diff --git a/ATC_Thermometer31.bin b/ATC_Thermometer31.bin
new file mode 100644
index 00000000..b534b8b5
Binary files /dev/null and b/ATC_Thermometer31.bin differ
diff --git a/CGG1_v31.bin b/CGG1_v31.bin
new file mode 100644
index 00000000..bcd8ad98
Binary files /dev/null and b/CGG1_v31.bin differ
diff --git a/MHO_C401_v31.bin b/MHO_C401_v31.bin
new file mode 100644
index 00000000..4f623b6e
Binary files /dev/null and b/MHO_C401_v31.bin differ
diff --git a/README.md b/README.md
index c5fd6510..9f24dbcc 100644
--- a/README.md
+++ b/README.md
@@ -102,9 +102,9 @@ You can directly update/flash the firmware without downloading the binaries belo
 
 **Custom Firmware Versions:**
 
-* [LYWSD03MMC Custom Firmware Version 3.0](https://github.com/pvvx/ATC_MiThermometer/raw/master/ATC_Thermometer30.bin)
-* [MHO-C401 Custom Firmware Version 3.0](https://github.com/pvvx/ATC_MiThermometer/raw/master/MHO_C401_v30.bin)
-* [CGG1 Custom Firmware Version 3.0](https://github.com/pvvx/ATC_MiThermometer/raw/master/CGG1_v30.bin)
+* [LYWSD03MMC Custom Firmware Version 3.1](https://github.com/pvvx/ATC_MiThermometer/raw/master/ATC_Thermometer31.bin)
+* [MHO-C401 Custom Firmware Version 3.1](https://github.com/pvvx/ATC_MiThermometer/raw/master/MHO_C401_v31.bin)
+* [CGG1 Custom Firmware Version 3.1](https://github.com/pvvx/ATC_MiThermometer/raw/master/CGG1_v31.bin)
 
 **Original Manufacturer Firmware Version**
 
@@ -136,7 +136,8 @@ In case you want to go back to the original firmware, you can download them here
 |     2.7 | Reducing power consumption of MHO-C401 (EDP update), adding version for CGG1
 |     2.8 | Added saving bindkey to EEP if mi-keys are erased, reduced TX power to 0 dB for defaults
 |     2.9 | Added additional id flags to advertising packages
-|     3.0 | Added toggle support for advertising package structures for third-party software written by unqualified authors
+|     3.0 | Added toggle support for advertising package structures for third-party software
+|     3.1 | Fix security attributes for pincode
 
 
 ## Applications
diff --git a/firmware.json b/firmware.json
index 7161cee7..39bac8f2 100644
--- a/firmware.json
+++ b/firmware.json
@@ -1,3 +1,3 @@
-{"version": 48, 
-"custom":["ATC_Thermometer30.bin", "MHO_C401_v30.bin", "CGG1_v30.bin"], 
+{"version": 49, 
+"custom":["ATC_Thermometer31.bin", "MHO_C401_v31.bin", "CGG1_v31.bin"], 
 "original":["Original_OTA_Xiaomi_LYWSD03MMC_v1.0.0_0109.bin","Original_OTA_Xiaomi_MHO_C401_v1.0.0_0010.bin","Original_OTA_CGG1_v1.0.1_0093.bin"]}
\ No newline at end of file
diff --git a/src/app.c b/src/app.c
index f15dcdeb..77a96aa0 100644
--- a/src/app.c
+++ b/src/app.c
@@ -23,8 +23,8 @@
 
 void app_enter_ota_mode(void);
 
-RAM uint32_t chow_tick_clk; // count chow validity time, in clock
-RAM uint32_t chow_tick_sec; // count chow validity time, in sec
+RAM uint32_t chow_tick_clk; // count show validity time, in clock
+RAM uint32_t chow_tick_sec; // count show validity time, in sec
 RAM uint8_t show_stage; // count/stage update lcd code buffer
 RAM lcd_flg_t lcd_flg;
 
diff --git a/src/app_att.c b/src/app_att.c
index 827134ef..f64458c4 100644
--- a/src/app_att.c
+++ b/src/app_att.c
@@ -423,8 +423,8 @@ RAM attribute_t my_Attributes[] = {
 
 void my_att_init(void) {
 	if(pincode) {
-		my_Attributes[RxTx_CMD_OUT_DP_H].perm = ATT_PERMISSIONS_AUTHOR_RDWR;
-		my_Attributes[OTA_CMD_OUT_DP_H].perm = ATT_PERMISSIONS_AUTHOR_RDWR;
+		my_Attributes[RxTx_CMD_OUT_DP_H].perm = ATT_PERMISSIONS_SECURE_CONN_RDWR;
+		my_Attributes[OTA_CMD_OUT_DP_H].perm = ATT_PERMISSIONS_SECURE_CONN_RDWR;
 	} else {
 		my_Attributes[RxTx_CMD_OUT_DP_H].perm = ATT_PERMISSIONS_RDWR;
 		my_Attributes[OTA_CMD_OUT_DP_H].perm = ATT_PERMISSIONS_RDWR;
diff --git a/src/app_config.h b/src/app_config.h
index 3c4fdcd6..88406c84 100644
--- a/src/app_config.h
+++ b/src/app_config.h
@@ -4,7 +4,7 @@
 extern "C" {
 #endif
 
-#define VERSION 0x30	 // BCD format (0x34 -> '3.4')
+#define VERSION 0x31	 // BCD format (0x34 -> '3.4')
 #define EEP_SUP_VER 0x09 // EEP data minimum supported version
 
 #define DEVICE_LYWSD03MMC   0x055B	// LCD display LYWSD03MMC
diff --git a/src/battery.c b/src/battery.c
index 184a1991..bbe72e17 100644
--- a/src/battery.c
+++ b/src/battery.c
@@ -5,13 +5,11 @@
 
 #include "battery.h"
 
-RAM uint16_t    batt_vol_mv;
+uint8_t adc_hw_initialized = 0;
+#define ADC_BUF_COUNT	8
+volatile unsigned int adc_dat_buf[ADC_BUF_COUNT];
 
-uint8_t     adc_hw_initialized = 0;
-volatile unsigned int adc_dat_buf[8];
-
-_attribute_ram_code_ static void adc_bat_init(void)
-{
+_attribute_ram_code_ static void adc_bat_init(void) {
 	adc_power_on_sar_adc(0);
 	gpio_set_output_en(GPIO_PB5, 1);
 	gpio_set_input_en(GPIO_PB5, 0);
@@ -25,64 +23,63 @@ _attribute_ram_code_ static void adc_bat_init(void)
 	adc_set_ref_voltage(ADC_MISC_CHN, ADC_VREF_1P2V);
 	adc_set_tsample_cycle_chn_misc(SAMPLING_CYCLES_6);
 	adc_set_ain_pre_scaler(ADC_PRESCALER_1F8);
-//	adc_power_on_sar_adc(1);
+	//	adc_power_on_sar_adc(1);
 }
 
 // Process takes about 83 μs.
-_attribute_ram_code_ uint16_t get_battery_mv(void)
-{
+_attribute_ram_code_ uint16_t get_battery_mv(void) {
 	uint16_t temp;
-	int i,j;
-	if(!adc_hw_initialized){
+	int i, j;
+	if (!adc_hw_initialized) {
 		adc_hw_initialized = 1;
 		adc_bat_init();
 	}
-	adc_power_on_sar_adc(1);	// + 0.4 mA
+	adc_power_on_sar_adc(1); // + 0.4 mA
 	adc_reset_adc_module();
 	u32 t0 = clock_time();
 
-	uint16_t adc_sample[8] = {0};
-	u32 adc_result;
-	for(i=0;i<8;i++){
+	uint16_t adc_sample[8] = { 0 };
+	u32 adc_average;
+	for (i = 0; i < ADC_BUF_COUNT; i++) {
 		adc_dat_buf[i] = 0;
 	}
-	while(!clock_time_exceed(t0, 25)); //wait at least 2 sample cycle(f = 96K, T = 10.4us)
-	adc_config_misc_channel_buf((uint16_t *)adc_dat_buf, 8<<2);
+	while (!clock_time_exceed(t0, 25))
+		; //wait at least 2 sample cycle(f = 96K, T = 10.4us)
+	adc_config_misc_channel_buf((uint16_t *) adc_dat_buf, sizeof(adc_dat_buf));
 	dfifo_enable_dfifo2();
-	for(i=0;i<8;i++){
-		while(!adc_dat_buf[i]);
-		if(adc_dat_buf[i] & BIT(13)){
+	for (i = 0; i < ADC_BUF_COUNT; i++) {
+		while (!adc_dat_buf[i])
+			;
+		if (adc_dat_buf[i] & BIT(13)) {
 			adc_sample[i] = 0;
+		} else {
+			adc_sample[i] = ((uint16_t) adc_dat_buf[i] & 0x1FFF);
 		}
-		else{
-			adc_sample[i] = ((uint16_t)adc_dat_buf[i] & 0x1FFF);
-		}
-		if(i){
-			if(adc_sample[i] < adc_sample[i-1]){
+		if (i) {
+			if (adc_sample[i] < adc_sample[i - 1]) {
 				temp = adc_sample[i];
-				adc_sample[i] = adc_sample[i-1];
-				for(j=i-1;j>=0 && adc_sample[j] > temp;j--){
-					adc_sample[j+1] = adc_sample[j];
+				adc_sample[i] = adc_sample[i - 1];
+				for (j = i - 1; j >= 0 && adc_sample[j] > temp; j--) {
+					adc_sample[j + 1] = adc_sample[j];
 				}
-				adc_sample[j+1] = temp;
+				adc_sample[j + 1] = temp;
 			}
 		}
 	}
 	dfifo_disable_dfifo2();
-	u32 adc_average = (adc_sample[2] + adc_sample[3] + adc_sample[4] + adc_sample[5])/4;
-	adc_result = adc_average;
-	batt_vol_mv  = (adc_result * adc_vref_cfg.adc_vref) >> 10; // adc_vref default: 1175 (mV)
 	adc_power_on_sar_adc(0); // - 0.4 mA
-	
-	return batt_vol_mv;
+	adc_average = (adc_sample[2] + adc_sample[3] + adc_sample[4]
+			+ adc_sample[5]) / 4;
+	return (adc_average * adc_vref_cfg.adc_vref) >> 10; // adc_vref default: 1175 (mV)
 }
 
 // 2200..3100 mv - 0..100%
-_attribute_ram_code_ uint8_t get_battery_level(uint16_t battery_mv){
+_attribute_ram_code_ uint8_t get_battery_level(uint16_t battery_mv) {
 	uint8_t battery_level = 0;
-	if(battery_mv > MIN_VBAT_MV) {
-		battery_level = (battery_mv - MIN_VBAT_MV)/((MAX_VBAT_MV - MIN_VBAT_MV)/100);
-		if(battery_level > 100)
+	if (battery_mv > MIN_VBAT_MV) {
+		battery_level = (battery_mv - MIN_VBAT_MV) / ((MAX_VBAT_MV
+				- MIN_VBAT_MV) / 100);
+		if (battery_level > 100)
 			battery_level = 100;
 	}
 	return battery_level;
diff --git a/src/ble.c b/src/ble.c
index 3d86bed6..56fee654 100644
--- a/src/ble.c
+++ b/src/ble.c
@@ -220,7 +220,7 @@ __attribute__((optimize("-Os"))) void init_ble(void) {
 	if(pincode) {
 		//bls_smp_configParingSecurityInfoStorageAddr(0x074000);
 		//bls_smp_eraseAllParingInformation();
-		//blc_smp_param_setBondingDeviceMaxNumber(SMP_BONDING_DEVICE_MAX_NUM);
+		//blc_smp_param_setBondingDeviceMaxNumber(SMP_BONDING_DEVICE_MAX_NUM); //if not set, default is : SMP_BONDING_DEVICE_MAX_NUM
 #if 0
 		//set security level: "LE_Security_Mode_1_Level_2"
 		blc_smp_setSecurityLevel(Unauthenticated_Paring_with_Encryption);  //if not set, default is : LE_Security_Mode_1_Level_2(Unauthenticated_Paring_with_Encryption)
diff --git a/test_adv_key.py b/test_adv_key.py
index 67442ca0..54cc511a 100644
--- a/test_adv_key.py
+++ b/test_adv_key.py
@@ -94,7 +94,7 @@ def main():
 	decrypt_aes_ccm(binkey, pkt);
 
 	print()
-	print("====== Test deccode ------------------------------------------")
+	print("====== Test decode -------------------------------------------")
 	# 0  1  2 3  4 5  6 7  8  9         14 15                    26
 	# 1a 16 95fe 5858 5b05 a8 ed5e0b38c1a4 0239ff0e350000002f044957
 	#                 pid  cnt mac         crypt data      mic