Elektroda.com
Elektroda.com
X
Elektroda.com

[TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

tomanyusers 264 14
  • #1
    tomanyusers
    Level 3  
    Teardown of this DIN-rail energy meter from AliExpress. https://www.aliexpress.com/i/1005004628460684.html

    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]







    I want to use the device in Home Assistant without using Tuya.

    From what I see I have a few options:
    1. Reflash the BK7231N with OpenBK7231N
    2. Replace the BK7231N with an ESP-12F Flashed with Tasmors or ESP-Home (Will probably have to jump a few pins to get it to boot from what I have read)

    The issue I have is that I don't know what the energy meter chip used by this meter is and what driver I would need to use. Can anybody point me in the right direction?

    Has anybody used one of these meters before?
  • #2
    p.kaczmarek2
    Level 28  
    Hello, I can get OpenBK working for you on this chip, but I would need a bit more of information. From the current photos, I can't see what's happening on the PCB.

    Can you provide more information, including the name of ICs on the boards, is there some kind of power measuring chip like BL0937 or BL0942 or CSE*, it there, maybe, a TuyaMCU that connects to RX1 and TX1 of CB3S?
  • #3
    tomanyusers
    Level 3  
    Hi

    I had to desolder the LCD Board and this is what I found. TX and RX from the CB3S are routed thought to the LCD PCB.

    The Main Chip Is a V9911
    A FM24C64 - nonvolatile memory
    A SC02B - Best Guess The numbers are unclear


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]


  • #4
    p.kaczmarek2
    Level 28  
    Are you really sure that's a V9911? But... the photo certainly confirms. I haven't seen such chip yet.

    I am only aware about the V9261F chip. It was described here:
    https://www.creationfactory.co/2019/12/reverse-engineering-zmai-90-din-rail.html
    I already started working on V9261F driver for OBK. V9911 (or V9911F?), on other hand, doesn't seem to exist anywhere. I am also unable to find the datasheet.

    Where exactly is V9911 connected? Does it connect to RX1 and TX1 of CB3S?
  • #5
    tomanyusers
    Level 3  
    It's definitely a V9911. I found the data sheet if that helps.

    Pin15 and 16 ( RX1 and TX1) of CB3S are connected directly to the V9911 on TXD4 and RXD4 respectively.
  • #6
    p.kaczmarek2
    Level 28  
    If that's using UART, then I can try to make you support for that if you just provide me a capture of sent data, in hex format.

    I can run OBK on Windows and easily developer drivers with 'fake' UART packets.

    Would you be able to provide Realterm hex capture (and determine baud rate) like the user in this topic?
    https://www.elektroda.com/rtvforum/topic3933836.html

    Second option: is there ANY driver for V9911 anywhere? Tasmota? From what I heard, there is only that:
    https://www.creationfactory.co/2019/12/reverse-engineering-zmai-90-din-rail.html
    but zmai-90 uses Vangotech V9821 chip so we would need to know if it is the same as V9911
  • #7
    tomanyusers
    Level 3  
    Hi

    I have sniffed the data on the Tx and Rx. It's a new meter so most of the values are still all zero. Ill run the meter with a load connected for a bit and then give you some more results.

    The voltage: ~236.5V

    Rx PIN:
    Code:

    (Normal Running)
    55 AA 03 07 00 14 06 00 00 08 09 1D 00 00 00 00 00 00 01 02 00 04 00 00
    00 00 58 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01
    01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26
    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55
    AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03
    00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24
    00 00 26 55 AA 03 07 00 14 06 00 00 08 09 36 00 00 00 00 00 00 01 02 00
    04 00 00 00 00 71 55 AA 03 00 00 01 01 04                               
                                               

    (Toggel Relay)
    55 AA 03 24 00 00 26 55 AA 03 07 00 11 10 01 00 01 00 12 03 00 08 32 32
    34 39 30 30 36 38 E8 55 AA 03 07 00 11 10 01 00 01 01 12 03 00 08 32 32
    34 39 30 30 36 38 E9 55 AA 03 00 00 01 01 04
     




    Tx Pin
    Code:

    (Normal Running)
    55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BE E2 55 AA 00 00 00 00 FF 55 AA
    00 24 00 01 C2 E6 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 C3 E7 55 AA 00
    00 00 00 FF 55 AA 00 24 00 01 C2 E6 55 AA 00 00 00 00 FF 55 AA 00 24 00
    01 C3 E7 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BB DF 55 AA 00 00 00 00
    FF 55 AA 00 24 00 01 BD E1 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BE E2
    55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BE E2 55 AA 00 00 00 00 FF 55 AA
    00 24 00 01 BD E1   

    (Toggel Relay)
    55 AA 00 00 00 00 FF 55 AA 00 06 00 05 10 01 00 01 00 1C 55 AA 00 24 00
    01 B7 DB 55 AA 00 06 00 05 10 01 00 01 01 1D 


    Added after 1 [hours] 22 [minutes]:

    From looking at the data and some googleing this looks like the Tuya MCU protocol to me. As 55 AA 00 00 00 00 FF is the Tuya MCU heartbeat.

    What are your thoughts?
  • #8
    p.kaczmarek2
    Level 28  
    Hey, it has 55 AA header! That's a very good news, it's a Tuya MCU, like the previous one, and we already support most of it out of the box!

    Still, lets analyze the packets, because some devices have 'special' packets that we still need to parse.

    But don't worry, you will certainly get support for that device.

    Quote:

    Rx PIN:
    Code:

    (Normal Running)
    55 AA 03 07 00 14 06 00 00 08 09 1D 00 00 00 00 00 00 01 02 00 04 00 00
    00 00 58 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01
    01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26
    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55
    AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03
    00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24
    00 00 26 55 AA 03 07 00 14 06 00 00 08 09 36 00 00 00 00 00 00 01 02 00
    04 00 00 00 00 71 55 AA 03 00 00 01 01 04                               


    This is the data send from TuyaMCU to WiFi module. It contains energy stats, voltage, etc.
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    fnID 6 looks like a compound data packet
    55 AA 03 07 00 14 06 00 00 08 09 1D 00 00 00 00 00 00 01 02 00 04 00 00
    00 00 58
    the content: 091D000000000000
    091D looks like a big endian 2333 to me, so a voltage times 10? 233.3V?
    the remaining bytes in this packet are most likely current, power etc, but they are all 0 and I can't determine which value is where, I need a sample with a 60W load

    Quote:

    Rx PIN:
    Code:

    (Toggel Relay)
    55 AA 03 24 00 00 26 55 AA 03 07 00 11 10 01 00 01 00 12 03 00 08 32 32
    34 39 30 30 36 38 E8 55 AA 03 07 00 11 10 01 00 01 01 12 03 00 08 32 32
    34 39 30 30 36 38 E9 55 AA 03 00 00 01 01 04


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    Huh? A a string?
    No idea what it might be currently.
    But there is also a fnID=16 with Val 0 or 1... so, a relay.
    it looks like a relay is connected to MCU and MCU reports to WiFi module the state of relay..

    Quote:

    Tx Pin
    Code:

    (Normal Running)
    55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BE E2 55 AA 00 00 00 00 FF 55 AA
    00 24 00 01 C2 E6 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 C3 E7 55 AA 00
    00 00 00 FF 55 AA 00 24 00 01 C2 E6 55 AA 00 00 00 00 FF 55 AA 00 24 00
    01 C3 E7 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BB DF 55 AA 00 00 00 00
    FF 55 AA 00 24 00 01 BD E1 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BE E2
    55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BE E2 55 AA 00 00 00 00 FF 55 AA
    00 24 00 01 BD E1   


    Nothing interesting here:
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

    Quote:

    Tx Pin
    Code:

    (Toggel Relay)
    55 AA 00 00 00 00 FF 55 AA 00 06 00 05 10 01 00 01 00 1C 55 AA 00 24 00
    01 B7 DB 55 AA 00 06 00 05 10 01 00 01 01 1D 

    Not much interesting here...
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

    I would need to know:
    1. that "toggling relay" was toggling relay on the case? Not by Tuya App?
    2. Can you provide packet sample for toggling relay from Tuya App? But... maybe it's not needed, most likely just send fnID....
    3. Would you be able to provide a packet sample with 60W bulb as a load and with, for example, 12W load so I can figure out where is current stored in that compound packet?

    I just need that information, or at least info from 3 - 60W bulb load and, let's say, 12W load capture... and it will be very EASY to support that one.

    We're lucky. I was worried it was using some kind of more exotic protocol.
  • #9
    tomanyusers
    Level 3  
    Great News. I was also a little worried.
    I don't have a light ready at hand but I do have a fan. I hope that will work. If not let me know.

    Here is the Tx Pin when toggling the relay from the App.
    Code:

    55 AA 00 24 00 01 C7 EB
    55 AA 00 00 00 00 FF
    55 AA 00 24 00 01 C8 EC
    55 AA 00 06 00 05 10 01 00 01 00 1C
    55 AA 00 00 00 00 FF
    55 AA 00 06 00 05 10 01 00 01 01 1D
    55 AA 00 24 00 01 C8 EC
    55 AA 00 00 00 00 FF
    55 AA 00 24 00 01 C8 EC
    55 AA 00 06 00 05 10 01 00 01 00 1C
    55 AA 00 06 00 05 10 01 00 01 01 1D
    55 AA 00 00 00 00 FF
    55 AA 00 24 00 01 C8 EC


    Here is the Rx Pin when toggling the relay from the App.
    Code:

    55 AA 03 24 00 00 26 55 AA 03 07 00 11 10 01 00 01 00 12 03 00 08 32 32 34 39 30 30 36 38 E8 55 AA 03 00 00 01 01 04 55 AA 03 07 00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 4A 00 00 84 00 00 1D 01 02 00 04 00 00 00 03 29 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26


    Here is running with a fan on max:
    Voltage~ 234.8
    Current~0.154
    Watage~36.13
    PF ~0.999
    Frequency 50.04
    Code:

    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 16 00 00 99 00 00 23 01 02 00 04 00 00 00 03 10 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26



    Here is running with a fan on min:
    Voltage~ 235.8
    Current~0.131
    Watage~28.67
    PF ~0.93
    Frequency 50.04
    Code:

    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 33 00 00 83 00 00 1C 01 02 00 04 00 00 00 03 10 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 39 00 00 84 00 00 1C 01 02 00 04 00 00 00 03 17 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26



    Here is toggling the relay from the meter with the push button
    Code:

    55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 42 00 00 84 00 00 1C 01 02 00 04 00 00 00 04 21 55 AA 03 07 00 11 10 01 00 01 00 12 03 00 08 32 32 34 39 30 30 36 38 E8 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26


    Added after 25 [minutes]:

    I meant to add that the total kWh is 0.03 to 0.04 but reports as 0.02 in the app so I think there is the option to use the value stored in the MCU or in the BK7231N.
    I had the same with a HiKing DDS238 meter I have used in the past.
  • #10
    p.kaczmarek2
    Level 28  
    Thank you for providing futher data for analysis. Let's see what more is hiding there.

    It seems I've found a little issue. The packets marked in my previous post as "invalid date" starting with 0x10 date (16) are not a date, they are a relay value. fnID = 16, values 0 and 1. It seems the same packet type on two different devices have different meaning.


    tomanyusers wrote:

    Here is the Tx Pin when toggling the relay from the App.
    Code:

    55 AA 00 24 00 01 C7 EB
    55 AA 00 00 00 00 FF
    55 AA 00 24 00 01 C8 EC
    55 AA 00 06 00 05 10 01 00 01 00 1C
    55 AA 00 00 00 00 FF
    55 AA 00 06 00 05 10 01 00 01 01 1D
    55 AA 00 24 00 01 C8 EC
    55 AA 00 00 00 00 FF
    55 AA 00 24 00 01 C8 EC
    55 AA 00 06 00 05 10 01 00 01 00 1C
    55 AA 00 06 00 05 10 01 00 01 01 1D
    55 AA 00 00 00 00 FF
    55 AA 00 24 00 01 C8 EC


    WiFI module sends setting of fnID 16 boolean to 1 or 0:
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

    tomanyusers wrote:

    Here is the Rx Pin when toggling the relay from the App.
    Code:

    55 AA 03 24 00 00 26 55 AA 03 07 00 11 10 01 00 01 00 12 03 00 08 32 32 34 39 30 30 36 38 E8 55 AA 03 00 00 01 01 04 55 AA 03 07 00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 4A 00 00 84 00 00 1D 01 02 00 04 00 00 00 03 29 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    I wonder what that string might be... 22490068 2249 00 68 ??? Maybe a wild guess



    tomanyusers wrote:

    Here is running with a fan on max:
    Voltage~ 234.8
    Current~0.154
    Watage~36.13
    PF ~0.999
    Frequency 50.04
    Code:

    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 16 00 00 99 00 00 23 01 02 00 04 00 00 00 03 10 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    The compound packet data binary looks like this: 0916000099000023
    0916 ---> Big endian 2326 ---> 232.6V
    00
    0099 ---> Big endian 153 ---> 0.153A
    00
    0023 --> Big endian 35 ---> 35W
    huh, where is the Wattage data past the decimal point?


    tomanyusers wrote:

    Here is running with a fan on min:
    Voltage~ 235.8
    Current~0.131
    Watage~28.67
    PF ~0.93
    Frequency 50.04
    Code:

    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 33 00 00 83 00 00 1C 01 02 00 04 00 00 00 03 10 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 39 00 00 84 00 00 1C 01 02 00 04 00 00 00 03 17 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    So again, let's split this compound value and check what's inside:
    093900008400001C
    0939 ---> Big endian 2361 --> 236.1V
    00
    0084 --> Bigi Endian 132 ---> 0.132A
    00
    001C --> Big endian 28 ---> 28W?
    maybe that 00 bytes belong to next values as well... idk
    Where is the power factor?

    tomanyusers wrote:

    Here is toggling the relay from the meter with the push button
    Code:

    55 AA 03 24 00 00 26 55 AA 03 07 00 14 06 00 00 08 09 42 00 00 84 00 00 1C 01 02 00 04 00 00 00 04 21 55 AA 03 07 00 11 10 01 00 01 00 12 03 00 08 32 32 34 39 30 30 36 38 E8 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 07 00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    Ok, let's focus on that:
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    So basically, we have:
    - fnID 16 - relay boolean
    - fnID 6 - binary data 094200008400001C -> as explained above, voltage (0x0942 is 2370), current, power
    - fnID 1 - value - V=4 ??? No idea what it could be and why it's 4
    - fnID 18 - string - 22490068 - no idea yet. It's worth noting that it's marked as an ASCII string, it's 3232343930303638 in hex
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    but that 2249 from string doesn't match 0x0942 - 2370 hmm

    22490068 that string seems to be present in all the tests, so maybe it's some kind of constant, and not the measurements data?

    It would be really useful if you had a autotransformer and try to show me the UART packets at 180V voltage or something.... but I am aware that most of people don't have them at hand.

    PS: it is worth nothing that DDS238 is using different packet format:
    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

    so we still need to find where the power factor is, maybe I missed that, I will recheck those packets later.
  • #11
    tomanyusers
    Level 3  
    Going through the LCD menu I could find the same number 22490068. Maybe a serial number? I have emailed the manufacturer for the operating instructions, perhaps we can find something there.

    I think the wattage is being reported in kW. So it is 0.035kW

    I think the 4 might be 0.04 kWh

    I'm not sure where the Power Factor is and there should be some other parameters like two-way active energy, reactive energy, and monthly and daily electricity consumption statistics available from this meter.

    But it looks like they are not sent through to the App at the moment.

    Added after 7 [minutes]:

    From the ads the following should be available but are not being sent to the App at the moment:
    Quote:

    ▷ Multi-function parameter measurement, providing voltage, current, active power, reactive power, apparent power, power factor, phase Angle, etc
    ▷ Providing a variety of statistical data and local storage functions. Provide monthly electricity consumption statistics for the last 12 months and daily electricity consumption statistics for the last 31 days.
  • #12
    p.kaczmarek2
    Level 28  
    Ah ok, so the "22490068" is solved, altough it would be interesting to see how it's displayed. A model number?

    Can you provide a sample with larger kWh value so we can check?

    Quote:

    But it looks like they are not sent through to the App at the moment.

    So what kind of values that are available in the App we are still missing?
  • #13
    tomanyusers
    Level 3  
    Going back through this thread I can see that the 4 is 0.04kWh as it was 0.03kWh in some of our earlier tests.

    From the screenshots looks like we have all the info.

    Here is the sample at the startup

    RX Pin
    Code:

    55 AA 03 00 00 01 00 03 55 AA 03 01 00 2A 7B 22 70 22 3A 22 6C 69 68 34
    76 6A 65 6F 79 61 6F 34 6A 65 6B 75 22 2C 22 76 22 3A 22 32 2E 30 2E 30
    22 2C 22 6D 22 3A 30 7D 41 55 AA 03 02 00 00 04 55 AA 03 03 00 00 05 55
    AA 03 00 00 01 01 04 55 AA 03 03 00 00 05 55 AA 03 07 00 14 06 00 00 08
    09 28 00 00 00 00 00 00 01 02 00 04 00 00 00 04 67 55 AA 03 07 00 0C 03
    00 00 08 16 0B 16 0B 00 00 00 04 66 55 AA 03 07 00 0C 04 00 00 08 0B 1D
    0B 1D 00 00 00 00 71 55 AA 03 07 00 06 0B 00 00 02 01 00 1D 55 AA 03 07
    00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03 24
    00 00 26 55 AA 03 1C 00 00 1E 55 AA 03 1C 00 00 1E 55 AA 03 1C 00 00 1E
    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04   


    TX Pin
    Code:

    55 AA 00 00 00 00 FF 55 AA 00 00 00 00 FF 55 AA 00 00 00 00 FF 55 AA 00
    08 00 00 07 55 AA 00 03 00 01 04 07 55 AA 00 1C 00 08 01 16 0B 1D 07 30
    26 02 C1 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 C0 E4


    On The Rx Pin when querying historical data from the app
    Code:

    55 AA 03 00 00 01 01 04 55 AA 03 07 00 0C 04 00 00 08 0B 1D 0B 1D 00 00
    00 00 71 55 AA 03 24 00 00 26 55 AA 03 07 00 0C 03 00 00 08 16 0B 16 0B
    00 00 00 04 66 55 AA 03 07 00 0C 04 00 00 08 0B 1D 0B 1D 00 00 00 00 71
    55 AA 03 07 00 0C 03 00 00 08 16 0B 16 0B 00 00 00 04 66 55 AA 03 00 00
    01 01 04 55 AA 03 24 00 00 26                                           


    On the Tx Pin when querying historical data from the app
    Code:

    55 AA 00 06 00 08 04 00 00 04 0B 1D 0B 1D 65 55 AA 00 1C 00 08 01 16 0B
    1D 07 34 35 02 D4 55 AA 00 06 00 08 04 00 00 04 0B 1D 0B 1D 65 55 AA 00
    06 00 08 03 00 00 04 16 0B 16 0B 56 55 AA 00 06 00 08 03 00 00 04 16 0B
    16 0B 56 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BF E3



    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N] [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N] [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

    Added after 1 [hours] 37 [minutes]:

    I was able to track down the datasheet for this meter.
  • #14
    p.kaczmarek2
    Level 28  
    tomanyusers wrote:

    Here is the sample at the startup

    RX Pin
    Code:

    55 AA 03 00 00 01 00 03 55 AA 03 01 00 2A 7B 22 70 22 3A 22 6C 69 68 34
    76 6A 65 6F 79 61 6F 34 6A 65 6B 75 22 2C 22 76 22 3A 22 32 2E 30 2E 30
    22 2C 22 6D 22 3A 30 7D 41 55 AA 03 02 00 00 04 55 AA 03 03 00 00 05 55
    AA 03 00 00 01 01 04 55 AA 03 03 00 00 05 55 AA 03 07 00 14 06 00 00 08
    09 28 00 00 00 00 00 00 01 02 00 04 00 00 00 04 67 55 AA 03 07 00 0C 03
    00 00 08 16 0B 16 0B 00 00 00 04 66 55 AA 03 07 00 0C 04 00 00 08 0B 1D
    0B 1D 00 00 00 00 71 55 AA 03 07 00 06 0B 00 00 02 01 00 1D 55 AA 03 07
    00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03 24
    00 00 26 55 AA 03 1C 00 00 1E 55 AA 03 1C 00 00 1E 55 AA 03 1C 00 00 1E
    55 AA 03 00 00 01 01 04 55 AA 03 24 00 00 26 55 AA 03 00 00 01 01 04   


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    - fnId=6 Raw V=09 28 00 00 00 00 00 00 - already described above, 0x0928 is 2344 which is 234.4V, other fields are current and power
    - fnId=1 Val V=4- idk
    - fnId=3 Raw 16 0B 16 0B 00 00 00 04 - TODO?
    What could be 160B hex? That 0004 might be... just a 4. Total power consumption. full 4 bytes integer, 32 bit one. 00 00 00 04.
    Wait...
    0x16 is is 22 and 0B is 11... a date? Year and month? Hmm we would need to check in the next month if it changes to 0x0C (12 month).
    - fnId=4 Raw 0B 1D 0B 1D 00 00 00 00 - TODO?
    What could be 0B1D hex?
    0x0B is 11.... and 0x1D is 29! A day! 29th day of month 11!
    So...
    Maybe fnId==3 is a 'last month' and fnId=4 is 'last day'?
    The format would be: 2 bytes day ID, 2 bytes month ID, 4 bytes Wh consumption

    - fnId=11 Raw 01 00
    - fnId=16 Bool V=1 - relay boolean
    - fnId=18 Str "22490068" - model number


    tomanyusers wrote:

    TX Pin
    Code:

    55 AA 00 00 00 00 FF 55 AA 00 00 00 00 FF 55 AA 00 00 00 00 FF 55 AA 00
    08 00 00 07 55 AA 00 03 00 01 04 07 55 AA 00 1C 00 08 01 16 0B 1D 07 30
    26 02 C1 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 C0 E4


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    In the following packet, the current date is being sent from WiFI module to TuyaMCU. We will also have to send that, but we have NTP.


    tomanyusers wrote:

    On The Rx Pin when querying historical data from the app
    Code:

    55 AA 03 00 00 01 01 04 55 AA 03 07 00 0C 04 00 00 08 0B 1D 0B 1D 00 00
    00 00 71 55 AA 03 24 00 00 26 55 AA 03 07 00 0C 03 00 00 08 16 0B 16 0B
    00 00 00 04 66 55 AA 03 07 00 0C 04 00 00 08 0B 1D 0B 1D 00 00 00 00 71
    55 AA 03 07 00 0C 03 00 00 08 16 0B 16 0B 00 00 00 04 66 55 AA 03 00 00
    01 01 04 55 AA 03 24 00 00 26                                           


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
    - fnId 4, Raw, 0B1D0B1D00000000
    - fnId 3, raw, 160B160B00000004


    tomanyusers wrote:

    On the Tx Pin when querying historical data from the app
    Code:

    55 AA 00 06 00 08 04 00 00 04 0B 1D 0B 1D 65 55 AA 00 1C 00 08 01 16 0B
    1D 07 34 35 02 D4 55 AA 00 06 00 08 04 00 00 04 0B 1D 0B 1D 65 55 AA 00
    06 00 08 03 00 00 04 16 0B 16 0B 56 55 AA 00 06 00 08 03 00 00 04 16 0B
    16 0B 56 55 AA 00 00 00 00 FF 55 AA 00 24 00 01 BF E3


    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]

    It seems there is still more data we could use.
  • #15
    tomanyusers
    Level 3  
    On Startup

    Code:

    55 AA 00 00 00 00 FF 55 AA 00 00 00 00 FF 55 AA 00 08 00 00 07 55 AA 00
    03 00 01 04 07 55 AA 00 1C 00 08 01 16 0C 01 11 36 33 04 C5 


    Code:

    55 AA 03 00 00 01 00 03 55 AA 03 03 00 00 05 55 AA 03 07 00 14 06 00 00
    08 09 46 00 00 F9 00 00 3A 01 02 00 04 00 00 00 07 BB 55 AA 03 07 00 0C
    03 00 00 08 16 0C 16 0C 00 00 00 03 67 55 AA 03 07 00 0C 04 00 00 08 0C
    01 0C 01 00 00 00 03 3E 55 AA 03 07 00 06 0B 00 00 02 01 00 1D 55 AA 03
    07 00 11 10 01 00 01 01 12 03 00 08 32 32 34 39 30 30 36 38 E9 55 AA 03
    1C 00 00 1E                                                             



    Requesting Historical Data
    Code:

    55 AA 03 24 00 00 26 55 AA 03 07 00 0C 03 00 00 08 16 0C 16 0C 00 00 00
    03 67 55 AA 03 07 00 0C 04 00 00 08 0C 01 0C 01 00 00 00 03 3E 55 AA 03
    00 00 01 01 04 55 AA 03 07 00 14 06 00 00 08 09 52 00 00 FA 00 00 3B 01
    02 00 04 00 00 00 07 C9 55 AA 03 24 00 00 26

    Code:

    55 AA 00 06 00 08 03 00 00 04 16 0C 16 0C 58 55 AA 00 06 00 08 04 00 00
    04 0C 01 0C 01 2F 55 AA 00 00 00 00 FF 






    [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N] [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]


    What are the next steps from here?