logo elektroda
logo elektroda
X
logo elektroda

Exploring Tuya WiFi 24G MmWave Radar Sensor: PCB, Chips, and Features

peter_v 1083 15
ADVERTISEMENT
  • Helpful post
    #1 21457747
    peter_v
    Level 3  
    Bought "Tuya WiFi 24G MmWave Radar Smart Human Presence With Illumination Detector Support Light Switch 95~250V" from:

    https://vi.aliexpress.com/item/1005008058620784.html

    The package is very non descript, but it's the Ø 60mm x 28.5mm model. It's flatter than other presence sensors and contains also a switch. The pcb board name is nas-ps10w6-mos-v 2024.09.25.

    Tuya ceiling sensor with Wi-Fi support

    Package:

    Package of Neo WiFi presence sensor with informational labels.

    The bk7231n is on board, so no module transplant possible.. But the triac BTB24-800BWRG keeps me hoping for light dimming possibility :)
    https://www.st.com/resource/en/datasheet/bta24.pdf

    The two other identifiable chips on board are:

    UMW MOC3020, an Random-Phase Triac Driver Output Optocoupler
    https://www.micros.com.pl/mediaserver/ORMOC3023_UMW_0001.pdf

    KP3210BSGA, an High Performance Low Cost Off-line PWM Power Switch
    https://www.lcsc.com/datasheet/lcsc_datasheet...91005_Kiwi-Instruments-KP3210BSGA_C554027.pdf

    Photos of the PCB board:

    Printed circuit board with electronic components, including LEDs and integrated circuits.
    Electronic module with green connector and various components.

    I didn't do any pairing, just powered it on and the wifi name was "SmartLife-D32C".
    After soldering TX0, RX0, GND and 33V I was able to dump the flash (attached below).

    Output from analyzing the dump with ltchiptool:
    Quote:

    W: Block by ID 8 does not exist, returning empty
    I: UPK: Found BK7231N config!
    I: UPK: Found TuyaMCU device
    W: No schema model for TuyaMCU - can't process datapoints
    esphome:
    name: upk2esphome-bk7231n

    bk72xx:
    board: generic-bk7231n-qfn32-tuya

    logger:

    web_server:

    captive_portal:

    mdns:

    api:
    password: ""

    ota:
    platform: esphome
    password: ""

    wifi:
    ssid: !secret wifi_ssid
    password: !secret wifi_password
    ap:

    text_sensor:
    - platform: libretiny
    version:
    name: LibreTiny Version

    uart:
    rx_pin: RX1
    tx_pin: TX1
    baud_rate: 9600

    tuya:


    Could someone please guide me through next steps to openbekenize, esphomeize or in some other way to detasmonize ;) this sensor??

    (edit: attachment reupload)
    (edit: package with manufacturer photo)
  • ADVERTISEMENT
  • #2 21457761
    p.kaczmarek2
    Moderator Smart Home
    Thank you for sharing this interesting device! I haven't seen that kind of sensor yet.

    From a brief glance, it looks like it might be a TuyaMCU device, so I would suggest starting with TuyaMCU guide:
    TuyaMCU flashing, setup and configuration guide - configure dpIDs for Home Assistant
    We could use TuyaMCU analyzer to get dpID meanings, but maybe it would be safer to use API method:
    Extracting DpIDs for TUYA MCU devices
    Then we can help you with autoexec.bat setup.

    I think also @divadiow might know something more about this device.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #4 21457922
    ferbulous
    Level 18  
    Looks like ld2410c, can you use the ld2410 component in the yaml?
  • ADVERTISEMENT
  • #6 21458009
    p.kaczmarek2
    Moderator Smart Home
    I would love to add a driver for this chip! Protocol is known. Can you help testing?

    The attachment in the first post didn't load correctly. Can you delete it and upload again?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #7 21458022
    peter_v
    Level 3  
    p.kaczmarek2 wrote:
    I would love to add a driver for this chip! Protocol is known. Can you help testing?

    The attachment in the first post didn't load correctly. Can you delete it and upload again?


    Still no luck with the upload, even zip compressed dump didn't go through.. But fixed with temporary external upload..

    No, no, You are helping me :-) So I'm absolutely glad to do testing. My next step would be to debug serial communication, just not sure if it would be possible with power from the red ttl/usb thingy..
  • Helpful post
    #8 21458036
    divadiow
    Level 34  
    The PCB colour, typeface of markings, layout of test pads, general style and the "NAS-" prefix to the main PCB marking makes me wonder if it's a WENZHOU NOVA NEW ENERGY CO.,LTD product, like seen here: https://www.elektroda.com/rtvforum/topic4106753.html

    Close-up of a circuit board with electronic components.

    If you have the packaging does it have a sticker label with details like this:
    Address label on product packaging with manufacturer and European distributor information.

    Added after 14 [minutes]:

    boot log through to paired status with Tuya. MCU simulator used

    Code: Text
    Log in, to see the code


    Tuya app experience:
    Screenshot of a smart home management app with a message about adding a device. App screen showing added presence sensor. Presence sensor app screen. Presence sensor settings screen with various options and values. Device update screen showing no updates available.

    Added after 8 [minutes]:

    dev site:
    Code: Text
    Log in, to see the code
    =
    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    which tidies to:

    Code: JSON
    Log in, to see the code
  • #9 21458097
    peter_v
    Level 3  
    WOW, I'm astonished what you were able to do with only the fw dump..

    divadiow wrote:
    The PCB colour, typeface of markings, layout of test pads, general style and the "NAS-" prefix to the main PCB marking makes me wonder if it's a WENZHOU NOVA NEW ENERGY CO.,LTD product, like seen here: https://www.elektroda.com/rtvforum/topic4106753.html


    I think you are right, the PCB looks to be the same style.. Will check the package in the evening.
  • #10 21458153
    p.kaczmarek2
    Moderator Smart Home
    Good job @divadiow . Well... it seems I was partially wrong:
    p.kaczmarek2 wrote:
    I would love to add a driver for this chip! Protocol is known. Can you help testing?

    Since it's TuyaMCU, it's already supported, we don't need to interface that chip directly... just use TuyaMCU.

    We can start working on autoexec.bat now I guess?
    Helpful post? Buy me a coffee.
  • #11 21459324
    peter_v
    Level 3  
    I flashed the device with OpenBK7231N_QIO_1.18.48.bin using ltchiptool.

    The device booted probably ok, because I can see a new wifi ap, but after connecting to it, I wasn't able to open the configuration interface. All I got was connection refused or site not available status. I tried even connecting directly to 192.168.4.1 and 192.168.4.100, still no luck..

    The device seems to be doing something ;) and after a while begins cycling to on/off the output.

    Could you please tell me, what I'm doing wrong?
  • #13 21463578
    peter_v
    Level 3  
    p.kaczmarek2 wrote:
    Take debug log out of the TX2 pin.


    Connected to TXD1 pad on PCB and the log seemed to be ok.. Turns out, my phone wasn't able to open the page, when switched to PC, it opened fine.. More wasted time..

    Thanks to @divadiow 's json dump (took me quite a while to realize what it contained ;) ) I was able to write this (beta version) autoexec.bat:

    
    startDriver TuyaMCU
    tuyaMcu_defWiFiState 4
    
    setChannelType 1 ReadOnly
    setChannelLabel 1 "Presence State"
    linkTuyaMCUOutputToChannel 1 val 1
    
    setChannelType 2 Toggle
    setChannelLabel 2 "Auto"
    linkTuyaMCUOutputToChannel 101 val 2
    //linkTuyaMCUOutputToChannel 101 enum 2
    //?? setChannelEnum 2 1:Auto 0:Manual 
    
    setChannelType 3 ReadOnly
    setChannelLabel 3 "Human Motion State"
    linkTuyaMCUOutputToChannel 102 val 3
    //linkTuyaMCUOutputToChannel 102 enum 3
    //?? setChannelEnum 3 0:none 1:small_move 2:large_move
    
    setChannelType 4 Default
    setChannelLabel 4 "Presence Hold Time"
    linkTuyaMCUOutputToChannel 103 val 4
    // default to 10 seconds
    SetStartValue 4 10
    
    setChannelType 5 Default
    setChannelLabel 5 "Motion Detection Max Distance"
    linkTuyaMCUOutputToChannel 104 val 5
    
    setChannelType 6 Default
    setChannelLabel 6 "Motion Detection Sensitivity"
    linkTuyaMCUOutputToChannel 105 val 6
    
    setChannelType 7 Default
    setChannelLabel 7 "Micro Motion Detection Sensitivity"
    linkTuyaMCUOutputToChannel 106 val 7
    
    setChannelType 8 Default
    setChannelLabel 8 "Current Distance"
    linkTuyaMCUOutputToChannel 107 val 8
    
    setChannelType 9 Default
    setChannelLabel 9 "Lux Value"
    linkTuyaMCUOutputToChannel 108 val 9
    
    setChannelType 10 Default
    setChannelLabel 10 "Output Duration"
    linkTuyaMCUOutputToChannel 109 val 10
    // default to 10 seconds
    SetStartValue 11 10
    
    setChannelType 11 Toggle
    setChannelLabel 11 "Switch"
    linkTuyaMCUOutputToChannel 110 bool 11
    // default to OFF
    SetStartValue 11 0
    
    setChannelType 12 Toggle
    setChannelLabel 12 "Status Indicator Light"
    linkTuyaMCUOutputToChannel 111 bool 12
    // default to OFF
    SetStartValue 12 0
    


    BUT:
    1.) It seems that the "SetStartValue 12 0" is ignored (probably also for other channels).
    2.) setChannelEnum is contrary to documentation not supported (is disabled in OBK source code).
    3.) I wasn't able to represent channels as sliders with defined range and stepping in interface.

    And if I'm not mistaken, the fact that this module is TuyaMCU, there is no way to use the onboard triac to implement dimming..
  • #14 21470593
    divadiow
    Level 34  
    peter_v wrote:
    And if I'm not mistaken, the fact that this module is TuyaMCU, there is no way to use the onboard triac to implement dimming..

    I think you'll be at the mercy of the TuyaMCU for everything. Did you get any further?

    In the meantime, I've had this arrive. A little different.
    Close-up of an electronic module with a label showing model WBR3 and a QR code. GigaDevice microchip on a green circuit board with markings GD32E230F8P6TR ARM. Electronic module with visible components on a printed circuit board.
  • #15 21470625
    peter_v
    Level 3  
    Thanks for checking on me :)

    divadiow wrote:
    I think you'll be at the mercy of the TuyaMCU for everything.

    A bit disappointing, that there is a triac that I can't use for dimming and a lux sensor I can't read light levels from..

    divadiow wrote:
    Did you get any further?

    I stumbled upon the "httpButtons" driver, so I started to design a custom interface for the module, but I got busy with other things..

    divadiow wrote:

    In the meantime, I've had this arrive. A little different.
    Close-up of an electronic module with a label showing model WBR3 and a QR code. GigaDevice microchip on a green circuit board with markings GD32E230F8P6TR ARM. Electronic module with visible components on a printed circuit board.


    :D To be frank, there is already another presence sensor on my desk also.. And it seems to be using the same radar module as you have, on mine is "ZY-M100", but equal otherwise, even the pinout is the same.. It seems to be a common tuya component:

    https://smarthomescene.com/reviews/tuya-zigbee-human-presence-sensor-zy-m100-review/

    Are you going to reflash it?
  • #16 21549634
    przemsi_ele
    Level 11  
    I'm trying to guess, but I don't know if it works at all

    this will be apply to TuyaMCU

    setChannelType 55 LedIncandescentHalogen - i know ther is no such of thing
    setChannelEnum 55 0:Led 1:Incandescent 2:Halogen - how can i add tihs ?

    or maybe with comma
    SetChannelEnum    [ChannelIndex][Value,Title][Value,Title]


    the same situation with dpId 47 :
    "range": ["flip","sync","button"]

    @peter_v wrote
    peter_v wrote:
    2.) setChannelEnum is contrary to documentation not supported (is disabled in OBK source code).

Topic summary

The discussion centers on the Tuya WiFi 24G MmWave Radar Smart Human Presence sensor with illumination detection and integrated light switch, specifically the Ø60mm x 28.5mm model featuring a BK7231N SoC and triac BTB24-800BWRG for potential light dimming. The PCB is marked nas-ps10w6-mos-v 2024.09.25. Additional onboard components include the UMW MOC3020 random-phase triac driver optocoupler and KP3210BSGA off-line PWM power switch. The device appears to be a TuyaMCU-based product, likely from Wenzhou Nova New Energy Co., Ltd., sharing PCB style and boot logs consistent with Tuya firmware. Attempts to reflash with OpenBK7231N firmware yielded a WiFi access point but no accessible configuration interface, suggesting the need for proper serial debugging and use of TuyaMCU drivers. An autoexec.bat script was developed to map TuyaMCU datapoints (dpIDs) to channels for presence state, human motion, and hold time, enabling integration with Home Assistant. The triac and lux sensor functionalities remain inaccessible via standard interfaces, limiting dimming and illumination reading capabilities. A similar device using the ZY-M100 radar module was noted, indicating commonality in Tuya presence sensors. The community discussed using TuyaMCU analyzers and API methods to extract dpIDs and configure the device, with ongoing efforts to improve firmware support and custom interfaces.
Summary generated by the language model.
ADVERTISEMENT