logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Exploring Tuya WiFi 24G MmWave Radar Sensor: PCB, Chips, and Features

peter_v 3819 15
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • Helpful post
    #1 21457747
    peter_v
    Level 3  
    Posts: 7
    Help: 1
    Rate: 1
    Bought "Tuya WiFi 24G MmWave Radar Smart Human Presence With Illumination Detector Support Light Switch 95~250V" from:

    https://vi.aliexpress.com/item/1005008058620784.html

    The package is very non descript, but it's the Ø 60mm x 28.5mm model. It's flatter than other presence sensors and contains also a switch. The pcb board name is nas-ps10w6-mos-v 2024.09.25.

    Tuya ceiling sensor with Wi-Fi support

    Package:

    Package of Neo WiFi presence sensor with informational labels.

    The bk7231n is on board, so no module transplant possible.. But the triac BTB24-800BWRG keeps me hoping for light dimming possibility :)
    https://www.st.com/resource/en/datasheet/bta24.pdf

    The two other identifiable chips on board are:

    UMW MOC3020, an Random-Phase Triac Driver Output Optocoupler
    https://www.micros.com.pl/mediaserver/ORMOC3023_UMW_0001.pdf

    KP3210BSGA, an High Performance Low Cost Off-line PWM Power Switch
    https://www.lcsc.com/datasheet/lcsc_datasheet...91005_Kiwi-Instruments-KP3210BSGA_C554027.pdf

    Photos of the PCB board:

    Printed circuit board with electronic components, including LEDs and integrated circuits.
    Electronic module with green connector and various components.

    I didn't do any pairing, just powered it on and the wifi name was "SmartLife-D32C".
    After soldering TX0, RX0, GND and 33V I was able to dump the flash (attached below).

    Output from analyzing the dump with ltchiptool:
    Quote:

    W: Block by ID 8 does not exist, returning empty
    I: UPK: Found BK7231N config!
    I: UPK: Found TuyaMCU device
    W: No schema model for TuyaMCU - can't process datapoints
    esphome:
    name: upk2esphome-bk7231n

    bk72xx:
    board: generic-bk7231n-qfn32-tuya

    logger:

    web_server:

    captive_portal:

    mdns:

    api:
    password: ""

    ota:
    platform: esphome
    password: ""

    wifi:
    ssid: !secret wifi_ssid
    password: !secret wifi_password
    ap:

    text_sensor:
    - platform: libretiny
    version:
    name: LibreTiny Version

    uart:
    rx_pin: RX1
    tx_pin: TX1
    baud_rate: 9600

    tuya:


    Could someone please guide me through next steps to openbekenize, esphomeize or in some other way to detasmonize ;) this sensor??

    (edit: attachment reupload)
    (edit: package with manufacturer photo)
    Attachments:
    • dump1.img.gz (1.3 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #2 21457761
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    Thank you for sharing this interesting device! I haven't seen that kind of sensor yet.

    From a brief glance, it looks like it might be a TuyaMCU device, so I would suggest starting with TuyaMCU guide:
    TuyaMCU flashing, setup and configuration guide - configure dpIDs for Home Assistant
    We could use TuyaMCU analyzer to get dpID meanings, but maybe it would be safer to use API method:
    Extracting DpIDs for TUYA MCU devices
    Then we can help you with autoexec.bat setup.

    I think also @divadiow might know something more about this device.
    Helpful post? Buy me a coffee.
  • #3 21457868
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    Quote:
    I think also @divadiow might know something more about this device.


    I don't think I do :)
    I have yet to get a presence sensor, though this is in the post:
    ZigBee Wifi MmWave motion detector with USB cable.

    I could find out more but the download just takes me to this
    Screenshot of the elektroda.com website with a navigation bar and information section.

    I do recognise that blue PCB though from Ali https://www.aliexpress.com/item/1005007765988010.html

    Hi-Link HLK-LD2410C https://www.hlktech.net/index.php?id=1095
  • #4 21457922
    ferbulous
    Level 18  
    Posts: 419
    Help: 8
    Rate: 56
    Looks like ld2410c, can you use the ld2410 component in the yaml?
  • ADVERTISEMENT
  • #6 21458009
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    I would love to add a driver for this chip! Protocol is known. Can you help testing?

    The attachment in the first post didn't load correctly. Can you delete it and upload again?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #7 21458022
    peter_v
    Level 3  
    Posts: 7
    Help: 1
    Rate: 1
    p.kaczmarek2 wrote:
    I would love to add a driver for this chip! Protocol is known. Can you help testing?

    The attachment in the first post didn't load correctly. Can you delete it and upload again?


    Still no luck with the upload, even zip compressed dump didn't go through.. But fixed with temporary external upload..

    No, no, You are helping me :-) So I'm absolutely glad to do testing. My next step would be to debug serial communication, just not sure if it would be possible with power from the red ttl/usb thingy..
  • Helpful post
    #8 21458036
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    The PCB colour, typeface of markings, layout of test pads, general style and the "NAS-" prefix to the main PCB marking makes me wonder if it's a WENZHOU NOVA NEW ENERGY CO.,LTD product, like seen here: https://www.elektroda.com/rtvforum/topic4106753.html

    Close-up of a circuit board with electronic components.

    If you have the packaging does it have a sticker label with details like this:
    Address label on product packaging with manufacturer and European distributor information.

    Added after 14 [minutes]:

    boot log through to paired status with Tuya. MCU simulator used

    Code: Text
    Log in, to see the code


    Tuya app experience:
    Screenshot of a smart home management app with a message about adding a device. App screen showing added presence sensor. Presence sensor app screen. Presence sensor settings screen with various options and values. Device update screen showing no updates available.

    Added after 8 [minutes]:

    dev site:
    Code: Text
    Log in, to see the code
    =
    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code


    which tidies to:

    Code: JSON
    Log in, to see the code
  • #9 21458097
    peter_v
    Level 3  
    Posts: 7
    Help: 1
    Rate: 1
    WOW, I'm astonished what you were able to do with only the fw dump..

    divadiow wrote:
    The PCB colour, typeface of markings, layout of test pads, general style and the "NAS-" prefix to the main PCB marking makes me wonder if it's a WENZHOU NOVA NEW ENERGY CO.,LTD product, like seen here: https://www.elektroda.com/rtvforum/topic4106753.html


    I think you are right, the PCB looks to be the same style.. Will check the package in the evening.
  • #10 21458153
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    Good job @divadiow . Well... it seems I was partially wrong:
    p.kaczmarek2 wrote:
    I would love to add a driver for this chip! Protocol is known. Can you help testing?

    Since it's TuyaMCU, it's already supported, we don't need to interface that chip directly... just use TuyaMCU.

    We can start working on autoexec.bat now I guess?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #11 21459324
    peter_v
    Level 3  
    Posts: 7
    Help: 1
    Rate: 1
    I flashed the device with OpenBK7231N_QIO_1.18.48.bin using ltchiptool.

    The device booted probably ok, because I can see a new wifi ap, but after connecting to it, I wasn't able to open the configuration interface. All I got was connection refused or site not available status. I tried even connecting directly to 192.168.4.1 and 192.168.4.100, still no luck..

    The device seems to be doing something ;) and after a while begins cycling to on/off the output.

    Could you please tell me, what I'm doing wrong?
  • #12 21459450
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    Take debug log out of the TX2 pin.
    Helpful post? Buy me a coffee.
  • #13 21463578
    peter_v
    Level 3  
    Posts: 7
    Help: 1
    Rate: 1
    p.kaczmarek2 wrote:
    Take debug log out of the TX2 pin.


    Connected to TXD1 pad on PCB and the log seemed to be ok.. Turns out, my phone wasn't able to open the page, when switched to PC, it opened fine.. More wasted time..

    Thanks to @divadiow 's json dump (took me quite a while to realize what it contained ;) ) I was able to write this (beta version) autoexec.bat:

    Code: text Expand Select all Copy to clipboard
    
startDriver TuyaMCU
tuyaMcu_defWiFiState 4

setChannelType 1 ReadOnly
setChannelLabel 1 "Presence State"
linkTuyaMCUOutputToChannel 1 val 1

setChannelType 2 Toggle
setChannelLabel 2 "Auto"
linkTuyaMCUOutputToChannel 101 val 2
//linkTuyaMCUOutputToChannel 101 enum 2
//?? setChannelEnum 2 1:Auto 0:Manual 

setChannelType 3 ReadOnly
setChannelLabel 3 "Human Motion State"
linkTuyaMCUOutputToChannel 102 val 3
//linkTuyaMCUOutputToChannel 102 enum 3
//?? setChannelEnum 3 0:none 1:small_move 2:large_move

setChannelType 4 Default
setChannelLabel 4 "Presence Hold Time"
linkTuyaMCUOutputToChannel 103 val 4
// default to 10 seconds
SetStartValue 4 10

setChannelType 5 Default
setChannelLabel 5 "Motion Detection Max Distance"
linkTuyaMCUOutputToChannel 104 val 5

setChannelType 6 Default
setChannelLabel 6 "Motion Detection Sensitivity"
linkTuyaMCUOutputToChannel 105 val 6

setChannelType 7 Default
setChannelLabel 7 "Micro Motion Detection Sensitivity"
linkTuyaMCUOutputToChannel 106 val 7

setChannelType 8 Default
setChannelLabel 8 "Current Distance"
linkTuyaMCUOutputToChannel 107 val 8

setChannelType 9 Default
setChannelLabel 9 "Lux Value"
linkTuyaMCUOutputToChannel 108 val 9

setChannelType 10 Default
setChannelLabel 10 "Output Duration"
linkTuyaMCUOutputToChannel 109 val 10
// default to 10 seconds
SetStartValue 11 10

setChannelType 11 Toggle
setChannelLabel 11 "Switch"
linkTuyaMCUOutputToChannel 110 bool 11
// default to OFF
SetStartValue 11 0

setChannelType 12 Toggle
setChannelLabel 12 "Status Indicator Light"
linkTuyaMCUOutputToChannel 111 bool 12
// default to OFF
SetStartValue 12 0


    BUT:
    1.) It seems that the "SetStartValue 12 0" is ignored (probably also for other channels).
    2.) setChannelEnum is contrary to documentation not supported (is disabled in OBK source code).
    3.) I wasn't able to represent channels as sliders with defined range and stepping in interface.

    And if I'm not mistaken, the fact that this module is TuyaMCU, there is no way to use the onboard triac to implement dimming..
  • #14 21470593
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    peter_v wrote:
    And if I'm not mistaken, the fact that this module is TuyaMCU, there is no way to use the onboard triac to implement dimming..

    I think you'll be at the mercy of the TuyaMCU for everything. Did you get any further?

    In the meantime, I've had this arrive. A little different.
    Close-up of an electronic module with a label showing model WBR3 and a QR code. GigaDevice microchip on a green circuit board with markings GD32E230F8P6TR ARM. Electronic module with visible components on a printed circuit board.
  • #15 21470625
    peter_v
    Level 3  
    Posts: 7
    Help: 1
    Rate: 1
    Thanks for checking on me :)

    divadiow wrote:
    I think you'll be at the mercy of the TuyaMCU for everything.

    A bit disappointing, that there is a triac that I can't use for dimming and a lux sensor I can't read light levels from..

    divadiow wrote:
    Did you get any further?

    I stumbled upon the "httpButtons" driver, so I started to design a custom interface for the module, but I got busy with other things..

    divadiow wrote:

    In the meantime, I've had this arrive. A little different.
    Close-up of an electronic module with a label showing model WBR3 and a QR code. GigaDevice microchip on a green circuit board with markings GD32E230F8P6TR ARM. Electronic module with visible components on a printed circuit board.


    :D To be frank, there is already another presence sensor on my desk also.. And it seems to be using the same radar module as you have, on mine is "ZY-M100", but equal otherwise, even the pinout is the same.. It seems to be a common tuya component:

    https://smarthomescene.com/reviews/tuya-zigbee-human-presence-sensor-zy-m100-review/

    Are you going to reflash it?
  • #16 21549634
    przemsi_ele
    Level 12  
    Posts: 62
    Help: 1
    Rate: 14
    I'm trying to guess, but I don't know if it works at all

    this will be apply to TuyaMCU

    setChannelType 55 LedIncandescentHalogen - i know ther is no such of thing
    setChannelEnum 55 0:Led 1:Incandescent 2:Halogen - how can i add tihs ?

    or maybe with comma
    Code: text Expand Select all Copy to clipboard
    SetChannelEnum    [ChannelIndex][Value,Title][Value,Title]


    the same situation with dpId 47 :
    "range": ["flip","sync","button"]

    @peter_v wrote
    peter_v wrote:
    2.) setChannelEnum is contrary to documentation not supported (is disabled in OBK source code).
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the Tuya WiFi 24G MmWave Radar Smart Human Presence sensor with illumination detection and integrated light switch, specifically the Ø60mm x 28.5mm model featuring a BK7231N SoC and triac BTB24-800BWRG for potential light dimming. The PCB is marked nas-ps10w6-mos-v 2024.09.25. Additional onboard components include the UMW MOC3020 random-phase triac driver optocoupler and KP3210BSGA off-line PWM power switch. The device appears to be a TuyaMCU-based product, likely from Wenzhou Nova New Energy Co., Ltd., sharing PCB style and boot logs consistent with Tuya firmware. Attempts to reflash with OpenBK7231N firmware yielded a WiFi access point but no accessible configuration interface, suggesting the need for proper serial debugging and use of TuyaMCU drivers. An autoexec.bat script was developed to map TuyaMCU datapoints (dpIDs) to channels for presence state, human motion, and hold time, enabling integration with Home Assistant. The triac and lux sensor functionalities remain inaccessible via standard interfaces, limiting dimming and illumination reading capabilities. A similar device using the ZY-M100 radar module was noted, indicating commonality in Tuya presence sensors. The community discussed using TuyaMCU analyzers and API methods to extract dpIDs and configure the device, with ongoing efforts to improve firmware support and custom interfaces.
Generated by the language model.
Today's popular

FAQ

TL;DR: 12 dpIDs are exposed; "Presence PS10 Wi‑Fi Solution" confirms TuyaMCU mapping. Use OpenBeken’s TuyaMCU to map presence, distance, lux, and switch; UART is 9600. Dimming isn’t in the schema. [Elektroda, divadiow, post #21458036]

Why it matters: It shows exactly how to de-Tuya this 24 GHz radar sensor and map functions cleanly for local control.

For: Makers and integrators who want to flash OpenBeken/ESPHome, map TuyaMCU dpIDs, and fix setup issues on BK7231N-based presence sensors.

Quick Facts

What’s inside the Tuya WiFi 24G mmWave presence sensor (PS10)?

It uses a BK7231N SoC on a NAS‑PS10W6‑MOS‑V PCB. Power/control includes KP3210BSGA PSU, MOC3020 optotriac driver, and BTB24‑800BWRG triac. The package is Ø 60 mm × 28.5 mm. It boots broadcasting SmartLife‑D32C without pairing. The board exposes UART pads used for flashing and logs. [Elektroda, peter_v, post #21457747]

Is this a TuyaMCU device and already supported by OpenBeken?

Yes. The firmware identifies as TuyaMCU, so you handle it via the TuyaMCU driver. As one maintainer put it, "Since it's TuyaMCU, it's already supported... just use TuyaMCU." This avoids writing a radar‑module driver and focuses on dpID mapping. [Elektroda, p.kaczmarek2, post #21458153]

What datapoints (dpIDs) does it expose and what do they do?

Schema shows 12 dpIDs: presence_state (1), work_mode (101), human_motion_state (102), presence_time 3–10 s (103), motion_far_detection 150–600 cm in 75 cm steps (104), motion and micro‑motion sensitivities 0–7 (105–106), current distance cm (107), lux thresholds enum (108), output_time 10–1800 s in 10 s steps (109), switch_1 (110), and status LED (111). [Elektroda, divadiow, post #21458036]

Can I use ESPHome’s ld2410 component with this unit?

Use TuyaMCU bridging instead. The device communicates via a TuyaMCU protocol over UART, not a direct LD2410 serial. Configure TuyaMCU in your firmware and map dpIDs to sensors/switches for Home Assistant. "We don’t need to interface that chip directly." [Elektroda, p.kaczmarek2, post #21458153]

How do I flash OpenBeken (OpenBK7231N) and get the web UI?

Use ltchiptool and UART pads to flash OpenBK7231N_QIO_1.18.48.bin. After flashing, power the device and join its AP. Browse the AP gateway UI to configure Wi‑Fi and TuyaMCU mapping.
  1. Flash OpenBK7231N_QIO_1.18.48.bin with ltchiptool.
  2. Connect to the device AP.
  3. Open the config UI and set TuyaMCU. [Elektroda, peter_v, post #21459324]

I can connect to the AP, but the config page won’t load—how do I fix this?

Try a desktop browser. One user could not open the page on a phone, but it opened immediately on a PC. After access, proceed with TuyaMCU mapping and channel setup. This is a known edge case during initial setup. [Elektroda, peter_v, post #21463578]

How do I capture logs or debug output during bring‑up?

Use the TX2 pin for debug logs. Connect a USB‑TTL adapter ground and RX to the device’s TX2, then open a terminal at the configured baud. Logs help diagnose AP/UI issues and TuyaMCU serial mapping problems. [Elektroda, p.kaczmarek2, post #21459450]

Which UART pins and baud rate does TuyaMCU use here?

TuyaMCU runs at 9600 baud on RX1/TX1 according to the extracted config. For flashing or dumping, pads for TX0/RX0, GND, and 3.3 V were used. Keep TX/RX directionality straight when wiring your USB‑TTL adapter. [Elektroda, peter_v, post #21457747]

Can the onboard triac be used for dimming?

Not via the exposed TuyaMCU schema. The device exposes an on/off switch dpID, but no level control dpID for dimming. As noted, "you’ll be at the mercy of the TuyaMCU for everything." That means dimming is unavailable without changing the MCU firmware. [Elektroda, divadiow, post #21470593]

Do I get actual lux values, or only thresholds?

Only thresholds. The schema’s lux_value dpID is an enum with 10Lux, 20Lux, 50Lux, and 24H options. It does not report a numeric lux measurement. Use the enum to gate switching behavior rather than read light levels. [Elektroda, divadiow, post #21458036]

Why doesn’t SetStartValue apply to my TuyaMCU‑linked channels?

SetStartValue can be ignored on channels bound to TuyaMCU dpIDs. The MCU side overwrites initial values when it synchronizes. Map dpIDs first, then adjust via dpID writes to persist behavior. This was observed after creating an autoexec mapping. [Elektroda, peter_v, post #21463578]

Why is setChannelEnum not working even though it’s in docs?

In the referenced OpenBeken build, setChannelEnum was disabled in source. You cannot create enumerated UI controls this way. Use boolean or value channels, or build an HTTP Buttons UI as a workaround. [Elektroda, przemsi_ele, post #21549634]

After flashing, the relay toggles on/off by itself—what’s happening?

This behavior was seen before mapping dpIDs. The device booted, created an AP, and then began cycling the output. Complete TuyaMCU setup and bind the switch dpID to stabilize output control. [Elektroda, peter_v, post #21459324]

Who likely manufactures the NAS‑PS10W6‑MOS‑V board?

Forum analysis links NAS‑prefixed PCBs and styling to WENZHOU NOVA NEW ENERGY CO., LTD. Similar markings and test‑pad layouts match earlier documented boards. Packaging labels can further confirm provenance. [Elektroda, divadiow, post #21458036]

How do I extract dpIDs if I don’t have a model JSON?

Use the TuyaMCU analyzer or Tuya API to derive dpID meanings. Follow the TuyaMCU flashing and configuration guide, then capture serial to map dpIDs to channels. This approach feeds clean entities to Home Assistant. [Elektroda, p.kaczmarek2, post #21457761]

Can I integrate this presence sensor with Home Assistant?

Yes. Configure TuyaMCU in OpenBeken, map dpIDs to channels, and expose them via MQTT or native integrations. The TuyaMCU setup guide includes Home Assistant configuration details for dpIDs. [Elektroda, p.kaczmarek2, post #21457761]
Generated by the language model.
ADVERTISEMENT