logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Flashing ZY_HPS01_V1.2 Presence Sensor with CB3S Module: TX/RX Connection Issues

simnad2020IOT 1548 12
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21523369
    simnad2020IOT
    Level 2  
    Hi, first time posting here. I have a presence sensor bought on AliExpress by mistake (Click bait?) and I would like to flash it but this is more a test run for something else since I already have a few of these in Zigbee. So, I flashed a couple of 8266 a while back and it was pretty easy, but this looks like a more daunting task.
    Close-up of a MoreSense LIVE-IOT 2431 electronic module circuit board with visible components and labels.
    Printed circuit board (PCB) with electronic modules and a micro USB connector.
    CB3S electronic module mounted on a PCB, with visible SMD components.
    On the board there is the name ZY_HPS01_V1.2, the module is a cb3s and I think I got the pin right. Even if there is no Tuya Mcu on the board is it possible that the motion sensor chip is connected on the TX RX? And preventing me from flashing it? I added picture of the board and chips, and a portion of the log of the flasher. It did output another key than Encryption key: 00000000 00000000 00000000 00000000
    on one try: 510fb093 a3cbeadc 5993a17e c7adeb03
    Getting bus success!
    Going to set baud rate setting (921600)!
    Will try to read device flash MID (for unprotect N):
    Flash MID loaded: 1560EB
    Will now search for Flash def in out database...
    Flash def found! For: 1560EB
    Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
    Entering SetProtectState(True)...
    sr: 0
    sr: 0
    final sr: 0
    msk: 407c
    cw: 0, sb: 2, lb: 5
    bfd: 0
    SetProtectState(True) success!
    Going to read encryption key...
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 103E050378008000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 103E050374008000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 303C050374008000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 303C050378008000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 303C050374008000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 181E050374008000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 103E050374008000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 103E050374008000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 181E050378008000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 303C050374008000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 207C7F4120171030E0 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 303C050378008000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000270000000 data.
    failed with serial.BytesToRead 9 (expected 15)
    The beginning of buffer in UART contains 00C0F8000260000000 data.
    CheckRespond_WriteReg: ERROR
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 181E050374008000 data.
    failed with serial.BytesToRead 8 (expected 15)
    The beginning of buffer in UART contains 103E050378008000 data.
    Encryption key read done!
    Encryption key: 00000000 00000000 00000000 00000000
    ^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
    WARNING! Non-standard encryption key!
    If it's all zero, it may also mean that read is disabled.
    Please report to forum https://www.elektroda.com/rtvforum/forum51.html
    Or just try using BK7231M mode
    ^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^*^
    There was no result to save.
    AI: Can you share exactly how you’re connecting the CB3S module for flashing (e.g., which USB-to-serial adapter you’re using, wiring details, and whether you’re powering the board separately or through the adapter)?
    I am using a USB FTDI FT232RL, I did try powering the device through an external source but got the same results.
    AI: Did you put the CB3S module into flashing mode before trying to flash it? If so, how did you do it (e.g., holding a button, grounding a pin, etc.)?
    There is a reset button and I tried holding it, pressing it a couple of second, at intervals (~2sec). The only thing that made me have some kind of information out of the chip was power off/on and cen to ground.
  • ADVERTISEMENT
  • Helpful post
    #2 21523464
    p.kaczmarek2
    Moderator Smart Home  
    It looks like your device has something connected to UART port.
    Close-up of a PCB with a CB3S module and the marking ZY_HPS01_V1.2 dated 2024-10-23.
    Try disconnecting it (desoldering those two resistors or desoldering CB3S entirely).
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21523494
    simnad2020IOT
    Level 2  
    Hi, thanks for the quick answer, that's what I expected but hope that was not the case. Is the log consistent with a blocked/occupied UART? On my side I am not equipped for desoldering, so I hoped that someone would say that you just don't press the button hard enough. :-) When I did the 8266 there was spot on the board directly linked to the chip. In this device case the obvious ones are linked to the sensor chip if I am not mistaken. I might give desoldering a try but that won't be today, is it easier to just remove the cb3s (heat gun) or unsolder the resistors?
  • #4 21523521
    p.kaczmarek2
    Moderator Smart Home  
    You can still try different baud rates, but for reliable operation, clearing UART lines is always recommended.

    What kind of sensor is that? I don't recognize it. Have you seen it, @divadiow ?
    Helpful post? Buy me a coffee.
  • #5 21523843
    simnad2020IOT
    Level 2  
    These are Tuya compatible Wifi MmWave Human Presence Motion Sensor With Luminance/Distance Detection. They are not very good, but good enough. And they are very cheap, I bought a couple zigbee ones but got one wifi. They get the presence of a person even if there is no movement, small movements is enough to to get a an event. Better than PIR but like I said they are just good enough for me. 90 degrees cone and enough range for use in a house.
    I hope this link works
    https://www.aliexpress.com/item/1005005935585...tpp_buckets:668#2846#8107#1934&pdp_ext_f={"order":"1799","eval":"1","sceneId":"30050"}&pdp_npi=4@dis!CAD!14.61!13.38!!!10.31!9.44!@210318e817450368281498825ecd38!12000034928101604!rec!CA!3228470409!X&utparam-url=scene:pcDetailTopMoreOtherSeller|query_from:
  • Helpful post
    #6 21525047
    divadiow
    Level 38  
    same device here: https://www.elektroda.com/rtvforum/topic4094577.html

    I have 1 human presence sensor https://www.elektroda.com/rtvforum/topic4108806.html#21470593
    not yet even de-soldered WBR3 to dump firmware :o

    Added after 18 [minutes]:

    sensor module itself looks to be an MS58-2020D20M4-LIVE from MoreSense / Migan

    https://www.moresense-tech.com/product_details/70.html
    https://miganiot.com/product/ms58-2020d20m4-live/

    Code: Text
    Log in, to see the code



    Close-up of two green printed circuit boards (PCBs) with electronic components and connectors.
  • ADVERTISEMENT
  • #7 21525074
    p.kaczmarek2
    Moderator Smart Home  
    any info on protocol? i got this so far
    A diagram of radar detection range showing sensitivity zones and a detection angle of about 120 degrees.
    Schematics of microwave/radar module applications showing two connection methods to a microcontroller.
    Diagram and description of an electronic module with labeled VCC, GND, OUT, TX, RX pins and PCB dimension drawings.
    Photo of both sides of an electronic radar module with labeled technical components.
    Photo of the MS58-2020D20M4 5.8G radar module showing the circuit board with electronic components and connector labels.
    Helpful post? Buy me a coffee.
  • #8 21525082
    divadiow
    Level 38  
    I have made contact asking for a full datasheet
  • #9 21526562
    divadiow
    Level 38  
    hmm. got supplied with this. not any help
    Attachments:
    • MS58-2020D20M4-5V-G-5D-NLS-LIVE Product Data Sheet V1.0.pdf (1.24 MB) You must be logged in to download this attachment.
  • #10 21526731
    simnad2020IOT
    Level 2  
    When I have the time I will desolder the cb3s. I hoped that I'll get the device running with esphome but at this point any solution that works with home assistant is fine with me.
  • ADVERTISEMENT
  • #11 21540510
    p.kaczmarek2
    Moderator Smart Home  
    It seems the protocol is not known yet, so probably the first thing we need now is the data packets capture. If it's UART, then guess baud and capture with Realterm, both RX->TX and TX->RX traffic. It can be also captured more easily with Sigrok clone:
    Salae 24MHz logic analyzer for 10$ - analysis of an unknown LED display protocol
    Helpful post? Buy me a coffee.
  • #12 21540559
    divadiow
    Level 38  
    I was also sent this after requesting more info, but it still doesn't contain what's needed
    Attachments:
    • wetransfer_ms58-2020d20m4-5v-g-5d-nls-live-product-data-sheet-v1-0-pdf_2025-04-24_0647.zip (37.81 MB) You must be logged in to download this attachment.
  • #13 21540736
    p.kaczmarek2
    Moderator Smart Home  
    Included ATRadarSettingTool_V1.4 seem to be able to use UART to communicate with that, so maybe we could use it for testing, but I still can't see protocol documentation.
    Helpful post? Buy me a coffee.
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on flashing the ZY_HPS01_V1.2 presence sensor equipped with a CB3S module, purchased from AliExpress. The main challenge is the inability to flash the device due to suspected UART port blockage caused by the sensor chip connected to the TX/RX lines. Recommendations include desoldering the CB3S module or associated resistors to free the UART lines for flashing. The sensor module is identified as an MS58-2020D20M4-LIVE from MoreSense/Migan, operating in the 5.8 GHz band with FMCW radar technology for human presence detection, including micro-movements and breathing. The device is Tuya-compatible WiFi mmWave human presence sensor with luminance and distance detection, offering a 90-degree detection cone and suitable range for indoor use. Attempts to identify the communication protocol continue, with suggestions to capture UART data using tools like Realterm or a low-cost logic analyzer (Sigrok clone). The ATRadarSettingTool_V1.4 software can communicate via UART but lacks full protocol documentation. The community is awaiting datasheets and further technical details to enable integration with platforms like ESPHome and Home Assistant.
Today's popular

FAQ

TL;DR: 24 MHz logic analyzer costs about $10; "the first thing we need now is the data packets capture." Capture UART between the radar and CB3S before changing firmware. [Elektroda, p.kaczmarek2, post #21540510]

Why it matters: For tinkerers flashing ZY_HPS01_V1.2 with CB3S, TX/RX contention can block flashing; capturing and isolating UART prevents dead-ends.

Quick Facts

How do I fix TX/RX connection issues when flashing the CB3S on ZY_HPS01_V1.2?

Your UART lines are likely shared with the radar module. Isolate them before flashing. Desolder the two series resistors that bridge the radar UART to CB3S, or remove the CB3S entirely. “It looks like your device has something connected to UART port.” [Elektroda, p.kaczmarek2, post #21523464]

What’s the safest way to isolate TX/RX without removing the whole module?

Use the board’s two series resistors. 1) Identify the resistors linking radar UART to CB3S. 2) Desolder them to open the lines. 3) Refit after flashing, or leave pads accessible for future debugging. This avoids heating the whole module. [Elektroda, p.kaczmarek2, post #21523464]

My flasher shows serial.BytesToRead errors and an all‑zero key—what does it mean?

Your log shows repeated read errors at 921,600 bps and an all‑zero key. The tool warns: “If it’s all zero, it may also mean that read is disabled.” It also suggests using BK7231M mode when standard read fails. [Elektroda, simnad2020IOT, post #21523369]

What baud rate should I try when sniffing or flashing?

Vary the baud rate until framing looks correct. Start with common values and adjust as needed. For protocol work, collect data first, then fine‑tune. “You can still try different baud rates, but clearing UART lines is always recommended.” [Elektroda, p.kaczmarek2, post #21523521]

Did my tool actually detect the SPI flash?

Yes. The log reports MID 1560EB and TH25Q16HB. The tool also logged SetProtectState(True) success. That confirms SPI flash communication was achieved, even if subsequent encrypted reads failed. [Elektroda, simnad2020IOT, post #21523369]

What radar module is inside, and what are its key specs?

It appears to be a MoreSense/Migan MS58‑2020D20M4‑LIVE. Specs: 5.8 GHz band (5725–5875 MHz), ~3 m radius at 3 m height, ~20 mA supply, 3.3/5/12 V options, UART parameter adjustment, FMCW ranging. [Elektroda, divadiow, post #21525047]

Is there a vendor tool to talk to the radar over UART?

Yes. ATRadarSettingTool_V1.4 appears to communicate with the module via UART. It’s useful for quick tests, though protocol documentation is still missing. [Elektroda, p.kaczmarek2, post #21540736]

Can I power the board from an FT232RL, or should I use external 3.3 V?

The user tried both FTDI power and an external source, with identical results. That suggests the issue is not supply‑related in this case. Focus on UART isolation and mode selection first. [Elektroda, simnad2020IOT, post #21523369]

Can I use ESPHome with a Tuya CB3S board?

ESPHome primarily targets ESP8266 and ESP32 platforms. CB3S is not directly supported by ESPHome, so consider other firmware or UART integration. [ESPHome — Platforms]

How do I capture the radar’s UART traffic for reverse engineering?

Use Realterm or a Sigrok‑compatible logic analyzer. 1) Tap both RX→TX and TX→RX lines. 2) Guess baud and record continuous data. 3) Analyze frames to infer message structure and commands. A $10 24 MHz clone works. [Elektroda, p.kaczmarek2, post #21540510]

Is the sensor’s protocol already known?

No. The immediate need is a clean UART capture to document exchanges. After that, mapping commands and responses becomes straightforward. Data first, then driver implementation. [Elektroda, p.kaczmarek2, post #21540510]

Is it easier to remove the CB3S or just the UART resistors?

Both approaches were suggested. Removing the two UART series resistors is quick and reversible. Full module removal needs hot‑air and risks pad damage. Choose based on your tools and comfort. [Elektroda, p.kaczmarek2, post #21523464]
ADVERTISEMENT