Disassembly & Insights on TO-Q-SYS-JWT DIN Rail kWh Meter with Display

Selfdrivers 31 Jan 2024 00:05 52 8751 Cool? (+9)

📢 Listen (AI):

TL;DR

TO-Q-SYS-JWT DIN rail kWh meter with display was disassembled and examined, including its relay, WiFi board, display controller, and energy-measurement circuitry.
The unit uses a BK7231N WiFi board connected to an HC32F460 microcontroller on the display board, while the WiFi module mainly relays commands and data.
The internal power switch appears to be a 60A 250V relay, and the energy-measurement side includes an HT7017? chip.
OpenBeken can be flashed onto the BK7231N without breaking the display, buttons, or stored fuse settings because those peripherals are handled by the HC32F460.
Configuration for full MCB control and energy metering remains unresolved, and the device is kept on a dummy load for safe access and calibration.

Generated by the language model.

Hello everyone, I recently bought this fuse in DIN format with the option of measuring kWh consumption. This is the TO-Q-SYS-JWT model, a version similar to TO-Q-SY1-JWT, but with a built-in display where you can make changes to the fuse settings (undervoltage, overvoltage, temperature, power protection, etc.). In the photo below we can see the device (the front itself after the disassembly phase).

I looked on the forum for this fuse model, but to no avail (it`s a total novelty on the forum, so I decided to write this entry).

Let`s start from the basics, to disassemble the fuse itself, you need to "pick out" the metal pins that hold it together (there are six of them and the side we start from is not important because it is important to bend the edge of the pin inward and then gently knock out the rod), I am writing about this step because I was looking for quite a long time how to disassemble this type of MCB fuse. Once we have removed all the rods (they are gold, so they are easy to see), gently pry off the latches visible on the top of the housing. After these steps, you should now have the MCB switch open.

Now let`s move on to the most interesting stage, i.e. the interior, which looks like this:

We can see here (as I assume correctly, a 60A 250V relay from "AT"[?]) and quite tightly packed integrated circuits. The whole thing consists of three PCB boards. The first one can be easily removed by unscrewing the screw in the upper right corner of the PCB (with the left side of the MCB facing us). After removing it, the whole thing looks like this:

The board that comes out first is the one that interests us the most because it is responsible for WiFi connectivity. In fact, we could stop at this stage of disassembling the MCB, but since this device is not available on the forum yet, we will take a closer look inside.

The BK7231N board itself looks like this:

In order to upload the OpenBeken software, I had to unsolder the white board from the blue board, which actually only connects the E469716 board with the rest of the MCB. Everything after desoldering looks like this:

The board with the WiFi module seems to be a normal board, but after reading the software we will get the following result of the tuya config analysis:

The flashing software suggests that it is probably TuyaMCU, but I do not agree with this conclusion, such a poor config is simply due to the fact that the WiFi module is only responsible for communication with WiFi and data transfer in this MCB, it does not directly control anything and he only performs (or rather delegates) the tasks entrusted to him through commands. These tasks are transferred to the HC32F460 microcontroller, which is located on the board with the display (OLED?) and controls it. The display board looks like this:

HC32F460 is apparently a clone of the more famous stm32f103c8t6 and according to the datasheet it has i2c connectors for communication with an OLED display or other peripherals (of course, there are many more protocols and I am mentioning the ones that concern us here), and a UART bus which is used to communicate with WiFi module (baudrate is probably 115200 because it is set in the WiFi module configuration, but I may be wrong and it concerns something else). The uC itself also has a built-in EEPROM memory, so there are no EEPROM chips on the other boards (probably not, as I wasn`t able to read the markings of one of the chips on the PCB - photo below).

The second die that we can find on the board (HT7017?):

This die looks like a die measuring energy consumption.

The entire back of the PCB (the main and largest one looks like this):

I am also sending inputs (with original software) from the BK7231N board.

When it comes to the configuration of the entire MCB, this is a problem that I have not solved yet (I assume that you need to send the appropriate TuyaMCU commands to the HC32F460, but I still don`t know how to do it exactly and therefore I would also like to ask for some technical support to create a configuration file especially for this MCB with energy consumption measurement.

NOTE: The display, fuse status memory, buttons, etc. work correctly even after uploading OpenBeken, this is due to the fact that the BK7231N does not control these peripherals, so any changes in its software do not change the operation of the counter (they only "stupid" it with the function of connecting to WiFi and sending data to the application from China). I`m not connecting the MCB itself for now until I manage to create a configuration file (I hope together

) for this device. The MCB is currently connected to the dummy load so that it can be easily accessed if necessary and that any calibration can be made based on a known load.

Attachments:

readResult_BK7231N_QIO_2024-30-1-19-06-56.bin (2 MB) You must be logged in to download this attachment.

About Author

Selfdrivers wrote 35 posts with rating 12 . Live in city Zielona Góra. Been with us since 2015 year.

Comments

Add a comment

gulson 31 Jan 2024 08:49

Very interesting, fuse, current measurement and control/reading by applications in one. Thanks for sharing how to remove the fuse and how to change the software. If you give me the parcel locker, I will... [Read more]

nyquist 31 Jan 2024 10:33

An interesting article and kudos for using the correct phrase when talking about "energy consumption", while today everyone is trying to convince us that "we consume electricity" on every side, starting... [Read more]

CosteC 31 Jan 2024 10:55

Is there any documentation for this or is this just another Chinese improvement that violates safety and common sense? It hurts me when I look at the photos, but it`s probably a professional deviation... [Read more]

slaw0 31 Jan 2024 15:03

In my opinion, calling it a fuse is an overstatement. [Read more]

CosteC 31 Jan 2024 15:26

Quoting the "manufacturer", it is "Smart WiFi Switch with metering function – TO-Q-SY1-JWT" It is not a fuse and cannot perform any protective functions per se. It could supposedly be subsumed into a... [Read more]

Selfdrivers 31 Jan 2024 18:24

Nie do końca wiem o co chodzi ze zdjęciami ale niektóre są prześwietlone specjalnie aby było widać dokładnie oznaczenie chip-u który się tam znajduje. Jestem zawsze otwarty na sugestie :). Jeśli chodzi... [Read more]

p.kaczmarek2 31 Jan 2024 18:44

I see that the device will be cloud free. To run them in OpenBeken , you need to know the baud rate of TuyaMCU, and the dpID (identifiers) of the variables along with their types, because they change... [Read more]

__Maciek__ 31 Jan 2024 20:40

I will add one more interesting fact... the relays in these devices are probably bistable - there is an interesting full-bridge circuit for controlling the relay in the sot23-6 housing - I have something... [Read more]

p.kaczmarek2 31 Jan 2024 20:53

I actually encounter bistable relays in this type of equipment. IN TONGOU TO-Q-SY1-JWT and Zmai90 I saw one like that too. At OBK we wrote a driver for this Bridge . But in order not to mislead... [Read more]

Selfdrivers 31 Jan 2024 21:33

https://obrazki.elektroda.pl/4025598300_1706732885_thumb.jpg This is what I received in the console after starting TuyaMCU (I completely forgot about it yesterday when I wrote the post), it looks like... [Read more]

p.kaczmarek2 31 Jan 2024 21:50

Post all IoT devices you have, but please do not duplicate existing topics, we want to reach 500 devices soon: https://openbekeniot.github.io/webapp/devicesList.html I m sure I broke some record here. ... [Read more]

Selfdrivers 01 Feb 2024 20:08

dpID 141 looks like it is simply an ID for controlling the display backlight :D , I will try to create a script that will search for dpID by force. As soon as I find out more, I will write an update. [Read more]

p.kaczmarek2 01 Feb 2024 20:11

Please try the query command again. Does it crash every time with an error after a few IDs? Does this device allow you to change the state of the relay using a physical button? The physical operation... [Read more]

artin.bruyen 02 Feb 2024 12:45

Where can this "device" be found on the Internet? Any description, photos, price? My google doesn`t know anything about it. :( [Read more]

Selfdrivers 02 Feb 2024 21:04

https://a.aliexpress.com/_EyCIK5X I bought this auction on Aliexpress. Added after 58 [minutes]: I managed to determine that the relay has dpID 16, (but e.g. dpID 11 turns off the relay without... [Read more]

p.kaczmarek2 03 Feb 2024 08:40

I haven s: // From MCU. Response should be 0x0b 00/01/02 // subcmd 03 -> request weather data // subcmd 06 -> get map id #define TUYA_CMD_REPORT_STATUS_RECORD_TYPE 0x34 // not implemented ... [Read more]

Selfdrivers 03 Feb 2024 12:06

I t try and think about it, I can`t force TuyaMCU to give me the dpID containing the value of energy consumption/energy consumed/voltage/current/power. I managed to figure this out: The above script... [Read more]

p.kaczmarek2 03 Feb 2024 12:28

Sometimes it is simpler, sometimes more difficult, dpIDs are not standardized at Tuya. When I was developing another device with @xury, the measurements were immediately available. Are you not sending... [Read more]

Selfdrivers 03 Feb 2024 12:35

As I wrote in the edit of the previous answer, I executed the command uartSendHex 55 aa 00 34 00 02 04 00 39 and the effect is that I no longer receive constant questions from the MCU and the logs... [Read more]

FAQ

TL;DR: With a 115200 baud TuyaMCU link and 6 housing pins removed, this teardown shows that “the screen is controlled via MCU,” so OpenBeken can replace the cloud Wi‑Fi side while the local display still works. It helps tinkerers who want relay control, kWh-related telemetry, and protection settings on the TO-Q-SYS-JWT without losing core front-panel functions. [#21088469]

Why it matters: This thread turns an undocumented DIN-rail Wi‑Fi meter-switch into a repeatable OpenBeken workflow, including disassembly, dpID discovery, and safe limits.

Feature	TO-Q-SYS-JWT	TO-Q-SY1-JWT
Front display	Yes, built-in display with local settings	Mentioned as similar version; no display noted here
Main Wi‑Fi module	BK7231N	Same family/device line discussed as comparable
Relay behavior	Suspected bistable, MCU-controlled	Reported as also using bistable relay
OpenBeken path	TuyaMCU mapping needed	Existing related topic/driver experience available

Key insight: The BK7231N does not directly run the relay, buttons, or display here. It mainly bridges Wi‑Fi to a separate MCU, so successful conversion depends on decoding TuyaMCU dpIDs, not on simple GPIO remapping. [#20938300]

Quick Facts

The housing is held by 6 metal pins, and the first visible power part was described as a 60A 250V relay inside a 3-PCB stack, which matters for careful teardown planning and reassembly. [#20937367]
After desoldering the BK7231N module, users reported reliable flashing at 115200 baud, and one later confirmed even 1500000 baud read/write worked. [#21089661]
A working raw measurement frame was mapped from dpID 6 using RAW_TAC2121C_VCP, exposing Voltage_div10, Current_div1000, and Power channels in OpenBeken. [#20943257]
Confirmed protection-related values included 245 V overvoltage, 219 V undervoltage, 550 for overtemperature as 55.0°C, and 2123 W overpower threshold. [#20943018]
One buyer cited an online price of about 42€, while other posters criticized the weak documentation, missing installation-category details, and sparse safety markings. [#20951149]

How do you disassemble the TO-Q-SYS-JWT DIN rail kWh meter and remove the housing pins without damaging the case?

You open it by removing the 6 metal rods first, not by forcing the plastic shell. 1. Bend the visible edge of each gold-colored pin inward. 2. Gently tap each rod out; the starting side does not matter. 3. After all 6 rods are out, release the top latches and lift the housing apart. The author called this step out because standard MCB-style cases hide the pins well, and prying first risks breaking the clips. [#20937367]

Why does flashing the BK7231N on the TO-Q-SYS-JWT seem to require desoldering the module, and what baud rates were reported to work afterward?

Flashing worked reliably only after desoldering the BK7231N from the carrier board. The original poster said in-circuit flashing failed, while later confirmation showed read and write worked “like a charm” once the module was removed. Reported working speeds were 115200 baud and even 1500000 baud after desoldering. That makes this device a poor candidate for casual pogo-pin flashing unless you verify the board does not load TX/RX lines. [#21089661]

What is TuyaMCU, and how does it differ from a setup where the BK7231N directly controls the relay and display?

TuyaMCU here means the Wi‑Fi chip exchanges serialized commands with a separate controller instead of driving hardware directly. "TuyaMCU is a UART-based device architecture that sends dpID state packets between a Wi‑Fi module and a main MCU, rather than exposing direct relay or display GPIO control." In this meter-switch, the HC32F460 handles the display, buttons, and relay logic, while the BK7231N mainly handles Wi‑Fi transport. That is why the display still works after flashing OpenBeken. [#20937367]

What does dpID mean in TuyaMCU devices, and how do you figure out which dpIDs control relay, protection settings, and measurements on the TO-Q-SYS-JWT?

A dpID is the device-property identifier that labels each TuyaMCU state or command field. The thread identified dpID 16 as relay control, 114 as overcurrent, 115 as overvoltage, 116 as undervoltage, 118 as overtemperature, 119 as overpower, and 131 as processor temperature. Users found them by sending tuyaMcu_sendQueryState, toggling settings, and comparing returned values like 245, 219, 550, and 2123 to what the display or UI showed. The fallback method is restoring stock firmware and extracting full dpIDs from Tuya’s developer portal. [#20942478]

Which OpenBeken autoexec.bat lines were used to get the TO-Q-SYS-JWT relay control, voltage, current, power, and protection thresholds working?

The working setup used TuyaMCU at 115200 baud, mapped dpID 16 to a toggle, dpID 6 to raw V/I/P decoding, and linked threshold dpIDs 114, 115, 116, 118, 119, and 131 to channels. The final script also labeled channels and added addRepeatingEvent 2 -1 tuyaMcu_sendQueryState for periodic refresh. Key lines included startDriver TuyaMCU, tuyaMcu_defWiFiState 4, linkTuyaMCUOutputToChannel 6 RAW_TAC2121C_VCP, and linkTuyaMCUOutputToChannel 16 bool 1. That combination exposed relay, voltage, current, power, and protection values in the panel. [#20943360]

How can you identify whether dpID 6 on this device is the raw voltage-current-power packet and map it with RAW_TAC2121C_VCP in OpenBeken?

You identify it by matching the raw 8-byte payload against known VCP packet structure and real load changes. A 13–14 W load produced bytes ending with 00 00 0D, while a 4 W load produced 00 00 04, which aligned with power. The developer then matched dpID 6 to the existing TAC2121C-style raw frame and recommended linkTuyaMCUOutputToChannel 6 RAW_TAC2121C_VCP. That automatically created channels for voltage divided by 10, current divided by 1000, and power. [#20943234]

Why were the TuyaMCU logs getting cut off during tuyaMcu_sendQueryState, and how was the larger log buffer used to reveal all dpIDs?

The logs were getting truncated because the returned state list was larger than the visible or buffered log path could hold. Once the buffer was enlarged from 1024 to 8192 bytes in a test build, full dpID output appeared, including ids 1, 6, 11, 13, 16, 101–120, 131, 137, 140, 141, and 142. The thread also checked for another failure case: two browser tabs can split WebApp logs between tabs. In this case, only one WebApp instance was open, so the larger buffer exposed the missing entries. [#20943018]

What is command 0x34 in TuyaMCU communication, and why did replying with "55 aa 00 34 00 02 04 00 39" stop the repeated unknown query messages?

Command 0x34 is an extended Tuya module service packet that OpenBeken initially logged as unknown. The repeating frame 55 AA 03 34 00 01 04 3B kept appearing after Wi‑Fi state was set to 4, and replying with 55 aa 00 34 00 02 04 00 39 stopped the spam immediately. The developer linked 0x34 to Tuya’s extended module functions and then added support so the main firmware would answer it automatically. That calmed the logs, although it did not directly reveal energy measurements. [#20942168]

How can you capture original Tuya UART traffic safely on a mains-powered device like this if the power supply may be non-isolated?

You should revert to the original firmware, then capture UART only with isolation in place. The thread explicitly warned that the internal converter may be non-isolated, so a plain USB-UART hookup is risky on a live mains device. The recommended path was to restore the saved 2 MB flash backup, power the unit safely, and use a UART isolator while recording packets during normal app and button actions. That method avoids guesswork and recovers hidden dpIDs cleanly. [#20942614]

TO-Q-SYS-JWT vs TO-Q-SY1-JWT: what similarities and differences were noted in hardware layout, relay behavior, and TuyaMCU mapping?

They look closely related, but the TO-Q-SYS-JWT adds a built-in display and local settings menu. The original poster described it as a version similar to TO-Q-SY1-JWT, and another developer said both device families had seen bistable relay behavior. Both were treated as TuyaMCU-style designs with BK7231-based Wi‑Fi modules and MCU-side relay control, which means dpID mapping matters more than GPIO templates. The practical difference in this thread was the display board and HC32F460 controller in the TO-Q-SYS-JWT. [#20938495]

What is a bistable relay, and why did users suspect this meter-switch uses one instead of a standard continuously powered relay?

A bistable relay is a latching relay that changes state with a pulse and then holds that state without continuous coil power. "A bistable relay is an electromechanical switch that stays open or closed after a short drive pulse, reducing standby consumption because the coil is not energized continuously." Users suspected one here because they saw a full-bridge relay drive stage in SOT23-6 and noted similar hardware in related Tuya rail devices. That would fit a design focused on low static power. [#20938473]

Where can you find the TO-Q-SYS-JWT online, what price was mentioned, and what concerns were raised about documentation and safety markings?

The device was linked to an AliExpress listing, and one poster later remarked that the advertisement showed a price around 42€. Several replies criticized the product page and paperwork, saying the documentation was “pathetic,” the installation category was missing, and required markings were sparse. Another poster argued it should not be called a fuse at all, but rather a smart Wi‑Fi switch with metering and trip-style control behavior. Those concerns matter if you plan to use it as a protective device. [#20938044]

How do you edit autoexec.bat in OpenBeken for this device, including adding repeating TuyaMCU queries and channel labels?

You edit autoexec.bat in OpenBeken’s LittleFS-backed web interface or by following the project’s tutorial workflow. A working example in the thread used setChannelLabel for names like MainRelay, Voltage (V), and Power (W), then added addRepeatingEvent 2 -1 tuyaMcu_sendQueryState for automatic updates every 2 seconds. One later user explicitly asked how to edit autoexec.bat, found the video tutorial, and confirmed the setup worked. That makes the web UI the practical path for this device. [#21089722]

What’s the best way to recover the full list of Tuya dpIDs for the TO-Q-SYS-JWT using the original firmware and the Tuya developer website?

The best method is to restore the stock firmware first, then extract the dpID definitions through Tuya’s developer platform. Two experienced contributors recommended this because it returns the dpID list, meaning, type, and often min/max ranges, which is faster than guessing from live packets. The suggested workflow was: make a flash backup, revert to original firmware, pair it with Tuya, and then query the developer portal before flashing OpenBeken again. That is the fastest route to complete mapping. [#20954276]

How can energy counters like today, yesterday, and total consumption be obtained on this device, and are they exposed as TuyaMCU dpIDs or something OpenBeken would need to calculate?

The thread did not confirm those counters yet. A later user asked about today, yesterday, and total energy, and the answer was a direct technical question: are those values available as TuyaMCU dpIDs, or must OpenBeken calculate them itself? The only partly identified candidate earlier was dpID 137, mentioned as “probably” total energy, but it was still under verification. So, for this device, daily and total counters remain unresolved until stock-firmware dpID extraction confirms whether Tuya exposes them. [#21094715]

Generated by the language model.