P06 Tuya PIR Motion Sensor Review: CBU Module, BK7231N, and MCU Insights

Here I'll post my findings relating to the P06 Tuya PIR motion sensor. This device takes 2 AA batteries and 5v USB using a micro-USB connector.

This item was purchased from https://www.aliexpress.com/item/1005004083257831.html from the NVWU store



Opening we see it comes with a CBU module. Unlike this P06 which comes with an XR3 (which is what I was hoping for). We also see it's accompanied by a Tuya MCU.



from TX2:



As expected the RX1/TX1 communication with the Tuya MCU gets in the way of dump/flash



There is no continuity between RX/TX and any of the MCU legs but instead there is continuity to the small resistors beside the MCU. So, I severed the RX trace just where it leaves the CBU, after which the dump could be obtained, attached. Being Tuya MCU, there's no pin extraction



firmware version 2.1.0 so no good for cloudcutter.

Flashed with OBK and then soldered a little pb bridge over the cut RX.

And that's as far as I can go tonight.

So it can work with both batteries and USB? But it's battery-powered flavour of TuyaMCU, so it always sleeps anyway? How is the connection handled? Do batteries discharge when 5V USB is connected?

good questions. The manual isn't much help




apart from this perhaps



I should probably flash back to factory to see what default behaviour is. You'd think there'd be safeguards in place to stop damage if both battery and USB were live, right?!

Those safeguards would be in hardware, not software, so there is no need to flash. It depends on the connection circuit. The simplest (but no so efficient) way would be to use some dodes.

curious, the only dpID appears to be

so what kind of values does this enum have?

actually dpID 3 too

Battery enum is nothing new.
So, pir state is an enum but has only two values possible?

seems so.

result of tuyaMcu_sendQueryState



Added after 34 [minutes]:

button and key pad trace to MCU leg



Added after 6 [minutes]:

BS612 PIR sensor seen on 3 other devices. https://www.elektroda.com/rtvforum/find.php?q=bs612

https://www.adafruit.com/product/5578

im still fiddling.

autoexec

I think that you need a tmSensor driver as well, as it is a TuyaMCU low power protocol. Not the classic TuyaMCU

ah! genius.





I did try ReadOnlyLowMidHigh on setChannelType 3 ReadOnly but that didn't reveal anything in the GUI.

Also, if there are only two dpIDs, I can't do anything with the LED or Btn? that's it, PIR and a rubbish battery indicator?

Are LED and Btn connected to MCU or to WiFI module?

I can't seem to trace from resistor I am getting continuity from on one side. It's all right next to the MCU. I don't have continuity from CBU to any components. Button is as above to MCU.

and no sign of pin assignments in binary



posting this for ref too

Well, I am almost certain that the button at least must be connected to MCU. You can press it and MCU may send then a special packet to WiFI module, which is used for pairing.

The same probably goes for the LED>...

yes. I expected that too but that was not the experience. button pushes didn't seem to produce any MCU packets.

I've gone back to factory and hooked up a second USB-TTL so I can properly see what factory is doing. Also, believe it or not, I've not really done much with TuyaMCU Analyser, so good practice,



COM10 = USBTTL_RX - RX test pad on PIR device
COM22 = USBTTL_RX - TX test pad on PIR device

boot log:



Added after 2 [minutes]:

and a bit of Tuya app info too while I'm here



Added after 24 [minutes]:

change from motion detected to no motion detected status:



and reverse:



Added after 3 [minutes]:

unpairing/wipe data and reboot from Tuya app. LED fast flash;



Added after 7 [minutes]:

motion detected = dpId=1 Enum V=0
no motion = dpId=1 Enum V=1

Added after 3 [minutes]:

odd. button short, long or very long presses produce nothing. not even a ringbuffer count change. It also doesn't reset/unpair the device to default.

Added after 1 [hours] 18 [minutes]:

CEN has a trace but the path is missing a component so ultimately doesn't have continuity to the MCU leg highlighted

Thank you for sharing. This is very strange that the RESET button does not seem to work.

The CEN trace without component, on the other hand, seems normal. They don't need CEN. They just cut the power to the whole module.

yes. and there's continuity still from both sides of the button through to the MCU leg. the far side beeps fine when the button is pushed.

nothing new in log out when button is pushed.

Added after 18 [minutes]:

divadiow wrote:

I did try ReadOnlyLowMidHigh on setChannelType 3 ReadOnly but that didn't reveal anything in the GUI

is ReadOnlyLowMidHigh not correct for this?

Added after 10 [minutes]:

OK so with the autoexec above (tmsensor now added) we get this on USB power



when no motion PIR = 1 and this is changed when the MCU sends this:



motion detected PIR = 0 - MCU sends this



Added after 4 [minutes]:

after 30s of the sensor being covered after motion, it will go back to no motion detected. The MCU flashes the red LED once when motion is detected and again when asserting no motion state

I can indeed see that this channel type is missing http display. Can you check this commit, after it builds?
https://github.com/openshwprojects/OpenBK7231...mmit/a70bd96ee1275ec3b65572c56166b8d532404f8a

-on 5v USB the device stays online all the time
-on battery the MCU deep sleeps until a motion event then sleeps - then 30s later a no-motion event. For each event it boots and stays awake long enough for OBK to load for a few seconds
-with batteries inserted and USB powered it will stay awake, presumably using USB as power source
-if USB removed with batteries inserted the batteries do not take over. The device has to have all power removed and a power source added again

at 3.0v (according to my PSU) battery level = 2
at 2.9v (according to my PSU) battery level = 2
at 2.8v (according to my PSU) battery level = 1
at 2.7v (according to my PSU) battery level = 1
at 2.6v (according to my PSU) battery level = 1
at 2.5v (according to my PSU) battery level = 1
at 2.4v (according to my PSU) battery level = 1
at 2.3v (according to my PSU) battery level = 0
at 2.2v (according to my PSU) battery level = 0

Added after 14 [minutes]:

p.kaczmarek2 wrote:

Can you check this commit, after it builds?

Added after 2 [minutes]:

does this mean there could be ReadOnlyMotion for 0 + 1 byte translation to plain-text status? What was the case for doing ReadOnlyLowMidHigh for battery and not other RO enum values?

Added after 7 [hours] 2 [minutes]:



https://github.com/OpenBekenIOT/webapp/pull/127

How does it know it's connected to 5V?

ReadOnlyLowMidHigh was added because we had a LowMidHigh type for kitchen fans, which was both read and write enabled. It was showing a radio buttons on http panel and user was able to choose the level himself just by clicking.
Motion, on the other hand, it's always just a read-only type, so there is no need to special "read only" version in this case.