Arlec Grid Connect PC191HA Series 2, Plug-In Socket with Energy Meter Teardown

tonyb62 6666 44

#31 20990154 04 Mar 2024 17:57

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #31
20990154 04 Mar 2024 17:57

PowerSave is recommended for most devices. I would only avoid using PowerSave on BL0937 power metering devices and on IR devices. Otherwise PowerSave should be on, this will reduce current usage. Otherwise low quality power supplies of Tuya products may fail.

See this topic to see how running device without PowerSave may break the power supply:
https://www.elektroda.pl/rtvforum/topic3898805.html

See the powersave test on Elektroda Youtube:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#32 21035578 07 Apr 2024 02:42

gen_mheloy gen_mheloy

Level 5

Helpful post? (0)

Post #32
21035578 07 Apr 2024 02:42

>>20875348

Just back to it now... the LED in the unit is showing solid red.
Yes, I have opened it and the chip is CBS2.
I think during the cloudcutter something failed and it's not completed.

I was thinking of flashing it directly manually.
ADVERTISEMENT
#33 21036078 07 Apr 2024 12:49

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #33
21036078 07 Apr 2024 12:49

Here is a playlist of our flashing by wires guides, they include soldering tips, etc:
https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM
Here is our recommended BK7231tool flash:
https://github.com/openshwprojects/BK7231GUIFlashTool

Please try and let me know

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#34 21036164 07 Apr 2024 13:43

gen_mheloy gen_mheloy

Level 5

Helpful post? (0)

Post #34
21036164 07 Apr 2024 13:43

I tried flashing almost half a day I could not get it to reset to get the bus. I have a USB to YP-05, is USB to UART different?
#35 21064051 29 Apr 2024 08:40

kennelloggia0r kennelloggia0r

Level 3

Helpful post? (0)

Post #35
21064051 29 Apr 2024 08:40

Have been trying to get this working but hitting the following error, seems it connects, starts doing something, then re-connects and cannot do anything after that. Any ideas?

Quote:
[?] Select your custom firmware file for BK7231T chip: ESPHome-Kickstart-v23.08.29_bk7231t_app.ota.ug.bin
► ESPHome-Kickstart-v23.08.29_bk7231t_app.ota.ug.bin
OpenBeken-v1.17.262_bk7231t.ug.bin

Selected Device Slug: arlec-pc191ha-smart-plug-bk7231t-v1.3.5
Selected Profile: oem-bk7231s-dltj-1.3.5-sdk-1.0.2-40.00
Selected Firmware: ESPHome-Kickstart-v23.08.29_bk7231t_app.ota.ug.bin

================================================================================
Place your device in AP (slow blink) mode. This can usually be accomplished by either:
Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================

Wiping NetworkManager configs
Scanning for open Tuya SmartLife AP
........
Found access point name: "GRID-23A4", trying to connect...
Device 'wlan0' successfully activated with 'redacted'.
Connected to access point.
Waiting 1 sec to allow device to set itself up...
Running initial exploit toolchain...
Exploit run, saved device config too!
output=/work/configured-devices/jpw2un7yZBw6.deviceconfig
Saved device config in /work/configured-devices/jpw2un7yZBw6.deviceconfig

================================================================================
Power cycle and place your device in AP (slow blink) mode again. This can usually be accomplished by either:
Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================

Wiping NetworkManager configs
Scanning for open Tuya SmartLife AP
...
Found access point name: "GRID-23A4", trying to connect...
Error: Connection activation failed: (53) The Wi-Fi network could not be found.
Wiping NetworkManager configs
#36 21064060 29 Apr 2024 08:47

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #36
21064060 29 Apr 2024 08:47

Which Tuya firmware version do you have?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#37 21064151 29 Apr 2024 10:03

kennelloggia0r kennelloggia0r

Level 3

Helpful post? (0)

Post #37
21064151 29 Apr 2024 10:03

p.kaczmarek2 wrote:
Which Tuya firmware version do you have?

This device is saying V1.3.5 in the Update area. I have tried both V1.3.5 and V1.1.8
ADVERTISEMENT
#38 21064285 29 Apr 2024 12:11

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #38
21064285 29 Apr 2024 12:11

Have you flashed any other devices with your current setup via cloudcutter?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#39 21064286 29 Apr 2024 12:12

kennelloggia0r kennelloggia0r

Level 3

Helpful post? (0)

Post #39
21064286 29 Apr 2024 12:12

No, this was my first attempt at using the software.
#40 21064287 29 Apr 2024 12:14

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #40
21064287 29 Apr 2024 12:14

According to this:
https://www.elektroda.com/rtvforum/topic3979215.html
1.3.5 is not marked yet as patched:

Added after 1 [minutes]:

The log indicates that exploit has ran:
Code: text Expand Select all Copy to clipboard
Found access point name: "GRID-23A4", trying to connect... Device 'wlan0' successfully activated with 'redacted'. Connected to access point. Waiting 1 sec to allow device to set itself up... Running initial exploit toolchain... Exploit run, saved device config too! output=/work/configured-devices/jpw2un7yZBw6.deviceconfig Saved device config in /work/configured-devices/jpw2un7yZBw6.deviceconfig

is device still with Tuya? Do you have that deviceconfig file? Can you share it?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#41 21064293 29 Apr 2024 12:18

kennelloggia0r kennelloggia0r

Level 3

Helpful post? (0)

Post #41
21064293 29 Apr 2024 12:18

p.kaczmarek2 wrote:
is device still with Tuya? Do you have that deviceconfig file? Can you share it?

Yep, I had two, bricked one, and returned to the shop and got a new one. So I have two again, one not in the app and one that is still in the Smart Life app. How do I grab device config files there?
#42 21064537 29 Apr 2024 15:59

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Helpful post? (0)

Post #42
21064537 29 Apr 2024 15:59

Well, according to the log you posted, the config was saved on your computer:
Code: text Expand Select all Copy to clipboard
Saved device config in /work/configured-devices/jpw2un7yZBw6.deviceconfig

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#43 21064541 29 Apr 2024 16:04

kennelloggia0r kennelloggia0r

Level 3
Helpful post? (0)

Post #43
21064541 29 Apr 2024 16:04

I learn something new every day...

Assuming you didn't need the other bits.... here is the crux of it.

Code: text Expand Select all Copy to clipboard
"chip_family": "BK7231T", "profile_name": "1.3.5 - BK7231T / oem>

Interesting that I also had this one which had failed on 1.1.8

Code: text Expand Select all Copy to clipboard
"chip_family": "BK7231N", "profile_name": "1.1.8 - BK7231N / oem>
#44 21136598 29 Jun 2024 12:28

ManUnited10 ManUnited10

Level 1

Helpful post? (0)

Post #44
21136598 29 Jun 2024 12:28

Hey guys,
I bought one of these plugs from Bunnings and I managed to flash it with ESPHome. All good - thanks to this topic.
I was just wondering what is the ESPHome equivalent of this `PowerSave` which has been mentioned above? Thanks.
#45 21140273 02 Jul 2024 13:19

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #45
21140273 02 Jul 2024 13:19

I don't know if they have this feature and how optimized is it, but you can always convert to OBK with:
https://github.com/BenJamesAndo/OpenBeken_uf2_firmware
Using a socket without PowerSave can quickly degrade capacitors:
https://www.elektroda.com/rtvforum/topic3898805.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Topic summary

The discussion revolves around the Arlec Grid Connect PC191HA Series 2 plug-in socket, focusing on issues related to flashing the device with custom firmware using CloudCutter and OpenBeken. Users report varying experiences with different chipsets (BK7231N and BK7231T) found in the devices, with some successfully flashing the devices while others encounter difficulties. Key topics include the importance of enabling PowerSave mode to prevent overheating, configuring energy statistics, and troubleshooting GPIO settings for LED control. Users share configurations, firmware versions, and experiences with device performance, including issues with relay control and power reporting. The conversation highlights the variability in hardware between batches and the need for careful configuration to ensure proper functionality.
Summary generated by the language model.

FAQ

TL;DR: 66 % of PC191HA “Series 2” plugs opened by users held BK7231N CB2S modules; “PowerSave is always recommended,” notes expert p.kaczmarek2 [Elektroda, 20570099] Cloudcutter 0-click flashing succeeds on firmware v1.1.8 & v1.3.5 but can fail on later builds [Elektroda, 21064287]

Why it matters: Knowing the chipset, GPIO map and safe-power settings prevents bricking and premature power-supply failure.

Quick Facts

• MCU variants: BK7231N (CB2S) and BK7231T (WB2S) confirmed in retail units [Elektroda, #20569008; #20853062]
• Factory firmware spotted: v1.1.8, v1.3.5 [Elektroda, #20569088; #21064151]
• Default Series 2 (BK7231N) pin map: 6 SEL, 7 CF1, 8 CF, 10 Btn, 24 Rel, 26 WiFiLED [Elektroda, 20569008]
• OTA exploit: Works on BK7231N/T up to v1.3.5 with Cloudcutter profile “oem_bk7231*” [Elektroda, #20711470; #21064051]
• PowerSave halves idle draw and avoids capacitor bulging after ~6 months [Elektroda, 20971254]

1. What distinguishes the PC191HA “Series 2” from the earlier batch?

Series 2 units swap the original WB2S (BK7231T) module for CB2S (BK7231N) and relocate the relay to GPIO 24 [Elektroda, 20569008] Older, un-branded boxes often house WB2S with a different LED map [Elektroda, 20845362]

2. How can I identify the chip without opening the plug?

Start Cloudcutter; the exploit’s device-config shows "chip_family": "BK7231N" or "BK7231T" after the first handshake [Elektroda, 21064541] Cancel before flashing if the family mismatches your chosen profile.

3. Which Cloudcutter profile works for firmware v1.1.8?

Select “1.1.8 – BK7231N / oem_bk7231n_plug” and device “Tuya Generic → LSPA9 Plug v1.1.8.” User tonyb62 flashed successfully with it [Elektroda, 20569088]

4. Cloudcutter fails on my v1.3.5 unit—what next?

v1.3.5 is still exploitable, but the AP can disappear mid-process. Re-enter pairing mode twice when prompted and keep the phone/PC <1 m from the plug [Elektroda, 21064051] If it still loops, resort to UART flashing.

5. What’s the complete GPIO template for BK7231N CB2S?

{"6":"BL0937SEL;0","7":"BL0937CF1;0","8":"BL0937CF;0","10":"Btn;0","24":"Rel;0","26":"WifiLED;0"} [Elektroda, 20569008] Add P11 as RedLED if fitted [Elektroda, 20853062]

6. How do I enable PowerSave in OpenBeken?

Enter the web console and run: PowerSave 1. Use Backlog for startup: Backlog PowerSave 1; SetupEnergyStats 1 60 5 [Elektroda, #20571516; #20573799].

7. Why does the plug feel warm even when off?

The always-on AC-DC supply feeds the Wi-Fi SoC; without PowerSave it draws ~40 mA continuously, heating the transformer stage [Elektroda, 20570029]

8. My relay keeps toggling after I set BL0937SEL to pin 24—why?

Pin 24 actually drives the relay. Move BL0937SEL back to pin 6 and assign Rel 0 to pin 24 to stop the loop [Elektroda, 20631659]

9. Can I disable the bright blue LED without opening the case?

If the LED sits on GPIO 26, change its role to None in OpenBeken. On some BK7231N boards the blue LED is wired with the relay on GPIO 24; that LED is not software-controllable, so you must desolder or mask it [Elektroda, 20845362]

10. Energy stats don’t appear—what command should I use?

Run SetupEnergyStats 1 60 5, then reboot. This enables 1-minute collection and 5-second web updates [Elektroda, 20573799]

11. A unit lost relay control after six months—root cause?

The 470 µF/10 V capacitor in the PSU bulged, starving the relay driver. Replacing it restored operation [Elektroda, 20971254] "Using PowerSave cuts stress on that cap," warns p.kaczmarek2 [Elektroda, 20990154]

12. What’s the ESPHome equivalent of PowerSave?

ESPHome lacks an identical low-power mode. Reduce load by shortening Wi-Fi update intervals or migrate to OpenBeken, which has built-in PowerSave [Elektroda, 21140273]

13. How do I flash via UART if OTA is patched?

Solder RX, TX, 3V3, GND and BOOT pads on CB2S/WB2S.
Connect a 3.3 V USB-UART, hold BOOT low, reset.
Use BK7231GUIFlashTool to write OpenBeken .bin [Elektroda, 21036078]

14. Which firmware versions block the exploit?

As of June 2024, anything above v1.3.5 is unconfirmed; devices may ship with vendor-specific builds that omit Tuya pins, preventing automatic GPIO extraction [Elektroda, 20845557] Always test Cloudcutter before disassembly.