What chips are inside the PJ-MGW1103 energy meter?
The meter carries a BK7231N Wi-Fi module (CB2S), an STC 8-bit MCU that speaks TuyaMCU over UART, and a BL0942 metering IC wired to the MCU [Elektroda, p.kaczmarek2, post #21077589]
How do I free the PJ-MGW1103 energy meter from the cloud and connect it to Home Assistant?
TL;DR
- PJ-MGW1103 energy meter is opened, tested with Tuya, and converted from cloud dependence to local Home Assistant control with OpenBeken.
- Inside, BL0942 measures energy through a separate STC 381-TSSOP20 MCU, while the CB2S WiFi module uses BK7231N and UART TuyaMCU communication.
- Captured dpIDs show current on 18, power on 19, and voltage on 20, with example raw values 77, 177, and 2403.
- An autoexec.bat maps those outputs to Voltage_div10, Current_Div1000, and Power_Div10, while setting TuyaMCU WiFi state 0x04 and polling every 10 seconds.
- After flashing and scripting, Home Assistant discovers the meter locally and measurements appear, but the device uses a non-isolated inverter and exposes no extra useful dpIDs.
I invite you to analyse a current/voltage/power meter working normally with the Tuya ecosystem. Here I'll test it with the manufacturer's app, analyze its MCU communication protocol with the WiFi module, and then try to change it's batch to OpenBeken, which I'll configure accordingly for this purpose.
But first....
Related topics
This device is based on TuyaMCU, ie. inside there is separately a WiFi module (here on BK7231N) and separately an MCU that communicates with it via UART. I will not discuss the basics of the TuyaMCU here, as I have already cited them in these topics:
TuyaMCU protocol - communication between microcontroller and WiFi module
TuyaMCU analyzer -. UART packet decoder for Tuya devices - dpID detector
Flashing guide, installation and configuration of TuyaMCU - configure dpID for Home Assistant I recommend reading these before reading the content below.
Purchase, kit contents, First impression The whole set costs about £120, depends where you buy:
Dimensions:
Mounting:
Specification:
In practice you get a box like this:
Contents:
This time I'm not uploading the firmware straight away, but I'll start by looking inside anyway...
Interior of PJ-MGW1103
We remove the cover:
Inside you can see BL0942 for energy measurement, but it is connected not to the WiFi module, but to a nearby MCU - here STC 381-TSSOP20 8G1K17.
Platform designation:
20221109
PJ-CS01
[] 1203
[] 1103
Face-to-face view:
You can see the free space after the relay, this product does not have a relay, it just performs the measurement.
The WiFi module here is CB2S, it is based on BK7231N:
7b21879a.
You can also see the KP3210SG module soldered transversely into the main PCB here.
This means we have a non-isolated inverter here:
Test with Tuya application
Intercepting TuyaMCU communications is discussed in the separate topic mentioned at the beginning. The whole process requires a high degree of care, as you cannot simply connect the UART from this device to our computer, there is then a risk of a short circuit. However, it is possible to use galvanic isolation for the UART, there are various modules available for purchase for this on the web.
The process requires two USB to UART converters, as we are tapping both TX->RX and RX->TX (two lines), the whole thing is about performing operations in the Tuya application and watching what happens.
So we start with the pairing:
Thanks to Bluetooth you don't even have to manually pair like in the days of ESP, the phone detects the new device by itself.
We enter our WiFi data, etc:
Pairing:
After all, we are greeted by a rather unusual and modest panel. Strangely enough without a relay:
The panel shows measurements of power, current and voltage:
But I don't need to post the communication here, as it has already been captured in a related topic:
https://www.elektroda.com/rtvforum/topic3946128.html
Uploading OpenBeken
The UART1 port is used both for programming and for communication with the MCU, so the WiFi module has to be soldered out:
We solder the power supply, RX and TX, according to the instructions of our flasher:
https://github.com/openshwprojects/BK7231GUIFlashTool
Flasher will not discover the configuration of this device, as it is based on TuyaMCU. We need to write an autoexec.bat where we map the dpID from the TuyaMCU to the OBK channels. Searching for the dpID is mentioned in related topics, although here I used tuyaMcu_sendQueryState , and more precisely I manually sent the same package ( uartSendHex 55AA0008000007 ):
Info:MAIN:Time 152, idle 193677/s, free 73136, MQTT 0(9), bWifi 1, secondsWithNoPing 1, socks 2/38
Info:CMD:[WebApp Cmd 'uartSendHex 55AA0008000007' Result] OK
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 12 02 00 04 00 00 00 4D 76
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 18, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 77
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 13 02 00 04 00 00 00 B1 DB
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 19, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 177
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 14 02 00 04 00 00 09 63 97
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 20, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 2403
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
From the above log you can read out what dpIDs (data identifiers) with types and values were sent to us by the MCU. That's how I know that dpID 18 has a value of 77 (probably current), dpID 19 177 (power?) and dpID 20 is 2403 (here we know in advance that voltage). Just need to select the multipliers and map this to the channels in the OBK...
So I wrote a script:
startDriver TuyaMCU
tuyaMCU_setBaudRate 115200
tuyaMcu_defWiFiState 4
// request full state from time to time (every 10 seconds, -1 repeats - forever)
addRepeatingEvent 10 -1 uartSendHex 55AA0008000007
// dpID 20 is voltage * 0.1
setChannelType 1 Voltage_div10
linkTuyaMCUOutputToChannel 20 val 1
// dpID 18 is current * 0.001
setChannelType 2 Current_Div1000
linkTuyaMCUOutputToChannel 18 val 2
// dpID 19 is power * 0.1
setChannelType 3 Power_Div10
linkTuyaMCUOutputToChannel 19 val 3
The above script creates three channels (power, current and voltage), maps the dpID from the TuyaMCU to these channels, additionally forces a WiFi state of 0x04 (we simulate a connection to the cloud) and additionally periodically sends a state refresh request to provide us with the most recent measurements.
Result:
NOTE - without default WiFi state 0x04, at first the LED on the device was red and then flashing, but the device would not give measurements. After setting the default WiFi state to 0x04 this diode went off and the measurements appeared.
This is a sample log from the OpenBeken Web App, it also shows the received dpID:
bT obk1FFC6D06/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens/ subT bekens/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/obk1FFC6D06/ subT cmnd/obk1FFC6D06/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bekens/ subT cmnd/bekens/+
Info:MQTT:MQTT_RegisterCallback called for bT obk1FFC6D06/ subT obk1FFC6D06/+/get
Info:CMD:CMD_StartScript: started autoexec.bat at the beginning
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Started TuyaMCU.
Info:MAIN:Time 1, idle 276756/s, free 78120, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:MAIN:Time 2, idle 466680/s, free 78120, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 01 00 2A 7B 22 70 22 3A 22 64 6A 66 65 70 39 73 36 73 33 62 32 71 6B 38 39 22 2C 22 76 22 3A 22 31 2E 30 2E 30 22 2C 22 6D 22 3A 32 7D 63
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 1 (QueryProductInformation) with 49 bytes
Info:TuyaMCU:TuyaMCU_ParseQueryProductInformation: received {"p":"djfep9s6s3b2qk89","v":"1.0.0","m":2}
Info:MAIN:Time 3, idle 186861/s, free 78120, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 02 00 00 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 2 (MCUconf) with 7 bytes
Info:TuyaMCU:TuyaMCU_ProcessIncoming: TUYA_CMD_MCU_CONF, TODO!
Info:MAIN:Time 4, idle 181710/s, free 78120, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 12 02 00 04 00 00 00 4B 74
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 18, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 75
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 13 02 00 04 00 00 00 AF D9
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 19, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 175
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 14 02 00 04 00 00 09 55 89
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 20, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 2389
Info:MAIN:Time 5, idle 187156/s, free 78120, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:ssid:ELEKTRODA_WIFI key:REDACTED
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:MAIN:Time 6, idle 161327/s, free 72656, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Boot complete time reached (5 seconds)
Info:CFG:####### Set Boot Complete #######
Info:TuyaMCU:TUYAMCU received: 55 AA 03 03 00 00 05
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 3 (WiFiState) with 7 bytes
Info:MAIN:Time 7, idle 174407/s, free 72656, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 8, idle 87090/s, free 72760, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 9, idle 0/s, free 72760, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:MAIN:Time 10, idle 0/s, free 72760, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/38
Info:GEN:dhcp=0 ip=0.0.0.0 gate=0.0.0.0 mask=0.0.0.0 mac=fc:67:1f:fc:6d:06
Info:GEN:sta: 0, softap: 0, b/g/n
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTED - 4
Info:MAIN:Time 11, idle 88454/s, free 73088, MQTT 0(0), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 12, idle 183454/s, free 72912, MQTT 0(0), bWifi 1, secondsWithNoPing -1, socks 3/38
Info:MQTT:mqtt_host empty, not starting mqtt
Info:MAIN:Time 13, idle 192457/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:TuyaMCU:TUYAMCU received: 55 AA 03 07 00 08 13 02 00 04 00 00 00 B4 DE
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 7 (State) with 15 bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: processing dpId 19, dataType 2-DP_TYPE_VALUE and 4 data bytes
Info:TuyaMCU:TuyaMCU_ParseStateMessage: raw data 4 int: 180
Info:MAIN:Time 14, idle 190254/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 15, idle 181946/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 16, idle 189477/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 17, idle 189969/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:MAIN:Time 18, idle 185606/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 19, idle 187869/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 20, idle 188410/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:GEN:dhcp=0 ip=192.168.0.161 gate=192.168.0.1 mask=255.255.255.0 mac=fc:67:1f:fc:6d:06
Info:GEN:sta: 1, softap: 0, b/g/n
Info:GEN:sta:rssi=-46,ssid=ELEKTRODA_WIFI,bssid=28:87:ba:a0:f5:6d ,channel=3,cipher_type:CCMP
Info:MAIN:Time 21, idle 194897/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:MAIN:Time 22, idle 197878/s, free 72912, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 3/38
Info:MAIN:Time 23, idle 188471/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 24, idle 186461/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:MAIN:Time 25, idle 189066/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Info:TuyaMCU:TUYAMCU received: 55 AA 03 00 00 01 01 04
Info:TuyaMCU:TuyaMCU_ProcessIncoming[ver=3]: processing command 0 (Hearbeat) with 8 bytes
Info:MAIN:Time 26, idle 190211/s, free 73128, MQTT 0(1), bWifi 1, secondsWithNoPing -1, socks 2/38
Additionally it is worth running the TuyaMCU queue in flags and adding to autoexec.bat powersave 1 .
Summary
After changing the firmware and uploading my autoexec.bat you can already pair this device with Home Assistant via automatic Discovery in OBK . The whole thing already works locally, without the cloud.
The device works satisfactorily, but could at least show a bit more data. I couldn't find any more interesting dpIDs, the device doesn't report anything else.
You could consider trying to rewire BL0942 directly to the WiFi module, the MCU would then have to be removed. This would also allow for self-calibration already in the OBK itself, but it's hard for me to even determine if this is a plus or minus - the factory calibration isn't that bad, although I haven't done any comparative measurements in this particular case.
p.kaczmarek2 wrote 14220 posts with
rating 12113 , helped 647 times.
Been with us since 2014 year.
Comments
Hey, very cool topic solved. I have a question regarding just changing from Tuya to OBK. I have TO-Q-SY2-JWT and the change to OpenBeken comes out very nicely, works correctly, shows voltages, amperage... [Read more]
In what circuit are these elements There are two possibilities. Either you are simply missing powerSave 1 in autoexec.bat, i.e. dynamic sleep, power saving, or something on the GPIO is wrong. If powersave... [Read more]
You were right. PowerSave 1 doesn't solve the problem but looking after the GPIO was good advice. This particular switch has a bistable relay controlled by GPIO 24 and 26 alternating + o - depending on... [Read more]
There is a driver for this: https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/drivers.md https://obrazki.elektroda.pl/8831039200_1715449184_bigthumb.jpg The appropriate GPIO roles... [Read more]
I admire your wealth of knowledge Both ways I just tested and they worked. Brilliant. What about Tuya's JSON from the device it unfortunately went "in the sewer" because as you can see I'm not the smartest....... [Read more]
But wait, after all, Tuya's JSON is not lost after uploading the firmware. He is there all the time, even after uploading OpenBeken. Unless you performed on chip erase all ? [Read more]
If you can tell me how to download it I will be happy to do so. I have not done EraseAll [Read more]
https://obrazki.elektroda.pl/5779104900_1715456633_thumb.jpg https://obrazki.elektroda.pl/5595567600_1715456655_thumb.jpg . [Read more]
Enclosed Thank you very much once again for your help. I have extracted a great deal more knowledge from the links you sent. Apparently I am doing a poor job of searching ;) . [Read more]
As far as I can see, however, the automatic detection of GPIO roles from my flasher managed it: Device configuration, as extracted from Tuya: - Button (channel 1) on P17 - LED (channel... [Read more]
This is your flasher? I'm full of admiration But I'll admit I'm not sure it is. The file seems to me to have looked different at the time of the flashing process itself. I'm not 100% sure but I'll confirm... [Read more]
Make a topic for each device you have, I will help with getting them up and running. We are creating list of devices here: https://openbekeniot.github.io/webapp/devicesList.html We already have 570 entries,... [Read more]
Hi, where you able to determine the metering chip? Mine has no label on top. I'm curious if it is the same as de SY1. The SY2 is advertised as having over/under voltage protection and over current protection. Where... [Read more]
Hello, where did you get temp_mea_pin key? Can you post full set of images and full JSON? There are no other mentions of temp_mea_pin on our forum yet. https://www.elektroda.com/rtvforum/find.php?q=... [Read more]
It was not actually mentioned in a post, but it is in the JSON file sent by @gregorpn a couple of posts above. I have a device, but chips have no markings on top, so I couldn’t find much. But clearly... [Read more]
yes, interesting { "gw_bi": { "uuid": "397ad6c413026ceb", "psk_key": "7aiqqjpp5BmM5tozpZJ6shEW9UeKOYzfpA0IL", "auth_key": "M2yRClbcA1FkYvLhi46euIPvshTG6oMs", ... [Read more]
So what is connected to P28? https://www.elektroda.com/rtvforum/topic3951016.html#gallery-2 Wait a sec, but this device has CB2S as in first post? So P28 is not routed? Huh. [Read more]
This device I’m referring to is a TO-Q-SY2-JWT and has a CBU module. It was mention in the thread but is not the same as the first post. But this is the only thread I found (in any forum) that mentions... [Read more]
Hello! I have a PJ-1103 and i managed to screw it up. Maybe you can help me recover it. First I made a backup of the original tuya firmware using your nice software flasher. Then I flashed the latest... [Read more]