HKWL-MS03W motion sensor with Tasmota

Hi, I was actually able to easily flash the device to Tasmota and I flashed it to the latest firmware. Thanks to all the information in this post and these ones:

I was able to get mine working and was able to easily set up the system to report the PIR in Home assist.

Below is my setup:
Template, Model Config, Other Config

Tasmota Commands I executed:
Enable Battery Mode: TuyaMCU 51,21
Enable TuyaReceived: SetOption66 1
Rule (1) to enable report the Reed switch trigger and release:
Rule1 ON TuyaReceived#Data=55AA0005000A65010001016601000100DE DO publish KitchenPir/tele/PirSensor Sensor_triggered ENDON ON TuyaReceived#Data=55AA0005000A65010001006601000100DD DO publish KitchenPir/tele/PirSensor Sensor_Triggered_Cleared ENDON
Enable the Rule: Rule1 1

Rule (2) to enable reporting the tamper switch:
Rule2 ON TuyaReceived#Data=55AA0005000F6501000100660100010068010001014D DO publish KitchenPir/tele/PirSensor Tamper_Triggered ENDON
Enable the Rule: Rule2 1

Hope this helps someone.

I am not getting any Tuyareceived…
I’ve done all the commands except the rules.
I’m getting the blue light on motion since executing the battery commands though.
No idea what could be wrong …

Sorry, I forgot to add that you do need to set ‘Module 54’
Be sure that ‘setoption66 1’ is set

Please run ‘SerialSend5 55aa0001000000’ and see if it is responding with a send command.

also set weblog to 4 to see if the messages are being generated on the device side

I also needed to reboot the device ,

you should get a response that looks like this when the device is triggered

00:00:18 MQT: KitchenPir/tele/RESULT = {“TuyaReceived”:{“Data”:“55AA0005000A65010001016601000100DE”,“Cmnd”:5,“CmndData”:“65010001016601000100”}}
00:00:18 RUL: TUYARECEIVED#DATA=55AA0005000A65010001016601000100DE performs “publish KitchenPir/tele/PirSensor Sensor_triggered”
00:00:18 MQT: KitchenPir/tele/PirSensor = Sensor_triggered
00:00:20 MQT: KitchenPir/tele/HASS_STATE = {“Version”:“8.1.0(tasmota)”,“BuildDateTime”:“2019-12-25T12:33:25”,“Core”:“2_6_1”,“SDK”:“2.2.2-dev(38a443e)”,“Module”:“Tuya MCU”,“RestartReason”:“Software Watchdog”,“Uptime”:“0T00:00:22”,“WiFi LinkCount”:1,“WiFi Downtime”:“0T00:00:08”,“MqttCount”:1,“BootCount”:392,“SaveCount”:461,“IPAddress”:“”,“RSSI”:“80”,“LoadAvg”:19}
00:00:21 MQT: KitchenPir/tele/RESULT = {“TuyaReceived”:{“Data”:“55AA0005000A65010001016601000100DE”,“Cmnd”:5,“CmndData”:“65010001016601000100”}}
00:00:21 RUL: TUYARECEIVED#DATA=55AA0005000A65010001016601000100DE performs “publish KitchenPir/tele/PirSensor Sensor_triggered”
00:00:21 MQT: KitchenPir/tele/PirSensor = Sensor_triggered
00:00:21 MQT: KitchenPir/tele/RESULT = {“TuyaReceived”:{“Data”:“55AA0005000A65010001006601000100DD”,“Cmnd”:5,“CmndData”:“65010001006601000100”}}
00:00:21 RUL: TUYARECEIVED#DATA=55AA0005000A65010001006601000100DD performs “publish KitchenPir/tele/PirSensor Sensor_Triggered_Cleared”
00:00:21 MQT: KitchenPir/tele/PirSensor = Sensor_Triggered_Cleared

I have already done these commands… I must have buggered somthing whilst I was screwing around.
My og firmware one is also broken haha
Looks like I’m heading to Kmart, buying two more, putting my old two in the new packaging and returning them… Hopefully it’s not the Mirabella Genio rebranded ones that are the problem. Might just try the newest Tuya-convert and not open them. Thanks for all your help ! Will let you know how I go :slight_smile:

My Firmware flash was done using tuya-convert OTA, and I can confirm I am running this on a Genio PIR

I tried Tuya-convert for about an hour initially, but the older version seemed to have trouble on all my tywe3s devices so I went with a serial flash. The latest version has had no issues though. Poking around must have buggered it.
Thanks for the confirmation it works ota :slight_smile:

On further investigation, I have also seen that it produces different messages if it is powered via a USB connection (config above) vs when it purely runs off batteries. I will be looking into the battery only messages and posting a possible solution when I get a moment.

I have only ever used USB power. I did not think this would affect anything…
Still feel I best start from scratch. I haven’t had a chance to swap for new ones yet.

So having spent some time watching the traffic I think i have identified the different components:
It looks like the cmndData seems to contain the following unique bits of information (Happy to be corrected):
Tamper Switch: ‘6801000101’
ReedSwitch triggered: ‘6501000100’
Reedswtich multitrigger" ‘6501000101’
Not sure: ‘6601000100’ (is usually combined with reeds switch data i.e. 65010001006601000100)

Battery status indicator: ‘670200040000005F’ (67020004000000xx suspected because it only shows up in traffic when on battery power)

This is usually encaptulated in the return packet as
Command/Data stream/Checksum
55AA0005000A 6501000100 6601000100 DD (Powered Sample)
55AA00050017 6501000101 6702000400000064 6601000101 6801000101 28 (Battery Sample)

With this in Mind I’ve
I’ve updated my ruleset as follows:
Rule1 ON TuyaReceived#cmndData DO Publish KitchenPir/tele/PirSensor %value%_sensor_Triggered ENDON

I then handle the values with a match in HA

1 Like

Nice :slight_smile:

I suggest you upload template with all this info on

I put up the Mirabella Genio aroma diffuser not long ago :slight_smile:

It would be one of only two PIR sensors in the repo.

1 Like

it’s been added


Wow great progress guys, been away on holidays for a few weeks in Japan.
Ill have to try what @jssting is suggesting and I will get back to you guys!

I seem to also not be able to see any Tuyareceived output. I flashed with ESPHome OTA via placing the bin file in an existing config. I then applied all the settings via your template and enabled debug. I might try with tuya-convert tomorrow, I don’t believe the flashing method will change anything.

Hi Anthony, You need to ensure the ‘Setoption66 1’ is set, then also reboot the device and set
‘weblog 4’. I have set up 3 devices with the same config and they are working a charm. I have found on one that you sometimes need to swap tx and rx ports and then swap them back before it registers the traffic. Also, you need to be on Version >7.

I fear my initial flashing method is the reason for no tuya received…I bought another 2 and returned the broken ones. Complete success with my new ones.
Even when probing one whilst on original firmware I managed to break it somehow…

I have ensured the SetOption66 is set to 1, I also tried swapping tx and rx ports, and swapping them back; and I believe I am on 8.1.0(tasmota).

The only information I can get out of the device is when I hold down the sync button.
00:01:14 RSL: tasmota/tele/RESULT = {"TuyaReceived":{"Data":"55AA000400010105","Cmnd":4,"CmndData":"01"}}

I also believe that it restarts every few minutes as the console goes unresponsive and seems to clear and restart.

I am close to just buying a new device as @zacnut has done but I am willing to give it a few more goes. Only issue is that I don’t have the docket or packaging for this one.

Hi Anthony, you should not need the sync button, just wave your hand in front of the sensor and it should register the motion as a Tuya message which is the components you use to send the notifications. If you are powering it on USB, then you won’t need the Tuyasend 51,20 setting as it only maps the fact that it is battery powered which is why it will shut down every few minutes if no motion is detected. I will do a video of the next one I setup and post the link when done

Thanks for the fast reply!
Ah yes I am currently powering it via battery, I am glad that is not an issue then.

Yes I have tried waving my hand in front of the sensor, nothing appeared, the button was the last resort to get any type of reaction out of the device.

I don’t believe the setup is wrong, I am starting to think that I may of busted my devices sensor.

I did this as a challenge to myself and happy if it works. I did find that it’s response on batteries is probably not that great given that it needs to wake the MCU and ESP devices, and then register the motion. My suggestion here is to keep it on USB power of you need near real-time response.
I am currently looking at a RF bridge and 433mhz wireless PIR sensors, with the smarts being at the RF Bridge part, as the RF sensors are way more responsive as it only needs to send an RF signal.

You could also consider Zigbee devices: a little more expensive (at ~ 25-30% more than 433 Mhz), but with similar performances, quite low power consumption (usually with coin battery cells) and most important differentiation would be that the Zigbee protocol is secure (it won’t do much good to kids in the neighborhood to turn on/off your 433 Mhz devices, but still).

I will buy a new device today and tell you how it goes, could probably return the busted one in the same package a few days later and have 2 new ones :joy:

I believe I have the same issue as @zacnut. I’m assuming you used OTA to flash instead of opening the device up. May have blown something while doing so.

I’ll be in touch later once I have my new device!