logo elektroda
logo elektroda
X
logo elektroda

Arlec Grid Connect PC191HA Series 2, Plug-In Socket with Energy Meter Teardown

tonyb62 9906 44
ADVERTISEMENT
  • #31 20990154
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    PowerSave is recommended for most devices. I would only avoid using PowerSave on BL0937 power metering devices and on IR devices. Otherwise PowerSave should be on, this will reduce current usage. Otherwise low quality power supplies of Tuya products may fail.

    See this topic to see how running device without PowerSave may break the power supply:
    https://www.elektroda.pl/rtvforum/topic3898805.html

    See the powersave test on Elektroda Youtube:


    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #32 21035578
    gen_mheloy
    Level 5  
    Posts: 11

    >>20875348

    Just back to it now... the LED in the unit is showing solid red.
    Yes, I have opened it and the chip is CBS2.
    I think during the cloudcutter something failed and it's not completed.

    I was thinking of flashing it directly manually.
  • ADVERTISEMENT
  • #33 21036078
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    Here is a playlist of our flashing by wires guides, they include soldering tips, etc:
    https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM
    Here is our recommended BK7231tool flash:
    https://github.com/openshwprojects/BK7231GUIFlashTool

    Please try and let me know
    Helpful post? Buy me a coffee.
  • #34 21036164
    gen_mheloy
    Level 5  
    Posts: 11

    I tried flashing almost half a day I could not get it to reset to get the bus. I have a USB to YP-05, is USB to UART different?
  • #35 21064051
    kennelloggia0r
    Level 3  
    Posts: 5
    Have been trying to get this working but hitting the following error, seems it connects, starts doing something, then re-connects and cannot do anything after that. Any ideas?

    Quote:
    [?] Select your custom firmware file for BK7231T chip: ESPHome-Kickstart-v23.08.29_bk7231t_app.ota.ug.bin
    ► ESPHome-Kickstart-v23.08.29_bk7231t_app.ota.ug.bin
    OpenBeken-v1.17.262_bk7231t.ug.bin

    Selected Device Slug: arlec-pc191ha-smart-plug-bk7231t-v1.3.5
    Selected Profile: oem-bk7231s-dltj-1.3.5-sdk-1.0.2-40.00
    Selected Firmware: ESPHome-Kickstart-v23.08.29_bk7231t_app.ota.ug.bin

    ================================================================================
    Place your device in AP (slow blink) mode. This can usually be accomplished by either:
    Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
    Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
    See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
    ================================================================================

    Wiping NetworkManager configs
    Scanning for open Tuya SmartLife AP
    ........
    Found access point name: "GRID-23A4", trying to connect...
    Device 'wlan0' successfully activated with 'redacted'.
    Connected to access point.
    Waiting 1 sec to allow device to set itself up...
    Running initial exploit toolchain...
    Exploit run, saved device config too!
    output=/work/configured-devices/jpw2un7yZBw6.deviceconfig
    Saved device config in /work/configured-devices/jpw2un7yZBw6.deviceconfig

    ================================================================================
    Power cycle and place your device in AP (slow blink) mode again. This can usually be accomplished by either:
    Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
    Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
    See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
    ================================================================================

    Wiping NetworkManager configs
    Scanning for open Tuya SmartLife AP
    ...
    Found access point name: "GRID-23A4", trying to connect...
    Error: Connection activation failed: (53) The Wi-Fi network could not be found.
    Wiping NetworkManager configs
  • #36 21064060
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    Which Tuya firmware version do you have?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #37 21064151
    kennelloggia0r
    Level 3  
    Posts: 5
    p.kaczmarek2 wrote:
    Which Tuya firmware version do you have?


    This device is saying V1.3.5 in the Update area. I have tried both V1.3.5 and V1.1.8
  • #38 21064285
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    Have you flashed any other devices with your current setup via cloudcutter?
    Helpful post? Buy me a coffee.
  • #39 21064286
    kennelloggia0r
    Level 3  
    Posts: 5

    No, this was my first attempt at using the software.
  • #40 21064287
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    According to this:
    https://www.elektroda.com/rtvforum/topic3979215.html
    1.3.5 is not marked yet as patched:
    List of firmware versions of devices supported by Tuya-cloudcutter.

    Added after 1 [minutes]:

    The log indicates that exploit has ran:
    
    
    Found access point name: "GRID-23A4", trying to connect...
    Device 'wlan0' successfully activated with 'redacted'.
    Connected to access point.
    Waiting 1 sec to allow device to set itself up...
    Running initial exploit toolchain...
    Exploit run, saved device config too!
    output=/work/configured-devices/jpw2un7yZBw6.deviceconfig
    Saved device config in /work/configured-devices/jpw2un7yZBw6.deviceconfig
    

    is device still with Tuya? Do you have that deviceconfig file? Can you share it?
    Helpful post? Buy me a coffee.
  • #41 21064293
    kennelloggia0r
    Level 3  
    Posts: 5
    p.kaczmarek2 wrote:
    is device still with Tuya? Do you have that deviceconfig file? Can you share it?


    Yep, I had two, bricked one, and returned to the shop and got a new one. So I have two again, one not in the app and one that is still in the Smart Life app. How do I grab device config files there?
  • ADVERTISEMENT
  • #42 21064537
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    Well, according to the log you posted, the config was saved on your computer:
    
    Saved device config in /work/configured-devices/jpw2un7yZBw6.deviceconfig
    
    Helpful post? Buy me a coffee.
  • #43 21064541
    kennelloggia0r
    Level 3  
    Posts: 5

    I learn something new every day...

    Assuming you didn't need the other bits.... here is the crux of it.

    "chip_family": "BK7231T", "profile_name": "1.3.5 - BK7231T / oem>
    


    Interesting that I also had this one which had failed on 1.1.8

    "chip_family": "BK7231N", "profile_name": "1.1.8 - BK7231N / oem>
    

  • #44 21136598
    ManUnited10
    Level 1  
    Posts: 1
    Hey guys,
    I bought one of these plugs from Bunnings and I managed to flash it with ESPHome. All good - thanks to this topic.
    I was just wondering what is the ESPHome equivalent of this `PowerSave` which has been mentioned above? Thanks.
  • #45 21140273
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14611
    Help: 654
    Rate: 12622
    I don't know if they have this feature and how optimized is it, but you can always convert to OBK with:
    https://github.com/BenJamesAndo/OpenBeken_uf2_firmware
    Using a socket without PowerSave can quickly degrade capacitors:
    https://www.elektroda.com/rtvforum/topic3898805.html
    Helpful post? Buy me a coffee.

Topic summary

✨ The discussion revolves around the Arlec Grid Connect PC191HA Series 2 plug-in socket, focusing on issues related to flashing the device with custom firmware using CloudCutter and OpenBeken. Users report varying experiences with different chipsets (BK7231N and BK7231T) found in the devices, with some successfully flashing the devices while others encounter difficulties. Key topics include the importance of enabling PowerSave mode to prevent overheating, configuring energy statistics, and troubleshooting GPIO settings for LED control. Users share configurations, firmware versions, and experiences with device performance, including issues with relay control and power reporting. The conversation highlights the variability in hardware between batches and the need for careful configuration to ensure proper functionality.
Generated by the language model.

FAQ

TL;DR: 66 % of PC191HA “Series 2” plugs opened by users held BK7231N CB2S modules; “PowerSave is always recommended,” notes expert p.kaczmarek2 [Elektroda, 20570099] Cloudcutter 0-click flashing succeeds on firmware v1.1.8 & v1.3.5 but can fail on later builds [Elektroda, post #21064287]

Why it matters: Knowing the chipset, GPIO map and safe-power settings prevents bricking and premature power-supply failure.

Quick Facts

• MCU variants: BK7231N (CB2S) and BK7231T (WB2S) confirmed in retail units [Elektroda, #20569008; #20853062] • Factory firmware spotted: v1.1.8, v1.3.5 [Elektroda, #20569088; #21064151] • Default Series 2 (BK7231N) pin map: 6 SEL, 7 CF1, 8 CF, 10 Btn, 24 Rel, 26 WiFiLED [Elektroda, 20569008] • OTA exploit: Works on BK7231N/T up to v1.3.5 with Cloudcutter profile “oem_bk7231*” [Elektroda, #20711470; #21064051] • PowerSave halves idle draw and avoids capacitor bulging after ~6 months [Elektroda, post #20971254]

1. What distinguishes the PC191HA “Series 2” from the earlier batch?

Series 2 units swap the original WB2S (BK7231T) module for CB2S (BK7231N) and relocate the relay to GPIO 24 [Elektroda, 20569008] Older, un-branded boxes often house WB2S with a different LED map [Elektroda, 20845362]

2. How can I identify the chip without opening the plug?

Start Cloudcutter; the exploit’s device-config shows "chip_family": "BK7231N" or "BK7231T" after the first handshake [Elektroda, 21064541] Cancel before flashing if the family mismatches your chosen profile.

3. Which Cloudcutter profile works for firmware v1.1.8?

Select “1.1.8 – BK7231N / oem_bk7231n_plug” and device “Tuya Generic → LSPA9 Plug v1.1.8.” User tonyb62 flashed successfully with it [Elektroda, 20569088]

4. Cloudcutter fails on my v1.3.5 unit—what next?

v1.3.5 is still exploitable, but the AP can disappear mid-process. Re-enter pairing mode twice when prompted and keep the phone/PC <1 m from the plug [Elektroda, 21064051] If it still loops, resort to UART flashing.

5. What’s the complete GPIO template for BK7231N CB2S?

{"6":"BL0937SEL;0","7":"BL0937CF1;0","8":"BL0937CF;0","10":"Btn;0","24":"Rel;0","26":"WifiLED;0"} [Elektroda, 20569008] Add P11 as RedLED if fitted [Elektroda, post #20853062]

6. How do I enable PowerSave in OpenBeken?

Enter the web console and run: PowerSave 1. Use Backlog for startup: Backlog PowerSave 1; SetupEnergyStats 1 60 5 [Elektroda, #20571516; #20573799].

7. Why does the plug feel warm even when off?

The always-on AC-DC supply feeds the Wi-Fi SoC; without PowerSave it draws ~40 mA continuously, heating the transformer stage [Elektroda, 20570029]

8. My relay keeps toggling after I set BL0937SEL to pin 24—why?

Pin 24 actually drives the relay. Move BL0937SEL back to pin 6 and assign Rel 0 to pin 24 to stop the loop [Elektroda, 20631659]

9. Can I disable the bright blue LED without opening the case?

If the LED sits on GPIO 26, change its role to None in OpenBeken. On some BK7231N boards the blue LED is wired with the relay on GPIO 24; that LED is not software-controllable, so you must desolder or mask it [Elektroda, 20845362]

10. Energy stats don’t appear—what command should I use?

Run SetupEnergyStats 1 60 5, then reboot. This enables 1-minute collection and 5-second web updates [Elektroda, 20573799]

11. A unit lost relay control after six months—root cause?

The 470 µF/10 V capacitor in the PSU bulged, starving the relay driver. Replacing it restored operation [Elektroda, 20971254] "Using PowerSave cuts stress on that cap," warns p.kaczmarek2 [Elektroda, 20990154]

12. What’s the ESPHome equivalent of PowerSave?

ESPHome lacks an identical low-power mode. Reduce load by shortening Wi-Fi update intervals or migrate to OpenBeken, which has built-in PowerSave [Elektroda, 21140273]

13. How do I flash via UART if OTA is patched?

  1. Solder RX, TX, 3V3, GND and BOOT pads on CB2S/WB2S.
  2. Connect a 3.3 V USB-UART, hold BOOT low, reset.
  3. Use BK7231GUIFlashTool to write OpenBeken .bin [Elektroda, 21036078]

14. Which firmware versions block the exploit?

As of June 2024, anything above v1.3.5 is unconfirmed; devices may ship with vendor-specific builds that omit Tuya pins, preventing automatic GPIO extraction [Elektroda, 20845557] Always test Cloudcutter before disassembly.
Generated by the language model.
ADVERTISEMENT