[BK7231N / CBU] PZIOT-E01 DIN rail pass-through energy meter

Teardown of this energy meter from AliExpress.



This device is an interesting DIN rail energy meter with a hole through the middle to pass a wire for metering. No physical connection of the circuit being metered is required. It's a unique design; instead of connecting a CT clamp to a metering device, the CT is inside the DIN module, so it keeps the circuit box tidy.





Opening the device is very simple, just 4 screws on the back:

We can see the CT wrapped around the through-hole. Accessing the circuit board is quite a hassle; there are no screws holding it in place, it is secured by the 4 plastic clips you can see at the 4 corners of the board:

It's obviously designed to be assembled, but not disassembled. It was very difficult to get out from the clips, I ended up using a blade to shave away one of the clips at the corner, and then when lifting that one corner out, I was able to wiggle it free from the remaining 3 clips.

Now we can see there are 2 boards inside. The wifi board is connected to the power electronics board by a little ribbon:


Closer look at the mainboard:


And I disconnected the ribbon to have a closer look at the little daughterboard:



It's running a CBU and BL0942 for metering.
The BL0942 is NOT connected with RS232, it seems to be connected by SPI instead.

Flashed OpenBK with no problem using the command:


The pinouts I could trace:
P9 - BL0942 - CF1
P14 - BL0942 - SCLK_BPS
P16 - BL0942 - RX/SDI
P17 - BL0942 - TX/SDO
P20 - Bluetooth button
P22 - Status LED
P28 - ??? E2 Via

There is a button on the device with the bluetooth logo next to it:


I guess this button will put it into discovery mode with stock firmware. It is connected to P20, and I'm not sure how to make this work in OpenBK? I guess it should be configured that a long-press might perform a factory reset, or go into some wifi discovery mode without wiping other config data.
Alternatively, if OpenBK ever supports something like a quick local-read feature pairing with a nearby bluetooth device and run an app for a quick local reading?

There is also an LED on the front with POWER/BLUETOOTH/WIFI written next to it. It just seems to be a red LED that you can turn on/off, so stock firmware probably uses some flashing states to communicate different information. It would be nice for OpenBK to model some sort of "status" led, which could communicate various status details via flash patterns on a status led. Many devices have these, and it's never quite sure what to do with them. I usually just assign them wifi state, but that's not how the stock firmware uses these lights.

There is also one random track that leads from P28 to the big unpopulated VIA just below the E2 label on the circuit board... it doesn't go anywhere else. So P28 is not wired to anything, but it looks like the circuit design intended that it might be used for something.




TODO: This device uses SPI, which is not yet supported. I'll update this post when it is working.

For the impatient, a hack has been proposed, which will convert the device to be connected by UART instead of SPI.
A modification like this can be made, and then load the existing bl0942 driver: