logo elektroda
logo elektroda
X
logo elektroda

[w800] XM-HE201 24G Sensor flashed to OpenBeken, sensors partially working

juanwick 504 14
ADVERTISEMENT
  • #1 21796926
    juanwick
    Level 3  
    XM-HE201 24 GHz Human Presence Sensor. I've managed to flash one of these to OpenBeken but I am struggling to get all the sensors working.

    To flash to OpenBeken you need to tie the boot pin to ground on startup, UART will output "C" continuously when it's ready to receive the firmware from wm_tool.exe. Use TX0/RX0 to flash the firmware; TX1/RX1 are connected to the mmWave sensor (LD2410B.)

    Pin 21 is connected to the PIR sensor and Pin 24 to the mmWave sensor's GPIO pin; setting them to DoorSnsrWSleep has them working. I believe the illuminance sensor is between the button and the LED and one of its pins did have continuity with pin 4 but I don't know how to identify it or configure it with OpenBeken. To fully support this device I believe a driver would have to be written to interface the LD2410B UART; way beyond my depth, barely got it flashed with LLM assistance.

    XM-HE201 PCB with USB-C port, RF module, and labeled TX/RX and GND pins.

    PCB with PIR and mmWave modules placed on a blue cutting mat with grid lines


    OpenW800 panel showing 12136.0 Lux light level and 54.3°C chip temperature
    AI: When you try to configure or read from the illuminance sensor in OpenBeken, what exactly happens—do you get any readings, errors, or does it just not show up at all?
    I set the pin to ADC. The value stays between 10k and 12k whether the device is covered or a flashlight is shined directly on it. This is all on the advice of an LLM so it didn't really seem appropriate to even post as it's based on nothing tangible.
    AI: Have you tried any specific OpenBeken settings, commands, or logs to identify or configure the illuminance sensor, and if so, what were the results?
    I wouldn't know what to try; I tried dumping the OEM firmware from a second device, but OpenBK7231T_App couldn't extract the Tuya GPIO information from the dump. The dump had my SSID and network pass inside, so I'm fairly certain it's valid.
  • ADVERTISEMENT
  • #2 21797071
    divadiow
    Level 37  
    I guess it would need some driver writing to parse the uart comms from the S3KM1110?

    I guess if you used wm_tool.exe you didn't come across Easy Flasher which can take a backup of W800 before flashing to OpenW800
  • #3 21797096
    juanwick
    Level 3  
    Thank you for that. Took a backup of a second device. It was not able to extract any Tuya information as far as I can tell, but this backup does look better than my w800-python-flash-read attempt.
    Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
    Failed to extract Tuya keys - no json start found
    Sorry, failed to extract keys from Tuya Config in backup binary.
    Tuya config extractor - magic is at 1933312 


    The protocol is documented. LD2410 tool.exe is able to connect to the chip over TX1/RX1.

    EDIT
    Took another backup without my wifi information inside to share.
  • ADVERTISEMENT
  • #4 21798204
    divadiow
    Level 37  
    boot log from your w800 dump, with some obvious differences because I don't have the real device with sensor

    Code: Text
    Log in, to see the code


    appearance in Tuya app
    [w800] XM-HE201 24G Sensor flashed to OpenBeken, sensors partially workingApp screen showing motion sensor settings for device XM-HE201Device update screen showing “No updates available” message
  • #5 21798545
    juanwick
    Level 3  
    The light sensor visually looks like a Liteon LTR-303ALS-01 eBay listing I found. I see this in my log: I2C data received PART_ID = A0 I2C data received MANUFAC_ID = 05
  • ADVERTISEMENT
  • #6 21799119
    p.kaczmarek2
    Moderator Smart Home
    So, is it I2C or UART? If that's UART, then I can add a driver maybe, i'm just not sure if we have generic UART driver on W800.

    Still, UART protocol in the documentation of HLK-LD2410B looks somewhat more advanced than I'd expect from such a simple sensor.

    Would you be able to provide a capture of packets from UART so I can work on parsing them on my side?
    Helpful post? Buy me a coffee.
  • Helpful post
    #8 21799291
    insmod
    Level 30  
    I ordered both of them, will try to help when they arrive.
    Is your device battery powered? If not, then change DoorSnsrWSleep to dInput
  • #9 21799297
    p.kaczmarek2
    Moderator Smart Home
    I can't see any battery there, only USB C connector.

    Is this your device?
    XM-HE201 sensor with USB-C connection and mobile app shown on phone
    Motion sensor with USB-C port and 120-degree detection range up to 6 meters
    XiuMii presence sensor kit contents with USB-C cable and mounting accessories
    It should be, I got confused at first, because it has two USB C ports for easier mounting.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #11 21799995
    divadiow
    Level 37  
    not wanting to be left out, I have ordered the sensor

    LD2420 millimeter wave radar module with blue PCB and electronic components
  • Helpful post
    #14 21821486
    divadiow
    Level 37  
    insmod wrote:
    don't you already have this device?


    negative. only the above sensor

    Added after 2 [hours] 42 [minutes]:

    cool

    HLK-LD2410 app screen displaying motion sensor data and detection graphs App screen showing detected sensor HLK-LD2410_2095 with RSSI signal -52 Radar parameter settings screen with sensitivity and motion graphs Software update screen showing three selectable firmware versions

    Blue WiGig sensor with chip and wires on a blue work mat

    uart sniff attached is what the W800 dump is sending from PB6

    Sensor module with labeled pins: VCC, GND, UART Rx, UART Tx, and OUT

    Tuya firmware doesn't seem to want to talk to I don't think. Connected to PB6/PB16 and OUT is to PB24

    Code: Text
    Log in, to see the code


    Maybe I should just get the same device

Topic summary

The XM-HE201 24 GHz Human Presence Sensor was successfully flashed to OpenBeken firmware by grounding the boot pin at startup and using UART TX0/RX0 for flashing, while TX1/RX1 interfaces with the LD2410B mmWave sensor. Pins 21 and 24 correspond to the PIR sensor and mmWave sensor GPIO, respectively, and can be configured as DoorSnsrWSleep to function. The illuminance sensor's identification and configuration remain unclear, with partial continuity noted to pin 4. Full device support likely requires developing a UART driver for the LD2410B, which is complex. Backup attempts using Easy Flasher provided better data than w800-python-flash-read but failed to extract Tuya keys. The LD2410 tool.exe can communicate with the LD2410B chip over TX1/RX1, indicating documented protocol availability.
Summary generated by the language model.
ADVERTISEMENT