[W600 / TW-03] Door Sensor - Bootloop on 1.18.110/109 Firmware

Question

Hey everyone, I'm trying to flash an ancien Live best door sensor (LSD-TW03 / W601 chip). This sensor uses a reed switch, not cheap Hall. I mostly followed this (using the GUI tool). Flashed OpenW600_1.18.110.fls successfully, but got a bootloop (no AP). Did an Erase Flash then flashed...

divadiow · Answer

interesting. Don't see many W600s appear. Is the behaviour any different if powered from the battery terminals instead?

But also, is that an ST 8L053F396 (cant really see it) MCU on the board?

the only Google result for that: https://www.st.com/resource/en/datasheet/stm8l051f3.pdf

p.kaczmarek2 · Answer

How good are your soldering skills? I would first try to desolder WiFi module and check outside circuit. It's a battery powered device. It may be doing external resets of WiFi module, so it's better to be 100% sure before we proceed with investigating.

sevenissimo · Answer

It's an old sensor on duty since 2022. As far as I remember it is Aubess branded. Slightly differs from similar in the external rounded shape.

However, the behavior is pretty much the same regardless of the power source. I've tried both the external PSU and the battery terminals, and it's still stuck.

Interestingly, after my last flash (with 1.18.110 again), the log no longer shows the AP creation message, and it's not even bootlooping anymore.
But still no AP to connect to, so no way to get to OBK.

w600 Compiled @Jun  4 2025 10:36:26
Entering initLog()...
Commands registered!
initLog() done!
Main_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 7 #######
Info:CFG:####### HAL_FlashVars_GetBootFailures= -65528
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT w600CD3BF2B5/ subT w600CD3BF2B5/ /set
Info:MQTT:MQTT_RegisterCallback called for bT w600s/ subT w600s/ /set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600CD3BF2B5/ subT cmnd/w600CD3BF2B5/ 
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600s/ subT cmnd/w600s/ 
Info:MQTT:MQTT_RegisterCallback called for bT w600CD3BF2B5/ subT w600CD3BF2B5/ /get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Time 1, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 2, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 3, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 4, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8

And yes, you're spot on about the MCU – it's an ST 8L053F3P6.

insmod · Answer

Try this build

sevenissimo · Answer

I'm still fairly new to soldering, and my desoldering skills are far from good.However, I tried to get the module off the board. I put (a lot) of flux on it and cleaned it with brass-threads, but... No way I can get this thing out. So, before literally burning out the PCB, I resoldered the pins and added the wiring.Then I tested @insmod >>21571493 build.The boot process hangs at secboot(1MB) running V3.9..., but maybe that's expected, Idk.Here are the flashing and boot logs.Code: text Expand Select all Copy to clipboard Firmware size: 549.86 kb Waiting for receive CCC ... Waiting for sync device timeout. Waiting for restarting device... CCCCCCCCCCCCCCCCCCCCCCCCCCCC= Sync success, W60X WIFI MAC:286DCD3BF2B5 old gain: 74667460747474747474747474747474747474747474747474747474 new gain: 74667460747474747474747474747474747474747474747474747474 PPPPPPPPPPPPPPPCCCC Erase secboot ok. Please wait for Erase flash ... >>>>>>CCCC Erase flash ok. Try 1000000 baud download file ... Wait for the chip to be ready ... Start the download ... Download C:/Users/Matteo/Desktop/W600-TW03/OpenW600_1629_merge_765fc4385077.fls file success! secboot(1MB) running V3.9... CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC secboot(1MB) running V3.9... CCCCCCCCCCCCCCCCCCCCCCCC *Reboot after flashing success, and after first Secboot...CCCC are due to my manual button press.

insmod · Answer

>>21575999
It works for me, i used Upgrade_Tools_v1.5.9.
Flashed latest version, OpenW600_1629_merge_30b67b1e8996.fls
Did you power cycle it?


Firmware size: 551.71 kb

Waiting for receive CCC ...

Waiting for sync device timeout.
Waiting for restarting device...
CCCC=
Sync success, W60X
WIFI MAC:286DCEB74B4E
old gain: 74667460747474747474747474747474747474747474747474747474
new gain: 74667460747474747474747474747474747474747474747474747474
PPPPPPPPPPPPPPPCCCC
Erase secboot ok.

Try 2000000 baud download file ...

Wait for the chip to be ready ...
Start the download ...

Download "xxx/OpenW600_1629_merge_30b67b1e8996.fls" file success!


w600 Compiled @Jun 10 2025 05:34:38
Entering initLog()...
Commands registered!
initLog() done!
Main_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 19 #######
Info:CFG:####### HAL_FlashVars_GetBootFailures= 1
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 2 changes count.
Error:CMD:no file early.bat err -2
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID [wrtaiot]
Info:MAIN:Using Pass [inhumanpassword]
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT w60000000000/ subT w60000000000/+/set
Info:MQTT:MQTT_RegisterCallback called for bT w600s/ subT w600s/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w60000000000/ subT cmnd/w60000000000/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600s/ subT cmnd/w600s/+
Info:MQTT:MQTT_RegisterCallback called for bT w60000000000/ subT w60000000000/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Time 1, idle 0/s, free 30968, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8

sevenissimo · Answer

>>21576838
Yep, I've done plenty of power cycles.

Just re-tested today:
My first test (power cycles and battery-powered with common ground to the CH340) still showed no luck. I can't get past Secboot.

Then, after I flashed the image again, the behavior changed:
- External power: OBK gets to `ap create Successfully ! Info:MAIN:Time 5, idle 0/s, free 3096` and then bootloops.
- Battery power: OBK doesn't even create the AP, but it doesn't bootloop either. It just stops.

Here's the log, though it doesn't show anything particularly new:


w600 Compiled @May 23 2025 08:41:01
Entering initLog()...
Commands registered!
initLog() done!
Main_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 29 #######
Info:CFG:####### HAL_FlashVars_GetBootFailures= -65506
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT w600CD3BF2B5/ subT w600CD3BF2B5/+/set
Info:MQTT:MQTT_RegisterCallback called for bT w600s/ subT w600s/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600CD3BF2B5/ subT cmnd/w600CD3BF2B5/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600s/ subT cmnd/w600s/+
Info:MQTT:MQTT_RegisterCallback called for bT w600CD3BF2B5/ subT w600CD3BF2B5/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Time 1, idle 0/s, free 30968, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 2, idle 0/s, free 30968, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 3, idle 0/s, free 30968, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 4, idle 0/s, free 30968, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8

As a third attempt, I re-flashed OpenW600_1.18.110.fls again. When powered by battery, the behavior is the same as above (no bootloop, but no AP).


w600 Compiled @Jun  4 2025 10:36:26
Entering initLog()...
Commands registered!
initLog() done!
Main_Init_Before_Delay done
Main_Init_Delay
Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 1 #######
Info:CFG:####### HAL_FlashVars_GetBootFailures= -65534
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT w600CD3BF2B5/ subT w600CD3BF2B5/+/set
Info:MQTT:MQTT_RegisterCallback called for bT w600s/ subT w600s/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600CD3BF2B5/ subT cmnd/w600CD3BF2B5/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/w600s/ subT cmnd/w600s/+
Info:MQTT:MQTT_RegisterCallback called for bT w600CD3BF2B5/ subT w600CD3BF2B5/+/get
Info:CMD:CMD_StartScript: started @startup at the beginning
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Time 1, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 2, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 3, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8 
Info:MAIN:Time 4, idle 0/s, free 30728, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/8

insmod · Answer

Bootloop on ap creation means there is not enough power. Wifi requires a lot, and common CH340 adapters aren't capable of handling it. You would need either a different adapter (with ams1117), or ams1117 wired to your adapter.

sevenissimo · Answer

>>21577008
Yeah, I know about the power issue. Unfortunately, I just fried my LDOs by accidentally reversing the polarity with an external PSU.....
That's precisely why I tried powering the device with batteries, as intended by its design. I was expecting it to be configurable via an AP, but I'm getting nothing. Is that normal behavior for obk?

insmod · Answer

I don't know?
This looks like a tuyamcu device, and it regulates if module is on or off.
But tuyamcu driver is not enabled on W600.

And W600 is not really suited for battery-powered devices.
Since so few pins are soldered, perhaps you might want to switch module to beken? CB3S or BK7238 XH-WB3S would do much better.

p.kaczmarek2 · Answer

If you put in the batteries, as intended by design, and have WiFi module flashed with 3rd party firmware, but don't configure tmSensor driver, then sometime later the MCU will turnon WiFi module for a short time, it will expect a TuyaMCU packet from WiFi module, and upon not receiving it, it will forcibly turn off WiFi modul again. This is why I suggest powering WiFi module directly to 3.3V WiFi module pad to make sure that MCU won't turn it off. I also suggested desoldering WiFi module, because MCU may just reset it via RST/CEN/anything, but I am not sure about that. If you don't want to desolder the WiFi module, then there is alternative - desolder the MCU. It's possible but tricky, depending on your toolset. Once you desolder the MCU, we will be finally 100% sure whether it's external reset that causes the problem or is it really a power supply issue. Why do you think so? Deep sleep of WiFi module is not needed for TuyaMCU battery powered devices. They just need UART and a relatively quick WiFi connection procedure.

insmod · Answer

>>21577071
There is no mosfet on picture, so module is powered off via CEN.
As for why i don't think it is suitable, it is because it requires a lot of power. More than twice as much as bk7238, and a little more than BK7231T.

p.kaczmarek2 · Answer

Oh, fair point. I didn't notice it/I assumed that MOSFET has to be there, because 100% of TuyaMCU products that I had so far had MOSFET used to control the power of WiFi module. Well, so if it's using CEN, then whole power supply bad discussion is in my opinion pointless. OP just has to either cut CEN trace, or desolder MCU, or desolder WiFi module. I am not sure if MCU and WiFi module has 3.3V connected together and how would device behave if only WiFi module is powered (MCU is unpowered), but still... testing with MCU in circuit is not a good idea. Interesting, sources?

insmod · Answer

>>21577166
My own measurements, done with Kowsi KWS-X1. No powersave.
HC01 W600 module (soldered on wires to D1 mini board), consumption is jumping like power save is enabled, from 0.1w to 0.55w. Max consumption spike was 0.75w.
7231T on NiceMCU is ~0.48w.
Original NiceMCU with 7238 is about 0.19-0.2w.

divadiow · Answer

Google search for something I just found and had forgotten about brought me to this thread. HC-25 with HC-T TTL adaptor is this your module?

insmod · Answer

>>21621485 This one, but just the module without 6-pin board. I will also soon have air602.

divadiow · Answer

interesting. PB6 and PB7 are routed out on these for SWDIO/SWCLK J-Link Commander connection and dump to file Code: TextLog in, to see the code

divadiow · Answer

I notice in the W600 SWD doc there's some flash algorithm file for Keil. Qflash. I wonder if plain SWD read is as good. hmm

Added after 13 [minutes]:

https://github.com/RT-Thread/W601_IoT_Board/t...es/Doc/W60X_QFLASH_Driver_for_SWD/W60X_QFlash

Added after 1 [hours] 17 [minutes]:

AT firmware broadcasts AP and a cute little web console

Added after 10 [hours] 6 [minutes]:

Log in, to see the code

hmm. write of dump does not appear to result in a restore of working firmware

Added after 48 [minutes]:

it's not actually writing. subsequent dumps show OBK code still.

[W600 / TW-03] Door Sensor - Bootloop on 1.18.110/109 Firmware

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Didn't find an answer? Ask Artificial Intelligence

Topic summary