I have a HKWL-MS03W motion sensor, a Mirabella rebranded one. They’re cheap on Chinese websites.
EDIT: DO NOT FLASH VIA SERIAL, USE TUYA CONVERT. SERIAL FLASH HAS A HIGH/100% BRICK CHANCE.
PLEASE READ NEWER POSTS.
Uses TYWE3S.
I tried configuring TuyaMCU with both
RX > GPIO1
TX > GPIO3
And
RX > GPIO13
TX > GPIO15
But get nothing but send 55aa00000000ff
Anyone got any ideas?
I have been trying to hardware flash this device forever, I was under the impression that I had to ground GPIO0.
I can’t seem to find GPIO1, or MRST.
Are you able to post a picture of your setup.
I will be trying to flash it with ESPHome, no idea if it will make any difference to your issue.
Worth a shot.
EDIT: DO NOT FLASH VIA SERIAL, USE TUYA CONVERT. SERIAL FLASH HAS A HIGH/100% BRICK CHANCE.
PLEASE READ NEWER POSTS.
“NRST”…
Ground both throughout flashing process.
GPIO1 could be on the board, but I just leaned a pin up against the sensor then taping it.
I did all pins like this with tape and just held VCC
Thanks for the reply.
That’s differently a creative solution!
Did you powered the chip by the VDD near the NRST?
As for RX and TX did you use the MCU pins, or those pads on the PCB.
Will get back to you later on how it goes if I have time tonight!
EDIT: DO NOT FLASH VIA SERIAL, USE TUYA CONVERT. SERIAL FLASH HAS A HIGH/100% BRICK CHANCE.
PLEASE READ NEWER POSTS.
I was going to use TX and RX pads next to the esp but chose to tape them directly on, seems they sat so secure and stable, plus no solder or holding.
I powered it with VCC on the esp by just holding a dupont pin against it.
Rx, Tx, Ground, and gpio1 taped on.
NRST stays in on its own with a pin jammed in there.
VCC held on by hand
NRST, gpio1 and esp gnd all connected to each other.
I’m sure you can use another gnd though.
Thanks for the help, I have flashed the device with ESPHome and enabled OTA which works perfectly.
Now I think I am at your stage, I cannot find the pin that tells the esp the motion detector has been triggered.
I will have to look more into it tomorrow.
I believe what you are getting now “55aa00000000ff” is just a heart beat for the wifi.
I gathered it was heartbeat.
I have been busy with work and havent had a chance to do much except read.
Maybe we can try serial debug or a debug module/build:
Untill I get more time, I’m going to read up on the MCU and might ask in a discord or telegram chat.
Same here, quite busy.
Been reading up on some ESPHome stuff, might be useful for you too.
https://github.com/brandond/esphome-tuya_pir
https://beta.esphome.io/components/uart.html
Thought I would bump this and see how you are going, I have not been able to get this working yet. 
I have some time tomorrow and will give it another shot. Sorry, my line of work is very busy around Christmas and new year. Have had no time
No rush, I am the same. Only had a few minutes here and there around Christmas.
I don’t want to give up on these things just yet.
Have you been using this module:
Yeah that’s the one. I asked on telegram and was asked if I had sniffed tx/rx with original firmware. So I’m going to do that and return the info and see where we go from there.
Will find out what info is passed back and forth on MCU on original firmware.
Edit: I haven’t tried rx/tx reversed yet.
TX > GPIO1
RX > GPIO3
Or
TX > GPIO13
RX > GPIO15
I should have tried earlier. Worth a quick try later tonight.
Some devices have them reversed.
It could explain why we get no data…
I will also verify that these are the correct gpio pins.
If incorrect, this could explain why I couldn’t flash from the labled TX/RX pads…
I will try this too, are you able to upload the original firmware. Seems that I did not back it up…
I thought I had a backup… I do not. I tested pins for continuity. IO1 and 03 are correct, so reversing did nothing. I must have just had a bad solder initially.
I’m gonna return this to the store for a fresh one. I have my receipt still. Will put original firmware up when I dump it.
So I got a new one, a second one, set it up with original firmware. Did you use it at all with the original firmware? The blue light flashes once when motion is detected. But the light doesn’t do anything on my Tasmota one.
Perhaps it controlled by the esp…
I connected the new one via serial
I would think that I would get the same data from the MCU on both but I don’t…
This is what i get on the new one when motion is detected
If you already flashed Tasmota on the sensor try https://templates.blakadder.com/TYMC-1.html
It’s working for the battery powered devices, both door/window and PIR sensors (needs to declare the device as such).
I have flashed one of these reed sensors with Tasmota. But the template it uses is just Tuya Rx>GPIO3 Tuya Tx>GPIO1
Which is what we have already tried
The HKWL-MS03W also has a micro USB port for power, which I am using.
I’m going to try wiring the working og firmware sensors MCU to my Tasmota flashed tywe3s on the ‘broken’ one. See how that goes… If it works, then somthing wrong with Tasmota flashed ones MCU.
Looking at the PCB, seems like there are in fact 2 MCU’s on that PIR device (like the writeup on the reed version). This isn’t surprising, since it looks like an sr501 sensor, which will suck with wifi rfi. So using a separate MCU to handle the pir signal while keeping the esp off is likely. So there may be 2 sets of UART pins floating around there… have you probed to make sure they’re connected to the esp UARTs?
My new one seems to have shit itself after sniffing serial. No led, not even the initial flash it used to do when first connected to power and app can’t connect. These things are driving me nuts.
Maybe I should send one to someone else.
I’m pretty new when it comes to working with any hardware. Have I checked if the second MCUs UART connected to esp UART? I wouldn’t know when to start honestly…
Edit forget I said anything…
