logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Resetting Issues with Tuya PIR Sensor on BK7231N Chip

vitya123 1035 22
ADVERTISEMENT
Reply | New topic
  • #1 21345017
    vitya123
    Level 6  
    I am having difficulties with my brand new Tuya PIR sensor:
    I can't flash it because it wouldn't respond to reset on its CEN nor its RST pins (according to the documentation). I have zero experience programming (as a developer) this chip, but in the ESP world I'm used to the chip resetting when I pull the EN pin to GND. This chip, however, doesn't react to any attempt to reset it. Using the BK7231Flasher utility, that I have now successfully used on several other devices in the recent past, it wouldn't flash:
    Code: text Expand Select all Copy to clipboard
    Backup name is set to PIR-sensor.
Starting read!
Read parms: start 0x00 (sector 0), len 0x200000 (0 sectors)
Now is: Thursday 12 December 2024 13:45:05.
Flasher mode: BK7231N
Going to open port: COM3.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus failed, will try again - 1/100!

    It doesn't respond to either CEN pulled to GND nor power cycling, like other devices do.

    Here is an original bootlog for reference:

    Code: text Expand Select all Copy to clipboard
    [12:46:42.344] - serial type is general
[12:46:42.393] - Open COM5 Success
[12:46:55.820] -
V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80069cca
FIR:000000d1 00000010 00401ffc 70a61b19
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
[12:46:55.989] - [0
[12:46:55.989] - 1-01 18:12:15 TUYA Info][lr:0xba139] mqc app init ...
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA Debug][lr:0xba0e7] mq_pro:5 cnt:1
[01-01 18:12:15 TUYA Debug][lr:0xba0e7] mq_pro:31 cnt:2
[01-01 18:12:15 TUYA Debug][lr:0x9a07f] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA Err][lr:0xacde3] logseq empty
[01-01 18:12:15 TUYA Debug][lr:0xb614b] svc online log init success
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA Err][lr:0x9f019] wd_protected_read fails gw_bi -1
[01-01 18:12:15 TUYA Debug][lr:0x9f2db] gw base read finish:-1
[01-01 18:12:15 TUYA Debug][lr:0xad0c5] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA Debug][lr:0xad4dd] upd adv para, send conn_req beacon.
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_port_init
[01-01 18:12
[01-01 18:12:15 TUYA Notice][lr:0xad1af] ty 1a,status:0x0
[01-01 18:12:15 TUYA Debug][lr[PLATFORM NOTICE]STACK :
[01-01 18:12:15 TUYA DIug][lr:0x5a7e1] bk7231ebug][lr:0x5a7e1] bk723n_lowpower_common_ty:2.1n_lowpower_common_ty:21.8
[PLATFORM NOTICE]C.1.8
REATE DB SUCCESS
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
[01-01 18:12:15 TUYA Notice][lr:0xad5f5] ble adv upd!
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
[01-01 18:12:15 TUYA Noti[PLATFORM DEBUG]UNKNOW cNT:17
EVENT:17
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:16
[01-01 18:12:15 TUYA Notice][lr:0xb22e7] get key:
0x9e 0xa0 0x7a 0xfe 0x1d 0xfa 0x21 0x40 0x7a 0x86 0x3f 0x4f 0x33 0x68 0x18 0xee
[12:46:56.143] - [01-01 18:12:15 TUYA Inf
[12:46:56.153] - o][lr:0x9a1f3] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[12:46:56.690] - [01-01 18:12:15 TUYA Notice][lr:0x58235] mf_init succ
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:ty_uart_task,stackDepth:3072,totalstackDepth:21504,priority:3
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:ty_record_task,stackDepth:2
[12:46:56.690] - 048,totalstackDepth:23552,priority:3
[01-01 18:12:15 TUYA Notice][lr:0x59e93] get baud:9600
[12:46:56.881] - [01-01 18:12:15 TUYA Notice][lr:0xb4369] wifi mcu init. pid:rjzon9kyxpoeksj3 firmwarekey:keyr5qhaxgstx9ys v1:2.1.8 v2:1.0.0
[PLATFORM NOTICE]bk_rst:0 tuya_rst:0
[01-01 18:12:15 TUYA Notice][lr:0xa3677] Last reset reason: 0
[01-
[12:46:56.891] - 01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:health_monitor,stackDepth:1536,totalstackDepth:25088,priority:5
[01-01 18:12:15 TUYA Notice][lr:0xa37e7] serial_no:fc3cd734d40b
[01-01 18:12:15 TUYA Notice][lr:0xa381f] gw_cntl.gw_wsm.stat:0
[01-01 18:12:15 TUYA Err][lr:0xa384d] read wf start mode err:-6
[01-01 18:12:15 TUYA Notice][lr:0xa38ad] gw_cntl.gw_wsm.nc_tp:1
[01-01 18:12:15 TUYA Notice][lr:0xa38b5] gw_cntl.gw_wsm.md:0
[01-01 18:12:16 TUYA Notice][lr:0xa3aa3] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:16 TUYA Notice][lr:0xa3aaf] gw_cntl.gw_if.product_key:rjzon9kyxpoeksj3, input:rjzon9kyxpoeksj3
[01-01 18:12:16 TUYA Notice][lr:0xa3abb] gw_cntl.gw_if.tp:9, input:9
[01-01 18:12:16 TUYA Notice][lr:0xa3acb] gw_cntl.gw_if.firmware_key:keyr5qhaxgstx9ys, input:keyr5qhaxgstx9ys
[01-01 18:12:16 TUYA Notice][lr:0xad203] ty bt upd product:rjzon9kyxpoeksj3 0
[01-01 18:12:16 TUYA Notice][lr:0xad77b] upd product_id type:0 rjzon9kyxpoeksj3 42f9c0884d2e0a10 OVrk7zA81YAmzVeBlR4ddNQYy7ebkdoU
[01-01 18:12:16 TUYA Notice][lr:0x5a793] device_init succ
[12:46:59.292] - [01-01 18:12:18 TUYA Notice][lr:0x5a5cd] wifi status is :1
[01-01 18:12:18 TUYA Notice][lr:0xad7ff] update boun
[12:46:59.292] - d stat:0
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
[PLATFORM DEBUG]UNKNOW EVENT:19
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:20
[PLATFORM DEBUG]UNKNOW EVENT:16
[01-01 18:12:18 TUYA Notice][lr:0xad5f5] ble adv upd!


    This is how I wired the device (Green:RX, Blue: TX):
    Close-up of Tuya PIR sensor board with visible wire connections.

    If anybody with more experience with these chips, if you have an idea, please don't hold back! :)

    Added after 14 [minutes]:

    Well, in the meantime I employed a second USB-UART adapter to monitor the chip WHILE trying to reset/flash and I can see that in fact, it does reset. I just didn't think it did, because the red LED kept blinking before-during and after the reset....
    Anyway, the issue still stands, I can't flash it, the flasher tool wouldn't recognize the reset.
  • ADVERTISEMENT
  • #2 21345880
    p.kaczmarek2
    Moderator Smart Home  
    This looks like TuyaMCU device. RX and TX (UART1) of WiFi module connects to small MCU in soic 8 case.
    To confirm it, use multimeter to check for continuity between RX/TX pins and some of the MCU pins.
    You can't flash it in circuit, and it would be the same with ESP.

    You have some options:
    - desolder SOIC chip, see how I do that (just see soldering method, nothing more, don't get confused):
    https://youtu.be/z9uLPo9QAY8?t=81
    - desolder WiFi module
    https://www.youtube.com/watch?v=fSbeKwCCMHM (or just via hot air)
    - cut RX/TX traces and reconstruct them later (maybe they have resistors on them that you can temporarily remove?)
    - if possible, find MCU datasheet, maybe it has RESET pin and can be put in reset?

    TuyaMCU guide: https://www.elektroda.com/rtvforum/topic4038151.html
    Similiar device teardown: https://www.elektroda.com/rtvforum/topic3914412.html

    If you want to smoothly convert it, I would also suggest to do a TuyaMCU packets capture first:
    https://www.elektroda.com/rtvforum/topic3970199.html
    Then you can try to use tmSensor on OBK to run it:
    https://www.elektroda.com/rtvforum/find.php?q=tmSensor
    Of course, it's assuming it's TuyaMCU device, but I think there is a fair chance it is. I can see RX/TX near SOIC 8 chip...

    Please also remember to take 2MB flash backup, I can help more if you share it.
    Helpful post? Buy me a coffee.
  • #3 21346222
    vitya123
    Level 6  
    Thanks for the detailed reply!

    I removed the 8 pin SOIC, and was able to make a backup of the original flash as well as to flash it with Openbk. The flasher could not get any meaningful config out of the factory firmware.
    Unfortunately, it still doesn't want to work properly: Monitoring the serial output of the chip I can see that it boots up OK, then at around line 191 it resets itself. Here is a sample of the bootloop (I left in 2 full cycles plus a bit so that you have something to look at :) ):

    Code: text Expand Select all Copy to clipboard
    
V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80069cca
FIR:000000d1 00000010 00401ffc 74861b1b
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 14 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
#Startup delayed 0ms#
[bk]tx_txdesc_flush
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
ge#Startup delayed 10ms#
tartup delayed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
#Startup delayed 460ms#
calibration_main over
                     flash txpwr table:0xf
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
xtal in flash is:65
xtal_cali:65
--init_xtal = 65
                [FUNC]#Startup delayed 470ms#
pp delayed 470ms#
[FUNC]func_init_extended OVER!!!

start_type:0
Version:
Initializing TCP/IP stack
#Startup delayed 480ms#
app_init finished
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obkD734D40B/ subT cmnd/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/get
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-23 - adc_code:341 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 259003/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 2, idle 447850/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 3, idle 186701/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 4, idle 185567/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 5, idle 188903/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:no flash configuration, use default
Info:MAIN:set ip info: 192.168.4.1,255.255.255.0,192.168.4.1
Info:MAIN:ssid:OpenBK7231N_D734D40B  key: mode:0
hostapd_main_exiting
hostapd_exit_handler
hostapd_exit_done
Soft_AP_start
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
[saap]ME_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
me_set_ps_disable:840 0 0 1 0 0
------beacon_int_set:100 TU
set_active param 0
                  [msg]APM_STOP_CFM
                                   update_ongoing_1_bcn_update
vif_idx:0, ch_idx:0, bcmc_idx:1
update_ongoing_1_bcn_update
enter low level!
mac fc:3c:d7:34:d4: a
leave low level!
net_wlan_add_netif done!, vif_idx:0
uap_ip_start

configuring interface uap (with Static IP)WARN: TCPIP mutex is NOT locked (1) caller 53C9F
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
sending broadcast_deauth:5
Info:MAIN:Time 6, idle 181100/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:MAIN:Time 7, idle 178893/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 8, idle 187360/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 9, idle 185044/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38

V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80068cca
FIR:000000d1 00000010 00401ffc 74a6191b
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 15 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdes#Startup delayed 0ms#
cyed 0ms#
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
get rfca#Startup delayed 10ms#
ldelayed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
calibration_main over
                     flash txpwr table:0xf
#Startup delayed 460ms#
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
xtal in flash is:65
xtal_cali:65
--init_xtal = 65
                [FUNC]ps_init
[FUNC#Startup delayed 470ms#
]up delayed 470ms#
start_type:0
Version:
Initializing TCP/IP stack
app_init finished
#Startup delayed 480ms#
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obkD734D40B/ subT cmnd/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/get
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-22 - adc_code:340 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 263603/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 2, idle 190364/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 3, idle 188279/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 4, idle 187986/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 5, idle 189377/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:no flash configuration, use default
Info:MAIN:set ip info: 192.168.4.1,255.255.255.0,192.168.4.1
Info:MAIN:ssid:OpenBK7231N_D734D40B  key: mode:0
hostapd_main_exiting
hostapd_exit_handler
hostapd_exit_done
Soft_AP_start
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
[saap]ME_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
me_set_ps_disable:840 0 0 1 0 0
------beacon_int_set:100 TU
set_active param 0
                  [msg]APM_STOP_CFM
                                   update_ongoing_1_bcn_update
vif_idx:0, ch_idx:0, bcmc_idx:1
update_ongoing_1_bcn_update
enter low level!
mac fc:3c:d7:34:d4: a
leave low level!
net_wlan_add_netif done!, vif_idx:0
uap_ip_start

configuring interface uap (with Static IP)WARN: TCPIP mutex is NOT locked (1) caller 53C9F
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
sending broadcast_deauth:5
Info:MAIN:Time 6, idle 180896/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:MAIN:Time 7, idle 180729/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 8, idle 188663/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 9, idle 187749/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38

V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80048cca
FIR:000000d1 00000010 00401ffc 74a61919
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 16 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdesc_flush
#Startup delayed 0ms#
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
get rfcali_mode:1
#Startup delayed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
calibration_main over
                     flash txpwr table:0xf
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
xtal in flash is:65
xtal_cali:#Startup delayed 460ms#
6layed 460ms#
--init_xtal = 65
                [FUNC]ps_init
[FUNC]func_init_extended OVER!!!

start_type:0
Version:
lp delayed 470ms#layed 470ms#

app_init finished
#Startup delayed 480ms#
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obkD734D40B/ subT cmnd/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/get
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-22 - adc_code:339 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 261995/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 2, idle 190117/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38


    I can see the wifi AP it creates for a few seconds, but I don't have enough time to fully connect to it (I click on it to connect, but by the time it would wrap up negotiating, it resets.).

    I also attach the backup of the factory firmware. Hope it helps - let me know if I can help further diagnose this.
    Attachments:
  • ADVERTISEMENT
  • #4 21346315
    divadiow
    Level 34  
    I was going to say the TuyaMCU is probably putting it to sleep, but I see you're powering the module directly anyway. Is that still the case?

    from that firmware backup:

    storage area after pairing with Tuya

    Code: JSON
    Log in, to see the code


    Tuya Dev shows the product name as P01CB3S自定义开发 which translates P01CB3S Custom Development
  • #5 21346325
    vitya123
    Level 6  
    Yes, still powering it directly - although I have already soldered the 8 pin SOIC back. Should I remove it?

    I have never paired it with the Tuya app, or anything else. As soon as I received it in the mail, I immediately started the conversion.
  • #6 21346358
    spin55
    Level 17  
    In battery-powered devices that have a TuyaMCU chip connected to the Tx and Rx pins of the Wi-Fi module (in this case CB3S), all the control logic is implemented in the TuyaMCU chip.

    Once flashed you cannot configure it because TuyaMCU controls the power of the WiFi module and cuts it off very quickly to extend the useful life of the batteries. In order to extend the connection time you need to hold down the pairing button until you can access the OpenBK configuration website.

    In this link you can see a flowchart that will help you understand how Tuya implements its firmware for battery-powered devices: https://developer.tuya.com/en/docs/iot/tuyacl...niversalserialaccessprotocol?id=K95afs9h4tjjh

    Unsolder all the cables from the WiFi module and leave the device ready to work. Put batteries in it or power it with 3V and put it in pairing mode. Follow the instructions noted above.

    Greetings
  • ADVERTISEMENT
  • #7 21346371
    divadiow
    Level 34  
    how does the TuyaMCU still have control over the power if the module is powered directly from PSU?
  • #8 21346417
    vitya123
    Level 6  
    Yes, I don't understand either. Although, it is possible that that other chip controls one of the Enable lines of the CB3S, which (according to my measurements) it doesn't...

    I made a quick video of what I am doing - no sound. During the first half, the CB3S is powered directly, the second half, it is powered from the battery terminals. You can see the debug output of the CB3S, and you can see that the button press makes little difference.

    Here is the video:




    BTW: I looked at the linked document (from @spin55), but I didn't get much wiser... I don't even know how to put it into pairing mode. Note, this doesn't have the original firmware at the moment. And with Openbk there is nothing to pair - just an access point to connect to. Or I misunderstand something...
  • #9 21346469
    spin55
    Level 17  
    In the video you can see that starting at minute 1:18 and almost at the end, the connection maintenance times go from 8 or 9 seconds to 18 seconds. Maybe if you play with the times you hold down the pairing button you will get it. At the moment, those 18 seconds are not enough.
  • #10 21346496
    vitya123
    Level 6  
    Indeed, it seems that if I keep pressing (not holding) the button every couple of seconds, the MCU stays open. It's VERY difficult to do that while configuring the device.... So far I managed to connect to my WiFi and I only cursed 4869028596590 times :))) Do you know of a way to circumvent this at least temporarily? On my old, ESP based door sensors, I simply powered the ESP directly and I had all the time in the world for configuration. Here this doesn't seem to be the case.
  • #11 21346523
    spin55
    Level 17  
    I remember that back in the day I was able to see with Realterm the best time to put the PIR NEO device in pairing mode. I think you have to take advantage of the brief moment you have connection to use the pairing button. I describe the process in the last pages of this thread: https://www.elektroda.com/rtvforum/topic3937723-150.html

    Maybe it will help you
  • #12 21346532
    vitya123
    Level 6  
    Ha! I figured it out:
    After doing some reverse engineering of the PCB I found out that something else controls NOT the 3.3V of the MCU, but the GND... If I connect the power AND the GND directly to the MCU, it stays on and now I can continue with the configuration. You can see the switching transistor above and left of the GND pin:

    PCB with CB3S module and soldered wires.

    Added after 1 [hours] 6 [minutes]:

    Now I got into new trouble... Maybe I should open another thread?

    Take a look at this image:
    Close-up of a circuit board with electronic components and marked connection points.

    The marked points (one side of R14 and test point PA5) are connected. This is the point where the voltage changes as the PIR sensor gets activated: Normally, it is GND level, when there is movement, it raises to around 3 volts, then, after a few seconds, it drops to GND again.

    I didn't find this signal on any of the MCU pins. I.e. none of the MCU pins change level when this point changes. This means that the other chip handles it: It switches on the MCU for a few seconds to report back to the MQTT server, probably it sends data to it so that the MCU has something meaningful to send, then it switches it off.

    Am I in the right direction? I'm concerned that if I have to tap into the serial communication between the SOIC chip and the MCU, I won't be able to continue as I don't have the right equipment for it and it is also a bit more time/effort I wanted to put into getting this bad boy working....
  • #13 21346704
    spin55
    Level 17  
    You have to be clear that this is a device controlled by TuyaMCU chip. The pir signal goes to this chip and it communicates with the wifi module through the Tx and Rx pins.

    Forget about hardware now. Now what you have to do is configure the CB3S wifi chip so that it communicates correctly with TuyaMCU. To do this you have to create a configuration file type autoexec.bat in the corresponding Openbeken tab. To do this, feed it directly as when you programmed it to stay online.

    The content of that file is:

    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU
startDriver tmSensor
//setChannelType 1 readonly
// vincular dpid al canal 1
//linkTuyaMCUOutputToChannel 1 val 1
//setChannelType 4 readonly
// vincular dpid al canal 4
//linkTuyaMCUOutputToChannel 4 val 4
//SetChannel 1 2


    Disconnect the Vcc and Gnd cables from the WiFi chip, but leave the Tx and Rx cables. Monitor the Rx and Tx lines separately with Rx from the USB module. I use Realterm, but you can use any other.

    This is to identify the DPid's in the TuyaMCU/CB3S communication. You will see something similar to this:

    Code: text Expand Select all Copy to clipboard
    55 AA 00 01 00 24 7B 22 50 22 3A 22 4F 6B 75 72 6F 6E 6F 32 58 4C 56 52 
56 30 66 42 22 2C 22 76 22 3A 22 31 2E 31 2E 30 22 7D 19                
55 AA 00 02 00 00 01                                                    
55 AA 00 02 00 00 01                                                    
55 AA 00 02 00 00 01                                                    
55 AA 00 05 00 0A 65 01 00 01 00 66 04 00 01 03 E3


    If you get this far we continue.
  • #14 21346748
    vitya123
    Level 6  
    I added the autoexec.bat file. I also set up the wires as you recommended, plus 3.3V and GND at the battery terminals. However, I don't see any communication between the chips. Not only is the terminal empty, but with an oscilloscope I can see that nothing is happening on the lines, they are constantly at high level. Could this indicate that the SOIC chip is broken?
  • #15 21346772
    spin55
    Level 17  
    Can you connect Rx of the USB modem to pin 11 of CB3S? Now restart the device.
  • #16 21346784
    vitya123
    Level 6  
    Yes, and I can see the messages coming. And the unit is restarting after a few seconds if I don't play with the button.
  • ADVERTISEMENT
  • #18 21346794
    vitya123
    Level 6  
    Here you are:

    Code: text Expand Select all Copy to clipboard
    V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80069cc2
FIR:000000d1 00000010 00401ffc 74a6191b
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 332 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 40 changes count.
Error:CMD:no file early.bat err -2
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdesc_fl#Startup delayed 0ms#
u0ms#
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
get rfcali_m#Startup delayed 10ms#
oyed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
calibration_main over
                     flash txpwr table:0xf
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
#Startup delayed 460ms#
xtal in flash is:65
xtal_cali:65
--init_xtal = 65
                [FUNC]ps_init
[FUNC]func_init_extended OVE#Startup delayed 470ms#
R!!!

start_type:0
Version:
Initializing TCP/IP stack
app_init finished
#Startup delayed 480ms#
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:WiFi SSID: waiting for SSID switch 1/3 (using SSID1)
Info:MAIN:Registered for wifi changes
Info:MAIN:Connecting to SSID [MYSSID]
Info:MAIN:ssid:MYSSID key:MYPASSWORD
supplicant_main_exiting
supplicant_exit_done
[sa_sta]MM_RESET_REQ
[bk]tx_txdesc_flush
[sa_sta]ME_CONFIG_REQ
[sa_sta]ME_CHAN_CONFIG_REQ
[sa_sta]MM_START_REQ
hapd_intf_add_vif,type:2, s:0, id:0
wpa_dInit
wpa_supplicant_req_scan
Setting scan[retry16] request: 0.100000 sec
MANUAL_SCAN_REQ
enter low level!
mac fc:3c:d7:34:d4: b
leave low level!
net_wlan_add_netif done!, vif_idx:0
Info:MAIN:Using SSID [MYSSID]
Info:MAIN:Using Pass [MYPASSWORD]
Info:MQTT:MQTT_RegisterCallback called for bT viktak/spiti/obkD734D40B/ subT viktak/spiti/obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/viktak/spiti/obkD734D40B/ subT cmnd/viktak/spiti/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT viktak/spiti/obkD734D40B/ subT viktak/spiti/obkD734D40B/+/get
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Started TuyaMCU.
Info:MAIN:Started tmSensor.
Info:MAIN:Main_Init_After_Delay done
wpa_supplicant_scan
wpa_drv_scan
wpa_send_scan_req
ht in scan
scan_start_req_handler
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-23 - adc_code:341 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 264716/s, free 73024, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:Received: 55 AA 00 01 00 24 7B 22 70 22 3A 22 72 6A 7A 6F 6E 39 6B 79 78 70 6F 65 6B 73 6A 33 22 2C 22 76 22 3A 22 31 2E 30 2E 30 22 7D 26
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 1 (QueryProductInformation) len 43
Info:TuyaMCU:ParseQueryProductInformation: received {"p":"rjzon9kyxpoeksj3","v":"1.0.0"}
Info:MAIN:Time 2, idle 182390/s, free 73024, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
wpa_driver_scan_cb
wpa_get_scan_rst:1
cipher2security 2 2 16 16
                         Info:MAIN:Time 3, idle 68716/s, free 73352, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 4, idle 0/s, free 73352, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 5, idle 0/s, free 73352, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
wpa_supplicant_connect
Cancelling scan request
wpa_driver_associate
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
ssid:MYSSID, 1
found scan rst rssi -57 < -50
dis ht_support
no ht in scan
scan_start_req_handler
aready open
aready open
me_set_ps_disable:840 0 0 1 0 3
sm_auth_send:1
sm_auth_handler
ht NOT in assoc req
sm_assoc_rsp_handler
rc_init: station_id=0 format_mod=0 pre_type=0 short_gi=0 max_bw=0
                                                                 rc_init: nss_max=0 mcs_max=255 r_idx_min=4 r_idx_max=11 no_samples=8
                                                                                                                                     ---------SM_CONNECT_IND_ok
wpa_driver_assoc_cb
Cancelling scan request
__l2_packet_send: ret 0
new dtim period:2

new ie: 0 : 4a 61 6e 69 63 65
new ie: 1 : 8c 12 98 24 b0 48 60 6c
new ie: 3 : 2
new ie: 30 : 1 0 0 f ac 4 1 0 0 f ac 4 3 0 0 f ac 2 0 f ac 6 0 f ac 8 8c 0
new ie: 2d : ec 1 3 ff ff 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

__l2_packet_send: ret 0
hapd_intf_add_key CCMP
add sta_mgmt_get_sta
sta:0, vif:0, key:0
sta_mgmt_add_key
add hw key idx:24
hapd_intf_add_key CCMP
add is_broadcast_ether_addr
sta:255, vif:0, key:1
add hw key idx:1
ctrl_port_hdl:1
me_set_ps_disable:840 0 0 0 0 3
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
sta_ip_start

configuring interface mlan (with DHCP client)WARN: TCPIP mutex is NOT locked (1) caller 53C9F
WARN: TCPIP mutex is NOT locked (1) caller 53C9F
ip_addr: 8a7ba8c0
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
Info:MQTT:mqtt_userName homeassistant
mqtt_pass homeassistantt
mqtt_clientID viktak/spiti/obkD734D40B
mqtt_host 192.168.123.42:1883
Info:MAIN:Time 6, idle 101883/s, free 73176, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:MQTT:mqtt_connection_cb: Successfully connected
Info:MQTT:mqtt_subscribed to viktak/spiti/obkD734D40B/+/set
Info:MQTT:mqtt_subscribed to bekens_n/+/set
Info:MQTT:mqtt_subscribed to cmnd/viktak/spiti/obkD734D40B/+
Info:MQTT:mqtt_subscribed to cmnd/bekens_n/+
Info:MQTT:mqtt_subscribed to viktak/spiti/obkD734D40B/+/get
Info:TuyaMCU:Received: 55 AA 00 02 00 00 01
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 2 (MCUconf) len 7
Info:TuyaMCU:ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:MQTT:Publishing val obkD734D40B to viktak/spiti/obkD734D40B/host retain=0
Info:MAIN:Time 7, idle 171985/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val OpenBK7231N 1.17.798 Dec 10 2024 16:02:12 to viktak/spiti/obkD734D40B/build retain=0
Info:MAIN:Time 8, idle 360254/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val fc:3c:d7:34:d4:0b to viktak/spiti/obkD734D40B/mac retain=0
Info:MAIN:Time 9, idle 188525/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:Received: 55 AA 00 02 00 00 01
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 2 (MCUconf) len 7
Info:TuyaMCU:ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:TuyaMCU:Received: 55 AA 00 08 00 0C 00 02 02 02 02 02 02 01 04 00 01 01 26
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 8 (QueryState) len 19
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: processing id 1, dataType 4-enum and 1 data bytes
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: byte 1
Info:MQTT:Publishing val 34.46 to viktak/spiti/obkD734D40B/temp retain=0
Info:MAIN:Time 10, idle 373905/s, free 73160, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:GEN:dhcp=0 ip=192.168.123.138 gate=192.168.123.6 mask=255.255.255.0 mac=fc:3c:d7:34:d4:0b
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-58,ssid=MYSSID,bssid=64:64:4a:e2:df:96,channel=2,cipher_type:CCMP
Info:TuyaMCU:Received: 55 AA 00 05 00 05 03 04 00 01 02 13
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 5 (WiFiSelect) len 12
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: processing id 3, dataType 4-enum and 1 data bytes
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: byte 2
Info:MQTT:Publishing val MYSSID to viktak/spiti/obkD734D40B/ssid retain=0
Info:MAIN:Time 11, idle 181529/s, free 73160, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val 2 to viktak/spiti/obkD734D40B/sockets retain=0
Info:MAIN:Time 12, idle 191192/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val -58 to viktak/spiti/obkD734D40B/rssi retain=0
Info:MAIN:Time 13, idle 188435/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNo▒UUDD▒
  • #19 21346841
    spin55
    Level 17  
    It's working fine.

    55 AA 00 05 00 05 03 04 00 01 02 13

    You already have the DPId of the battery.
    Dp: 03
    Enum type: 04
    Value: 02 (0,1,2)

    Motion detector DP missing

    Do movement tests by monitoring pin 11.

    When you have the DP, you will have to complete autoexec.bat.
  • #20 21346871
    vitya123
    Level 6  
    Pin 11 is the UART (monitoring). Do you mean I should see something there during the motion test? I tried it, but any movement has zero effect on it. It keeps restarting, and now it restarts in a few seconds even if I press the button.... I fear that the SOIC chip is gone...
  • #21 21346874
    spin55
    Level 17  
    Can you take a photo of the plate as it is?

    I don't think the SOIC Tuya is wrong

    Added after 12 [minutes]:

    You can also try this autoexec.bat:

    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU
startDriver tmSensor
setChannelType 1 readonly
//Link dpid to channel 1
linkTuyaMCUOutputToChannel 1 val 1
setChannelType 3 readonly
///Link dpid to channel 3
linkTuyaMCUOutputToChannel 3 val 3
SetChannel 1 2


    Let's see if we're lucky and motion DP is 01.

    After remove all cables except pin 11 for monitoring. Power the device with 3 volts or batteries.

    Added after 9 [minutes]:

    This shows that SOIC is not bad:

    Info:TuyaMCU:Received: 55 AA 00 05 00 05 03 04 00 01 02 13
  • #22 21346918
    vitya123
    Level 6  
    OK, here is a pic of the current setup:
    Close-up of a circuit board with soldered wires and a module labeled CB3S.
    You can see that the thing is powered from the battery terminals. There are wires soldered on each UART line, but only the white one spits out useful info.

    I updated the autoexec.bat file.

    Aaaaaaa and it is working!!!! When I activate it with some movement, it publishes a 0/1 in the get topic:
    Screenshot of diagnostic data from OpenBK7231N device.

    Excellent!!!! Thank you for sticking with me - even after I lost hope :)

    I documented every step of the way - so in a few days I will write a guide in the new hardware topic.

    Thank you again!!!
  • Helpful post
    #23 21346925
    spin55
    Level 17  
    May you enjoy it!.
Reply | New topic
Report a violation of the law

Topic summary

Użytkownik ma problemy z resetowaniem czujnika PIR Tuya opartego na układzie BK7231N, nie mogąc go zaprogramować ani zaktualizować oprogramowania. Po usunięciu układu SOIC udało mu się wykonać kopię zapasową i wgrać OpenBK, ale urządzenie wchodzi w pętlę rozruchową. Użytkownicy sugerują, że czujnik może być kontrolowany przez chip TuyaMCU, który zarządza zasilaniem modułu Wi-Fi, co może powodować problemy z konfiguracją. Po dalszym badaniu, użytkownik odkrył, że podłączenie zasilania i GND bezpośrednio do MCU pozwala na kontynuację konfiguracji. Udało mu się skonfigurować urządzenie, które teraz poprawnie reaguje na ruch.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT