fast.
5. Connect S1 to L for 10 times (not so slow, not so fast, e.g. once for 2 seconds) to enter the "slow beeping" AP mode. You can connect any descent isolated push button to the S1 and L to make this task easier. I simply used piece of wire and touched the S1 and L screws.
6. While running the tuya-cloudcutter asks you a few questions. Choose the answers as below:
[?] How do you want to choose the device?:
By manufacturer/device name
> By firmware version and name
From device-profiles (i.e. custom profile)
Select the firmware version you obtained from Tuya app. You must be sure that the selected chip type match the chip used in your device. Probably all MS-105B dimmers use the BK7231N SOC but you can never be sure until you open your device (it's quiet easy).
In my case, I chose the names one by one until I found the first one that works: bk7231n_common_user_config_ty.
Select the OpenBeken firmware included in the tuya-cloudcutter or provide it the latest one. I've used the one included and next OTA upgraded to the latest.
================================================================================
Place your device in AP (slow blink) mode. This can usually be accomplished by
Power cycling off/on - 3 times and wait for the device to fast-blink, then repea
Long press the power/reset button on the device until it starts fast-blinking, t
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================
Next you will be asked to power cycle your device and enter the slow beep mode again. In my case after powering off and on the device automatically enters this mode.
Bellow is the full log of the rest of the flashing process.
Scanning for open Tuya SmartLife AP
.
Found access point name: "SmartLife-3715", trying to connect...
Device 'wlo1' successfully activated with 'dcf54998-8a2e-4015-9847-d6c89aa88a8b'
Connected to access point.
Waiting 1 sec to allow device to set itself up...
Running initial exploit toolchain...
Exploit run, saved device config too!
output=/work/configured-devices/DkIOuLcT0kyp.deviceconfig
Saved device config in /work/configured-devices/DkIOuLcT0kyp.deviceconfig
================================================================================
Power cycle and place your device in AP (slow blink) mode again. This can usual
Power cycling off/on - 3 times and wait for the device to fast-blink, then repea
Long press the power/reset button on the device until it starts fast-blinking, t
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================
Scanning for open Tuya SmartLife AP
..
Found access point name: "A-3715", trying to connect...
Device 'wlo1' successfully activated with '93b806ad-cbb1-4979-a6c7-9b9d483475fd'
Connected to access point.
Configured device to connect to 'cloudcutterflash'
Device is connecting to 'cloudcutterflash' access point. Passphrase for the AP i
Flashing custom firmware...
================================================================================
Wait for up to 10-120 seconds for the device to connect to 'cloudcutterflash'. T
================================================================================
Using WLAN adapter: wlo1
Configuration file: /dev/stdin
Using interface wlo1 with hwaddr 60:67:xx:xx:xx:xx and ssid "cloudcutterflash"
wlo1: interface state UNINITIALIZED->ENABLED
wlo1: AP-ENABLED
Using PSK v1 - Received PSK ID version 01
Processing endpoint /v2/url_config
Processing endpoint tuya.device.active
Processing endpoint tuya.device.dynamic.config.get
Processing endpoint tuya.device.upgrade.get
Processing endpoint tuya.device.upgrade.status.update
Processing endpoint /files/OpenBeken-v1.17.262_bk7231n.ug.bin
Firmware update progress: 11%
Processing endpoint tuya.device.uuid.pskkey.get
Firmware update progress: 30%
Firmware update progress: 60%
Firmware update progress: 87%
[Firmware Upload] /files/OpenBeken-v1.17.262_bk7231n.ug.bin send complete, reque
Firmware update progress: 98%
Firmware file has been sent and MQTT reported a progress of nearly complete. Wa
Flashing should be complete. It takes about 15 seconds for the device to reboot
Please wait about 30 seconds then look for signs of activity from the firmware y
Device MAC address: 38:1f:xx:xx:xx:xx
Dodano po 40 [minuty]:
After flashing both LEDs are blinking fast. The LEDs are controlled by the Holtek chip (TuyaMCU).
After starting the TuyaMCU driver the device starts beeping fast in sync with the onboard LEDs.
Below the TuyaMCU logs after starting the driver. The last entry more or less corresponds to the time when the device starts beeping.
Info:TuyaMCU:TUYAMCU received: 55 AA 00 00 00 01 00 00
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 0 (Hearbeat) with 8 bytes
Info:TuyaMCU:TUYAMCU received: 55 AA 00 01 00 15 6B 71 6D 30 6D 71 7A 62 35 7A 61 7A 65 77 73 62 32 2E 30 2E 32 73
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 1 (QueryProductInformation) with 28 bytes
Info:TuyaMCU:TuyaMCU_ParseQueryProductInformation: received kqm0mqzb5zazewsb2.0.2
Info:TuyaMCU:TUYAMCU received: 55 AA 00 02 00 00 01
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 2 (MCUconf) with 7 bytes
Info:TuyaMCU:TuyaMCU_ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:TuyaMCU:TUYAMCU received: 55 AA 00 07 00 08 06 02 00 04 00 00 00 00 1A
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 6, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 0
Info:TuyaMCU:TUYAMCU received: 55 AA 00 07 00 08 0C 02 00 04 00 00 00 00 20
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 12, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 0
Info:TuyaMCU:TUYAMCU received: 55 AA 00 07 00 05 01 01 00 01 00 0E
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 7 (State) with 12 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 1, dataType 1-DP_TYPE_BOOL and 1 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 1 byte: 0
Info:TuyaMCU:TUYAMCU received: 55 AA 00 07 00 05 07 01 00 01 00 14
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 7 (State) with 12 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 7, dataType 1-DP_TYPE_BOOL and 1 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 1 byte: 0
Info:TuyaMCU:TUYAMCU received: 55 AA 00 07 00 08 02 02 00 04 00 00 01 10 27
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 2, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 272
Info:TuyaMCU:TUYAMCU received: 55 AA 00 07 00 08 08 02 00 04 00 00 00 C6 E2
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 8, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 198
Info:TuyaMCU:TUYAMCU received: 55 AA 00 00 00 01 01 01
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 0 (Hearbeat) with 8 bytes
Info:TuyaMCU:TUYAMCU received: 55 AA 00 03 00 00 02
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=0]: processing command 3 (WiFiState) with 7 bytes
Dodano po 19 [minuty]:
p.kaczmarek2 wrote:
The following device is TuyaMCU-based. I don't know why Tuya always uses external MCU for dimming, but it really does.
They probably use it to do some real-time stuff such as detecting the zero crossing point and control the MOSFETs on time.
The whole dimming algorithm and the manual control of the dimming channels by S1 and S2 lines seems to run autonomously on the TuyaMCU. It all probably may be implemented on the Beken SOC but it may be simpler to have such functions implemented outside of the main firmware, probably developed by different team, etc. In case of the STM32 MCUs the whole dimming algorithm with the zero crossing detection, etc. can be probably implemented in hardware, using timers (hard realtime guaranteed). I don't know if the Beken chips do provide such functionality in hardware. Maybe Holteks do it...
Following command must be entered in the autoexec.bat and then you must reboot the device (along with MCU). It has been tested several times by users on this forum, if the default WiFi state 0x04 does not help for you, then you are the first one...
Is the setChannelType configuration stored in some kind of EEPROM or in the Flash? It's more about whether it store something in Flash or somewhere during every execution of autoexec.bat if set there?
Dodano po 2 [minuty]:
p.kaczmarek2 wrote:
Is this a typo, or why are you linking both dpID 3 and 4 to channel 2?
No. I tried these both commands but not at the same time.
Dodano po 6 [minuty]:
p.kaczmarek2 wrote:
Can you try to run this command from the Web App (at realtime) and catch the output?
TuyaMCU dpIDs mapping is not stored between reboots, that's why we use autoexec.bat.
[[edit]] setChannelType settings are stored in flash. You can edit them in the Web App.
I can see some more dpIDs in your log output. Now you should be able to tell which dpID is second power state (boolean) and which is second dimmer state (value). There seems to be more of them than two pairs, but at least it will help you narrow it down
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 6, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 12, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 6, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 12, dataType 2-DP_TYPE_VALUE and 4 data bytes
This may be the minimal brightness setting, maybe it's a separate value for each dimmer. You can try if you feel brave
leśny_ziutek wrote:
So leaving them in autoexec.bat isn't recommended because of increased Flash wearing.
Flash writes are optimized, flash is written only if there is a change, and futhermore we try to save many changes with one write:
your script will not cause any flash wear
The dpID 6 and 12 have a function to toggle the output state after the given number of seconds. That is, tuyaMcu_sendState 6 2 0 does nothing, tuyaMcu_sendState 6 2 1 toggles the L1 after 1 second, tuyaMcu_sendState 6 2 30 toggles the L1 after 30 seconds.
Dodano po 17 [minuty]:
It can be useful in some scenarios. Something like ToggleAfter channel type would be handy.
It's usually easier for me, when a user already copy-pastes the OBK JSON from the Web App, can you do that in that topic?
(for the record, I will leave this discussion here, because it is related to all teardown topics. Copying/filling the fields in OBK JSON from the Web App always helps)
In the Home Assistant Configuration, the CMD window is empty. When I started the HA discovery, there were 4 switches detected (two switch icons and two light bulb icons) and an RSSI sensor. There isn't any dimming control, only on and off.
There are 5 retained configuration messages in my MQTT broker:
Code: JSON
Log in, to see the code
Dodano po 2 [godziny] 14 [minuty]:
***
Feature request
Per channel tuyaMcu_setDimmerRange command would be useful.
I have two different dimmable LED bulbs (Philips, Osram). With one global mapping command, there is no way to make them work similarly.
>>20827829 Thanks for the instructions on how to flash OpenBeken using Cloudcutter. I have tried this before and gave up. The instructions you posted solved the issue for me.
One question: is there a way to connect a rocker switch to the dimmer and make the rocker switch turn on and off the light? I don't want to dim using the wall switch, just turn on and off. I will handle the dimming using automations and voice commands.
Note: I mean by rocker switch a switch that has an on and off state only, it's not the momentary or reset switch that is usually used with dimmers.
@mcheibani what kind of dimmer you have? It should be possible, in worst case with a little help of a script.
Set TglChannelOnToggle role for given GPIO, assign channel like CH 10, and add a "on change" event that calls light toggle.
The S1 and S2 lines are handled by TuyaMCU completely autonomously. It has its advantages, e.g. the dimmer keeps working even if the Open Beken have rebooted into the safe mode.
I put pieces of elastic rubber under the buttons of the regular switch so it now works like momentary one.
It took a few days to get used to the momentary switches, but now it's unnoticeable to all users.
A script may not solve this problem because if the switch is closed TuyaMCU autonomously keeps dimming and undimming (what is the right English word?) the light.
Apologies for the delayed response. I was offline for the past week. The model I have is the MOES 3 gang dimmer switch MS-105B. It looks exactly like the one shown in this teardown thread. Even though the brand name is slightly different (MOES GO vs MOES), but I think it's the same company.
I am a beginner in the Tasmota and OpenBeken world, can you elaborate more on how to set the GPIO to TglChannelOnToggle. I am using autoexec.bat file with the following content which is currently working with reset switch but not with a rocker switch
This is TuyaMCU device, but you can make a work around. If you connect a wire to, for example, P26, which is not used yet, and add a rocker switch between P26 and GND, you can later set P26 pin role to TglChannelOnToggle (or to a Button, if you want to click) and us it to toggle, for example, channel 1:
The MoesGo Two Channel Smart Dimmer Module MS-105B utilizes a CB2S Tuya Module (BK7231N) and a Holtek HT66F3195 microcontroller. The power section features two SLD8N65SV MOSFETs and S3M diodes for rectification. Users discussed the flashing process via OTA and the configuration of the device using autoexec.bat scripts to control dimming and toggle functions. The device operates in AP mode for flashing, and users shared experiences with configuring GPIO for rocker switches to control the dimmer without affecting dimming functionality. The discussion also touched on the compatibility of the MS-105B with Home Assistant and the potential for using alternative dimmers like the Martin Jerry model. Summary generated by the language model.