Arlec Grid Connect Smart Home Control Kit - 5 Device Teardown

wolfieeewolf 17 Aug 2023 15:32 11 3438 Cool? (+2)

📢 Listen (AI):

TL;DR

The Arlec Grid Connect Smart Home Control Kit teardown covers the hub/control plug, contact sensor, motion sensor, smart button kit version, and standalone smart home button.
The hub is sonically welded shut, likely contains an energy meter and an unknown main chip, and its Bluetooth chip is required for the bundled sensors.
The contact sensor and smart button kit version use BT5S, the motion sensor uses BTU, and the standalone Smart Home Button uses ers-10tBBvB-aa_v1.2.
TX and RX pins suggest the sensors and buttons could be flashed, but they would need OBK firmware support for their chips.
Home Assistant integration mostly works through Tuya Integration, Local Tuya, and Tuya BLE, but the smart buttons still do not appear.

Generated by the language model.

The Arlec Grid Connect Smart Home Control Kit has 4 separate devices bundled together. I will break them down one by one

You can not use any of the sensors or buttons without the Hub as they are all running Bluetooth chips.

Device Name: Arlec Grid Connect Smart Home Control Plug
Device Type: Hub and Energy meter
Device Chip: Unknown. This device is sonically welded shut.

Flashing of Main Chip

I have no idea what kind of chip is inside. The device is sonically welded shut. Considering how much I paid for the kit I am reluctant to take it apart.

I believe it could possibly be a BK7231N/BK7231T chip as it has energy monitoring on board and the Arlec PC191HA runs on those as well. I have tried to use CloudCutter Lightleak to query the chip but have not been successful.

The device also has some kind of Bluetooth chip on board as the bundled sensors require the hub to run them.

Device Name: Arlec Grid Connect Contact Sensor
Device Chip: BT5S

Flashing of Main Chip

Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

Device Name: Arlec Grid Connect Motion Sensor
Device Chip: BTU

Flashing of Main Chip

Appear this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

Device Name: Arlec Grid Connect Smart Button Kit Version
Device Chip: BT5S

Flashing of Main Chip

Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

There are two versions of the smart button one comes with the kit the other can be purchased on its own. They both have different chips

Device Name: Arlec Grid Connect Smart Home Button
Device Chip: ers-10tBBvB-aa_v1.2

Flashing of Main Chip

Appears this device could be flashed as there are TX and RX pins to connect to. Would just need OBK firmware to support the chip.

See Here for the best teardown of this device.

Configuration of all devices

So far I have just been using a combination of Home Assistants Tuya Integration, Local Tuya and Tuya BLE

I have most of the devices working except for the smart buttons. None of the integrations seems to get them to show up. I can use the Tuya app to make scenes for the buttons but the scenes only allow you to control Tuya devices linked to the app. The scenes do show up in home assistant but you can't really do much with them. I have put in a git hub request with Tuya BLE to see if they can get the buttons working. At this stage, it's still pending.

When I get some time I will see if I can pull some data off these chips to see if they are hackable and post it here.

About Author

wolfieeewolf wrote 93 posts with rating 20 , helped 7 times. Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 17 Aug 2023 21:41

Very interesting devices, they remind me of Aqara set that I have tested two years ago or so. Can you write few words about how you've got them to connect to HA without changing firmware? I haven't... [Read more]

wolfieeewolf 20 Aug 2023 13:01

Connecting Devices to Home Assistant Without Changing Firmware Step 1: Link Devices to Tuya App: Begin by linking all your devices to the Tuya App on your mobile phone. Step 2: Obtain Access... [Read more]

wolfieeewolf 22 Aug 2023 09:33

Any ideas on what would be the best way to extract the firmware off these devices? They are Tuya modules so I was guessing just using the Tuya SDK or something like that. I did look at using BKwriter... [Read more]

wolfieeewolf 23 Aug 2023 06:51

So it looks like one of the smart buttons has an MCU on board https://obrazki.elektroda.pl/4647406300_1692765942_thumb.jpg It's a TLSR8250 from Telink. Appears there are some burning tools... [Read more]

p.kaczmarek2 23 Aug 2023 07:58

If their tools are operating on top of the UART, it still should be possible use cheap UART dongle. Maybe you can try first checking the RX and TX pins with UART to USB converter and see if there are any... [Read more]

wolfieeewolf 31 Aug 2023 06:24

I have been trying to extract data from the modules using Realterm . I haven't been successful yet in getting any data to output. It got the better of me and I decided to try and open the Hub. Inside... [Read more]

wolfieeewolf 13 Nov 2023 03:18

Have been doing a little bit more investigation about these devices. I found a few things that might be interesting TLSR8250F512ET32 datasheet for the TLSR8250 So far it appears that there... [Read more]

wolfieeewolf 14 Nov 2023 04:31

Not sure if this is at all helpful but I did find a Github link to some people having the same issues with Telink chips. Link This could possibly be the SDK to get it flash. Still looks like it... [Read more]

p.kaczmarek2 14 Nov 2023 09:26

Nice find! Is there a flasher as well? Can you try to read the firmware dump? [Read more]

wolfieeewolf 14 Nov 2023 09:58

After read the Github post I found this https://github.com/sylvek/itracing2/issues/5#issuecomment-683403605 It appears you might be able to just use a basic usb uart device. I haven't played around... [Read more]

wolfieeewolf 19 Nov 2023 10:59

Looks like there are two devices you can buy that might be able to dump the firmware. TLSR8267 Development Board Plus Burning EVK Telink BDT TLSR8258 Firmware Download Debugger When I get... [Read more]

FAQ

TL;DR: This 5-device teardown shows 4 bundled devices depend on the hub, and “you can not use any of the sensors or buttons without the Hub.” It helps Home Assistant users connect the kit without reflashing, identify the chips inside, and avoid risky dump attempts on CR2S and Telink hardware. [#20697218]

Why it matters: If you want local control, safer teardown choices, or Home Assistant compatibility, this thread maps what works now and where the hard limits still are.

Option	Best use in this kit	What worked	Main limit
Home Assistant Tuya integration	Motion and contact sensors	Devices can appear without firmware changes	Smart buttons remain limited
Local Tuya	Hub setup	Useful for initial hub configuration	Does not solve button exposure
TuyaBLE	Better BLE support path	Promising route for button support	Request was still pending
Tuya app scenes	Basic button actions	Scenes appear in Home Assistant	Mostly controls Tuya-linked devices

Key insight: The practical path is integration-first, not flashing-first. The sensors and hub can already be useful in Home Assistant, but the smart buttons and firmware dumping hit real platform and toolchain limits.

Quick Facts

The kit bundles 4 separate devices, and the sensors and buttons depend on the hub because they use Bluetooth chips rather than working standalone. [#20697218]
Identified chips in the bundled set were BT5S for the contact sensor, BTU for the motion sensor, and BT5S for the smart button included in the kit. [#20697218]
After opening the welded hub, the main radio module was identified as Tuya CR2S, and the board also appeared to include a secondary MCU. [#20715558]
One separately sold smart button used a TLSR8250 from Telink, and the author later linked the TLSR8250F512ET32 datasheet while investigating dump options. [#20704555]
A failed dump attempt used 4 different USB-to-TTY/Serial adapters and multiple terminal tools, then ended with a ripped TX pad, even though the device still appeared functional afterward. [#20715558]

How do I connect the Arlec Grid Connect Smart Home Control Kit to Home Assistant without changing the firmware?

Connect it through Tuya services first, then layer Home Assistant integrations. 1. Pair every device in the Tuya mobile app. 2. Create the access ID and client secret for the Home Assistant Tuya integration. 3. Use Local Tuya for the hub, and use the standard Tuya integration for the motion and contact sensors. Smart buttons stay limited, so scenes or automations are still needed. [#20700779]

What is the best way to extract firmware from Tuya-based Arlec Grid Connect sensors and buttons with UART-accessible pads?

Start with the original vendor toolchain and a cheap USB-UART adapter. One reply explicitly recommends checking RX and TX first for debug logs, then using those logs to identify the SDK before attempting broader support. That approach is safer than jumping straight to unknown flash tools, especially on non-BK Tuya modules. [#20704597]

Why do the Arlec Grid Connect contact sensor, motion sensor, and smart button from the kit need the hub before they can be used?

They need the hub because the bundled sensors and buttons use Bluetooth chips and do not operate independently. The teardown author states you cannot use any sensor or button without the hub. In this kit, the smart plug acts as both the hub and an energy meter, so it is the required bridge for the other 3 bundled accessory types. [#20697218]

What chips are used inside the Arlec Grid Connect Smart Home Control Kit devices, including the hub, contact sensor, motion sensor, and smart buttons?

The contact sensor uses BT5S, the motion sensor uses BTU, and the smart button included in the kit also uses BT5S. The separately sold Arlec smart button was first labeled ers-10tBBvB-aa_v1.2, then later one opened unit was identified as a Telink TLSR8250. The hub was later opened and found to use a Tuya CR2S module. [#20715558]

How can I tell whether an Arlec Grid Connect contact sensor or motion sensor is flashable from its TX and RX pads?

You can only say it looks flashable, not that flashing is confirmed. The thread treats visible TX and RX pads as a strong sign that serial access is possible, but support still depends on firmware tooling. For both the contact sensor and motion sensor, the author says the hardware exposes TX and RX, yet OBK would still need chip support first. [#20697218]

Why might Realterm, YAT, and PuTTY show no output when trying to read data from a Tuya CR2S or Telink TLSR8250 module?

They can show nothing because the module may not expose readable UART logs, may need a different toolchain, or may sit behind another MCU. One test session tried Realterm, YAT, and PuTTY, plus 4 USB-to-TTY adapters and many settings, with no output at all. The hub board also appeared to include a secondary MCU, which further limits what simple serial probing reveals. [#20715558]

What is OBK firmware, and what would need to happen before it could support BT5S, BTU, or Telink-based Arlec devices?

"OBK firmware" is replacement device firmware that targets supported smart-home chips, enabling custom control and integration outside the stock cloud stack. For these Arlec devices, support would require confirmed chip access, working flash or dump methods, and explicit firmware support for BT5S, BTU, or Telink parts. The thread repeatedly notes the hardware may be reachable through TX and RX, but software support does not exist yet. [#20697218]

What is TuyaBLE in Home Assistant, and how does it differ from the standard Tuya integration and Local Tuya?

"TuyaBLE" is a Home Assistant integration that targets Tuya Bluetooth devices, unlike the standard Tuya integration and Local Tuya paths used for cloud-linked or locally configured devices. In this thread, it is the promising option for improving smart-button support, while the standard Tuya integration already works for motion and contact sensors and Local Tuya helps with hub setup. [#20700779]

Local Tuya vs Home Assistant Tuya integration vs TuyaBLE: which works best for the Arlec Grid Connect hub, sensors, and smart buttons?

Use Local Tuya for the hub, the standard Home Assistant Tuya integration for motion and contact sensors, and treat TuyaBLE as the best future path for smart buttons. That exact split is what the author reported working. The buttons remained the weak point, because scenes appeared in Home Assistant but still offered little direct control there. [#20700779]

How do I create Home Assistant automations for Arlec Grid Connect smart buttons when the Tuya app only exposes them as scenes?

Create the button behavior in the Tuya app first, then use Home Assistant automations to extend what those scenes trigger. The thread says the scenes do appear in Home Assistant, but they mainly control Tuya devices already linked in the app. That makes Home Assistant automation the practical workaround until direct button support improves. [#20700779]

What are the differences between the Arlec Grid Connect smart button included in the kit and the separately sold Arlec Grid Connect Smart Home Button?

They are different hardware versions with different chips. The button included in the kit was identified as BT5S, while the separately sold Arlec Grid Connect Smart Home Button was labeled ers-10tBBvB-aa_v1.2 in one teardown and later linked to a Telink TLSR8250 MCU in another update. The thread explicitly says the two versions use different chips. [#20697218]

How risky is it to use third-party flashing tools on unknown Tuya or Telink modules compared with the original vendor tools?

It is risky enough that the thread recommends avoiding third-party flashers on new, unsupported devices. One reply warns that an untested tool may brick the device, especially when the module family is still unknown. That advice matters here because BKwriter and similar tools were being considered for hardware that did not clearly match BK7231 modules. [#20704597]

What is CloudCutter Lightleak, and why might it fail to identify or query the chip inside an Arlec Grid Connect smart plug hub?

"CloudCutter Lightleak" is a chip-query and exploit-oriented tool used against some Tuya-based devices, aiming to identify or access supported modules without opening them. It can fail here because the hub chip was unknown at first, the enclosure was sonically welded shut, and the eventual opened unit turned out to use a CR2S module with another MCU also present. [#20715558]

Which Telink tools or development boards are typically needed to dump or debug firmware from a TLSR8250, and what role does the authorization key play?

The thread points to Telink burning and debugging tools and later names two candidate boards: a TLSR8267 Development Board Plus Burning EVK and a Telink BDT TLSR8258 firmware debugger. It also states there was no way found to dump firmware from the TLSR8250 without some form of authorization key plus a Telink Burning and Debugging Tool. That key is the gatekeeper for dump access in this investigation. [#20822093]

When a smart plug hub is sonically welded shut and also contains a secondary MCU, what teardown and firmware-dumping approach is safest and most practical?

The safest approach is to avoid destructive opening until non-invasive checks are exhausted, then probe exposed serial points carefully and expect limited results. In this thread, opening the welded hub identified a CR2S module, but later serial work still produced no output and ended with a ripped TX pad. That failure, after 3 hours 34 minutes of follow-up work, shows why cautious probing beats aggressive teardown. [#20715558]

Generated by the language model.