logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Exploring LoraTap/Tuya MC100W Contact Sensor with Xradiotech/Allwinner XR809 Module [XR3]

divadiow 267 1
ADVERTISEMENT
Reply | New topic
  • Helpful post
    #1 21505143
    divadiow
    Level 34  
    Here I'll take a quick look inside a LoraTap/Tuya MC100W contact sensor for door/gate/window open/shut monitoring.

    Ali Express purchase
    https://www.aliexpress.com/item/1005007268034863.html
    Promotion for LoraTap WiFi/ZigBee door and window sensors.
    https://www.loratap.com/products/mc100w

    Box, parts, device internals:

    Label of LoraTap WiFi Door Sensor packaging with technical information. LoraTap Wi-Fi door sensor kit on a wooden surface, including a user guide, warranty card, mounting tapes, and a sensor. Two white enclosed devices on a wooden table resembling sensors.Open plastic battery case with a white cover next to it. Electronic module with components on a wooden background Close-up of a digital circuit board with electronic components. Electronic module with components on a printed circuit board Small screwdriver with a transparent orange handle lying on a wooden surface. LoraTap Wi-Fi door sensor kit with user manual and components. MC100W circuit board with buttons labeled KEY and BAT on a blue background.

    Xradiotech (now Allwinner) XR809 on a Tuya XR3 module
    Initial OpenXR809 development can be seen here with another contact sensor https://www.elektroda.com/rtvforum/topic3806769.html

    Electrical schematic of a connector and electronic components

    Electronic module with visible pins and labels on a navy blue background.

    With XR3 module powered directly with 3.3v, the boot log from RXD0 can be captured at 115200 baud

    Code: Text
    Log in, to see the code

    Circuit board with attached wires and a wireless module.

    And using the same process as with this P06 XR3 motion sensor the firmware can be dumped using PhoenixMC, the official UART flash tool.

    With PB02 and PB03 common grounded with 3.3v PSU, USB-TTL GND and XR GND+
    XR3 RXD0 -> USB-TTL RX
    XR3 TXD0 -> USB-TTL TX

    Electronic circuit board with colorful wires on a wooden table.

    we read the 2mb flash to file from the debug menu in PhoenixMC
    PhoenixMC software interface for mass production

    Flash operation program interface.

    output is flash_A_0x0_L_0x200000.bin at 2,097,152 bytes

    Before flashing OpenXR809 I paired it with the Tuya app

    App screen with added contact sensor. App screen showing the status of a contact sensor with low battery and open status. Screenshot showing activity history in an app with an entry labeled Night at 19:48:19, marked as Open. Screenshot of an app settings with options Door Sensor Opened and Door Sensor Closed both activated. Device update screen showing no updates available. App screen showing a contact sensor illustration.



    Device has schema ID: 000001qrb9, firmware key8ky3d8eshuygm and firmware version 1.0.6.

    Easy Flasher can extract some information from the flash dump

    Code: Text
    Log in, to see the code


    Full Tuya config JSON
    Code: JSON
    Log in, to see the code


    we also see this in the boot log + a button on P6
    Code: Text
    Log in, to see the code


    I don't see mention of BAT_ADC assignment, but one assumes this should be P08

    Electronic schematic with pin labels.


    Flashing OpenXR809 experience (animated gif):
    PhoenixMC software interface with file information and firmware update details.

    AP broadcast on power-up with PB02 and PB03 no longer grounded
    Wi-Fi signal icon next to the network name OpenXR809_668AB7E2.

    Connection to hotspot requires manually configuring IP on wireless adaptor to 192.168.4.2-254 so 192.168.4.1 can be browsed to (unless this has been merged https://github.com/openshwprojects/OpenXR809/pull/8)


    Template import does not work because there is no LittleFS support in OpenXR809
    Screenshot of an interface for importing templates for OBK and Cloudcutter devices.

    So manual assignment is required. In it's most basic form those are:

    Code: Text
    Log in, to see the code


    which, visually, is as follows
    Microcontroller port configuration with assigned functions and values.

    With this the button pushes are acknowledged

    Code: Text
    Log in, to see the code


    the LED flashes when connecting to wifi but is off once connected and the channel assigned dInput_NoPullUp (channel 2) will change state depending on the proximity of the magnet to the sensor on the PCB

    Magnet close (door closed)
    Code: Text
    Log in, to see the code


    Magnet removed (door open)
    Code: Text
    Log in, to see the code




    Unfortunately the battery driver does not seem to be present on OpenXR809 and I don't think any deep sleep functions are available so battery operation is not practical - it will need powering from external 3v. I may be corrected on this and XR809 support may get developed to enable these functions.



    Flash backup will land at https://github.com/openshwprojects/FlashDumps/tree/main/IoT/XR809 as Tuya_LoraTap_MC100W_Contact_(schemaID-000001qrb9)_key8ky3d8eshuygm_XR3_1.0.6.bin in due course



    OpenXR809 boot log

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
Reply | New topic
Report a violation of the law
Popular Topics
ADVERTISEMENT