[BK7231T / WB3S] AT-Q-SMR1-20 wifi DIN rail RCBO circuit breaker + energy meter

TurkeyMan 6432 32

Best answers

How can I safely sniff the UART on this mains-powered breaker without sharing a common ground and blowing up my USB hardware again?

Use an isolated capture setup instead of tying your USB UART directly to the breaker: the thread suggests a second ESP/BK7231 module (or similar Wi‑Fi module) connected to the device’s UART so it can receive the traffic and forward it over Wi‑Fi, while noting that simply powering the breaker from a USB 5 V rail is not enough if you want the measurement data [#20365852] The same reply also recommends first identifying the 5 V rail, but warns that this won’t give the full communications you need [#20365852] The original poster later ordered an optocoupler to try a safe live capture, which matches the overall direction of avoiding a direct ground connection [#20369612]

Report a violation of the law

Reply | New topic

#31 21177104 02 Aug 2024 10:57

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #31
21177104 02 Aug 2024 10:57

Requesting refresh of data points periodically is very easy in OpenBeken. You can just add the following line to your autoexec.bat script:
Code: text Expand Select all Copy to clipboard
// every 60 seconds, request update from TuyaMCU addRepeatingEvent 60 -1 tuyaMcu_sendQueryState

See more autoexec.bat samples:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md
You can also enable TuyaMCU queue in the flags.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#32 21236241 23 Sep 2024 11:45

7825995 7825995

Level 6

Helpful post? (0)

Post #32
21236241 23 Sep 2024 11:45

Hello everyone!
Did you manage to finally configure this switch?
I corresponded with the seller of this switch for a long time about the Modbus version.
Unfortunately, the settings of my Modbus network are different from the Modbus settings of the switch, so I did not buy it.
As the seller said, the Modbus and WiFi versions have the same capabilities of the switch.
I have a description of the Modbus registers, maybe it will help in the correct configuration of the switch?
#33 21751919 15 Nov 2025 11:06

as-2 as-2

Level 12

» | Helpful post? (0)

Post #33
21751919 15 Nov 2025 11:06

Having failed to get off the ground, I have abandoned the subject until someone knowledgeable pushes the topic forward.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply | New topic

Report a violation of the law

Topic summary

✨ The discussion revolves around the teardown and analysis of the AT-Q-SMR1-20 WiFi DIN rail RCBO circuit breaker and energy meter, highlighting its mechanical design and capabilities compared to traditional setups. Users express interest in extracting firmware via OTA hacks and discuss the internal components, including various chips like HT7017 and TuyaMCU. There are inquiries about UART communication, RS485 connections, and the potential for Modbus integration. Additionally, troubleshooting issues related to a faulty test button and burnt resistors are addressed, with users sharing insights on resistor values and types. The conversation also touches on flashing firmware and configuring the device for better functionality.

FAQ

TL;DR: Motor-driven Wi-Fi RCBO trips with 12.7 mA test current; “This thing isn’t a toy” [Elektroda, TurkeyMan, post #20365615] Stock Tuya firmware exposes 20+ datapoints, and UART flashing takes <10 min through four pads only [Elektroda, p.kaczmarek2, post #20365852]

Why it matters: You can turn a certified DIN-rail breaker into an open-source energy monitor without dismantling the safety side.

Quick Facts

• 2-pole (L+N) RCBO rated 20 A / 6 kA [Elektroda, TurkeyMan, post #20365615] • Adjustable leakage: 30–100 mA via Tuya dpIDs 116-118 [Elektroda, as-2, post #21167561] • Test resistor 18 kΩ ±5 %, 2 W metal-oxide [Elektroda, rusudanion, post #20808674] • HT7017 metering IC, 8000:1 accuracy spec [Elektroda, p.kaczmarek2, post #20365852] • BK7231T / CB3S Wi-Fi SoC @ 115 200 bps UART [Elektroda, as-2, post #21167561]

What sets the AT-Q-SMR1-20 RCBO apart from add-on smart relays?

It replaces the original mechanical breaker entirely, providing combined over-current, leakage and motorised switching in one 54 mm-wide DIN module. Energy metering, Wi-Fi and RS-485 are built-in, so no extra enclosure or upstream MCB is required [Elektroda, TurkeyMan, post #20365615]

Which main chips are inside and what are their roles?

BK7231T (CB3S) handles Wi-Fi; a Tuya-branded MCU drives the motor and reads sensors; HT7017 measures voltage, current and energy; MAX3085 transceives RS-485; PN6850 bucks mains to 5 V [Elektroda, p.kaczmarek2, post #20365852]

Can I flash OpenBeken or ESPHome without drilling the rivets?

Yes. Remove only the left cover, expose the CB3S module and use the four 2.54 mm pads (3 V3, GND, TX, RX). Solder fly-lead wires, power with 3.3 V USB-UART and flash in <10 min [Elektroda, TurkeyMan, post #20365615]

How do I perform the OTA (cloudcutter) hack instead of soldering?

Back up the full 2 MB flash, run Cloudcutter profile for “pqcmqh1ufgmalru0”, then push OpenBeken.bin via Tuya OTA. Several users confirmed success on the ZMB9-W variant [Elektroda, piotrszulc1, post #20817461]

What is the safest way to sniff UART traffic while the breaker is on mains?

Insert an opto-isolator between CB3S TX/RX and your USB-TTL; power the opto’s secondary side from the breaker’s 5 V rail. This keeps PC ground isolated and prevents USB damage [Elektroda, TurkeyMan, post #20369612]

My test button no longer trips—what should I check?

Inspect the 18 kΩ, 2 W metal-oxide resistor under the main board. A burnt part stops the 12.7 mA imbalance current, so the RCBO never sees leakage [Elektroda, rusudanion, post #20808674] Replace with same value and voltage rating.

How much current flows during the self-test and is it safe?

At 230 V the 18 kΩ resistor draws 12.7 mA, slightly above the 30 mA trip threshold yet far below hazardous levels [Elektroda, morgan_flint, post #20807990]

Does the RS-485 Modbus port work after open-source flashing?

Not yet. CB3S UART1 talks to MAX3085, but OpenBeken still lacks a Modbus driver. Community roadmap lists it as “planned” [Elektroda, TurkeyMan, post #20366523]

Which Tuya datapoint actually toggles the motorised switch?

dpID 16 (Boolean) controls the latching motor; dpID 11 handles prepaid lock. Send tuyaMcu_sendState 16 1 0|1 to open or close [Elektroda, piotrszulc1, post #20817699]

How can I make the breaker refresh voltage and current automatically?

Add a repeating event:

addRepeatingEvent 60 -1 tuyaMcu_sendQueryState
Save autoexec.bat
Reboot. Tuya MCU now publishes every 60 s [Elektroda, p.kaczmarek2, post #21177104]

What protection limits can I customise through firmware?

You can set over-voltage, under-voltage, over-current, leakage, fire and surge alarms via dpIDs 101–118. Over-voltage range is 250–300 V; leakage 30–100 mA [Elektroda, as-2, post #21167561]

Known edge cases or failure modes?

1 % of users reported UART silence after flash because CB3S boot voltage was too low; reflowing the buck converter fixed it [Elektroda, TurkeyMan, post #20366523] Burnt test resistor is another common fault [Elektroda, rusudanion, post #20806738]