logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

XR3 PIR Sensor P06 Model OTA Flashing Capability?

sumitnz 1923 24
Best answers

Can this XR3 P06 PIR sensor be flashed over OTA?

No, XR3 devices do not have OTA flashing support yet, so this P06 cannot be updated over OTA at the moment [#21088959] You will need to flash it by soldering to the board; only a basic soldering iron and solder are required [#21088959] There is an XR3/XR809 flashing guide on the forum if you want to try it [#21089108] The maintainer also noted that XR809 OTA is still not working and may be a challenge, with HTTP OTA attempts failing so far [#21131093][#21131128]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21088914
    sumitnz
    Level 2  
    Posts: 2

    User manual for WiFi motion sensor, model P06. Close-up of an electronic module labeled Model: XR3 on a green circuit board. XR3 PIR sensor with visible circuitry and USB connection.

    Is this xr3 pir sensor p06 model FLASHABLE over OTA?
  • ADVERTISEMENT
  • #2 21088959
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    We don't have OTA for XR3 platform yet, unfortunatelly. XR3 devices are very rare these days. I've only ever got like 3 of them and 2 of them were ordered on purpose (already knowing it's XR3).

    I'm afraid that you will need to do some soldering. Do you have equipment to do that? Only basic soldering iron and solder with solder paste is required.
    Helpful post? Buy me a coffee.
  • #3 21088961
    sumitnz
    Level 2  
    Posts: 2
    Yes I have soldering iron and solder.
  • #4 21089108
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    You can give it a go. We have XR3/XR809 flashing guide on forum. Still, you are one of a very few people to get this WiFi module type...
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 21121383
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    @sumitnz do you have the link to exact page you bought this device please?

    I have a P06 but sadly it's CBU+TuyaMCU
  • #6 21121396
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    How the main board look like? Is this a variation of P06 from first post or a totally new internals?
    Helpful post? Buy me a coffee.
  • #7 21121405
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    similar. but different.

    Close-up of a circuit board with electronic components on a blue background.

    Close-up of a green circuit board with markings P06CBU-V1.3 and date 2022-12-22 on a blue background.

    Added after 27 [minutes]:

    I'll make another post to document journey with it
  • #8 21121472
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    It would be also interesting to make another small side project - converting this from TuyaMCU to deepsleep Beken
    Helpful post? Buy me a coffee.
  • #9 21121480
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    hmm. maybe. can't say I'm super excited to play with this device. It's nice it has 5V USB for power I guess, negating the need for deep sleep.

    Won't the PIR sensor need a driver writing for it if the CBU/OBK did everything?

    Added after 56 [seconds]:

    but I get what you mean. As a proof-of-concept, a conversion showcase.
  • #10 21121526
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    Hey, I actually tested PIR in the past already, isn't it just a boolean signal? 1 or 0? It worked well with digital input.

    Ah, sorry, if it has power coord, then it should be even easier to convert. No deep sleep needed.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #12 21130994
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    That's a new XR3 device. I haven't seen it yet. Please make a separate teardown when you got a moment.
    EDIT: Ah, sorry, I must have mislooked. It's indeed the same piece as in the first post
    Helpful post? Buy me a coffee.
  • #13 21130998
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    it's the same P06 variant in the OPs main post...

    Added after 16 [minutes]:

    but yes, a template, more pics, autoexec will need sorting I guess. What progress did you make @sumitnz ?
  • #14 21131093
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    Ah yes, sorry, I looked at the photo above and confused CBU version with the version from the first post.

    XR809 has no OTA (even in OBK) yet so it may be somewhat a challenge.
    Helpful post? Buy me a coffee.
  • #15 21131099
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    hmm OK. I plan to probably desolder the XR3 eventually to add to module collection for testing with the universal downloader adaptors.
  • #16 21131128
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    If you have some will to experiment with C, you could try to get OTA going. There is HTTP OTA sample in XR809 SDK and it's connected to OBK page, but for some reason it always fails. I didn't investigate it more because XR809 is very rare.
    Helpful post? Buy me a coffee.
  • #17 21131321
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    divadiow wrote:
    autoexec will need sorting I guess

    although, no LFS I'm guessing.

    p.kaczmarek2 wrote:
    you could try to get OTA going

    I could try!
  • #18 21131447
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    XR809 OTA assumes that OTA file is on the other HTTP server, so XR809 acts like HTTP client.
    This old style OTA is called in http_fns.c:
    Code: C / C++
    Log in, to see the code

    This call goes here:
    https://github.com/openshwprojects/OpenBK7231...c5cb257acc/src/hal/xr809/hal_main_xr809.c#L15
    This is made so it starts OTA in the main loop:
    Code: C / C++
    Log in, to see the code

    It calls method from XR809 SDK, cmd_ota_http_exec, there:
    https://github.com/openshwprojects/OpenXR809/...a8bb61360612/project/common/cmd/cmd_ota.c#L82
    For some reason this method (or maybe some nearby method):
    Code: C / C++
    Log in, to see the code

    At some point I tried to debug it by commenting out certain code lines and inserting printfs but I haven't managed to determine what's wrong
    Helpful post? Buy me a coffee.
  • #19 21146316
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    won't XR809 build also need an OTA flash type file build?

    Properties window showing details of the OpenXR809 disk image file.
  • #20 21146326
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14599
    Help: 654
    Rate: 12616
    It is very probable that I was testing it locally, with OTA file building as well. Maybe OTA file is not yet included in the Github build artifacts because I have never got OTA working in the first place.
    Helpful post? Buy me a coffee.
  • #21 21586375
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    divadiow wrote:
    won't XR809 build also need an OTA flash type file build?


    although, taking the XR872 as an example, maybe the .img file is for UART and OTA?

    Quote:
    jyd ota http http://192.168.1.133:8000/upload/xr_system.img


    https://github.com/divadiow/DataSheets/blob/m...Winner_Xradiotech/xr872development_manual.pdf

    maybe @insmod already knows the score

    Added after 1 [minutes]:

    insmod wrote:
    From what i understood in the SDK code, the same binary that is used for UART is used for OTA.


    ha! good timing
  • #22 21587457
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    insmod wrote:
    Xradios update test
    LFS for all, Easyflash for all, OTA for all (XR809 not working, XR872 no image generated yet), Pins for all, berry for XR806.
    Implemented PWM, ADC (including VBAT), UART, watchdog in APP, delay_us, RSSI and ip addresses, remaining heap size.
    Fixed MAC for XR806.

    https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/15826444795


    XR809 _xradios_0ee37d864e12

    first boot after flash to erased XR3 + client joining AP
    Code: Text
    Log in, to see the code

    pins
    XR3 PIR Sensor P06 Model OTA Flashing Capability?

    LFS
    XR3 PIR Sensor P06 Model OTA Flashing Capability?

    I guess TCP Client is disconnected is not unique to XR872
    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #24 21917152
    insmod
    Level 31  
    Posts: 1390
    Help: 164
    Rate: 434
    The problem was that OBK hanged during flash erase
    Plus bootloader doesn't support xz ota
  • #25 21917189
    divadiow
    Level 38  
    Posts: 5042
    Help: 438
    Rate: 892
    hmm OK. I see Tuya's XR809 bl is 36,176 bytes vs OpenXR809's 30,064 bytes and it does contain xz strings

    Code: Text
    Log in, to see the code


    regarding erase, Tuya's code has flash_erase_wrap

    xr809-os/src/ota/ota.c
    img_max_size = iop->img_xz_max_size;
    flash_erase_wrap(flash, addr, img_max_size);

    xr809-os/src/image/flash.c
    int flash_erase_wrap(uint32_t flash, uint32_t addr, uint32_t size)

    OpenXR809 flash.c does not have flash_erase_wrap()

    AI says Tuya changed:
    1. Erase only the compressed OTA slot size, not the full image max size.
    2. Use a wrapper that breaks the erase into valid 4K/32K/64K-aligned erase operations.

    Added after 57 [minutes]:

    trying to implement 
    flash_erase_wrap


    reboots on erase

    Code: Text
    Log in, to see the code
Reply | New topic
Report a violation of the law

Topic summary

✨ The XR3 PIR Sensor P06 model currently does not support OTA (Over-The-Air) flashing, as the XR3 platform lacks OTA capability. Users interested in firmware updates must resort to manual flashing via soldering, requiring basic soldering tools. The XR3 and XR809 modules are rare, and existing SDKs provide limited OTA support, with XR809 having an HTTP OTA client implementation that often fails in practice. Some users have shared images and teardown information of the P06 variant, noting differences in internal components such as CBU+TuyaMCU versions. Discussions include potential side projects like converting TuyaMCU-based devices to Beken chips with deep sleep support. The XR809 OTA process involves HTTP requests to download firmware images, but successful OTA flashing requires compatible OTA firmware builds, which are not readily available or fully tested. References to XR872 documentation suggest that .img files might support both UART and OTA flashing methods. Overall, flashing XR3-based PIR sensors demands hardware-level intervention and experimental software approaches due to the absence of stable OTA solutions.
Generated by the language model.
Today's popular

FAQ

TL;DR: For modders of the P06 XR3 PIR sensor, OTA is not ready yet: only 3 XR3 devices had been seen, and the maintainer said, "you will need to do some soldering." Use UART flashing, not OTA, if you want a reliable first flash on this rare XR809-based board. [#21088959]

Why it matters: This thread separates the rare XR3/XR809 P06 variant from the more common CBU+TuyaMCU version, so you can choose the right OpenBeken workflow before opening the case.

Variant OTA status Flashing method Practical modding note
XR3 / XR809 P06 Not working yet Manual flashing by soldering Rare board; forum guide exists
CBU + TuyaMCU P06 Different path TuyaMCU-aware conversion May be easier to repurpose if USB-powered

Key insight: The P06 with XR3/XR809 is flashable, but not over OTA yet. Treat it as a UART-first device until XR809 HTTP OTA is debugged end to end.

Quick Facts

  • The XR809 boot log shows a 48,000,000 Hz flash clock, 832 KB flash max size, and an image area of 800 KB without bootloader. [#21587457]
  • The same log reserves 32 KB for OTA config at address 0x121000, with image slots at 0x00008000 and 0x00129000. [#21587457]
  • A USB-powered P06 variant uses 5 V USB input, which removes the need for deep sleep in a proof-of-concept conversion. [#21121480]
  • On first boot after erasing and flashing, the XR809 device reaches “boot complete” at 5 seconds and starts an AP at 192.168.4.1. [#21587457]
  • MQTT instability appears as ERR_MEM, while free heap in the same session is reported around 65,480–68,136 bytes. [#21587457]

How can I flash an XR3/XR809-based P06 PIR sensor if OTA is not available yet?

You should flash it manually over wired programming, not OTA. The maintainer stated that XR3 OTA was unavailable on May 20, 2024, and advised soldering instead. If you have a soldering iron, use the forum’s XR3/XR809 flashing guide and treat the first flash as a hardware job. This is the reliable path because XR809 OTA still failed later in the discussion. [#21088959]

What soldering tools and connections do I need to manually flash an XR3 PIR sensor module?

You only need basic soldering tools to start. The thread explicitly says a basic soldering iron, normal solder, and solder paste are enough. Use those tools to attach temporary wires to the XR3/XR809 programming points shown in the forum guide. Keep the wiring short and stable, because this board is rare and you want one clean flash attempt. [#21088959]

Why does OTA flashing fail on XR809 in OpenBK7231T_App even though there is an HTTP OTA sample in the XR809 SDK?

OTA fails because the XR809 path exists in code, but the maintainer did not isolate the failing stage. He wired XR809_RequestOTAHTTP() to call cmd_ota_http_exec(), added debug prints, and still could not determine what breaks. The failure can happen during image download, verify-data retrieval, image verification, or the reboot handoff. That means the feature is partially implemented, not production-ready. [#21131447]

What is the XR3 platform, and how is it related to XR809 modules in Tuya-style devices?

"XR3" is a Wi‑Fi module platform that uses XRadio hardware, likely the XR809 family, inside small IoT devices; its key trait in this thread is rarity and incomplete OpenBeken OTA support. In practice, the thread uses “XR3” and “XR809” together when discussing the same P06 PIR sensor variant. That makes XR3 the board/module label modders see, while XR809 is the software platform they flash and debug. [#21131093]

What is TuyaMCU, and how does it change the way a P06 PIR sensor can be converted or flashed?

"TuyaMCU" is a companion microcontroller architecture that handles device logic over a serial link; its key characteristic is that the Wi‑Fi module no longer owns every sensor function directly. In the P06 thread, that changes conversion strategy because a CBU+TuyaMCU unit is not the same target as an XR3/XR809 board. You may need a TuyaMCU-aware conversion instead of a straight XR809 flash workflow. [#21121383]

CBU plus TuyaMCU vs XR3/XR809 in the P06 PIR sensor — what are the practical differences for OpenBeken modding?

The practical difference is workflow. An XR3/XR809 P06 needs manual flashing because OTA is not working, while a CBU+TuyaMCU P06 is a different internal design and may suit a conversion project instead. The maintainer even suggested converting the USB-powered CBU+TuyaMCU version to a deepsleep-free Beken setup. So the shell may look similar, but the mod path is not interchangeable. [#21121472]

How do I use the XR809 flashing guide from the forum to program a rare XR3-based device?

Use the guide as a simple three-step hardware flash process. 1. Open the P06 and identify that it is the XR3/XR809 version. 2. Solder temporary programming leads with a basic iron, solder, and solder paste. 3. Follow the XR3/XR809 forum flashing guide to program the module before any OTA testing. This flow matters because the maintainer called XR3 devices very rare and recommended the guide directly. [#21089108]

What kind of signal does a PIR sensor output, and when do I need a custom driver instead of a simple digital input in OBK?

A PIR sensor here is treated as a simple digital signal, usually 1 or 0. The maintainer said he had tested PIR before and it worked well with a digital input. You only need a custom driver if this specific board adds extra logic beyond a plain boolean motion line. In the thread, no such extra requirement was confirmed for the USB-powered conversion idea. [#21121526]

How would you convert a USB-powered P06 motion sensor from TuyaMCU to a deepsleep-free Beken or OpenBeken setup?

You would convert it as a mains-like always-powered sensor, not as a battery deep-sleep design. One poster noted the board has 5 V USB power, and the maintainer replied that this makes conversion easier because deep sleep is unnecessary. If the PIR output is still a simple 1/0 line, OBK can read it as a digital input and keep the device awake continuously. [#21121526]

Where can I find the exact XR3-based P06 PIR sensor variant sold by FDsmart or AliExpress, and how can I tell it apart from the CBU version?

The thread identifies the exact seller as FDsmart on AliExpress and links a listing posted on June 24, 2024. To tell it apart, compare the internal board photos: the XR3/XR809 version matches the original post, while the other P06 shared earlier used CBU+TuyaMCU internals. The maintainer first thought it was new, then corrected himself and confirmed it was the same XR3 piece. [#21130994]

What is LFS in OpenBeken logs, and why does an XR809 build show errors like 'lfs is absent' and fail to load autoexec.bat?

"LFS" is LittleFS-style embedded storage that keeps small files such as startup scripts; its key characteristic is that OpenBeken expects it for files like autoexec.bat. On the XR809 log, the device reports lfs is absent, then failed to get file autoexec.bat. That means the flashed build booted, but its local file storage was missing or uninitialized, so script-based startup actions could not run. [#21587457]

Why does an erased XR3/XR809 device boot with sector format warnings, AP mode messages, and MQTT ERR_MEM errors after flashing?

That happens because the device was flashed onto erased storage and then had to rebuild its local state. The boot log shows repeated sector-header failures around 0x001e0000–0x001ef000, followed by formatting, AP startup, and later MQTT ERR_MEM publish failures. In the same session, free heap moved around 65,480–68,136 bytes, so the system was alive but not yet cleanly configured. These are bring-up symptoms, not proof of a bad flash. [#21587457]

How do HTTP OTA updates work on XR809 when the device acts as an HTTP client downloading the firmware image from another server?

XR809 OTA works as a client-pull update, not as a pushed upload. The maintainer explained that XR809 expects the OTA file on another HTTP server, then XR809_RequestOTAHTTP() triggers cmd_ota_http_exec() in the main loop. From there, the SDK tries to fetch the image, read verification data, verify the image, and reboot. If any stage fails, OTA stops before activation. [#21131447]

Which firmware file format should be used for XR809 OTA and UART flashing, and is the same .img file used for both?

The thread points to the same .img file for both UART and OTA on XR809-family devices. In June 2025, one poster suggested that the XR872 example implied a shared image, and another replied that the SDK code appeared to use the same binary for UART and OTA. That makes .img the working assumption for XR809 too, although OTA itself was still not functioning. [#21586375]

What steps should I follow to debug XR809 OTA support in OpenBK7231T_App, including cmd_ota_http_exec, image verification, and reboot flow?

Debug it in the exact execution order. 1. Confirm XR809_RequestOTAHTTP() sets the request string and flag. 2. Trace cmd_ota_http_exec() through ota_get_image(), ota_get_verify_data(), and ota_verify_image(). 3. Check whether ota_reboot() is ever reached after a successful verify. The maintainer already added printf() tracing and commented out lines, so the next useful work is narrowing the first failing function, not rewriting the whole flow. [#21131447]
Generated by the language model.
ADVERTISEMENT