Elektroda.com
Elektroda.com
X
Elektroda.com

[BK7231N] Tuya smart DIN-rail relay/energy meter

TurkeyMan 174 7
  • #1
    TurkeyMan
    Level 3  
    Teardown of this DIN-rail energy meter from AliExpress.

    [BK7231N] Tuya smart DIN-rail relay/energy meter

    It has a screen, lots of measurements, relay, earth leakage detection.
    It feels substantial and well made, much better than other similar AliExpress products.
    The case is secured with 2 screws, no clips and no rivets. Comes apart very easily.



    It opens to reveal a device with a pin-mounted daughterboard that easily lifts off, no solder.
    [BK7231N] Tuya smart DIN-rail relay/energy meter

    Removing the daughterboard reveals the CPU; another CB3S, it's a BK7231N?
    [BK7231N] Tuya smart DIN-rail relay/energy meter

    The back side of the daughterboard reveals what looks similar to another TuyaMCU I saw in another device, but not the same... so I'm not yet sure exactly what it is.
    The only pins connected are VCC/GND, P6, P9, and RX/TX, and looking at the PCB, I it appears P6/P9 do not go anywhere; I think they're just soldered to increase strength.
    So, VCC, GND, RX, TX... must be TuyaMCU? Just different looking/different version chips?

    I'll break out the uart and take some captures of the comms to see how they communicate later on.
  • #2
    p.kaczmarek2
    Level 28  
    Thank you for showing us this interesting device. I would like to get it supported, we will most likely take the approach similar to here:
    https://www.elektroda.com/rtvforum/topic3928897.html
    This device is also using TuyaMCU, most likely.
    [BK7231N] Tuya smart DIN-rail relay/energy meter
    Here is CB3S pinout:
    [BK7231N] Tuya smart DIN-rail relay/energy meter
    Pin numberSymbolI/O typeFunction
    1RSTILow-level reset, high level active (the pin has been pulled high internally), correspond to CEN of the IC
    2ADC3AIADC pin, which corresponds to P23 of the IC
    3CENIEnabling pin, which is pulled high internally to be compatible with other modules
    4P14I/OA common GPIO interface, which corresponds to P14 of the IC
    5P26I/OGPIOP_26, which corresponds to P26 of the IC, PWM 5
    6P24I/OGPIOP_24, which corresponds to P24 of the IC, PWM 4
    7P6I/OGPIOP_6, which corresponds to P6 of the IC, PWM 0
    8VCCPPower supply pin (3.3V)
    9GNDPPower supply reference ground
    10P9I/OGPIOP_9, which corresponds to P9 of the IC, PWM 3
    11TXD2I/OUART2_TXD (used to display the module internal information), which corresponds to P0 of the IC
    12CSNI/OProduction test control pin. If it is used as a common I/O pin, it must be connected to the VCC externally. Do not connect it to the ground before the module is powered on.
    13P8I/OGPIOP_8, which corresponds to P8 of the IC, PWM 2
    14P7I/OGPIOP_7, which corresponds to P7 of the IC, PWM 1
    15RXD1I/OUART1_RXD (user serial interface), which corresponds to P10 of the IC. Do not connect it to the VCC. By default, the MCU serial port should be in low-level or high-impedance state.
    16TXD1I/OUART1_TXD (user serial interface), which corresponds to P11 of the IC. Do not connect it to the VCC. By default, the MCU serial port should be in low-level or high-impedance state.
    17ADC3AI(Not recommended. If needed, please use Pin 2) ADC port, which corresponds to P23 of the IC. Programmed SPI
    18P22I/O(Not recommended ) GPIOP_22, which corresponds to P22 of the IC. Programmed SPI
    19CSNI/OThe pull-up resistor is needed during usage of customers. Do not connect it to the ground before the module is powered on. Correspond to P21 of the IC.
    20P20I/O(Not recommended. ) GPIOP_20, which corresponds to P20 of the IC. Programmed SPI
    21NC--
    22NC--

    For a start, let's capture some TuyaMCU data. Do not flash OBK yet.
    All you need to do is:
    1. 3.3V LDO power supply (connect GND and 3.3V)
    If you don't want to use 3.3V, it is possible to connect 5V if you have located the 3.3V LDO on the board of device. Connect 5V to input of the LDO and you will get 3.3V output for the board. Direct connection of 5V to CB3S will destroy CB3S
    2. USB to UART converter in 3.3V levels mode
    3. connect RX of UART converter to RX pin of CB3S
    4. keep UART converter connected to PC
    5. start RealTerm, baud 9600 most likely
    6. power on device by that 5V or 3.3V (do not power from mains, because it is dangerous)
    7. You should see packets in realterm
    8. then do again but in capture mode:
    [BK7231N] Tuya smart DIN-rail relay/energy meter
    9. You should create capture showing device usage, something like:
    Code:

    55AA0307000501010001011255AA0307000802020004000000647D55AA0307000501010001001155AA0307000802020004000000647D55AA0307000501010001011255AA0307000802020004000000647D55AA03000001010455AA0307000501010001001155AA0307000802020004000000647D55AA0301002A7B2270223A22706B6636676761616F66676F7439626B222C2276223A22312E302E30222C226D223A307D1B55AA030200000455AA0307000501010001001155AA0307000802020004000000647D55AA0307000504040001001755AA0307000803020004000000001A55AA0307000501010001011255AA0307000802020004000000647D55AA03070008020200040000005A7355AA030700080202000400000050695(...)

    above sample is from dimmer
    10. Repeat the same for TX pin of CB3S (because you can separately capture what CB3S sends to TuyaMCU, and what TuyaMCU sends to CB3S)
    11. Then I will be able to use my TuyaMCU analyzer tool to determine dpIDs and config:
    [BK7231N] Tuya smart DIN-rail relay/energy meter


    NOTE: it is also possible to skip packets capture on UART and straight up check them in OBK, but it's not always a very reliable way
    Another option would be to find some docs for an ESP8266 version of this device and use them, maybe Tuya didn't change DPid while migrating to BK....

    NOTE2: The TuyaMCU is using the same TX/RX as a flashing interface. You might have problems with flashing with TuyaMCU connected due to the interference (TuyaMCU interferes with flashing). You can disconnect TuyaMCU for the time of flashing OpenBeken to the device.
  • #3
    TurkeyMan
    Level 3  
    Yes I'll take a dump when I can work out how to access the TX/RX pins while it's powered on... the circuit is hard to follow, and I couldn't find an obvious place where the TX/RX lines shunt from the main board to the daughterboard... there must be pins to relay the RS232 comms, but I can't measure them with a continuity meter... maybe there's some resistors or buffering hardware or something in between?
    Also, the VCC seems complicated, like you said above; I can't find 3.3V continuity from the main power hardware to the chip. I can solder 3.3V to the chip directly, but I suspect that TuyaMCU and screen may not get their power if I do that, and the test will be useless!
    Do you have something more firm to help me work out what I'm looking for with the 5V line?

    Added after 12 [minutes]:

    p.kaczmarek2 wrote:
    You can disconnect TuyaMCU for the time of flashing OpenBeken to the device.


    Yes, fortunately the daughterboard just sits on pins; simply lift it off, no problem!
    I think this is one of the best DIN rail meters I've ever found in terms of features, build quality, and ease of liberating... assuming we can make it work! :P
  • #4
    TurkeyMan
    Level 3  
    Monitoring the RX line:
    Code:

    8000000000000000000055AA010006090500020800270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    (press button)
    55AA0307000569010001017A00000000000000000000000000
    (press button)
    55AA0307000569010001007900000000000000000000000000000000000000000000000000000000

    Monitoring the TX line:
    Code:

    800000000000000000000000000000


    Through all this though, the screen shows "0V", and "OFF" on it... my guess is that it doesn't actually work properly when the mains isn't connected.

    I'll have to do these captures on 240V power O_O

    Added after 13 [minutes]:

    Okay, I took readings when powered from the mains, and it all looks much more sensible.

    There was nothing on the load side, so the voltage should read ~247V, but ~0A... I saw the thing show a couple milli-Amps on the screen occasionally, maybe it's power used to power the device itself, so you might notice a very small Amp reading...?

    It's very important to determine if the device accumulates and reports kWh internally, or if it just reports discreet readings every few moments and expects external software to accumulate? I would expect it to internally maintain and report a kWh counter, otherwise it would be quite imprecise over a long time; short spikes or noise between samples may go un-noticed.

    RX line:
    Code:

    (power on)
    55AA03000001000355AA0301002A7B2270223A2272396B67326731756868796963796362222C2276223A22312E302E31222C226D223A327D0155AA030200000455AA030300000555AA03000001010455AA0307000865020004000001139055AA0307000866020004000000AA2755AA030700086702000400000032B055AA030700086802000400000032B155AA030700056A010001007A55AA030700050B010001001B55AA030700050C010001001C55AA030700080D020004000000002455AA03070016130300124653452D46373233433535383132383838355955AA0307000509050001001D55AA0307000569010001007955AA030300000555AA030300000555AA0307000509050001001D55AA03000001010455AA03000001010455AA0307000510010001012155AA0307000E0600000A09BA0000000000000000EA55AA0307000E0700000A000000000000000000002855AA0307000E0800000A000000000000000000002955AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09BA0000000000000000EA55AA03000001010455AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09A60000000000000000D655AA0307000E0600000A09BA0000000000000000EA55AA03000001010455AA0307000E0600000A09B0000000000000000CEC55AA0307000E0600000A09B00000000000000000E055AA03000001010455AA0307000E0600000A09BA0000000000000000EA55AA0307000E0600000A09C40000000000000000F455AA0307000E0600000A09BA0000000000000000EA55AA03000001010455AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09BA0000000000000000EA
    (turn relay off)
    55AA03000001010455AA0307000510010001002055AA03000001010455AA03000001010455AA03000001010455AA03000001010455AA030000010104
    (turn relay on)
    55AA0307000510010001012155AA03000001010455AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09BA0000000000000000EA55AA0307000E0600000A09BA000000000000000EF855AA0307000E0600000A09BA0000000000000000EA55AA0307000E0600000A09B00000000000000000E055AA03000001010455AA03000001010455AA0307000E0600000A09BA0000000000000000EA55AA030700051001000100200000000000000000E8000000FE00F8000000070001070000000000000018BE005000000700FF00304000180080FB04F8F0040058138800000000000008102000FF000000FF000000FE01F80000F00000FF0000BAF00086F80000788D0000C00310FF00E0080000

    Somewhere there in the last block is the power-off sequence, but I didn't note the offset when I powered the device off... I guess it's after the last 55AA sequence. Not sure if legit comms, or just noise that happens while the unit is powering down.

    TX line:
    Code:

    (power on)
    55AA00000000FF55AA000100000055AA000200000155AA00030001020555AA00000000FF55AA000800000755AA00030001030655AA00030001040755AA00000000FF55AA00000000FF
    (idling)
    55AA00000000FF55AA00000000FF55AA00000000FF55AA00000000FF55AA00000000FF55AA00000000FF
    (power off)
    0000000000080600FF0000E8FC000800EA010800880000000008F000088000087D000004CE00FC0000C00000BB00F0006000000104080018FC00F0180404001002BF0000F000000000
  • #5
    p.kaczmarek2
    Level 28  
    TurkeyMan wrote:
    Monitoring the RX line:
    Code:

    8000000000000000000055AA010006090500020800270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    (press button)
    55AA0307000569010001017A00000000000000000000000000
    (press button)
    55AA0307000569010001007900000000000000000000000000000000000000000000000000000000


    [BK7231N] Tuya smart DIN-rail relay/energy meter





    TurkeyMan wrote:

    RX line:
    Code:

    (power on)
    55AA03000001000355AA0301002A7B2270223A2272396B67326731756868796963796362222C2276223A22312E302E31222C226D223A327D0155AA030200000455AA030300000555AA03000001010455AA0307000865020004000001139055AA0307000866020004000000AA2755AA030700086702000400000032B055AA030700086802000400000032B155AA030700056A010001007A55AA030700050B010001001B55AA030700050C010001001C55AA030700080D020004000000002455AA03070016130300124653452D46373233433535383132383838355955AA0307000509050001001D55AA0307000569010001007955AA030300000555AA030300000555AA0307000509050001001D55AA03000001010455AA03000001010455AA0307000510010001012155AA0307000E0600000A09BA0000000000000000EA55AA0307000E0700000A000000000000000000002855AA0307000E0800000A000000000000000000002955AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09BA0000000000000000EA55AA03000001010455AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09A60000000000000000D655AA0307000E0600000A09BA0000000000000000EA55AA03000001010455AA0307000E0600000A09B0000000000000000CEC55AA0307000E0600000A09B00000000000000000E055AA03000001010455AA0307000E0600000A09BA0000000000000000EA55AA0307000E0600000A09C40000000000000000F455AA0307000E0600000A09BA0000000000000000EA55AA03000001010455AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09BA0000000000000000EA
    (turn relay off)
    55AA03000001010455AA0307000510010001002055AA03000001010455AA03000001010455AA03000001010455AA03000001010455AA030000010104
    (turn relay on)
    55AA0307000510010001012155AA03000001010455AA0307000E0600000A09B00000000000000000E055AA0307000E0600000A09BA0000000000000000EA55AA0307000E0600000A09BA000000000000000EF855AA0307000E0600000A09BA0000000000000000EA55AA0307000E0600000A09B00000000000000000E055AA03000001010455AA03000001010455AA0307000E0600000A09BA0000000000000000EA55AA030700051001000100200000000000000000E8000000FE00F8000000070001070000000000000018BE005000000700FF00304000180080FB04F8F0040058138800000000000008102000FF000000FF000000FE01F80000F00000FF0000BAF00086F80000788D0000C00310FF00E0080000

    Somewhere there in the last block is the power-off sequence, but I didn't note the offset when I powered the device off... I guess it's after the last 55AA sequence. Not sure if legit comms, or just noise that happens while the unit is powering down.

    [BK7231N] Tuya smart DIN-rail relay/energy meter
    They even send a string:
    Code:

    HEADER   VER=03   State      LEN   fnId=19 Str V=FSE-F723C558128885   CHK   

    What is FSE-F723C558128885?

    fnId6 is not yet on the small list but:

    55 AA 03 07 00 0E 06 00 00 0A 09BA000000000000000E F8
    HEADER VER=03 State LEN fnId=6 Raw V=09 BA 00 00 00 00 00 00 00 0E CHK

    09BA000000000000000E
    09BA looks like a big endian 2490, maybe this RAW packet is a custom version of voltage packet?
    [BK7231N] Tuya smart DIN-rail relay/energy meter

    TurkeyMan wrote:

    TX line:
    Code:

    (power on)
    55AA00000000FF55AA000100000055AA000200000155AA00030001020555AA00000000FF55AA000800000755AA00030001030655AA00030001040755AA00000000FF55AA00000000FF
    (idling)
    55AA00000000FF55AA00000000FF55AA00000000FF55AA00000000FF55AA00000000FF55AA00000000FF
    (power off)
    0000000000080600FF0000E8FC000800EA010800880000000008F000088000087D000004CE00FC0000C00000BB00F0006000000104080018FC00F0180404001002BF0000F000000000

    [BK7231N] Tuya smart DIN-rail relay/energy meter


    I could try to decrypt more and then add support to OpenBeken, but I would need, for instance, a sample with 60W bulb load and then a sample with 10W bulb load so I can compare the data
  • #6
    TurkeyMan
    Level 3  
    Yes I need to get a bulb fixture to wire in for load testing.
    I need some kind of device with a very precise and stable AMP draw (ideally PF1); some devices require calibration..

    Added after 6 [hours] 13 [minutes]:

    Here's another one, this time with my ~20W soldering iron.

    Voltage tonight is 239 - 240V
    I saw a bunch of 50's above, that's probably the 50hZ AC frequency?
    The soldering iron read 0.2A for a short while after turning on, then settled on 0.1A (probably when it warmed up).

    RX line:
    Code:

    (power on)
    0055AA03000001000355AA0301002A7B2270223A2272396B67326731756868796963796362222C2276223A22312E302E31222C226D223A327D0155AA030200000455AA030300000555AA03000001010455AA0307000865020004000001139055AA0307000866020004000000AA2755AA030700086702000400000032B055AA030700086802000400000032B155AA030700056A010001007A55AA030700050B010001001B55AA030700050C010001001C55AA030700080D020004000000002455AA03070016130300124653452D46373233433535383132383838355955AA0307000509050001001D55AA0307000569010001007955AA030300000555AA030300000555AA0307000509050001001D55AA03000001010455AA03000001010455AA0307000510010001012155AA0307000E0600000A09740000000000000000A455AA0307000E0700000A000000000000000000002855AA0307000E0800000A000000000000000000002955AA0307000E0600000A097400006400003300003B55AA0307000E0600000A09740000C800003000009C55AA0307000E0600000A096A0000C800003000009255AA0307000E0600000A096A0000C800002D00008F55AA0307000E0600000A096A00006400002B00002955AA0307000E0600000A096A000064000029000C3355AA0307000E0600000A096A00006400002900002755AA0307000E0600000A096A00006400002700002555AA0307000E0600000A096A00006400002600002455AA0307000E0600000A096A00006400002500002355AA0307000E0600000A097400006400002300002B55AA03000001010455AA0307000E0600000A097400006400002200002A55AA0307000E0600000A096A00006400002200002055AA0307000E0600000A096A00006400002100001F55AA0307000E0600000A097400006400002100002955AA0307000E0600000A097400006400002000002855AA0307000E0600000A096A00006400002000001E55AA0307000E0600000A096A00006400001F00001D55AA03000001010455AA0307000E0600000A097400006400001F00002755AA0307000E0600000A096A00006400001E00001C55AA03000001010455AA0307000E0600000A096A00006400001E000C2855AA0307000E0600000A096A00006400001D00001B55AA0307000E0600000A097400006400001E00002655AA0307000E0600000A096A00006400001D00001B55AA03000001010455AA0307000E0600000A096A00006400001D000C2755AA0307000E0600000A096A00006400001D00001B55AA0307000E0600000A096A00006400001C00001A55AA0307000E0600000A097400006400001C00002455AA0307000E0600000A096A00006400001C00001A55AA03000001010455AA0307000E0600000A097400006400001C00002455AA0307000E0600000A096A00006400001C00001A55AA03000001010455AA0307000E0600000A096A00006400001B00001955AA0307000E0600000A096A00006400001C000C2655AA0307000E0600000A096A00006400001C00001A55AA0307000E0600000A097400006400001B00002355AA03000001010455AA0307000E0600000A096A00006400001B000C2555AA0307000E0600000A096A00006400001C00001A55AA0307000E0600000A096A00006400001B000019
    (power switch off)
    55AA0307000E0600000A097400006400001B00002355AA03070005100100010020000000000000000000F700FF08000800FE7800F8F00000F00000000000080000FCF80000F80000F008080000F80008FEF0F70000000000F8FF0800F00800087800FF0000F000F0F800F80F081100007C0F0000FF00F800F80088780008FF02400B100000


    Added after 37 [minutes]:

    .... and there goes that one!
    I was doing another capture with a higher power device (my phone's fast-charger) as another voltage reference, and when it turned the relay on it tripped the house circuit breaker.
    Now when I try and power the device, it powers on for a few moments, then loses power for a moment, comes back, and repeats... it gets stuck in a sort of boot loop.
    I guess the device is electrically damaged. I have no idea what I did, but I guess I blew it up!
    I hope there's plenty of data there...

    Added after 12 [minutes]:

    One thing I noted is the CB3S gets very hot very fast. It's such a low power chip, and it's not doing a whole lot of work... should it get hot?
    I think the TuyaMCU is waiting for the CB3S to boot, notes that it's not responsive or crashed, and then reboots the whole system and starts over, gets stuck in a reboot cycle driven by TuyaMCU failing to communicate with the CB3S?
  • #7
    p.kaczmarek2
    Level 28  
    Are you sure it's dead? Maybe at least WiFi module is recoverable? Is there some kind of visible damage on the board?

    I will analyze the packets later today.

    CB3S might get cooler soon, we are working on low power mode for OBK.
  • #8
    TurkeyMan
    Level 3  
    I think the wifi module is the dead part.
    The Tuya seems to work on bootup for a while, screen displays, it shows correct voltage and current readings at power-on, then it enters a 30s bootup countdown sequence which I think is waiting for the wifi module to come online... then shortly after that 30s count finishes, the device appears to go into a hard reset cycle.
    In addition to that, the screen seems to have been damaged. At power-on, the screen is not as bright as it was before, and over the 30s countdown, the screen slowly fades away until it's not visible.
    I don't have the electronics skills to fix this :(

    The only theory I have, is when I was trying to work out how to power the wifi+tuya to take the first round of readings, I couldn't find a 3.3V source... there didn't seem to be one. You suggested I look for a 5V source, so I did... I powered it on from the mains and measured the voltage on the pins next to the GND pins that looked in the appropriate area for power delivery, and I did find a pin that was 5V to GND, so I guessed that was the power source.
    I wired up a 5V power supply and turned it on and everything seemed to boot up fine so I could do my tests... but then I realised that without the mains power connected, the device just reported "OFF", and so I couldn't capture any measurement comms... so I had to do the captured with mains power.
    I suspect maybe I damaged it while powering from external 5V, even though it seemed to be working fine... maybe something burned? (even though I measure 5V when it's on and operating normally on that line.