logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]

divadiow 393 6
ADVERTISEMENT
Reply | New topic
  • Helpful post
    #1 21505143
    divadiow
    Level 35  
    Here I'll take a quick look inside a LoraTap/Tuya MC100W contact sensor for door/gate/window open/shut monitoring.

    Ali Express purchase
    https://www.aliexpress.com/item/1005007268034863.html
    Promotion for LoraTap WiFi/ZigBee door and window sensors.
    https://www.loratap.com/products/mc100w

    Box, parts, device internals:

    Label of LoraTap WiFi Door Sensor packaging with technical information. LoraTap Wi-Fi door sensor kit on a wooden surface, including a user guide, warranty card, mounting tapes, and a sensor. Two white enclosed devices on a wooden table resembling sensors.Open plastic battery case with a white cover next to it. Electronic module with components on a wooden background Close-up of a digital circuit board with electronic components. Electronic module with components on a printed circuit board Small screwdriver with a transparent orange handle lying on a wooden surface. LoraTap Wi-Fi door sensor kit with user manual and components. MC100W circuit board with buttons labeled KEY and BAT on a blue background.

    Xradiotech (now Allwinner) XR809 on a Tuya XR3 module
    Initial OpenXR809 development can be seen here with another contact sensor https://www.elektroda.com/rtvforum/topic3806769.html

    Electrical schematic of a connector and electronic components

    Electronic module with visible pins and labels on a navy blue background.

    With XR3 module powered directly with 3.3v, the boot log from RXD0 can be captured at 115200 baud

    Code: Text
    Log in, to see the code

    Circuit board with attached wires and a wireless module.

    And using the same process as with this P06 XR3 motion sensor the firmware can be dumped using PhoenixMC, the official UART flash tool.

    With PB02 and PB03 common grounded with 3.3v PSU, USB-TTL GND and XR GND+
    XR3 RXD0 -> USB-TTL RX
    XR3 TXD0 -> USB-TTL TX

    Electronic circuit board with colorful wires on a wooden table.

    we read the 2mb flash to file from the debug menu in PhoenixMC
    PhoenixMC software interface for mass production

    Flash operation program interface.

    output is flash_A_0x0_L_0x200000.bin at 2,097,152 bytes

    Before flashing OpenXR809 I paired it with the Tuya app

    App screen with added contact sensor. App screen showing the status of a contact sensor with low battery and open status. Screenshot showing activity history in an app with an entry labeled Night at 19:48:19, marked as Open. Screenshot of an app settings with options Door Sensor Opened and Door Sensor Closed both activated. Device update screen showing no updates available. App screen showing a contact sensor illustration.



    Device has schema ID: 000001qrb9, firmware key8ky3d8eshuygm and firmware version 1.0.6.

    Easy Flasher can extract some information from the flash dump

    Code: Text
    Log in, to see the code


    Full Tuya config JSON
    Code: JSON
    Log in, to see the code


    we also see this in the boot log + a button on P6
    Code: Text
    Log in, to see the code


    I don't see mention of BAT_ADC assignment, but one assumes this should be P08

    Electronic schematic with pin labels.


    Flashing OpenXR809 experience (animated gif):
    PhoenixMC software interface with file information and firmware update details.

    AP broadcast on power-up with PB02 and PB03 no longer grounded
    Wi-Fi signal icon next to the network name OpenXR809_668AB7E2.

    Connection to hotspot requires manually configuring IP on wireless adaptor to 192.168.4.2-254 so 192.168.4.1 can be browsed to (unless this has been merged https://github.com/openshwprojects/OpenXR809/pull/8)


    Template import does not work because there is no LittleFS support in OpenXR809
    Screenshot of an interface for importing templates for OBK and Cloudcutter devices.

    So manual assignment is required. In it's most basic form those are:

    Code: Text
    Log in, to see the code


    which, visually, is as follows
    Microcontroller port configuration with assigned functions and values.

    With this the button pushes are acknowledged

    Code: Text
    Log in, to see the code


    the LED flashes when connecting to wifi but is off once connected and the channel assigned dInput_NoPullUp (channel 2) will change state depending on the proximity of the magnet to the sensor on the PCB

    Magnet close (door closed)
    Code: Text
    Log in, to see the code


    Magnet removed (door open)
    Code: Text
    Log in, to see the code




    Unfortunately the battery driver does not seem to be present on OpenXR809 and I don't think any deep sleep functions are available so battery operation is not practical - it will need powering from external 3v. I may be corrected on this and XR809 support may get developed to enable these functions.



    Flash backup will land at https://github.com/openshwprojects/FlashDumps/tree/main/IoT/XR809 as Tuya_LoraTap_MC100W_Contact_(schemaID-000001qrb9)_key8ky3d8eshuygm_XR3_1.0.6.bin in due course



    OpenXR809 boot log

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • ADVERTISEMENT
  • #3 21623745
    divadiow
    Level 35  
    revisiting this device now that @insmod has made quite a few adjustments to the XR809 code, including:

    -sorting, labelling and making available all usable GPIOs
    -enabled basic drivers to general release, including Berry
    Code: Text
    Log in, to see the code
    -enabled compression to save space
    -pindeepsleep
    -Implemented PWM, ADC (including VBAT), UART, watchdog in APP, delay_us, RSSI and ip addresses, remaining heap size.
    -LittleFS, Easyflash

    Because of the pin sort the assignments for this MC100W are now

    Code: JSON
    Log in, to see the code


    Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]

    I think this is a reasonable starting autoexec, not thoroughly tested.

    Code: Text
    Log in, to see the code


    Battery measurement seems to be OK sometimes, but will often drop to 0, even without autoexec configured

    Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]

    My setup is currently 3v fed through battery terminals

    Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]

    HomeAssistant registering changes in state as I move magnet close/away

    Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]

    Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]
  • Helpful post
    #4 21623747
    insmod
    Level 26  
    On XRs powersave has two parameters.
    Second one is DTIM interval. Values like 6 or 10 can be good for battery life.
  • ADVERTISEMENT
  • #5 21623784
    divadiow
    Level 35  
    oh cool. didn't know (not sure i fully understand it) what DTIM was or that XR powersave had this option. thanks. what's the trade-off? a potentially slower reflection of state change in HA?

    Added after 2 [minutes]:

    regarding free mem, with MQTT, battery driver configured, device runs at around ~80k

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • Helpful post
    #6 21623790
    insmod
    Level 26  
    >>21623784
    Mostly higher latency/lower throughput (both ways), and potentially dropped packets (but doubtful in iot)
  • #7 21623792
    divadiow
    Level 35  
    just to add that battery measurement appears to have stabilised somewhat, but occasionally drops to 0

    Screenshot showing a device template code snippet from the OpenBekenIOT platform on GitHub.

    Added after 25 [minutes]:

    and finally a template can be added
    https://github.com/OpenBekenIOT/webapp/commit/5651449bed1f67460db31b37f631a9d91b50753d

    I notice however, that, OK, so the pins have changed, but that the new numbering means a template cannot be extracted from any info Easy Flasher may be able to get or presumably, what might be visible in factory boot log. What I mean by that is that this was seen initially in EF (missing some stuff though)

    Code: Text
    Log in, to see the code


    but the new template doesn't line up with that at all

    Code: JSON
    Log in, to see the code


    not sure I can work out why. Is GPIO Dr/web app aligned OK with pins visible in GUI?

    Screenshot showing a configuration template code snippet for an IoT device, detailing GPIO pin assignments. Screenshot showing the GPIO configuration interface with visible pin assignments and a list of functions mapped to specific ports.
Reply | New topic
Report a violation of the law

Topic summary

The discussion explores the internal components and firmware integration of the LoraTap/Tuya MC100W contact sensor designed for door, gate, and window open/shut monitoring. The device was purchased via AliExpress and disassembled to reveal its internals, including the Xradiotech/Allwinner XR809 module. Efforts to enable battery measurement and SSDP (Simple Service Discovery Protocol) drivers in a custom firmware build based on OpenBK7231T_App are documented. Although SSDP functionality appears operational, battery voltage readings are inaccurate, showing errors related to ADC initialization and reporting zero battery percentage. The investigation highlights challenges in adapting the sensor's hardware interfaces within custom firmware environments.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT