FAQ
TL;DR: "565 devices are now listed, and 'It worked!' confirms serial flashing success" [Elektroda, p.kaczmarek2, #21064282; Elektroda, DexEdson, #21154883]. Use a 3-wire UART, hold RST low, tap CEN, then flash; add autoexec.bat to regain full PIR/relay control.
Why it matters: These steps cut Tuya cloud ties and restore 100 % local automation.
Quick Facts
• MCU & Wi-Fi: BK7231N on CBU daughter-board, 2 MB flash [Elektroda, DexEdson, post #21153263]
• PIR delay adjustable 5 – 3600 s via dpID 49 [Elektroda, gokeeper, post #21055031]
• Sensitivity levels: low / middle / high via dpID 48 [Elektroda, gokeeper, post #21055031]
• OpenBeken database now lists 565 devices [Elektroda, p.kaczmarek2, post #21064282]
• Firmware 2.1.17 blocks Cloudcutter OTA flashing [Elektroda, DexEdson, post #21153165]
What hardware is inside the Milfra MFA05F motion switch?
The wall switch hosts a BK7231N Wi-Fi SoC on a CBU Tuya module that talks to an STM-series MCU over UART. A PIR element, CDS light sensor and one 10 A relay share the MCU. No GPIOs from the BK7231N reach sensors directly [Elektroda, gokeeper, post #21055031]
Can I flash OpenBeken without desoldering the board?
Yes. Users succeeded by wiring 3.3 V, GND, RX, TX, holding the RST pad to GND during power-up, then tapping CEN to GND until ltchiptool syncs [Elektroda, DexEdson, post #21154883]
How do I enter flashing mode via UART?
- Connect 3.3 V, GND, RX→TX, TX→RX.
- Keep RST pad shorted to GND and power the module.
- Release RST, tap CEN to GND once or twice; console should show boot logs, then start flashing. [Elektroda, DexEdson, post #21154883]
Cloudcutter fails on firmware 2.1.17—what now?
Tuya blocked the exploit in 2.1.17, so OTA fails. Use the serial method described above or desolder the CBU. Edge-case: some units ship with glued shells, making pin access harder [Elektroda, DexEdson, post #21153165]
Which datapoints control the PIR schedule?
dpID 102 sets PIR start minute (0-1440) and dpID 101 sets end minute. If the time window excludes the current clock, motion reports stop [Elektroda, gokeeper, post #21062811]
My PIR sensor is silent after flashing—how can I fix it?
Make sure the device knows local time (tuyaMcu_sendCurTime) and push valid values to dpIDs 101/102 in autoexec.bat. Many users regained detection immediately after adding that line [Elektroda, gokeeper, post #21062811]
How can I decouple the relay from motion detection?
No public dpID does that. You must either cut the relay trace or remove the STM MCU and wire the PIR output to a BK7231N GPIO [Elektroda, p.kaczmarek2, post #21155031]
What does tuyaMCU_defWiFiState 4 do?
It makes the MCU think cloud is online, preventing some functions from locking. Add it once in autoexec.bat; save and reboot [Elektroda, p.kaczmarek2, post #21062761]
Do I need a WebApp template or just autoexec.bat?
“You only need autoexec.bat” for this TuyaMCU device; pin templates stay empty because UART is the sole connection [Elektroda, p.kaczmarek2, post #21305821]
How do I enable MQTT after migration?
Set mqtt_host and credentials, then restart. Once MQTT is active, dpID 15 (status LED mode) starts responding correctly, as one user observed [Elektroda, gokeeper, post #21062630]
How to adjust motion sensitivity and timeout?
Send tuyaMcu_sendState 48 4 X where X=0(low),1(mid),2(high). Send tuyaMcu_sendState 49 2 Y to set delay in seconds (5-3600) [Elektroda, gokeeper, post #21055031]
Is motion detection always reliable?
No. One user reports that “the light turns on only 25 % of the time” despite high sensitivity, showing an edge-case failure [Elektroda, psyko_chewbacca, post #21313159]
How do I back up the original firmware?
Run ltchiptool read_flash 0x0 0x200000 > backup.bin before flashing. A full 2 MB dump lets others compare UART frames later [Elektroda, divadiow, post #21156301]
Template settings reset after saving—why?
If your autoexec.bat clears IOs with cleario, any saved template disappears on reboot. Comment out cleario or re-apply template after you finish scripting [Elektroda, p.kaczmarek2, post #21163054]
Is the older ESP8266 version easier to hack?
Yes. The first MFA05 used an ESP-12 that flashes with standard 4-pin headers and exposes GPIOs, making relay/PIR separation trivial [Elektroda, gokeeper, post #21092461]
