In late 2025, Bunnings Australia commenced stocking Series 4 of the PC191HA (with remaining Series 3 stock in runout). It looks like these are cost reduced and introduce additional safety features. Not full-on enshittification, but gradually heading in this direction. In any case, I decided to buy a Series 4 unit to experiment.
The physical size is slightly larger than the Series 2/3, and the toggle button is a much smaller rectangle instead of the larger round button found on the earlier series. An extra physical safety feature is the shutters for the active and neutral pins, which explains why the Series 4 dimensions are larger than predecessors.
Given Series 4 was released many years since Tuya was patched, I immediately assumed whatever stock firmware was on them would be invulnerable to any sort of cloudcutter exploit, so I proceeded straight to disassembly. As the saying goes, "
Don't turn it on. Take it apart!"
Opening the case is the same as previous series. Simply pry carefully at the seams to break the ultrasonic weld.
Inside, one welcome change is there is far less silicone holding components together. Only one blob of silicone has been applied near one of the capacitors. The other obvious change is a new module, a Tuya T1-2S-NL. This uses the Beken BK7238. T1 modules have a very similar pinout to the WB2S/CB2S modules with the exception of a few GPIO. The 3v3, GND, RX1, TX1 and CEN pins are all in the same position.
Another notable change is the live/neutral AC prongs are captively moulded into the rear panel, making it is necessary to use a relatively high powered iron to de-solder them so the board can be freed. I guess this new design increases reliability by utilising the case as a strain relief for the prongs. That way, the solder joints don't experience stress each time the PC191HA is plugged/unplugged from the wall. By contrast, the Series 1/2/3 PCB could be pulled out of the plastic case without desoldering the prongs.
Once the board has been detached, the underside can be accessed to flash the T1 module. In my case, I also desoldered the T1 module for flashing.
As of posting this (Feb/Mar 2026), ESPhome doesn't yet have support for BK7238. However I was able to flash the latest OpenBK without issue. Using BK7231GUIFlashTool (Build 250), I first dumped the original firmware, then analysed it giving rise to the following:
- WiFi LED on P8
- Button (channel 1) on P24
- Relay (channel 1) on P26
Device seems to be using T1-2S-NL module, which is using BK7238.
And the Tuya section starts at 2052096 (0x1F5000), which is a default T1/XR806 and some T34/BK7231N offset.
The energy monitoring chip is a BL0942 but I haven't yet figured out the GPIO connections, let alone any calibration attempts. I was happy to initially use it as a simple MQTT smart plug without any energy monitoring. Later I'll do some further investigations to work out the energy monitoring function.
Unlike the previous series, there is no WiFi LED; only a single blue status LED is provided. This is a shame as it would be nice to have separate coloured LEDs to indicate the the WiFi status as well as the the relay state. There is likely to be a spare GPIO on the T1 module should anyone wish to add a secondary LED indicator.
Overall it looks like Series 4 have been designed to make it much more difficult to re-flash with ESPHome or OpenBK. But given the low price ($15 AUD as of Feb 2026), is still worthwhile if you're handy with electronics/modding and want to avoid third party cloud usage at all costs.
Luckily I was able to scoop up the last few remaining Series 3 stock, with all current 2026 stock being Series 4 only.
