logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

LN-CB3S Module Pinout and Flashing Issues on Tuya Wall Switch – Any Documentation?

patentjyp 1884 23
Best answers LABEL_AI_GENERATED

What is the pinout of the LN-CB3S module, and how do I put it into flash mode on a Tuya wall switch?

The module appears to be an LN882H-based LN-CB3S/LN-CB3S_V1.0 variant, and it can be flashed by pulling A9 to GND on boot; default RX/TX are used for flashing, while logs are on B9 [#21815999][#21884786] One user successfully flashed the module and confirmed that it works with both OpenBK/OBK and ESPHome [#21875743][#21877215] The posted pin functions for a BSEED 2-gang switch were PA0 backlight LED, PA2 right indicator LED, PA4 left indicator LED, PA6 relay 1, PA10 status LED, PA11 left button input, PB5 relay 2, and PB6 right button input [#21875863] A backup/readout was taken with BK7231GUIFlashTool / BK7231GUIFlashTool-style tooling, which also expects the chip in flashing mode with A9 grounded [#21815999]
AI summary based on the discussion. May contain errors.
ADVERTISEMENT
Report a violation of the law
Reply | New topic

  • LN-CB3S pinout differs from CB3S and won’t enter flash mode

    #1 21815997
    patentjyp
    Level 5  
    Posts: 20
    Help: 1
    Rate: 3
    Electronic module with labeled pins on a blue PCB, top view LN-CB3S electronic module with PCB antenna, CE marking, and QR code

    Any info on this module?

    I could not find any information by googling "LN-CB3S."

    It seems that this module has different pin labeling (and/or different pinouts) from CB3S module.

    I connected A2 and A3 pins to TX and RX (and also tried to RX and TX) of my USB-to-serial (and also CEN to GND), but I cannot get it to enter flash mode.

    This module is from a Tuya wall switch. Since I could not flash this module with any open-source firmware, I had to replace it with ESP-12F.

    Any info would be appreciated.
    eufyMake E1 - łatwa personalizacja za pomocą druku UV [sponsorowany]
  • ADVERTISEMENT
  • #2 21815999
    insmod
    Level 31  
    Posts: 1432
    Help: 168
    Rate: 455
    Judging from module and pin names - LN882H.
    Default RX/TX are for flashing (and app uart, if used), log should be at B9.

    Backup can be taken with BK7231GUIFlashTool, chip enters flashing mode with A9 pulled down on boot
  • #3 21818982
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14764
    Help: 659
    Rate: 12898
    Interesting, looks like LN882H CB3S version. Can you try to take a backup with our flasher?
    https://github.com/openshwprojects/BK7231GUIFlashTool
    Helpful post? Buy me a coffee.
  • #4 21820714
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    Pinout diagram of an electronic module showing GPIO, UART, and 3.3V power connections
    Attachments:
    • CB3S_4layers.zip (262.84 KB) You must be logged in to download this attachment.
    • CB3S_2layers.zip (228.95 KB) You must be logged in to download this attachment.
  • #5 21875317
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    any success to flash LN-CB3S ?
  • #6 21875564
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    was that aimed at @patentjyp? If it behaves like a standard LN882H then there should be no issues reading or writing to this module
  • ADVERTISEMENT
  • #7 21875743
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    I flash it. Ln-cb3s. Thanks
  • #8 21875746
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    Cool.

    Did you take a backup first? Would you be happy to share it for addition to our collection?

  • LN-CB3S pinout and GPIO mapping for BSEED switch

    #9 21875863
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    Hello,

    Yes, uploaded.

    Chip: LN-CB3S_V1.0
    Model: WL2H-U-2
    Device: DS-101JL, BSEED Wifi Touch Light Switches 2 Gang Smart Wall Switch
    PinFunctionDirectionInverted
    PA0Backlight LEDOutputyes
    PA2Right indicator LEDOutputyes
    PA4Left indicator LEDOutputyes
    PA6Relay 1 — Left LightOutputno
    PA10Status LEDOutputyes
    PA11Button LeftInput PULLUPyes
    PB5Relay 2 — Right LightOutputno
    PB6Button RightInput PULLUPyes

    Ed
  • ADVERTISEMENT
  • #10 21875955
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    thanks. Easy Flasher chokes on the KV extraction from that dump. Will fix.

    Screenshot of BK7231 Easy UART Flasher showing an error message and an empty JSON panel

  • Plaintext MAC and Wi‑Fi credentials in KV area

    #11 21875969
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    When comparing two flash dumps from DS-101JL light switches (Tuya WL2H-U-2 module, LN882H chip),
    I found the following:

    Firmware is 100% identical between units

    Both devices came from the factory with exactly the same firmware. The app partition
    (0x007000–0x132FFF, 1.2 MB) is bit-for-bit identical.

    Flash partition layout (2 MB total)

    Code: text Expand Select all Copy to clipboard
    
  Partition   Offset      Size    D1 vs D2
  ---------   ------      ----    --------
  boot        0x000000    24 KB   IDENTICAL
  part_table  0x006000     4 KB   IDENTICAL
  app         0x007000   1.2 MB   IDENTICAL  ← same firmware on all units
  ota         0x133000   680 KB   different  (6306 bytes — MAC   provisioning)
  nvds        0x1DD000    12 KB   different  (1146 bytes — runtime state)
  kv          0x1E0000    16 KB   different  (3069 bytes)
  kvs         0x1E4000    32 KB   different  (4095 bytes)
  user        0x1EC000    80 KB   different  (77813 bytes)
  


    All differences are in the data area above 0x133000 — device-specific info only.

    MAC address location

    Both WiFi and BLE MACs are stored in the OTA partition region at offset 0x1C543C.
    The KV key names are readable in plaintext:

    Code: text Expand Select all Copy to clipboard
    
  Key name      Offset      D1                  D2
  --------      ------      --                  --
  6_sta_mac     0x1C543C    00:33:7A:2B:86:95   BC:35:1E:BE:41:EB
  24_ble_mac    0x1C5464*   00:33:7A:2B:86:96   BC:35:1E:BE:41:EC

  * stored in reversed byte order
  


    BLE MAC is always WiFi MAC 1. The OUI 00:33:7A belongs to Lightning Semiconductor,
    BC:35:1E belongs to Tuya.

    KV key names visible in plaintext around the MAC area

    Code: text Expand Select all Copy to clipboard
    
  it_magic     — KV entry separator/magic marker
  6_sta_mac    — WiFi (station) MAC address
  24_ble_mac   — BLE MAC address
  ty_ada_psk   — WiFi credentials (SSID   password, plaintext!)
  
  • ADVERTISEMENT

  • Tuya config dump identifies LN882H environment

    #12 21876010
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    Code: JSON
    Log in, to see the code

  • Normal mode boot log confirms GPIOA_9 high

    #13 21877066
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    boot log
    Code: Text
    Log in, to see the code


    Added after 9 [hours] 31 [minutes]:

    @bl00dy, to confirm, your BSEED 2G touch light switch device has a WL2H-U (WL2H-U-2?) module, not LN-CB3S, the original focus of this thread?

    did you go with OBK or ESPHome in the end? I see you posted here too https://github.com/libretiny-eu/libretiny/issues/338#issuecomment-4178208889

    if OBK, what does your OBK template look like, so it can be added to device list?
  • #14 21877215
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    Hello,

    Let me send photo of chip:
    As you can see, it's LN-CB3S_V1.0 with WL2H-U-2 on it.
    I installed OBK on it, and also installed ESPHome. Both work.

    Ed
    Close-up of green PCB with LN-CB3S_V1.0 module and shielded WL2H-U-2 chip
  • #15 21877216
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    oh interesting. I see now. thanks
  • #16 21877224
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    there are 2 images without attaching to my Wi-Fi, clean from vendor
    Attachments:
    • ln882h.zip (1.2 MB) You must be logged in to download this attachment.
  • #17 21877225
    divadiow
    Level 38  
    Posts: 5216
    Help: 448
    Rate: 917
    thanks for the updates. Did you go with OpenLN882H or with ESPHome/LT?
  • #18 21877756
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    I fix static IP issue in a code and MAC address, and go with ESPHome, as I have more than 100 devices in ESPHome.
  • #19 21884532
    magikow
    Level 1  
    Posts: 1
    >>21877215 I have a similar circuit on my Smart Switch 4 channel - what settings to take in Flasher - what circuit to choose and do I short circuit A9 to ground when reading ?
  • #20 21884786
    bl00dy
    Level 7  
    Posts: 38
    Rate: 3
    Yes. Just A9 to ground when reading or writing chip.

  • Boot log confirms LN882H Tuya firmware startup

    #21 21900251
    xopkep
    Level 5  
    Posts: 20
    Rate: 2
    Boot log:
    Spoiler:

    bootloader build time: 05:54:04
    config item not found perip_param value
    -- tuya project compile time: Feb 28 2026 17:26:42--
    ble mac[4e:d7:a8:b2:f1:20]
    [BLIB_I]BLIB Ver: 1.0.5 [GCC] [/soft/ln882h_tuya_ble_host.git (branch:dev_tuya_host_gcclib) Commit-e2021f75] [build time:Jul 3 202516:49:42]
    xTaskCreate, name: rw_task, priority: 9, stack size: 2048
    xTaskCreate, name: worker, priority: 2, stack size: 1536
    xTaskCreate, name: ty_main, priority: 3, stack size: 4096
    xTaskCreate, name: IDLE, priority: 0, stack size: 1024
    xTaskCreate, name: Tmr Svc, priority: 10, stack size: 2048
    rw_main loop start!!
    Before enter tuya_main, Total:168124; Free:155696
    force enter Normal mode!
    Failed to enter ate mode! Start tuya user main.
    xTaskCreate, name: tuya_app_main, priority: 4, stack size: 4096
    xTaskCreate, name: TUYA_TCPIP, priority: 9, stack size: 2048
    tkl_ethernetif_init
    tkl_ethernetif_init
    xTaskCreate, name: app_msg, priority: 4, stack size: 3072
    xTaskCreate, name: sys_timer, priority: 5, stack size: 4096
    xTaskCreate, name: wq_system, priority: 3, stack size: 5120
    xTaskCreate, name: wq_highpri, priority: 4, stack size: 4096
    ----- tkl_watchdog_init
    wdg shift_left_num:0x10, set num:65535, top:0x0d
    xTaskCreate, name: health_monitor, priority: 5, stack size: 1536
    [01-01 00:00:00 ty N][ty_sys.c:272] sdk_info:< TuyaOS V:3.5.6 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
    < BUILD AT:2025_05_13_16_33_11 BY ci_manage FOR tuyaos-iot AT ln882h >
    IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 LITTLE_END:1 SL:0 OPERATING_SYSTEM:98 RELIABLE_TRANSFER:0 >

    [01-01 00:00:00 ty N][ty_sys.c:273] name:ln_sw_onoff:1.5.3
    [01-01 00:00:00 ty N][ty_sys.c:274] firmware compiled at Feb 28 2026 17:26:29
    [01-01 00:00:00 ty N][ty_sys.c:275] system reset reason:[0]
    [01-01 00:00:00 ty N][lr:0x100c165f] key_addr: 0x1ec000 block_sz 4096
    [01-01 00:00:00 ty N][lr:0x100c1939] get key:
    0xad 0xd7 0x3d 0xa4 0x9c 0xe8 0xc3 0xa5 0xbf 0xa5 0x0 0xd9 0xea 0x16 0x3f 0xb2
    [01-01 00:00:00 ty N][lr:0x1009d6d1] uni_random_init...
    [01-01 00:00:00 ty N][lr:0x1009d975] tuya_tls_rand_init ok!
    set work mode 2, is open 0, current ln mode: 0
    wifi not start, turn on first
    adapt wifi start <m:2>, hw_ready:0
    start rf preprocess and image cal
    [WLIB_E]idx=00, iq_hex_cal=0x807F, i=128, q=127, iavg= 1, qavg=102
    [WLIB_E]idx=01, iq_hex_cal=0x817E, i=129, q=126, iavg= 8, qavg= 29
    [WLIB_E]idx=02, iq_hex_cal=0x817B, i=129, q=123, iavg= 8, qavg= 70
    [WLIB_E]idx=03, iq_hex_cal=0x8077, i=128, q=119, iavg= 91, qavg= 66
    [WLIB_E]idx=04, iq_hex_cal=0x7E74, i=126, q=116, iavg= 96, qavg= 77
    [WLIB_E]idx=05, iq_hex_cal=0x817F, i=129, q=127, iavg= 13, qavg=110
    [WLIB_E]idx=06, iq_hex_cal=0x817E, i=129, q=126, iavg= 35, qavg= 12
    [WLIB_E]idx=07, iq_hex_cal=0x817C, i=129, q=124, iavg= 51, qavg= 59
    [WLIB_E]idx=08, iq_hex_cal=0x8178, i=129, q=120, iavg= 21, qavg= 61
    [WLIB_E]idx=09, iq_hex_cal=0x7F74, i=127, q=116, iavg= 39, qavg= 76
    [WLIB_E]idx=10, iq_hex_cal=0x817F, i=129, q=127, iavg= 15, qavg=103
    [WLIB_E]idx=11, iq_hex_cal=0x817E, i=129, q=126, iavg= 38, qavg= 18
    [WLIB_E]idx=12, iq_hex_cal=0x817B, i=129, q=123, iavg= 53, qavg= 72
    [WLIB_E]idx=13, iq_hex_cal=0x8178, i=129, q=120, iavg= 11, qavg= 70
    [WLIB_E]idx=14, iq_hex_cal=0x7F74, i=127, q=116, iavg= 35, qavg= 70
    [WLIB_E]idx=15, iq_hex_cal=0x817F, i=129, q=127, iavg= 24, qavg=103
    [WLIB_E]idx=16, iq_hex_cal=0x817E, i=129, q=126, iavg= 42, qavg= 34
    [WLIB_E]idx=17, iq_hex_cal=0x817B, i=129, q=123, iavg= 63, qavg= 74
    [WLIB_E]idx=18, iq_hex_cal=0x8177, i=129, q=119, iavg= 25, qavg= 56
    [WLIB_E]idx=19, iq_hex_cal=0x7F73, i=127, q=115, iavg= 70, qavg= 39
    [WLIB_E]idx=20, iq_hex_cal=0x8080, i=128, q=128, iavg= 60, qavg= 50
    [WLIB_E]idx=21, iq_hex_cal=0x7F7F, i=127, q=127, iavg= 86, qavg= 72
    [WLIB_E]idx=22, iq_hex_cal=0x7E7E, i=126, q=126, iavg= 1, qavg= 51
    [WLIB_E]idx=23, iq_hex_cal=0x7D7C, i=125, q=124, iavg= 8, qavg= 70
    [WLIB_E]idx=24, iq_hex_cal=0x787A, i=120, q=122, iavg= 7, qavg= 18
    xTaskCreate, name: wifi_cfg, priority: 5, stack size: 2048
    xTaskCreate, name: mac_task, priority: 9, stack size: 2048
    [WLIB_I]cap_comp = -8, xtal_capbank_tab:[0]:32 [1]:27 [2]:27 [3]:27 [4]:42 [5]:62 [6]:62 [7]:62
    [WLIB_I][original]phy_tab_1f(GN):0x50, phy_tab_20(B):0x3C
    [WLIB_I][efuse]phy_tab_1f(GN):0x50, phy_tab_20(B):0x3C, efuse_comp:0
    [WLIB_I][g_tx_comp]b_flag=0xFF, gn_flag=0xFF
    [WLIB_I][g_tx_comp.b_ch ]: ch1=0,ch2=0,ch3=0,ch4=0,ch5=0,ch6=0,ch7=0,ch8=0,ch9=0,ch10=0,ch11=0,ch12=0,ch13=0
    [WLIB_I][g_tx_comp.gn_ch]: ch1=0,ch2=0,ch3=0,ch4=0,ch5=0,ch6=0,ch7=0,ch8=0,ch9=0,ch10=0,ch11=0,ch12=0,ch13=0
    [WLIB_I][flash]phy_tab_1f(GN):0x50, phy_tab_20(B):0x3C, tx_pwr_comp_all=0, tx_pwr_comp_b=0, tx_pwr_comp_gn=0, b_ch=0, gn_ch=0
    [WLIB_I]==>temp_sect:3,phy_tab_1f:0x50,phy_tab_20:0x3C
    [WLIB_I]<==temp_sect:3,phy_tab_1f:0x50,phy_tab_20:0x3C
    XTAL CAP VAL:-8.
    wifi stop
    wifi sta start
    [WLIB_I]LN882H WiFi Lib Ver: 1.1.3 [GCC] [build time:Jun 18 2025 20:22:01][0x010103ff](custom-tuya_cuco:e4f5a7f5)
    [WLIB_I]STA_Startup.
    STA startup!
    [WLIB_I]Disconnected.
    [WLIB_I]HwInd:UKI:0
    [WLIB_I]Disconnected.
    current work mode 0
    No need to switch mode, mode:0
    [tkl_wifi_station_fast_connect:1626] ssid: xopkland pwd: 1234567890987654321 pwd len: 19, channel: 13
    [WLIB_I]Disconnected.
    [tkl_wifi_get_mac:1239] if: 0, mac: 20:f1:b2:a8:d7:4d
    ble_mac: 4e:d7:a8:b2:f1:20
    [WLIB_I]LN882H WiFi Lib Ver: 1.1.3 [GCC] [build time:Jun 18 2025 20:22:01][0x010103ff](custom-tuya_cuco:e4f5a7f5)
    [WLIB_I]STA_Startup.
    STA startup!
    [WLIB_I]Disconnected.
    [WLIB_I]HwInd:UKI:0
    [WLIB_I]Disconnected.
    [WLIB_I]will scan on ch:13
    [WLIB_I]Disconnected.
    [01-01 00:00:00 ty N][lr:0x10096891] have actived over 15 min, not enter mf_init
    [01-01 00:00:00 ty N][ty_sys.c:338] mf_init succ
    [01-01 00:00:00 ty N][tdd_button_gpio.c:191] tdd_gpio_button_register succ
    [01-01 00:00:00 ty N][tdd_button_gpio.c:191] tdd_gpio_button_register succ
    [01-01 00:00:00 ty N][t[WLIB_I]will connect...
    [WLIB_I]Disconnected.
    dd_button_gpio.c:191] tdd_gpio_button_register succ
    [01-01 00:00:00 ty N][tdd_button_gpio.c:191] tdd_gpio_button_register succ
    [01-01 00:00:00 ty N][tdd_button_gpio.c:191] tdd_gpio_button_register succ
    [01-01 00:00:00 ty N][ty_sys.c:364] gwcm_mode 5
    [01-01 00:00:00 ty N][ty_sys.c:59] have actived over 15min, don't scan prod test ssid
    [01-01 00:00:00 ty N][lr:0x100a6ba3] wifi soc init. pid:f3hj49ccab7praz6 firmwarekey: ver:1.5.3
    [01-01 00:00:00 ty N][lr:0x100acbe1] start wifi link params validate, nc_tp:9 md:3
    [01-01 00:00:00 ty N][lr:0x100acc69] gw_wsm.nc_tp:9
    [01-01 00:00:00 ty N][lr:0x100acc73] gw_wsm.md:3
    [01-01 00:00:00 ty N][lr:0x100a1bfd] Last reset reason: 0
    [01-01 00:00:00 ty N][lr:0x100a1c8d] gw_cntl->gw_wsm.stat:2
    [01-01 00:00:00 ty N][lr:0x100a1d27] gw_cntl->gw_if.abi:0 input:0
    [01-01 00:00:00 ty N][lr:0x100a1d35] gw_cntl->gw_if.product_key:f3hj49ccab7praz6, input:f3hj49ccab7praz6
    [01-01 00:00:00 ty N][lr:0x100a1d41] gw_cntl->gw_if.tp:0, input:0
    [01-01 00:00:00 ty N][lr:0x100a1d55] gw_cntl->gw_if.firmware_key:, input:
    [01-01 00:00:00 ty N][lr:0x100a2359] enter success_proc
    [tkl_wifi_get_mac:1239] if: 0, mac: 20:f1:b2:a8:d7:4d
    ble_mac: 4e:d7:a8:b2:f1:20
    [01-01 00:00:00 ty N][lr:0x100a236d] serial_no:20f1b2a8d74d
    [01-01 00:00:00 ty E][lr:0x100c56d5] uf_open measure_rslt err 8
    [01-01 00:00:00 ty E][tfm_timing_storage.c:147] uf measure_rslt can't open
    [01-01 00:00:00 ty N][lr:0x100bb5ab] bt startup attr:ff
    [01-01 00:00:00 ty N][lr:0x100823d3] upd product_id type:0 f3hj49ccab7praz6
    xTaskCreate, name: host_main_thread_hdl, priority: 8, stack size: 5120
    [01-01 00:00:00 ty N][lr:0x10082395] ty bt sdk init success finish
    [01-01 00:00:00 ty N][lr:0x100a266b] __devos_init_evt success
    [01-01 00:00:00 ty N][lr:0x100a19ab] already bind
    [01-01 00:00:00 ty E][lr:0x1009ec19] mqtt Get IP Fails
    xTaskCreate, name: mq_cntl_task, priority: 4, stack size: 5120
    set work mode 2, is open 1, current ln mode: 0
    current work mode 0
    No need to switch mode, mode:0
    [01-01 03:00:00 ty N][lr:0x100a8227] cur stat:5 0x1006a5c5 -->>
    [01-01 03:00:00 ty N][lr:0x100a8261] wifi netstat changed to:5 -->>
    [01-01 03:00:00 ty N][lr:0x100a8277] report wifi netstat[5] to callback -->>
    [01-01 03:00:00 ty N][ty_app_elec_trigger_network.c:81] --->net state change to:5
    [01-01 03:00:00 ty N][lr:0x1007d493] Start Adv
    [01-01 03:00:00 ty N][lr:0x10081f45] ble adv updated
    ======>[__tdd_relay_elec_write] pin: 14, status: 0
    ======>[__tdd_relay_elec_write] pin: 16, status: 0
    ======>[__tdd_relay_elec_write] pin: 20, status: 0
    ======>[__tdd_relay_elec_write] pin: 22, status: 0
    [01-01 03:00:00 ty E][app_elec_button.c:531] ret:-6
    xTaskCreate, name: button_scan, priority: 4, stack size: 2048
    [01-01 03:00:00 ty N][tdl_button_manage.c:632] tdl_button_create succ
    [01-01 03:00:00 ty N][tdl_button_manage.c:632] tdl_button_create succ
    [01-01 03:00:00 ty N][tdl_button_manage.c:632] tdl_button_create succ
    [01-01 03:00:00 ty N][tdl_button_manage.c:632] tdl_button_create succ
    [01-01 03:00:00 ty N][tdl_button_manage.c:632] tdl_button_create succ
    xTaskCreate, name: senior_tm_thrd, priority: 3, stack size: 2304
    [01-01 03:00:00 ty N][app_remote.c:414] remote list num:[6]
    [01-01 03:00:00 ty N][app_remote.c:438] analysis list message success!
    [01-01 03:00:00 ty N][app_driver_remote.c:351] [433]-start_us:[173:243], short:[4:17], long:[14:34]
    xTaskCreate, name: remote_task_0, priority: 5, stack size: 4096
    [01-01 03:00:00 ty N][app_driver_remote.c:382] *** driver remote io:6, hard timer:0 ***
    [01-01 03:00:00 ty N][app_driver_remote.c:393] tuya driver remote init success
    [01-01 03:00:00 ty N][app_remote.c:851] [remote] init success! Ver:[1.0.0]
    tkl_thread_release, name: tuya_app_
    [01-01 03:00:00 ty N][tfm_basic_timer.c:366] time is not sync!
    [WLIB_I]Status: Scan Successful. Initaiting Join:
    [WLIB_I]SSID = xopkland
    [WLIB_I]BSSID = 50:c7:bf:d6:14:ac
    [WLIB_I]Channel = 13
    [WLIB_I]RSSI = -36
    [WLIB_I]StationID = 20:f1:b2:a8:d7:4d
    [WLIB_I]Status: Initiating Authentication.
    [WLIB_I]Status: Authentication Successful. Initiating Association.
    [WLIB_I]Status: Association Successful.
    [WLIB_I]Connected.
    STA connected to target AP!
    >>>>>>>>>>FAST_CONN: STA start FAST DHCP!
    +--------------- net device info ------------+
    |netif hostname: lwip0 |
    |netif ip = 192.168.1.70 |
    |netif mask = 255.255.255.0 |
    |netif gateway = 192.168.1.1 |
    |netif mac : [20:F1:B2:A8:D7:4D] |
    +--------------------------------------------+
    tuya_wifi_get_ip_cb
    [01-01 03:00:02 ty N][lr:0x100ac6d1] wifi status changed to 0
    [01-01 03:00:02 ty N][lr:0x100a8227] cur stat:6 0x1006a5c5 -->>
    [01-01 03:00:02 ty N][lr:0x100a8261] wifi netstat changed to:6 -->>
    [01-01 03:00:02 ty N][lr:0x100a8277] report wifi netstat[6] to callback -->>
    [01-01 03:00:02 ty N][ty_app_elec_trigger_network.c:81] --->net state change to:6
    xTaskCreate, name: lan_sock_loop, priority: 3, stack size: 4096
    [01-01 03:00:02 ty N][lr:0x1009ebe5] mqtt ip:192.168.1.70 0xc0a80146
    [01-01 03:00:02 ty N][lr:0x1009fb97] transporter connect host[m3-eu.iot334.com] success, begin to mqtt connect
    [01-01 03:00:02 ty N][lr:0x1009fc09] mqtt connect success
    [01-01 03:00:02 ty N][lr:0x1009fc3b] mqtt subcribe success
    [01-01 03:00:02 ty N][lr:0x100a8227] cur stat:7 0x1006a5c5 -->>
    [01-01 03:00:02 ty N][lr:0x100a8261] wifi netstat changed to:7 -->>
    [01-01 03:00:02 ty N][lr:0x100a8277] report wifi netstat[7] to callback -->>
    [01-01 03:00:02 ty N][ty_app_elec_trigger_network.c:81] --->net state change to:7
    [01-01 03:00:02 ty E][lr:0x10076a23] devid: " dparr[0]:39 not find
    [01-01 03:00:02 ty E][app_elec_delay_off_timer.c:369] ret:-1
    [01-01 03:00:02 ty E][lr:0x10076a23] devid: " dparr[0]:26 not find
    [01-01 03:00:02 ty E][lr:0x100bb51f] tuya_ble_save_beacon_key err -1
    reboot type(0:power-on;1:soft-rst;2:wdt-rst): 0
    reboot count: 0
    [ln_ty_sdk_ver: 0.0.5_alpha or 0x00000500] [build time:2022-05-17_14:57:03]
    [Git info: develop_198ece8]
    [BLIB Ver: 1.0.5 [GCC] [/soft/ln882h_tuya_ble_host.git (branch:dev_tuya_host_gcclib) Commit-e2021f75] or 0x010005ff] [build time:Jul 3 202516:49:42]
    [01-01 03:00:03 ty N][lr:0x10082603] ble_sdk_send skip, no connect:4
    [01-01 03:00:05 ty E][lr:0x100c56d5] uf_open netcfg_log err 8
    [01-01 03:00:06 ty N][tfm_timing_storage.c:71] storage sucess
    [01-01 03:00:06 ty N][tfm_basic_timer.c:366] time is not sync!
    [01-01 03:00:11 ty N][tfm_basic_timer.c:366] time is not sync!
    [05-10 13:51:41 ty N][lr:0x1009898d] Update Timer from cloud
    [05-10 13:51:46 ty E][tuya_svc_upgrade.c:861] result null
    adc raw: 886, temp_IC: 70, cap:0x9B340500, rf43:0x0007, reg74:0x0228
    remote task init success
    [05-10 13:52:15 ty N][app_remote.c:760] recv 433 addr[0a-47-d8]
    [05-10 13:52:15 ty N][app_remote.c:622] [1:close 2:open 3:triger] cmd:[0,3,0,0]
    ======>[__tdd_relay_elec_write] pin: 16, status: 1
    [05-10 13:52:16 ty E][ty_app_elec_event.c:121] ret:-1
    [05-10 13:52:16 ty N][app_driver_remote.c:231] 433 continue check filter ok!
    [05-10 13:52:17 ty N][app_remote.c:760] recv 433 addr[0a-47-d8]
    [05-10 13:52:17 ty N][app_remote.c:622] [1:close 2:open 3:triger] cmd:[0,3,0,0]
    ======>[__tdd_relay_elec_write] pin: 16, status: 0
    [05-10 13:52:18 ty N][app_driver_remote.c:231] 433 continue check filter ok!
    [05-10 13:52:22 ty N][tfm_timing_storage.c:71] storage sucess
    adc raw: 890, temp_IC: 72, cap:0x9B340500, rf43:0x0007, reg74:0x0228
    ======>[__tdd_relay_elec_write] pin: 14, status: 1
    ======>[__tdd_relay_elec_write] pin: 16, status: 1
    ======>[__tdd_relay_elec_write] pin: 20, status: 1
    ======>[__tdd_relay_elec_write] pin: 22, status: 1
    [05-10 13:52:34 ty E][ty_app_elec_event.c:114] ret:-1
    [05-10 13:52:34 ty E][ty_app_elec_event.c:114] ret:-1
    [05-10 13:52:34 ty E][ty_app_elec_event.c:114] ret:-1
    [05-10 13:52:34 ty E][ty_app_elec_event.c:114] ret:-1
    ======>[__tdd_relay_elec_write] pin: 14, status: 0
    ======>[__tdd_relay_elec_write] pin: 16, status: 0
    ======>[__tdd_relay_elec_write] pin: 20, status: 0
    ======>[__tdd_relay_elec_write] pin: 22, status: 0
    [05-10 13:52:41 ty N][tfm_timing_storage.c:71] storage sucess



    Photo:
    Spoiler:

    LN-CB3S Module Pinout and Flashing Issues on Tuya Wall Switch – Any Documentation?
    LN-CB3S Module Pinout and Flashing Issues on Tuya Wall Switch – Any Documentation?


    I received a device with this module. ltchiptool couldn't read or flash it, and neither could BK7231Flasher. i connected it using the pinout from post #4. There's a log (above) on U1TXD/B9 if A9 isn't grounded; if it is, there's silence.
    Perhaps the module needs to be desoldered - i haven't tried it yet.

    UPD:
    i did it right after wrote it. Buttons 3 and 4 are connected to the RX/TX. There are also pull-up resistors and capacitors there. removed them, and everything flashed fine. im attaching a backup of the original firmware in case it's useful to anyone.
    Spoiler:

    LN-CB3S Module Pinout and Flashing Issues on Tuya Wall Switch – Any Documentation?
    readResult...-28-35.bin (2 MB)You must be logged in to download this attachment.

  • RC driver missing from this firmware build

    #23 21900401
    xopkep
    Level 5  
    Posts: 20
    Rate: 2
    >>21900293
    Spoiler:

    {
    "vendor": "Tuya",
    "bDetailed": "0",
    "name": "4CH Smart Switch",
    "model": "4CH Smart Switch",
    "chip": "LN882H",
    "board": "LN-CB3S_V1.0",
    "flags": "1024",
    "keywords": [
    "4ch",
    "RF",
    "Switch"
    ],
    "pins": {
    "1": "Rel;4",
    "2": "Btn;4",
    "3": "Btn;3",
    "4": "Rel;3",
    "5": "Rel;1",
    "6": "Rel;2",
    "10": "WifiLED_n;0",
    "11": "RCRecv;0",
    "20": "Btn;2",
    "21": "Btn;1"
    },
    "command": "",
    "image": "https://obrazki.elektroda.pl/7386383800_1778411028.jpg",
    "wiki": "https://www.elektroda.com/rtvforum/topic4162022.html#21900251"
    }

    This is the resulting OBK configuration. There are no distinguishing marks for the name or model.
    However, there's another problem: can anyone tell me how to get the compiled firmware with the RC driver?
    i receive a message:
    Quote:
    Info:MAIN:Driver RC is not known in this build.
    Info:MAIN:Available drivers:
    ...
Reply | New topic
Report a violation of the law

Topic summary

LABEL_AI_GENERATED
The discussion identifies the LN-CB3S module as an LN882H-based Tuya wall switch module rather than a standard CB3S/ESP module. The correct flashing access is via RX/TX on the module’s default UART pins, with A9 pulled low during boot to enter flashing mode; B9 is used for boot logs when A9 is not grounded. Several users report successful backup, flashing, and firmware replacement using BK7231GUIFlashTool, BK7231Flasher, ltchiptool, and OpenBeken/OpenLN882H. One case required removing pull-up resistors and capacitors from the RX/TX lines because the buttons were tied to those pins. Dumps show a 2 MB flash layout with boot, partition table, app, ota, nvds, kv, kvs, and user partitions, and the device was confirmed to run LN882H firmware with Tuya boot logs and working ESPHome/OpenBeken installs.
AI summary based on the discussion. May contain errors.
Today's popular
ADVERTISEMENT