[CBU] Tuya Battery-Powered PIR Siren/Light Alarm: Disassembly, Components, and MM32G0 TuyaMCU - WIP

I thought I'd give this Tuya battery-powered PIR/alarm device a look. It was purchased from Ali Express at https://vi.aliexpress.com/item/1005007342948074.html



What's inside? What makes it tick? A familiar module or something new?



CBU.

And a separate Mindmotion MM32G0 series 32-bit general-purpose microcontroller based on the Arm Cortex-M0 processor. Specifically, a TSSOP20 package MM32G0001A1T. Datasheet attached.



Despite my best efforts I could not get my J-Link USB clone to connect when soldered to DIO and CLK test pads, which have continuity with pins 4 (PA14) and 18 (PA13).



J-Link even has the 32G0001A1T in its list.



Not sure how or when it's programmed at the factory. Before CBU is present? PA14 can be NRST or SWCLK so not sure how to I can achieve a backup.

Onto the CBU. A backup was taken using Easy Flasher. Surprisingly the MCU did not get in the way of backup.

Before flashing OpenBeken I captured the UART log from TX2



and to see the behaviour and capture TuyaMCU data to and from the wifi module when paired with the Tuya app


On power-up the wifi module sends all the preference data set in the app in one go to the MCU





and when you change the preferences it will not apply them until the device next wakes. Eg, here's me changing the values of these settings with red exclamation marks against them





so we already know dpID 103 is alarm volume and dpID104 is alarm duration.

That's where I am for now. I'll carry on with the remaining dpIDs and flash OpenBeken then update this thread.

and here's a siren and LED demo when motion is detected. This is with the piezo unsoldered so barely audible.

yikes. trying to get TuyaMCU battery devices to stay awake is a pain. I thought some of my autoexec experiments were having success keeping it in a loop/awake, but I think hammering the button confuses the MCU for a while.