If you already flashed Tasmota on the sensor try https://templates.blakadder.com/TYMC-1.html
It’s working for the battery powered devices, both door/window and PIR sensors (needs to declare the device as such).
I have flashed one of these reed sensors with Tasmota. But the template it uses is just Tuya Rx>GPIO3 Tuya Tx>GPIO1
Which is what we have already tried 
The HKWL-MS03W also has a micro USB port for power, which I am using.
I’m going to try wiring the working og firmware sensors MCU to my Tasmota flashed tywe3s on the ‘broken’ one. See how that goes… If it works, then somthing wrong with Tasmota flashed ones MCU.
Looking at the PCB, seems like there are in fact 2 MCU’s on that PIR device (like the writeup on the reed version). This isn’t surprising, since it looks like an sr501 sensor, which will suck with wifi rfi. So using a separate MCU to handle the pir signal while keeping the esp off is likely. So there may be 2 sets of UART pins floating around there… have you probed to make sure they’re connected to the esp UARTs?
My new one seems to have shit itself after sniffing serial. No led, not even the initial flash it used to do when first connected to power and app can’t connect. These things are driving me nuts.
Maybe I should send one to someone else.
I’m pretty new when it comes to working with any hardware. Have I checked if the second MCUs UART connected to esp UART? I wouldn’t know when to start honestly…
Edit forget I said anything…
Hi, I was actually able to easily flash the device to Tasmota and I flashed it to the latest firmware. Thanks to all the information in this post and these ones:
I was able to get mine working and was able to easily set up the system to report the PIR in Home assist.
Below is my setup:
Template, Model Config, Other Config
Tasmota Commands I executed:
Enable Battery Mode: TuyaMCU 51,21
Enable TuyaReceived: SetOption66 1
Rule (1) to enable report the Reed switch trigger and release:
Rule1 ON TuyaReceived#Data=55AA0005000A65010001016601000100DE DO publish KitchenPir/tele/PirSensor Sensor_triggered ENDON ON TuyaReceived#Data=55AA0005000A65010001006601000100DD DO publish KitchenPir/tele/PirSensor Sensor_Triggered_Cleared ENDON
Enable the Rule: Rule1 1
Rule (2) to enable reporting the tamper switch:
Rule2 ON TuyaReceived#Data=55AA0005000F6501000100660100010068010001014D DO publish KitchenPir/tele/PirSensor Tamper_Triggered ENDON
Enable the Rule: Rule2 1
Hope this helps someone.
I am not getting any Tuyareceived…
I’ve done all the commands except the rules.
I’m getting the blue light on motion since executing the battery commands though.
No idea what could be wrong …
Sorry, I forgot to add that you do need to set ‘Module 54’
Be sure that ‘setoption66 1’ is set
Please run ‘SerialSend5 55aa0001000000’ and see if it is responding with a send command.
also set weblog to 4 to see if the messages are being generated on the device side
I also needed to reboot the device ,
you should get a response that looks like this when the device is triggered
00:00:18 MQT: KitchenPir/tele/RESULT = {“TuyaReceived”:{“Data”:“55AA0005000A65010001016601000100DE”,“Cmnd”:5,“CmndData”:“65010001016601000100”}}
00:00:18 RUL: TUYARECEIVED#DATA=55AA0005000A65010001016601000100DE performs “publish KitchenPir/tele/PirSensor Sensor_triggered”
00:00:18 MQT: KitchenPir/tele/PirSensor = Sensor_triggered
00:00:20 MQT: KitchenPir/tele/HASS_STATE = {“Version”:“8.1.0(tasmota)”,“BuildDateTime”:“2019-12-25T12:33:25”,“Core”:“2_6_1”,“SDK”:“2.2.2-dev(38a443e)”,“Module”:“Tuya MCU”,“RestartReason”:“Software Watchdog”,“Uptime”:“0T00:00:22”,“WiFi LinkCount”:1,“WiFi Downtime”:“0T00:00:08”,“MqttCount”:1,“BootCount”:392,“SaveCount”:461,“IPAddress”:“192.168.0.12”,“RSSI”:“80”,“LoadAvg”:19}
00:00:21 MQT: KitchenPir/tele/RESULT = {“TuyaReceived”:{“Data”:“55AA0005000A65010001016601000100DE”,“Cmnd”:5,“CmndData”:“65010001016601000100”}}
00:00:21 RUL: TUYARECEIVED#DATA=55AA0005000A65010001016601000100DE performs “publish KitchenPir/tele/PirSensor Sensor_triggered”
00:00:21 MQT: KitchenPir/tele/PirSensor = Sensor_triggered
00:00:21 MQT: KitchenPir/tele/RESULT = {“TuyaReceived”:{“Data”:“55AA0005000A65010001006601000100DD”,“Cmnd”:5,“CmndData”:“65010001006601000100”}}
00:00:21 RUL: TUYARECEIVED#DATA=55AA0005000A65010001006601000100DD performs “publish KitchenPir/tele/PirSensor Sensor_Triggered_Cleared”
00:00:21 MQT: KitchenPir/tele/PirSensor = Sensor_Triggered_Cleared
I have already done these commands… I must have buggered somthing whilst I was screwing around.
My og firmware one is also broken haha
Looks like I’m heading to Kmart, buying two more, putting my old two in the new packaging and returning them… Hopefully it’s not the Mirabella Genio rebranded ones that are the problem. Might just try the newest Tuya-convert and not open them. Thanks for all your help ! Will let you know how I go 
My Firmware flash was done using tuya-convert OTA, and I can confirm I am running this on a Genio PIR
I tried Tuya-convert for about an hour initially, but the older version seemed to have trouble on all my tywe3s devices so I went with a serial flash. The latest version has had no issues though. Poking around must have buggered it.
Thanks for the confirmation it works ota
On further investigation, I have also seen that it produces different messages if it is powered via a USB connection (config above) vs when it purely runs off batteries. I will be looking into the battery only messages and posting a possible solution when I get a moment.
I have only ever used USB power. I did not think this would affect anything…
Still feel I best start from scratch. I haven’t had a chance to swap for new ones yet.
So having spent some time watching the traffic I think i have identified the different components:
It looks like the cmndData seems to contain the following unique bits of information (Happy to be corrected):
Tamper Switch: ‘6801000101’
ReedSwitch triggered: ‘6501000100’
Reedswtich multitrigger" ‘6501000101’
Not sure: ‘6601000100’ (is usually combined with reeds switch data i.e. 65010001006601000100)
Battery status indicator: ‘670200040000005F’ (67020004000000xx suspected because it only shows up in traffic when on battery power)
This is usually encaptulated in the return packet as
Command/Data stream/Checksum
Checksum
55AA0005000A 6501000100 6601000100 DD (Powered Sample)
55AA00050017 6501000101 6702000400000064 6601000101 6801000101 28 (Battery Sample)
With this in Mind I’ve
I’ve updated my ruleset as follows:
Rule1 ON TuyaReceived#cmndData DO Publish KitchenPir/tele/PirSensor %value%_sensor_Triggered ENDON
I then handle the values with a match in HA
1 Like
Nice
I suggest you upload template with all this info on https://templates.blakadder.com/index.html
I put up the Mirabella Genio aroma diffuser not long ago
It would be one of only two PIR sensors in the repo.
1 Like
Wow great progress guys, been away on holidays for a few weeks in Japan.
Ill have to try what @jssting is suggesting and I will get back to you guys!
Update:
I seem to also not be able to see any Tuyareceived output. I flashed with ESPHome OTA via placing the bin file in an existing config. I then applied all the settings via your template and enabled debug. I might try with tuya-convert tomorrow, I don’t believe the flashing method will change anything.
Hi Anthony, You need to ensure the ‘Setoption66 1’ is set, then also reboot the device and set
‘weblog 4’. I have set up 3 devices with the same config and they are working a charm. I have found on one that you sometimes need to swap tx and rx ports and then swap them back before it registers the traffic. Also, you need to be on Version >7.
I fear my initial flashing method is the reason for no tuya received…I bought another 2 and returned the broken ones. Complete success with my new ones.
Even when probing one whilst on original firmware I managed to break it somehow…
I have ensured the SetOption66 is set to 1, I also tried swapping tx and rx ports, and swapping them back; and I believe I am on 8.1.0(tasmota).
The only information I can get out of the device is when I hold down the sync button.
00:01:14 RSL: tasmota/tele/RESULT = {"TuyaReceived":{"Data":"55AA000400010105","Cmnd":4,"CmndData":"01"}}
I also believe that it restarts every few minutes as the console goes unresponsive and seems to clear and restart.
I am close to just buying a new device as @zacnut has done but I am willing to give it a few more goes. Only issue is that I don’t have the docket or packaging for this one.