logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Tuya/IHSENO T1-U-HL Soil Tester Sensor: BK7238, MindMotion 32G0001 TuyaMCU, HGSEMI C5551 Analysis

divadiow 813 9
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Tuya T1-U-HL module with labeled signal and power pins

    Here I'll present my findings with a new Tuya device based on the Beken BK7238 MCU, packaged as a Tuya T1-U-HL module. For more general information relating to the T1 series and BK7238 uses see:

    T1, T1-M, T1-3S Tuya BK7238 module datasheet, pinout and flashing, Home Assistant
    NiceMCU XH-WB3S BK7238 Flashing, Testing, Pinout, Development, Porting
    NiceMCU XH-WB3S BK7238 tutorial - quickstart, flashing, sensors, MQTT and Home Assistant
    NiceMCU BK7238/T1 IR remote control support presentation tutorial - Home Assistant automations

    This is a 'Soil Tester Sensor' from Ali Express.
    Screenshot of Tuya soil sensor product page showing device, app, and function icons


    Soil moisture sensor with package and user manual on a wooden table Side of green packaging box showing Zigbee 3.0, WiFi, and Bluetooth icons. Green box labeled “Take Good Care of Every Plant” lying on wooden surface. Smart sensor package label with manufacturer info and barcode Green box labeled “Soil Tester Sensor” with product model WF-TR-1 and barcode. Green soil moisture sensor box with specs list and QR codes

    After popping off the battery cover, just 4 small cross-head screws allow for the removal of half the case

    Close-up of a probe-style soil sensor with a plastic casing White sensor with plastic casing and metal probe lying on a wooden surface Soil sensor with white plastic housing and black probe, placed on wooden background Disassembled soil sensor case with battery holder and screws on wooden surface Open soil sensor case showing two AA battery slots with springs and cover Disassembled soil sensor with battery compartment open and terminals exposed Opened soil sensor with white casing and exposed battery compartment White plastic sensor with a button on top, lying on a wooden surface

    to reveal the main module - the T1-U-HL, a 16kb MindMotion MM32G0001 Arm Cortex-M0 TuyaMCU (also seen here) and an HGSEMI C5551 WSAH SOIC8 chip.

    Tuya T1-U-HL module and components on IHSENO TY_WiFi_Soil_V1 sensor PCB Tuya T1-U-HL module and IC on PCB of IHSENO TY WiFi Soil V1 device Close-up of PCB with push button, HGSEMI C5551 chip, and SMD components. Close-up of PCB with MM32G0001 chip and Tuya T1-U-HL module with exposed test pads

    Unfortunately, the back of the PCB cannot be examined without de-soldering the battery terminals. There was little to be gained, however.

    Bottom of black PCB with green wire and visible copper traces

    T1-U-HL details - https://developer.tuya.com/en/docs/iot/T1-U-HL-Module-Datasheet?id=Kdfp5j893qwxg

    Top view of Tuya T1-U-HL module with pin numbers and size measurements Bottom view of T1-U-HL module with labeled pins and mechanical dimensions

    Pin No.SymbolI/O typeDescription
    1P14I/OA normal GPIO pin, corresponding to Pin 19 on the IC. It can be reused as SPI_SCK.
    2P16I/OA normal GPIO pin, corresponding to Pin 20 on the IC. It can be reused as SPI_MOSI.
    3P23I/OA normal GPIO pin, corresponding to Pin 16 on the IC.
    4P22I/OA normal GPIO pin, corresponding to Pin 15 on the IC.
    5ADCI/OAn ADC pin, corresponding to P20 (Pin 13) on the IC.
    6RX2I/OUART_RX2, corresponding to P1 (Pin 30) on the IC.
    7TX2I/OUART_TX2 to print logs, corresponding to P0 (Pin 31) on the IC.
    8P24I/OSupport hardware PWM4, corresponding to Pin 17 on the IC.
    9P9I/OSupport hardware PWM3, corresponding to Pin 27 on the IC.
    10P26I/OSupport hardware PWM5, corresponding to Pin 23 on the IC.
    11P6I/OSupport hardware PWM0, corresponding to Pin 24 on the IC.
    12P8I/OSupport hardware PWM2, corresponding to Pin 26 on the IC.
    13GNDPGround pin.
    143V3P3.3V power pin.
    15TX1I/OUART_TX1 to send user data, corresponding to P11 on the IC (corresponding to Pin 29 on the IC).
    16RX1I/OUART_RX1 to receive user data, corresponding to P10 on the IC (corresponding to Pin 28 on the IC).
    17P28I/OA normal GPIO pin, corresponding to Pin 12 on the IC.
    18CENI/OThe reset pin, active low, and pulled up internally. It is compatible with the designs of other modules. Corresponding to Pin 11 on the IC.
    19P21I/OA normal GPIO pin, corresponding to Pin 14 on the IC.
    20P17I/OA normal GPIO pin, corresponding to Pin 22 on the IC. It can be reused as SPI_MISO.
    21P15I/OA normal GPIO pin, corresponding to Pin 21 on the IC. It can be reused as SPI_CS


    Tuya T1-U-HL module with labeled signal and power pins

    Feeding 3V through the batters terminals and from TX2 the boot log is captured at 115200 baud:
    Code: Text
    Log in, to see the code


    Unfortunately, the MindMotion MCU gets in the way of any flash read efforts on RX1/TX1, even with the MCU Nrst held low, so the module had to be hot air gun removed for flashing away from the MCU.

    Sensor with Tuya T1-U-HL module wired to programmer via test leads

    Tuya T1-U-HL module with BK7238 MCU attached to a test board Close-up of PCB with TY_WiFi_Soil_V1 module and components under green coatingTuya T1-U-HL module with test wires soldered, placed on a blue surface

    Easy Flasher reads whole flash successfully in BK7238 mode

    Screenshot of BK7231 Easy UART Flasher showing “Reading success!” message
    Code: Text
    Log in, to see the code


    As a precaution a backup is also taken with BKFIL
    Code: Text
    Log in, to see the code


    Code: Text
    Log in, to see the code




    Regarding the TSSOP20 MM32 MCU (datasheet attached) we read this overview
    Code: Text
    Log in, to see the code


    Comparison table of MM32G0001 microcontrollers highlighting TSSOP20 variant

    And to put how it connects to the 4 test pads and to the T1-U-HL in context:
    Close-up of PCB with Tuya module and labeled MM32G0001 microcontroller pins.

    Maybe I should have another go at reading the flash with J-Link, I appear to have been unsuccessful with the other device.


    With the backup flashed to the NiceMCU and setup to talk to the Tuya Module Debugging Assistant with product ID rknwi0ctbbghzgla we can pair it with the Tuya app to check firmware versions, device appearance, options and readings

    View of MCU simulation in Tuya Module Debugging Assistant with diagnostic data

    It seems it's just a glorified temperature and humidity sensor.

    App screen showing successful addition of a soil sensor to Tuya systemApp screen showing soil sensor with 0% humidity and 0.0°C temperature readings Mobile app screenshot showing humidity graph for 2025/08/11 App settings screen showing battery level at 0% Device update screen indicating no updates available

    with the Tuya app linked to a dev account we can retrieve the dpIDs, needed for OpenBK7238 setup
    Code: JSON
    Log in, to see the code


    which when made pretty:

    Code: JSON
    Log in, to see the code


    Interesting, separate dpIDs for Fahrenheit and a switcher dpID. I don't see a change function in the app. The manual offers no clues.
    Tuya soil tester sensor manual with functions and app QR codes Soil sensor user manual with device diagram and usage instructions



    OpenBK7238 flashed over the top of factory firmware. I chose to overwrite the bootloader because keeping the factory BL meant OTA updates were not successful.

    Screenshot of Easy UART Flasher showing successful BK7238 flash operation

    PCB and module cleaned up. Excess solder removed with solder braid.

    T1-U-HL module next to TY_WiFi_Soil_V1 PCB, pads and microchips visible

    It appears the top two pads are only there to secure module to PCB - no traces on either side. It looks like P21 goes somewhere but I've yet to get any continuity to any component.

    With the module soldered back in and OBK unconfigured, you get 20s from button-push wake-up until the MCU withdraws power from the T1 module. This gives just about enough time to navigate to the web app, create autoexec and set a starting script

    With a basic starter:
    Code: Text
    Log in, to see the code


    I get no readings and no response to tuyaMcu_sendQueryState. Flag 26 ([UART] Use alternate UART for BL0942, CSE, TuyaMCU, etc) toggled doesn't change that.

    This is where I will pause to investigate TuyaMCU comms to the NiceMCU with TMDA and to research the HGSEMI chip.
    Attachments:

    Cool? Ranking DIY
    About Author
    divadiow
    Level 36  
    Offline 
    divadiow wrote 3721 posts with rating 635, helped 313 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • #2 21632492
    divadiow
    Level 36  
    TMDA says it is receiving a heartbeat from the NiceMCU
    Tuya MCU Debugging Assistant interface showing received heartbeat data

    but OBK doesn't log a valid heartbeat

    Code: Text
    Log in, to see the code


    With tuyaMcu_sendQueryState command to TMDA we see TMDA receiving the request and sending loads of info

    Tuya MCU Debugging Assistant interface with active COM3 simulation

    BK7238 logs nothing received. To test this setup should work, swapped to BK7231N and many responses enumerate

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #3 21634557
    p.kaczmarek2
    Moderator Smart Home  
    Very nice analysis, here's some little info from me - as far as I know, tuyaMcu_sendQueryState is only for core TuyaMCU (non-battery powered). So it is fully expected for battery powered (tmSensor) to ignore tuyaMcu_sendQueryState call.
    Helpful post? Buy me a coffee.
  • #4 21634599
    divadiow
    Level 36  
    OK sure, but on NiceMCU with no tmsensor running I would expect to see TuyaMCU responses in OpenBK7238 log. No heartbeat or any commands manually sent from TMDA are shown as received.
  • #5 21634612
    p.kaczmarek2
    Moderator Smart Home  
    If the device is using Battery Powered Tuya Serial Protocol, then it will not reply to classic TuyaMCU driver. tmSensor (Battery Powered Tuya Protocol) is different, and, as far as I remember, the MCU expects a very special packet to be sent from tmSensor when WiFi module boots.

    There was somewhere a nice Tuya page with full documentation of that.

    Also see here:
    https://www.elektroda.com/rtvforum/topic3914412.html
    Screenshot of forum showing TuyaMCU packet analysis and hexadecimal command example.
    Helpful post? Buy me a coffee.
  • #6 21634618
    divadiow
    Level 36  
    Quote:
    To test this setup should work, swapped to BK7231N and many responses enumerate


    but to be sure OBK7238 itself works alright with TuyaMCU I switched to NiceMCU and TMDA.

    BK-N dev receives commands OK, BK7238 does not. Same autoexec on both. No tmsensor running, only TuyaMCU.
  • ADVERTISEMENT
  • #7 21634639
    p.kaczmarek2
    Moderator Smart Home  
    divadiow wrote:
    OK sure, but on NiceMCU with no tmsensor running I would expect to see TuyaMCU responses in OpenBK7238 log. No heartbeat or any commands manually sent from TMDA are shown as received.

    So you are saying that you are sending non-battery powered commands from TMDA?

    That could mean UART driver is not working correctly in BK7238 build.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #8 21634644
    divadiow
    Level 36  
    yes sir. take soil sensor out of the equation. take battery tmsensor out of the equation = OBK7238 doesn't seem to receive responses from TuyaMCU simulator whereas OBK7231 does.

    I can do it again to be sure so as not to waste anyone's time with a perceived issue, but I was quite sure.
  • #9 21640993
    divadiow
    Level 36  
    back again.

    NiceMCU / Tuya Module Debugging Assistant TX/RX over P0/P1:
    TuyaMCU driver only.

    TMDA acknowledges heartbeats and will send query state response to BK7238 but BK7238 only prints this for anything received from TuyaMCU simulator:

    Code: Text
    Log in, to see the code


    Screenshot of UART fifo full messages and Tuya debugging interface with MCU simulation
  • #10 21643277
    divadiow
    Level 36  
    Code: Text
    Log in, to see the code


    getting something. no response to tuyaMcu_sendQueryState though and no sensor readings

    Humidity 0.0% and temperature 0.00°C displayed on dark background
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

The discussion focuses on the Tuya/IHSENO T1-U-HL Soil Tester Sensor, which utilizes the Beken BK7238 microcontroller unit (MCU) and integrates a MindMotion 32G0001 TuyaMCU alongside an HGSEMI C5551 component. The original poster shares detailed findings and references multiple datasheets and tutorials related to the BK7238 MCU and Tuya T1 series modules, including flashing, pinout, MQTT integration, and Home Assistant automation. The device is sourced from AliExpress and is analyzed through images and debugging logs. A key technical issue highlighted is the discrepancy in heartbeat signal detection: TMDA software detects a heartbeat from the NiceMCU, but OBK firmware logs indicate invalid heartbeat and product information, with self-processing mode active and no valid Wi-Fi state. Debug logs repeatedly show "TuyaMCU heartbeat_valid = 0," indicating communication or firmware compatibility challenges with the TuyaMCU interface on this soil sensor module.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT