Tuya ZY-TH01ProCB3S_v1.4 Temp & Humidity Sensor Firmware Programming

Question

I have a couple of Tuya ZY-TH01ProCB3S_v1.4 temp & humidity sensors with LCD display; see the attached pictures. I tried to use CloudCutter on the first one and that seemed to go well and I managed to reflash it OTA with what I now assume is rubbish. So, I have been trying to reflash it using a...

siggiullrich · Accepted Answer

After some more reading in different topics I decided not to cut RX/TX, but connect Pin9 (GND) of the CB3S to BAT-. That way, powered by USB-Serial 3,3V on BAT+,BAT- and connected RX/TX, the CB3S permanently stays on. Then I was able to flash the firmware (1.18.244) with the BK7231 Easy UART Flasher (Baud 1500000) and could do the config (Wifi/MQTT) via WebInterface. StartUp Command Text Code: text Expand Select all Copy to clipboard startDriver TuyaMCU startDriver tmSensor // dpID 27 is temperature div 10 setChannelType 27 temperature_div10 linkTuyaMCUOutputToChannel 27 val 27 // dpID 46 is % humidity setChannelType 46 Humidity linkTuyaMCUOutputToChannel 46 val 46 // dpID 101 is battery state - low(0), mid(1) and high(2) setChannelType 10 ReadOnly linkTuyaMCUOutputToChannel 101 enum 10 setChannelLabel 10 Battery  After finishing the config, the Pin9 (GND) CB3S to BAT- connection must be removed to get any data. Added after 6 [hours] 15 [minutes]:I have now converted three of the sensors, and they run on batteries and deliver the values via MQTT. I would like to convert a few sensors to USB power supply (5V->3V conversion) and be able to determine the interval of data transmission myself. In addition, the sensor should always have WiFi turned on so that I can access the configuration pages via a browser. This can already be achieved with the Pin9->BAT connection. But the question is how to adjust the start commands so that the value transmission still works in this case. I will first have to read up on the TuyaMCU topics. Maybe the project is not feasible at all. If anyone has any information on whether someone has already done this for other sensors of this type, I would be very grateful.

divadiow · Answer

I have a feeling the RX/TX pads on the back of these are for the TuyaMCU and not the CB3S. I recall as much from this version You probably won't want to remove the LCD so you'd need to angle something in to get to the pads on CB3S

Dnomis77 · Answer

Hi, thanks. I have tried using the top 2 RHS pins on the CB3S module directly also, but it didn't behave any differently. It never seems to reset, and seems to have a path to power for the LCD even if I apply power at the CB3S pins.

divadiow · Answer

hmm yes. TuyaMCU is also known to get in the way of flashing so often rx and or tx needs to be isolated from the TuyaMCU. This can be done by removing the CB3S completely or severing a PCB trace then repairing it later. The LCD on these makes CB3S removal quite a chore. Your wires definitely short to CB3S RX/TX and they cross with your USB-TTL RX->TX and TX->RX? You may be able to hold the TuyaMCU is reset mode too I think I've seen reported, but I haven't had a device where that's been possible yet. More difficult if you can't even see the chip and then if it's pins are known.

Dnomis77 · Answer

I've not tried removing a surface mount board before, it was hard enough trying to solder to it! I removed the wires from direct connection at the CB3S TX/RX and yes, I tried lots of combinations of TX - TX, TX -RX etc and baud rates, I saw someone posted that they had to use 15000000 so will try that tomorrow. Not sure how to go about removing the CB3S heat up and cut the join with a scalpel? Solder Pump? Presumably I only need to remove the 3.3v and Tx/ Rx lines

divadiow · Answer

I was thinking hot air gun removal after desoldering the LCD, but that's probably not an option. But actually, look, the RX/TX on CB3S do look to go those headers on the back. I hadn't spotted that. Looks like they each have a little trace breaking out to the TuyaMCU? maybe? Maybe it'll just be a case of severing the CB3S's RX at that little junction so TuyaMCU can't transmit stuff and get in the way. How are you powering your device btw? external 3.3v power supply with common grounds to USB-TTL or powering whole thing from USB-TTL 3.3v or 5v with LDO? Added after 2 [minutes]:that assumes these two come off CB3S RX/TX

Dnomis77 · Answer

I have tried powering it via just the TTL converter, via batteries and via one of those USB-to-3 V battery eliminators. The circuit board looks multi-layered so not easy to trace where those two go, I'll have another look in the morning. I don't have a hot air gun suitable for SMD removal so that option is out. And I really didn't want to remove the LCD unless I have to.

Dnomis77 · Answer

OK, now we are getting somewhere!I pondered the option of trying to cut the 2 small traces by those pads, but opted to cut them further up the trace (don't ask me why I staggered them) I then was able to get it to connect via the CB3S TX/RXIt would not read the firmware successfully and kept failing at the same place; I assume this was where the previous OTA flash failed.So I bit the bullet and tried to flash the latest firmware with success!! I can now talk to it!I have changed the WiFi details and can now talk to it via my network!Now all I need to do is work out how to stop it from turning itself off after 30 seconds or so so I can talk to it long enough to figure out how to configure it. I have never played with OpenBK before, so this is a massive learning curve for me!

p.kaczmarek2 · Answer

Battery-powered devices are inherently hard to flash and convert. The turning off after 30 seconds it's just one of the issues. You can either power the CB3S directly (via 3.3V pad) or try pressing pair button repeatedly. Be aware that powering CB3S is just a first step. You also need to properly setup tmSensor driver and dpIDs, so they match what Tuya used in this particular device. Each device may have totally different dpID meaning. I usually do a communication capture with Tuya firmware first, and then change to OBK. Here is the tool I use: By the way, it's indeed a very interesting sensor. I haven't seen that one yet. Thanks for sharing!

Dnomis77 · Answer

Really struggling to get started with this... I tried to get Gemini to help me, and it kept sending me in circles, asking me to set pins 10 and 11 to TuyaMCU_RX and TuyaMCU_TX, but they aren't in the pull-downs of either the web app or the config pages.It then keeps going over and over different commands that don't work, and keeps telling me I have the lite version of the firmware with no Tuya support, and I need a different version.I used the Get Latest Firmware from the Flash program, which put this one on... sure where to go from here; I'm stuck. Is there a tutorial on finding the right pin setup anywhere please?

divadiow · Answer

here's the list of TuyaMCU guides and examples I've been posting

p.kaczmarek2 · Answer

TuyaMCU UART is always on the same UART port so we don't have those pins roles. I believe this is a halucination. Do not trust LLMs. TuyaMCU and tmSensors drivers are in default OBK build, so you have them. AI says it just because it fits to the context (it's just a prediction mechanism). UART pins are always correct by default, but you need to know the baud rate. In my opinion converting those devices is somewhat advanced topic, but you can start with my guide for a door sensor: Your device most likely works more or less the same, but have different dpIDs.

Dnomis77 · Answer

Thanks, both. I'll start reading tomorrow. I didn't think this would have been such a tough choice of sensor to start with. I do know not to trust LLM, but they do come up with some useful stuff sometimes... This time, I just went round in circles pointing out to it why it was wrong!

p.kaczmarek2 · Answer

Don't worry that much about it, I never ever seen such sensor with LCD before, so at least you taught us something new. I saw you said the firmware backup failed, but maybe you can at least recover Tuya config partition? This will not contain GPIO on your device, but may contain baud setting. WiFi battery powered devices are hard to convert in general. I am usually choosing Zigbee in that matter.

Dnomis77 · Answer

Attached is the Tuya Config Partition. The Flasher reports... Sorry, no meaningful pins data found. This device may be TuyaMCU or a custom one with no Tuya config data. No module information found. And the Tuya section starts at an UNCOMMON POSITION 0. Code: JSONLog in, to see the code

divadiow · Answer

try this autoexec Code: TextLog in, to see the code

Dnomis77 · Answer

Hi,I got to the same place!I have my startup command set to this...Code: text Expand Select all Copy to clipboardstartDriver TuyaMCU startDriver tmSensor // Temperature setChannelType 1 temperature_div10 linkTuyaMCUOutputToChannel 27 val 1 // Humidity setChannelType 2 Humidity linkTuyaMCUOutputToChannel 46 val 2 // Unknown Sensor/Mode from logs (dpID 101) setChannelType 3 ReadOnly linkTuyaMCUOutputToChannel 101 val 3And it works! I can now report the temp and humidity (and the odd one) via MQTT into HAWith tmSensor not running, the Wi‑Fi board stays alive for 88 seconds but does not report any values before its power is cut.As soon as I enable tmSensor, it reports the values and shuts down the Wi‑Fi board at 12 seconds. Presumably for power-saving measures. Is there a way to force it on all the time other than hard-wiring it to power? I will be running via 3.3 V external power, not batteries

divadiow · Answer

as far as I recall you're at the mercy of the TuyaMCU. I think it usually cuts the power to module (?) so maybe a case of simply tying the CB3S ground into a plane?

Dnomis77 · Answer

Yes, that works, tying the CB3S GND to the battery -ve keeps the WiFi alive.But the TuyaMCU doesn't like it... The LCD and readings refuse to update, even when the temperature/humidity changes on the sensor (like breathing on it)

p.kaczmarek2 · Answer

GND or power? I think it disconnected power from CB3S. How this LCD works, how often is it refreshed? Is it on all the time? As I said, i never saw such device before, I'm curious. The problem is that TuyaMCU MCU has a state machine, and it expects tmSensor to send packet when it turns on the power for the WiFi module, so, if you power WiFi module all the time, the tmSensor will not know when to send packet, so there will be no data exchange, so no measurements.

Dnomis77 · Answer

If I make a permanent connection of the CB3S GND to the battery ground, then the WiFi does not turn off. It also stops sending readings and the LCD no longer updates.The LCD display is always on; even with the original firmware, it was always on.This is where I purchased the sensor...

p.kaczmarek2 · Answer

Oh I see, they offer a nice deal for this device right now: I'm suprised that you're saying they disconnect GND, but maybe you are right. Chinese devices often suprise me. It would be interesting to see what's under LCD, but maybe someday...

divadiow · Answer

something not too dissimilar to this one maybe

siggiullrich · Answer

Hello, I am just starting to look into Tuya and OpenBeken. I have also purchased this temperature sensor and am trying to install OpenBeken for the first time. If there is any further information regarding the next steps and configuration (autoexec.bat), I would be very grateful if you could share it here.

Dnomis77 · Answer

By far the hardest thing about this sensor is keeping the thing alive long enough to do anything with it. It automatically goes to sleep very quickly. If you keep pressing the button, then it will keep it alive longer, but I found it difficult to concentrate on typing or pressing buttons on the computer at the same time as pressing the button on the sensor every few seconds; it was a bit like trying to rub your tummy and pat your head at the same time!As for configuration, I used the 229 version of the OpenBeken firmware and used the code listed above in the startup command box of the home page of the sensor.I have done a second one since and did not need to break the tracks anywhere. I used the MCU_TX & MCU_RX, BAT and BAT- on the circuit board and disconnected the BAT or BAT- from the board to reboot and get the flasher to catch.I also found I had to use 230400 baud rate, otherwise the thing fell asleep before it finished getting or writing the data.With hindsight I wish I had started with a Wi-Fi switch or something that didn't go to sleep so quickly as they have been a walk in the park to flash since cutting my teeth on this Temp Sensor!

Tuya ZY-TH01ProCB3S_v1.4 Temp & Humidity Sensor Firmware Programming

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Topic summary