logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Resetting Issues with Tuya PIR Sensor on BK7231N Chip

vitya123 2694 22
Best answers

Why won’t my Tuya BK7231N PIR sensor reset or enter flashing mode, and how can I flash and configure it?

It’s a TuyaMCU-based device, so the BK7231N is controlled by another MCU and may be power-gated; in this case the fix was to feed the CB3S/BK7231N with both Vcc and GND directly so it stays on long enough to flash and configure [#21345880][#21346532] In-circuit flashing usually won’t work on these boards, so the practical options are to desolder the 8-pin SOIC or the Wi‑Fi module, or temporarily cut the RX/TX traces [#21345880] Once OpenBK is installed, create `autoexec.bat` with `startDriver TuyaMCU` and `startDriver tmSensor`, then monitor the UART on pin 11 to read the TuyaMCU traffic [#21346704][#21346784] The logs showed valid TuyaMCU frames, including DPID 03 for the battery/status enum, so the MCU was alive and communicating rather than dead [#21346841] After adding the suggested channel links, motion events started publishing 0/1 values to the get topic, which confirmed the setup was working [#21346874][#21346918]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21345017
    vitya123
    Level 6  
    I am having difficulties with my brand new Tuya PIR sensor:
    I can't flash it because it wouldn't respond to reset on its CEN nor its RST pins (according to the documentation). I have zero experience programming (as a developer) this chip, but in the ESP world I'm used to the chip resetting when I pull the EN pin to GND. This chip, however, doesn't react to any attempt to reset it. Using the BK7231Flasher utility, that I have now successfully used on several other devices in the recent past, it wouldn't flash:
    Code: text Expand Select all Copy to clipboard
    Backup name is set to PIR-sensor.
Starting read!
Read parms: start 0x00 (sector 0), len 0x200000 (0 sectors)
Now is: Thursday 12 December 2024 13:45:05.
Flasher mode: BK7231N
Going to open port: COM3.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus failed, will try again - 1/100!

    It doesn't respond to either CEN pulled to GND nor power cycling, like other devices do.

    Here is an original bootlog for reference:

    Code: text Expand Select all Copy to clipboard
    [12:46:42.344] - serial type is general
[12:46:42.393] - Open COM5 Success
[12:46:55.820] -
V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80069cca
FIR:000000d1 00000010 00401ffc 70a61b19
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
[12:46:55.989] - [0
[12:46:55.989] - 1-01 18:12:15 TUYA Info][lr:0xba139] mqc app init ...
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:5
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:cmmod,stackDepth:4096,totalstackDepth:8192,priority:4
[01-01 18:12:15 TUYA Debug][lr:0xba0e7] mq_pro:5 cnt:1
[01-01 18:12:15 TUYA Debug][lr:0xba0e7] mq_pro:31 cnt:2
[01-01 18:12:15 TUYA Debug][lr:0x9a07f] Thread:sys_timer Exec Start. Set to Running Stat
[01-01 18:12:15 TUYA Err][lr:0xacde3] logseq empty
[01-01 18:12:15 TUYA Debug][lr:0xb614b] svc online log init success
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:wk_th-0,stackDepth:5120,totalstackDepth:13312,priority:3
[01-01 18:12:15 TUYA Err][lr:0x9f019] wd_protected_read fails gw_bi -1
[01-01 18:12:15 TUYA Debug][lr:0x9f2db] gw base read finish:-1
[01-01 18:12:15 TUYA Debug][lr:0xad0c5] ty bt cmmod regist ok:1
[01-01 18:12:15 TUYA Debug][lr:0xad4dd] upd adv para, send conn_req beacon.
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_port_init
[01-01 18:12
[01-01 18:12:15 TUYA Notice][lr:0xad1af] ty 1a,status:0x0
[01-01 18:12:15 TUYA Debug][lr[PLATFORM NOTICE]STACK :
[01-01 18:12:15 TUYA DIug][lr:0x5a7e1] bk7231ebug][lr:0x5a7e1] bk723n_lowpower_common_ty:2.1n_lowpower_common_ty:21.8
[PLATFORM NOTICE]C.1.8
REATE DB SUCCESS
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
[01-01 18:12:15 TUYA Notice][lr:0xad5f5] ble adv upd!
[PLATFORM NOTICE]!!!!!!!!!!tuya_before_netcfg_cb
[01-01 18:12:15 TUYA Noti[PLATFORM DEBUG]UNKNOW cNT:17
EVENT:17
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:16
[01-01 18:12:15 TUYA Notice][lr:0xb22e7] get key:
0x9e 0xa0 0x7a 0xfe 0x1d 0xfa 0x21 0x40 0x7a 0x86 0x3f 0x4f 0x33 0x68 0x18 0xee
[12:46:56.143] - [01-01 18:12:15 TUYA Inf
[12:46:56.153] - o][lr:0x9a1f3] thread_create name:mf_test,stackDepth:5120,totalstackDepth:18432,priority:4
[12:46:56.690] - [01-01 18:12:15 TUYA Notice][lr:0x58235] mf_init succ
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:ty_uart_task,stackDepth:3072,totalstackDepth:21504,priority:3
[01-01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:ty_record_task,stackDepth:2
[12:46:56.690] - 048,totalstackDepth:23552,priority:3
[01-01 18:12:15 TUYA Notice][lr:0x59e93] get baud:9600
[12:46:56.881] - [01-01 18:12:15 TUYA Notice][lr:0xb4369] wifi mcu init. pid:rjzon9kyxpoeksj3 firmwarekey:keyr5qhaxgstx9ys v1:2.1.8 v2:1.0.0
[PLATFORM NOTICE]bk_rst:0 tuya_rst:0
[01-01 18:12:15 TUYA Notice][lr:0xa3677] Last reset reason: 0
[01-
[12:46:56.891] - 01 18:12:15 TUYA Info][lr:0x9a1f3] thread_create name:health_monitor,stackDepth:1536,totalstackDepth:25088,priority:5
[01-01 18:12:15 TUYA Notice][lr:0xa37e7] serial_no:fc3cd734d40b
[01-01 18:12:15 TUYA Notice][lr:0xa381f] gw_cntl.gw_wsm.stat:0
[01-01 18:12:15 TUYA Err][lr:0xa384d] read wf start mode err:-6
[01-01 18:12:15 TUYA Notice][lr:0xa38ad] gw_cntl.gw_wsm.nc_tp:1
[01-01 18:12:15 TUYA Notice][lr:0xa38b5] gw_cntl.gw_wsm.md:0
[01-01 18:12:16 TUYA Notice][lr:0xa3aa3] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:16 TUYA Notice][lr:0xa3aaf] gw_cntl.gw_if.product_key:rjzon9kyxpoeksj3, input:rjzon9kyxpoeksj3
[01-01 18:12:16 TUYA Notice][lr:0xa3abb] gw_cntl.gw_if.tp:9, input:9
[01-01 18:12:16 TUYA Notice][lr:0xa3acb] gw_cntl.gw_if.firmware_key:keyr5qhaxgstx9ys, input:keyr5qhaxgstx9ys
[01-01 18:12:16 TUYA Notice][lr:0xad203] ty bt upd product:rjzon9kyxpoeksj3 0
[01-01 18:12:16 TUYA Notice][lr:0xad77b] upd product_id type:0 rjzon9kyxpoeksj3 42f9c0884d2e0a10 OVrk7zA81YAmzVeBlR4ddNQYy7ebkdoU
[01-01 18:12:16 TUYA Notice][lr:0x5a793] device_init succ
[12:46:59.292] - [01-01 18:12:18 TUYA Notice][lr:0x5a5cd] wifi status is :1
[01-01 18:12:18 TUYA Notice][lr:0xad7ff] update boun
[12:46:59.292] - d stat:0
[PLATFORM DEBUG]!!!!!!!!!!tuya_os_adapt_bt_reset_adv
[PLATFORM DEBUG]UNKNOW EVENT:19
[PLATFORM DEBUG]UNKNOW EVENT:16
[PLATFORM DEBUG]UNKNOW EVENT:20
[PLATFORM DEBUG]UNKNOW EVENT:16
[01-01 18:12:18 TUYA Notice][lr:0xad5f5] ble adv upd!


    This is how I wired the device (Green:RX, Blue: TX):
    Close-up of Tuya PIR sensor board with visible wire connections.

    If anybody with more experience with these chips, if you have an idea, please don't hold back! :)

    Added after 14 [minutes]:

    Well, in the meantime I employed a second USB-UART adapter to monitor the chip WHILE trying to reset/flash and I can see that in fact, it does reset. I just didn't think it did, because the red LED kept blinking before-during and after the reset....
    Anyway, the issue still stands, I can't flash it, the flasher tool wouldn't recognize the reset.
  • ADVERTISEMENT
  • #2 21345880
    p.kaczmarek2
    Moderator Smart Home  
    This looks like TuyaMCU device. RX and TX (UART1) of WiFi module connects to small MCU in soic 8 case.
    To confirm it, use multimeter to check for continuity between RX/TX pins and some of the MCU pins.
    You can't flash it in circuit, and it would be the same with ESP.

    You have some options:
    - desolder SOIC chip, see how I do that (just see soldering method, nothing more, don't get confused):
    https://youtu.be/z9uLPo9QAY8?t=81
    - desolder WiFi module
    https://www.youtube.com/watch?v=fSbeKwCCMHM (or just via hot air)
    - cut RX/TX traces and reconstruct them later (maybe they have resistors on them that you can temporarily remove?)
    - if possible, find MCU datasheet, maybe it has RESET pin and can be put in reset?

    TuyaMCU guide: https://www.elektroda.com/rtvforum/topic4038151.html
    Similiar device teardown: https://www.elektroda.com/rtvforum/topic3914412.html

    If you want to smoothly convert it, I would also suggest to do a TuyaMCU packets capture first:
    https://www.elektroda.com/rtvforum/topic3970199.html
    Then you can try to use tmSensor on OBK to run it:
    https://www.elektroda.com/rtvforum/find.php?q=tmSensor
    Of course, it's assuming it's TuyaMCU device, but I think there is a fair chance it is. I can see RX/TX near SOIC 8 chip...

    Please also remember to take 2MB flash backup, I can help more if you share it.
    Helpful post? Buy me a coffee.
  • #3 21346222
    vitya123
    Level 6  
    Thanks for the detailed reply!

    I removed the 8 pin SOIC, and was able to make a backup of the original flash as well as to flash it with Openbk. The flasher could not get any meaningful config out of the factory firmware.
    Unfortunately, it still doesn't want to work properly: Monitoring the serial output of the chip I can see that it boots up OK, then at around line 191 it resets itself. Here is a sample of the bootloop (I left in 2 full cycles plus a bit so that you have something to look at :) ):

    Code: text Expand Select all Copy to clipboard
    
V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80069cca
FIR:000000d1 00000010 00401ffc 74861b1b
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 14 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
#Startup delayed 0ms#
[bk]tx_txdesc_flush
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
ge#Startup delayed 10ms#
tartup delayed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
#Startup delayed 460ms#
calibration_main over
                     flash txpwr table:0xf
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
xtal in flash is:65
xtal_cali:65
--init_xtal = 65
                [FUNC]#Startup delayed 470ms#
pp delayed 470ms#
[FUNC]func_init_extended OVER!!!

start_type:0
Version:
Initializing TCP/IP stack
#Startup delayed 480ms#
app_init finished
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obkD734D40B/ subT cmnd/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/get
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-23 - adc_code:341 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 259003/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 2, idle 447850/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 3, idle 186701/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 4, idle 185567/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 5, idle 188903/s, free 80728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:no flash configuration, use default
Info:MAIN:set ip info: 192.168.4.1,255.255.255.0,192.168.4.1
Info:MAIN:ssid:OpenBK7231N_D734D40B  key: mode:0
hostapd_main_exiting
hostapd_exit_handler
hostapd_exit_done
Soft_AP_start
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
[saap]ME_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
me_set_ps_disable:840 0 0 1 0 0
------beacon_int_set:100 TU
set_active param 0
                  [msg]APM_STOP_CFM
                                   update_ongoing_1_bcn_update
vif_idx:0, ch_idx:0, bcmc_idx:1
update_ongoing_1_bcn_update
enter low level!
mac fc:3c:d7:34:d4: a
leave low level!
net_wlan_add_netif done!, vif_idx:0
uap_ip_start

configuring interface uap (with Static IP)WARN: TCPIP mutex is NOT locked (1) caller 53C9F
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
sending broadcast_deauth:5
Info:MAIN:Time 6, idle 181100/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:MAIN:Time 7, idle 178893/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 8, idle 187360/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 9, idle 185044/s, free 73008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38

V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80068cca
FIR:000000d1 00000010 00401ffc 74a6191b
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 15 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdes#Startup delayed 0ms#
cyed 0ms#
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
get rfca#Startup delayed 10ms#
ldelayed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
calibration_main over
                     flash txpwr table:0xf
#Startup delayed 460ms#
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
xtal in flash is:65
xtal_cali:65
--init_xtal = 65
                [FUNC]ps_init
[FUNC#Startup delayed 470ms#
]up delayed 470ms#
start_type:0
Version:
Initializing TCP/IP stack
app_init finished
#Startup delayed 480ms#
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obkD734D40B/ subT cmnd/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/get
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-22 - adc_code:340 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 263603/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 2, idle 190364/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 3, idle 188279/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 4, idle 187986/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 5, idle 189377/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:no flash configuration, use default
Info:MAIN:set ip info: 192.168.4.1,255.255.255.0,192.168.4.1
Info:MAIN:ssid:OpenBK7231N_D734D40B  key: mode:0
hostapd_main_exiting
hostapd_exit_handler
hostapd_exit_done
Soft_AP_start
[saap]MM_RESET_REQ
[bk]tx_txdesc_flush
[saap]ME_CONFIG_REQ
[saap]ME_CHAN_CONFIG_REQ
[saap]MM_START_REQ
hapd_intf_add_vif,type:3, s:0, id:0
apm start with vif:0
me_set_ps_disable:840 0 0 1 0 0
------beacon_int_set:100 TU
set_active param 0
                  [msg]APM_STOP_CFM
                                   update_ongoing_1_bcn_update
vif_idx:0, ch_idx:0, bcmc_idx:1
update_ongoing_1_bcn_update
enter low level!
mac fc:3c:d7:34:d4: a
leave low level!
net_wlan_add_netif done!, vif_idx:0
uap_ip_start

configuring interface uap (with Static IP)WARN: TCPIP mutex is NOT locked (1) caller 53C9F
def netif is no ap's netif, sending boardcast or no-subnet ip packets may failed
sending broadcast_deauth:5
Info:MAIN:Time 6, idle 180896/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:MAIN:Time 7, idle 180729/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 8, idle 188663/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38
Info:MAIN:Time 9, idle 187749/s, free 72920, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 5/38

V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80048cca
FIR:000000d1 00000010 00401ffc 74a61919
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 16 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdesc_flush
#Startup delayed 0ms#
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
get rfcali_mode:1
#Startup delayed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
calibration_main over
                     flash txpwr table:0xf
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
xtal in flash is:65
xtal_cali:#Startup delayed 460ms#
6layed 460ms#
--init_xtal = 65
                [FUNC]ps_init
[FUNC]func_init_extended OVER!!!

start_type:0
Version:
lp delayed 470ms#layed 470ms#

app_init finished
#Startup delayed 480ms#
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obkD734D40B/ subT cmnd/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT obkD734D40B/ subT obkD734D40B/+/get
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-22 - adc_code:339 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 261995/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 2, idle 190117/s, free 80640, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38


    I can see the wifi AP it creates for a few seconds, but I don't have enough time to fully connect to it (I click on it to connect, but by the time it would wrap up negotiating, it resets.).

    I also attach the backup of the factory firmware. Hope it helps - let me know if I can help further diagnose this.
    Attachments:
    • readResult_BK7231N_QIO_PIR-sensor_2024-13-12-10-28-58.bin (2 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #4 21346315
    divadiow
    Level 38  
    I was going to say the TuyaMCU is probably putting it to sleep, but I see you're powering the module directly anyway. Is that still the case?

    from that firmware backup:

    storage area after pairing with Tuya

    Code: JSON
    Log in, to see the code


    Tuya Dev shows the product name as P01CB3S自定义开发 which translates P01CB3S Custom Development
  • #5 21346325
    vitya123
    Level 6  
    Yes, still powering it directly - although I have already soldered the 8 pin SOIC back. Should I remove it?

    I have never paired it with the Tuya app, or anything else. As soon as I received it in the mail, I immediately started the conversion.
  • #6 21346358
    spin55
    Level 17  
    In battery-powered devices that have a TuyaMCU chip connected to the Tx and Rx pins of the Wi-Fi module (in this case CB3S), all the control logic is implemented in the TuyaMCU chip.

    Once flashed you cannot configure it because TuyaMCU controls the power of the WiFi module and cuts it off very quickly to extend the useful life of the batteries. In order to extend the connection time you need to hold down the pairing button until you can access the OpenBK configuration website.

    In this link you can see a flowchart that will help you understand how Tuya implements its firmware for battery-powered devices: https://developer.tuya.com/en/docs/iot/tuyacl...niversalserialaccessprotocol?id=K95afs9h4tjjh

    Unsolder all the cables from the WiFi module and leave the device ready to work. Put batteries in it or power it with 3V and put it in pairing mode. Follow the instructions noted above.

    Greetings
  • #7 21346371
    divadiow
    Level 38  
    how does the TuyaMCU still have control over the power if the module is powered directly from PSU?
  • ADVERTISEMENT
  • #8 21346417
    vitya123
    Level 6  
    Yes, I don't understand either. Although, it is possible that that other chip controls one of the Enable lines of the CB3S, which (according to my measurements) it doesn't...

    I made a quick video of what I am doing - no sound. During the first half, the CB3S is powered directly, the second half, it is powered from the battery terminals. You can see the debug output of the CB3S, and you can see that the button press makes little difference.

    Here is the video:




    BTW: I looked at the linked document (from @spin55), but I didn't get much wiser... I don't even know how to put it into pairing mode. Note, this doesn't have the original firmware at the moment. And with Openbk there is nothing to pair - just an access point to connect to. Or I misunderstand something...
  • #9 21346469
    spin55
    Level 17  
    In the video you can see that starting at minute 1:18 and almost at the end, the connection maintenance times go from 8 or 9 seconds to 18 seconds. Maybe if you play with the times you hold down the pairing button you will get it. At the moment, those 18 seconds are not enough.
  • #10 21346496
    vitya123
    Level 6  
    Indeed, it seems that if I keep pressing (not holding) the button every couple of seconds, the MCU stays open. It's VERY difficult to do that while configuring the device.... So far I managed to connect to my WiFi and I only cursed 4869028596590 times :))) Do you know of a way to circumvent this at least temporarily? On my old, ESP based door sensors, I simply powered the ESP directly and I had all the time in the world for configuration. Here this doesn't seem to be the case.
  • #11 21346523
    spin55
    Level 17  
    I remember that back in the day I was able to see with Realterm the best time to put the PIR NEO device in pairing mode. I think you have to take advantage of the brief moment you have connection to use the pairing button. I describe the process in the last pages of this thread: https://www.elektroda.com/rtvforum/topic3937723-150.html

    Maybe it will help you
  • #12 21346532
    vitya123
    Level 6  
    Ha! I figured it out:
    After doing some reverse engineering of the PCB I found out that something else controls NOT the 3.3V of the MCU, but the GND... If I connect the power AND the GND directly to the MCU, it stays on and now I can continue with the configuration. You can see the switching transistor above and left of the GND pin:

    PCB with CB3S module and soldered wires.

    Added after 1 [hours] 6 [minutes]:

    Now I got into new trouble... Maybe I should open another thread?

    Take a look at this image:
    Close-up of a circuit board with electronic components and marked connection points.

    The marked points (one side of R14 and test point PA5) are connected. This is the point where the voltage changes as the PIR sensor gets activated: Normally, it is GND level, when there is movement, it raises to around 3 volts, then, after a few seconds, it drops to GND again.

    I didn't find this signal on any of the MCU pins. I.e. none of the MCU pins change level when this point changes. This means that the other chip handles it: It switches on the MCU for a few seconds to report back to the MQTT server, probably it sends data to it so that the MCU has something meaningful to send, then it switches it off.

    Am I in the right direction? I'm concerned that if I have to tap into the serial communication between the SOIC chip and the MCU, I won't be able to continue as I don't have the right equipment for it and it is also a bit more time/effort I wanted to put into getting this bad boy working....
  • #13 21346704
    spin55
    Level 17  
    You have to be clear that this is a device controlled by TuyaMCU chip. The pir signal goes to this chip and it communicates with the wifi module through the Tx and Rx pins.

    Forget about hardware now. Now what you have to do is configure the CB3S wifi chip so that it communicates correctly with TuyaMCU. To do this you have to create a configuration file type autoexec.bat in the corresponding Openbeken tab. To do this, feed it directly as when you programmed it to stay online.

    The content of that file is:

    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU
startDriver tmSensor
//setChannelType 1 readonly
// vincular dpid al canal 1
//linkTuyaMCUOutputToChannel 1 val 1
//setChannelType 4 readonly
// vincular dpid al canal 4
//linkTuyaMCUOutputToChannel 4 val 4
//SetChannel 1 2


    Disconnect the Vcc and Gnd cables from the WiFi chip, but leave the Tx and Rx cables. Monitor the Rx and Tx lines separately with Rx from the USB module. I use Realterm, but you can use any other.

    This is to identify the DPid's in the TuyaMCU/CB3S communication. You will see something similar to this:

    Code: text Expand Select all Copy to clipboard
    55 AA 00 01 00 24 7B 22 50 22 3A 22 4F 6B 75 72 6F 6E 6F 32 58 4C 56 52 
56 30 66 42 22 2C 22 76 22 3A 22 31 2E 31 2E 30 22 7D 19                
55 AA 00 02 00 00 01                                                    
55 AA 00 02 00 00 01                                                    
55 AA 00 02 00 00 01                                                    
55 AA 00 05 00 0A 65 01 00 01 00 66 04 00 01 03 E3


    If you get this far we continue.
  • #14 21346748
    vitya123
    Level 6  
    I added the autoexec.bat file. I also set up the wires as you recommended, plus 3.3V and GND at the battery terminals. However, I don't see any communication between the chips. Not only is the terminal empty, but with an oscilloscope I can see that nothing is happening on the lines, they are constantly at high level. Could this indicate that the SOIC chip is broken?
  • #15 21346772
    spin55
    Level 17  
    Can you connect Rx of the USB modem to pin 11 of CB3S? Now restart the device.
  • ADVERTISEMENT
  • #16 21346784
    vitya123
    Level 6  
    Yes, and I can see the messages coming. And the unit is restarting after a few seconds if I don't play with the button.
  • #18 21346794
    vitya123
    Level 6  
    Here you are:

    Code: text Expand Select all Copy to clipboard
    V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c 80069cc2
FIR:000000d1 00000010 00401ffc 74a6191b
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4144d8, size:113448
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 332 #######
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 40 changes count.
Error:CMD:no file early.bat err -2
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done

Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay

Main_Init_Delay

delaying start
bandgap_calm_in_efuse=0x56
[load]bandgap_calm=0x56->0x16,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdesc_fl#Startup delayed 0ms#
u0ms#
[FUNC]intc_init
[FUNC]calibration_main
gpio_level=1,txpwr_state=15
                           user define rfcali mode:1
get rfcali_m#Startup delayed 10ms#
oyed 10ms#
#Startup delayed 20ms#
#Startup delayed 30ms#
#Startup delayed 40ms#
#Startup delayed 50ms#
#Startup delayed 60ms#
#Startup delayed 70ms#
#Startup delayed 80ms#
#Startup delayed 90ms#
#Startup delayed 100ms#
#Startup delayed 110ms#
#Startup delayed 120ms#
#Startup delayed 130ms#
#Startup delayed 140ms#
#Startup delayed 150ms#
#Startup delayed 160ms#
#Startup delayed 170ms#
#Startup delayed 180ms#
#Startup delayed 190ms#
#Startup delayed 200ms#
#Startup delayed 210ms#
#Startup delayed 220ms#
#Startup delayed 230ms#
#Startup delayed 240ms#
#Startup delayed 250ms#
#Startup delayed 260ms#
#Startup delayed 270ms#
#Startup delayed 280ms#
#Startup delayed 290ms#
#Startup delayed 300ms#
#Startup delayed 310ms#
#Startup delayed 320ms#
#Startup delayed 330ms#
#Startup delayed 340ms#
#Startup delayed 350ms#
#Startup delayed 360ms#
#Startup delayed 370ms#
#Startup delayed 380ms#
#Startup delayed 390ms#
#Startup delayed 400ms#
#Startup delayed 410ms#
#Startup delayed 420ms#
#Startup delayed 430ms#
#Startup delayed 440ms#
#Startup delayed 450ms#
calibration_main over
                     flash txpwr table:0xf
dif g and n20 ID in flash:4
dif g and n40 ID in flash:4
read txpwr tab from flash success
temp in flash is:245
#Startup delayed 460ms#
xtal in flash is:65
xtal_cali:65
--init_xtal = 65
                [FUNC]ps_init
[FUNC]func_init_extended OVE#Startup delayed 470ms#
R!!!

start_type:0
Version:
Initializing TCP/IP stack
app_init finished
#Startup delayed 480ms#
#Startup delayed 490ms#
#Startup delayed 500ms#
#Startup delayed 510ms#
#Startup delayed 520ms#
#Startup delayed 530ms#
#Startup delayed 540ms#
#Startup delayed 550ms#
#Startup delayed 560ms#
#Startup delayed 570ms#
#Startup delayed 580ms#
#Startup delayed 590ms#
#Startup delayed 600ms#
#Startup delayed 610ms#
#Startup delayed 620ms#
#Startup delayed 630ms#
#Startup delayed 640ms#
#Startup delayed 650ms#
#Startup delayed 660ms#
#Startup delayed 670ms#
#Startup delayed 680ms#
#Startup delayed 690ms#
#Startup delayed 700ms#
#Startup delayed 710ms#
#Startup delayed 720ms#
#Startup delayed 730ms#
#Startup delayed 740ms#

starting....
Info:MAIN:Main_Init_Delay done

Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:WiFi SSID: waiting for SSID switch 1/3 (using SSID1)
Info:MAIN:Registered for wifi changes
Info:MAIN:Connecting to SSID [MYSSID]
Info:MAIN:ssid:MYSSID key:MYPASSWORD
supplicant_main_exiting
supplicant_exit_done
[sa_sta]MM_RESET_REQ
[bk]tx_txdesc_flush
[sa_sta]ME_CONFIG_REQ
[sa_sta]ME_CHAN_CONFIG_REQ
[sa_sta]MM_START_REQ
hapd_intf_add_vif,type:2, s:0, id:0
wpa_dInit
wpa_supplicant_req_scan
Setting scan[retry16] request: 0.100000 sec
MANUAL_SCAN_REQ
enter low level!
mac fc:3c:d7:34:d4: b
leave low level!
net_wlan_add_netif done!, vif_idx:0
Info:MAIN:Using SSID [MYSSID]
Info:MAIN:Using Pass [MYPASSWORD]
Info:MQTT:MQTT_RegisterCallback called for bT viktak/spiti/obkD734D40B/ subT viktak/spiti/obkD734D40B/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens_n/ subT bekens_n/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/viktak/spiti/obkD734D40B/ subT cmnd/viktak/spiti/obkD734D40B/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens_n/ subT cmnd/bekens_n/+
Info:MQTT:MQTT_RegisterCallback called for bT viktak/spiti/obkD734D40B/ subT viktak/spiti/obkD734D40B/+/get
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Started TuyaMCU.
Info:MAIN:Started tmSensor.
Info:MAIN:Main_Init_After_Delay done
wpa_supplicant_scan
wpa_drv_scan
wpa_send_scan_req
ht in scan
scan_start_req_handler
cal_bias!
cal dpll!
temperature_type=1
                  temp_code:-23 - adc_code:341 - adc_trend:[13]:245->[4]:335
Info:MAIN:Time 1, idle 264716/s, free 73024, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:Received: 55 AA 00 01 00 24 7B 22 70 22 3A 22 72 6A 7A 6F 6E 39 6B 79 78 70 6F 65 6B 73 6A 33 22 2C 22 76 22 3A 22 31 2E 30 2E 30 22 7D 26
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 1 (QueryProductInformation) len 43
Info:TuyaMCU:ParseQueryProductInformation: received {"p":"rjzon9kyxpoeksj3","v":"1.0.0"}
Info:MAIN:Time 2, idle 182390/s, free 73024, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
wpa_driver_scan_cb
wpa_get_scan_rst:1
cipher2security 2 2 16 16
                         Info:MAIN:Time 3, idle 68716/s, free 73352, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 4, idle 0/s, free 73352, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 5, idle 0/s, free 73352, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
wpa_supplicant_connect
Cancelling scan request
wpa_driver_associate
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
ssid:MYSSID, 1
found scan rst rssi -57 < -50
dis ht_support
no ht in scan
scan_start_req_handler
aready open
aready open
me_set_ps_disable:840 0 0 1 0 3
sm_auth_send:1
sm_auth_handler
ht NOT in assoc req
sm_assoc_rsp_handler
rc_init: station_id=0 format_mod=0 pre_type=0 short_gi=0 max_bw=0
                                                                 rc_init: nss_max=0 mcs_max=255 r_idx_min=4 r_idx_max=11 no_samples=8
                                                                                                                                     ---------SM_CONNECT_IND_ok
wpa_driver_assoc_cb
Cancelling scan request
__l2_packet_send: ret 0
new dtim period:2

new ie: 0 : 4a 61 6e 69 63 65
new ie: 1 : 8c 12 98 24 b0 48 60 6c
new ie: 3 : 2
new ie: 30 : 1 0 0 f ac 4 1 0 0 f ac 4 3 0 0 f ac 2 0 f ac 6 0 f ac 8 8c 0
new ie: 2d : ec 1 3 ff ff 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

__l2_packet_send: ret 0
hapd_intf_add_key CCMP
add sta_mgmt_get_sta
sta:0, vif:0, key:0
sta_mgmt_add_key
add hw key idx:24
hapd_intf_add_key CCMP
add is_broadcast_ether_addr
sta:255, vif:0, key:1
add hw key idx:1
ctrl_port_hdl:1
me_set_ps_disable:840 0 0 0 0 3
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
sta_ip_start

configuring interface mlan (with DHCP client)WARN: TCPIP mutex is NOT locked (1) caller 53C9F
WARN: TCPIP mutex is NOT locked (1) caller 53C9F
ip_addr: 8a7ba8c0
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
Info:MQTT:mqtt_userName homeassistant
mqtt_pass homeassistantt
mqtt_clientID viktak/spiti/obkD734D40B
mqtt_host 192.168.123.42:1883
Info:MAIN:Time 6, idle 101883/s, free 73176, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:MQTT:mqtt_connection_cb: Successfully connected
Info:MQTT:mqtt_subscribed to viktak/spiti/obkD734D40B/+/set
Info:MQTT:mqtt_subscribed to bekens_n/+/set
Info:MQTT:mqtt_subscribed to cmnd/viktak/spiti/obkD734D40B/+
Info:MQTT:mqtt_subscribed to cmnd/bekens_n/+
Info:MQTT:mqtt_subscribed to viktak/spiti/obkD734D40B/+/get
Info:TuyaMCU:Received: 55 AA 00 02 00 00 01
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 2 (MCUconf) len 7
Info:TuyaMCU:ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:MQTT:Publishing val obkD734D40B to viktak/spiti/obkD734D40B/host retain=0
Info:MAIN:Time 7, idle 171985/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val OpenBK7231N 1.17.798 Dec 10 2024 16:02:12 to viktak/spiti/obkD734D40B/build retain=0
Info:MAIN:Time 8, idle 360254/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val fc:3c:d7:34:d4:0b to viktak/spiti/obkD734D40B/mac retain=0
Info:MAIN:Time 9, idle 188525/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:Received: 55 AA 00 02 00 00 01
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 2 (MCUconf) len 7
Info:TuyaMCU:ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:TuyaMCU:Received: 55 AA 00 08 00 0C 00 02 02 02 02 02 02 01 04 00 01 01 26
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 8 (QueryState) len 19
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: processing id 1, dataType 4-enum and 1 data bytes
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: byte 1
Info:MQTT:Publishing val 34.46 to viktak/spiti/obkD734D40B/temp retain=0
Info:MAIN:Time 10, idle 373905/s, free 73160, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:GEN:dhcp=0 ip=192.168.123.138 gate=192.168.123.6 mask=255.255.255.0 mac=fc:3c:d7:34:d4:0b
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-58,ssid=MYSSID,bssid=64:64:4a:e2:df:96,channel=2,cipher_type:CCMP
Info:TuyaMCU:Received: 55 AA 00 05 00 05 03 04 00 01 02 13
Info:TuyaMCU:ProcessIncoming[v=0]: cmd 5 (WiFiSelect) len 12
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: processing id 3, dataType 4-enum and 1 data bytes
Info:TuyaMCU:V0_ParseRealTimeWithRecordStorage: byte 2
Info:MQTT:Publishing val MYSSID to viktak/spiti/obkD734D40B/ssid retain=0
Info:MAIN:Time 11, idle 181529/s, free 73160, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val 2 to viktak/spiti/obkD734D40B/sockets retain=0
Info:MAIN:Time 12, idle 191192/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MQTT:Publishing val -58 to viktak/spiti/obkD734D40B/rssi retain=0
Info:MAIN:Time 13, idle 188435/s, free 73408, MQTT 1(1), bWifi 1, secondsWithNo▒UUDD▒
  • #19 21346841
    spin55
    Level 17  
    It's working fine.

    55 AA 00 05 00 05 03 04 00 01 02 13

    You already have the DPId of the battery.
    Dp: 03
    Enum type: 04
    Value: 02 (0,1,2)

    Motion detector DP missing

    Do movement tests by monitoring pin 11.

    When you have the DP, you will have to complete autoexec.bat.
  • #20 21346871
    vitya123
    Level 6  
    Pin 11 is the UART (monitoring). Do you mean I should see something there during the motion test? I tried it, but any movement has zero effect on it. It keeps restarting, and now it restarts in a few seconds even if I press the button.... I fear that the SOIC chip is gone...
  • #21 21346874
    spin55
    Level 17  
    Can you take a photo of the plate as it is?

    I don't think the SOIC Tuya is wrong

    Added after 12 [minutes]:

    You can also try this autoexec.bat:

    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU
startDriver tmSensor
setChannelType 1 readonly
//Link dpid to channel 1
linkTuyaMCUOutputToChannel 1 val 1
setChannelType 3 readonly
///Link dpid to channel 3
linkTuyaMCUOutputToChannel 3 val 3
SetChannel 1 2


    Let's see if we're lucky and motion DP is 01.

    After remove all cables except pin 11 for monitoring. Power the device with 3 volts or batteries.

    Added after 9 [minutes]:

    This shows that SOIC is not bad:

    Info:TuyaMCU:Received: 55 AA 00 05 00 05 03 04 00 01 02 13
  • #22 21346918
    vitya123
    Level 6  
    OK, here is a pic of the current setup:
    Close-up of a circuit board with soldered wires and a module labeled CB3S.
    You can see that the thing is powered from the battery terminals. There are wires soldered on each UART line, but only the white one spits out useful info.

    I updated the autoexec.bat file.

    Aaaaaaa and it is working!!!! When I activate it with some movement, it publishes a 0/1 in the get topic:
    Screenshot of diagnostic data from OpenBK7231N device.

    Excellent!!!! Thank you for sticking with me - even after I lost hope :)

    I documented every step of the way - so in a few days I will write a guide in the new hardware topic.

    Thank you again!!!
  • Helpful post
    #23 21346925
    spin55
    Level 17  
    May you enjoy it!.
Reply | New topic
Report a violation of the law

Topic summary

✨ Użytkownik ma problemy z resetowaniem czujnika PIR Tuya opartego na układzie BK7231N, nie mogąc go zaprogramować ani zaktualizować oprogramowania. Po usunięciu układu SOIC udało mu się wykonać kopię zapasową i wgrać OpenBK, ale urządzenie wchodzi w pętlę rozruchową. Użytkownicy sugerują, że czujnik może być kontrolowany przez chip TuyaMCU, który zarządza zasilaniem modułu Wi-Fi, co może powodować problemy z konfiguracją. Po dalszym badaniu, użytkownik odkrył, że podłączenie zasilania i GND bezpośrednio do MCU pozwala na kontynuację konfiguracji. Udało mu się skonfigurować urządzenie, które teraz poprawnie reaguje na ruch.
Generated by the language model.
Today's popular

FAQ

TL;DR: A 2 MB backup and one clue — “It’s working fine” — solved this BK7231N Tuya PIR case. This FAQ is for people converting CB3S battery PIR sensors that reset during flashing or OpenBK setup: the blocker was not CEN, but a TuyaMCU design that held RX/TX busy and switched the module’s ground path, so stable setup required isolating or bypassing that control path first. [#21346918]

Why it matters: If you treat a TuyaMCU PIR like a normal GPIO-based BK7231N sensor, flashing may work, but configuration, packet mapping, and wake timing will fail.

Method Works for flashing Main risk Best use
Remove SOIC-8 MCU Yes Rework damage Fast confirmation that RX/TX are blocked
Desolder CB3S module Yes Harder reassembly Cleanest off-board flashing
Cut RX/TX traces Sometimes Trace repair later Good when pads or series resistors are accessible
Leave it fully in-circuit No, not reliably TuyaMCU holds UART/power logic Only for packet capture after setup

Key insight: The sensor was not failing to reset. It was resetting correctly, but the external TuyaMCU still controlled communication and sleep behavior. The successful fix was to bypass the switched ground path, then map TuyaMCU DPIDs in OpenBeken.

Quick Facts

  • The factory firmware exposed a BK7231N boot log, jumped to 0x10000, and reported firmware v1: 2.1.8 with a Tuya product key already stored in flash. [#21345017]
  • The working recovery path included a full 2 MB flash backup before conversion, because the factory config could not be meaningfully extracted by the flasher. [#21346222]
  • OpenBK stayed awake only about 8–9 seconds normally, but repeated button action stretched that to about 18 seconds, which was still barely enough for setup. [#21346469]
  • The PIR trigger node measured about 0 V idle and rose to about 3 V on motion, yet no CB3S GPIO changed state directly, showing the external MCU handled sensing logic. [#21346532]
  • TuyaMCU traffic was confirmed on UART after setup, including 55 AA frames and a battery datapoint on DPID 3 with enum value 2. [#21346841]

Why does a Tuya PIR sensor with a BK7231N/CB3S module fail to enter flashing mode even though pulling CEN or power cycling clearly resets it?

It fails because reset is not the only requirement. In this case, the CB3S did reset, but RX and TX were still tied to an external SOIC-8 controller, so BK7231Flasher could not get the bus even after CEN or power cycling. The user confirmed reset only after watching a second UART while flashing. That means the problem was in-circuit control, not a dead reset pin. [#21345017]

How can I confirm that a Tuya PIR sensor is a TuyaMCU design when the CB3S RX/TX lines appear to go to a separate SOIC-8 chip?

Check continuity from CB3S RX and TX to the SOIC-8 pins with a multimeter. In this thread, that layout strongly indicated a TuyaMCU design, because the Wi-Fi module UART connected to a separate controller instead of directly handling the PIR input. Later UART logs confirmed Tuya-style 55 AA packets, which is the decisive sign. [#21345880]

What is TuyaMCU, and how does it change the way a BK7231N-based sensor has to be flashed and configured?

TuyaMCU is a secondary controller that handles device logic, power behavior, and datapoint exchange over UART, while the BK7231N or CB3S mainly provides Wi-Fi. That changes everything: you must isolate the UART for flashing, then run OpenBeken with TuyaMCU and often tmSensor so the Wi-Fi module can parse datapoints instead of reading GPIOs directly. [#21346704]

What is a DPID in TuyaMCU communication, and how do I identify the motion and battery DPIDs from UART logs?

A DPID is Tuya’s datapoint identifier, used inside 55 AA UART frames to label values such as motion or battery state. In this case, the battery datapoint was identified as DPID 3, enum type 4, value 2 from the frame 55 AA 00 05 00 05 03 04 00 01 02 13. Motion was found by enabling channel mapping and then triggering the PIR until a 0/1 update appeared. [#21346841]

Which approach works best for flashing a TuyaMCU device in circuit: removing the SOIC-8 MCU, desoldering the CB3S Wi-Fi module, or cutting the RX/TX traces?

Removing the blocking part is the most reliable approach. The thread listed three workable options: desolder the SOIC-8 MCU, desolder the CB3S module, or cut the RX/TX traces and restore them later. The user succeeded after removing the SOIC-8 chip first, which immediately allowed backup and OpenBK flashing. [#21346222]

How do I capture TuyaMCU packets from a CB3S-based PIR sensor before converting it to OpenBK/OpenBeken?

Use the stock wiring long enough to watch the UART exchange. 1. Connect a USB-UART receiver to the CB3S monitoring pin. 2. Power the device normally from batteries or the board supply. 3. Log the 55 AA frames before replacing the firmware, because they reveal product info and datapoints. A moderator explicitly recommended packet capture before conversion for smoother setup. [#21345880]

What causes OpenBK on a battery-powered Tuya PIR sensor to boot, create an AP for a few seconds, and then reset repeatedly?

The external MCU is forcing low-power behavior. The OpenBK log showed the AP came up, but the board restarted after roughly 5 to 9 seconds, and the user could see the SSID only briefly. On this class of battery PIR, the TuyaMCU decides when the Wi-Fi section sleeps, so direct flashing alone does not remove the aggressive wake timer. [#21346358]

How can I keep a BK7231N Tuya PIR sensor online long enough to configure OpenBK if the external MCU quickly powers it down?

Bypass the MCU’s power-control path and feed the module directly on both rails. The key finding was that this board did not switch 3.3 V to the CB3S; it switched the ground path. Once power and ground were connected directly to the module, the CB3S stayed on long enough for normal configuration. Before that, repeated button presses only extended uptime to about 18 seconds. [#21346532]

Why would a Tuya PIR board switch the ground path to the CB3S module instead of switching its 3.3 V supply, and how do I verify that with measurements?

It uses ground switching because the external controller can still gate the module without interrupting the board’s main supply rail. Verification is simple: measure the suspected control transistor and module rails while powering the board. In this case, 3.3 V stayed present, but the module only stayed alive after the user tied both power and ground directly to the CB3S, proving the ground path was switched. [#21346532]

How do I wire power and UART correctly when bypassing the Tuya power-control circuit on a CB3S PIR sensor for setup and debugging?

Wire both supply rails and keep UART only for observation or TuyaMCU traffic. 1. Feed the board or module with about 3 V from the battery terminals or a stable lab source. 2. Bypass the switched ground so CB3S gets direct VCC and GND. 3. Leave RX/TX connected only as needed, and monitor the useful line on CB3S pin 11. That setup produced stable logs and later valid TuyaMCU frames. [#21346918]

What should I put into OpenBeken autoexec.bat to start TuyaMCU and tmSensor on a Tuya PIR sensor and map its datapoints to channels?

Use a minimal script that starts both drivers and links channels to DPIDs. The working version in the thread used startDriver TuyaMCU, startDriver tmSensor, setChannelType 1 readonly, linkTuyaMCUOutputToChannel 1 val 1, setChannelType 3 readonly, linkTuyaMCUOutputToChannel 3 val 3, and SetChannel 1 2. That mapping made motion publish 0/1 and exposed the battery datapoint. [#21346874]

How can I monitor pin 11 or the UART lines on a CB3S module to see whether TuyaMCU frames such as 55 AA packets are being exchanged?

Connect the USB-UART receiver to CB3S pin 11 and reboot the device. That line produced readable boot and runtime logs in this case, including OpenBK startup and later TuyaMCU frames like 55 AA 00 01 and 55 AA 00 05. When the user watched the wrong line, it appeared idle high and looked dead, so pin selection mattered. [#21346794]

Why does motion on some Tuya PIR sensors not directly toggle any CB3S GPIO pin and instead get handled entirely by the external TuyaMCU chip?

Because the PIR front end is wired to the external controller, not to a BK7231N GPIO. The user found a node near R14 / PA5 that sat at GND normally and rose to about 3 V on motion, yet none of the MCU pins changed state. That showed the external chip read the PIR event and only forwarded a logical datapoint over UART. [#21346532]

What’s the difference between a standalone BK7231N GPIO-based PIR sensor and a TuyaMCU-controlled PIR sensor when converting them to OpenBK?

A standalone GPIO PIR lets OpenBK read motion directly from a pin. A TuyaMCU PIR does not. Here, the CB3S needed UART drivers and DPID mapping, because motion and battery came from serial frames instead of GPIO edges. The successful result was MQTT publishing a motion 0/1 on the get topic, not raw pin state reading. [#21346918]

What’s the best way to put a battery-powered Tuya PIR sensor into pairing or long-awake mode so there is enough time to join Wi-Fi and finish configuration?

Exploit the brief wake window, then bypass it if needed. In the thread, repeated presses on the pairing button every few seconds kept the MCU awake longer, and some tries stretched the online period from about 8–9 seconds to about 18 seconds. That was enough to join Wi-Fi once, but the durable fix was direct module power and ground bypass so setup no longer depended on button timing. [#21346496]
Generated by the language model.
ADVERTISEMENT