logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Flashing New Tongou TO-Q-SY1-JWT Device: DIN Rail Switch and Meter, BK7231 template script

VIDPRO 28434 84

TL;DR

  • Tongou TO-Q-SY1-JWT DIN rail switch and meter was flashed with a BK7231 template script.
  • The BK7231N has all pins reachable, so the unit was flashed via serial and a config was attached.
  • All LEDs, the relay, and the meter are fully functional after flashing.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #31 20974510
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    @yorainoy excuse, what do you mean by frequency inside?

    @Spag cloudcutter is not a reliable solution due to many devices patched, we suggest using the UART flashing method, see tutorials playlist here:
    https://www.youtube.com/playlist?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #32 20974860
    Spag
    Level 3  
    Posts: 3
    Rate: 2
    @p.kaczmarek2 Thank you, I was able to flash it via UART and it's working perfectly now - I was just hoping I could flash it without having to destroy the rivets to open the case..

    Congratulations on an amazing piece of software!

    Screenshot of an MQTT interface displaying device info for BK7231N, controls, sensors, and logs.
  • #33 20974871
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    Thanks, by the way, I think you'd benefit from updating to the new release:
    Screenshot of OpenBK7231T/OpenBeken release 1.17.478 listing changes and developer version warnings.
    Especially thanks to this commit:
    Code: text Expand Select all Copy to clipboard
    
Home Assistant discovery - add energy counters today/yesterday, add clear date, add friendly names (#1092) (8eaf72e), closes #1092
    Helpful post? Buy me a coffee.
  • #34 20974872
    babaganesh
    Level 3  
    Posts: 10
    Help: 1
    Rate: 2
    >>20663233

    What was the easy way to open it up ?
  • ADVERTISEMENT
  • #35 20974921
    Spag
    Level 3  
    Posts: 3
    Rate: 2
    @p.kaczmarek2 Fantastic, perfect timing! :)

    @babaganesh You have to drill the rivets to destroy them... only then you can open the case.
  • #36 21080140
    onkel11
    Level 5  
    Posts: 10
    Help: 1
    Rate: 1
    Hi,

    any idea how do seal th device after flashing ?
    Somewhere to buy the seal pins ?
  • #38 21080758
    onkel11
    Level 5  
    Posts: 10
    Help: 1
    Rate: 1
    thanks

    Edit:

    I found another solution and will test it:

    Aderendhülsen unisoliert, Nennquerschnitt 1,50qmm, Länge 18mm, Außendurchmesser 2,00 mm

    the original ones do also have almost the same size.

    Keep you informed.

    Update:

    So this worked perfectly:
    hxxxs://www.amazon.de/Aderendh%C3%BClsen-Crimpverbinder-unisoliert-Kunststoffkragen-Nennquerschnitt/dp/B08QS2KR49?source=ps-sl-shoppingads-lpcontext&ref_=fplfs&smid=AER43YRX1AHYK&th=1

    Best regards
  • #39 21110271
    firsoff091
    Level 1  
    Posts: 1
    Hello,

    We purchased a smart WiFi switch, Tongou TO-Q-SY1-JWT, and flashed it with OpenBeken following your instructions. Thank you for the guidance.

    The device has been working for over a month, collecting metrics and being controlled via Home Assistant (HA). However, we've encountered an issue where the switch turns off the electricity without any apparent reason. This has happened twice, with a one-week interval between occurrences. Unfortunately, we couldn't determine the cause of the "failure" based on the collected metrics in HA. The graphs of the collected metrics show everything within normal ranges.

    Question:
    How can we configure the device to save all logs to a file or any other storage? It would be helpful to retain logs for at least a few hours, so that in case the issue recurs, we can "download or open the file" and analyze it in detail to understand the cause of the power off.

    Thank you in advance for your assistance!
  • #40 21118531
    silvestro_gatto
    Level 7  
    Posts: 30
    Rate: 4
    TO-Q-SY1-JWT 32A Smart WiFi Switch With Metering Function
    Tuya Main Module Firmware V1.0.18 (not supported by Tuya CloudCutter)
    Yellow PCB version AT63AJL-8VMT

    Device update screen showing no updates available.
    Yellow printed circuit board of a smart WiFi switch with electronic components. Close-up of a yellow printed circuit board labeled AT63AJL-8VMT.

    Flashed with OpenBK7231N build version 1.17.612 and configured with the following OBK template

    Code: text Expand Select all Copy to clipboard
    
  "pins": {
    "9": "LED_n;1",
    "15": "WifiLED_n;0",
    "17": "Btn;1",
    "24": "BridgeFWD;1",
    "26": "BridgeREV;1"
  },

  "command": "backlog startDriver BL0942; startDriver NTP"

    everything is working fine but the button, when pressed, does not switch on/off

    GPIO Doctor is showing P17 Val changing Low/High only when dInput is selected.

    Any advice? Thank you!

    Added after 10 [hours] 4 [minutes]:

    I found the solution to my problem with the unresponsive button ...

    Flag 41 [BTN] Ignore all button events (aka child lock) in Configure General/Flags was checked by default.

    Screenshot of flag settings in OpenBK7231N software.

    After unchecking the flag, the button started working as expected.
  • #41 21163281
    Wobbie
    Level 3  
    Posts: 8
    Hello all and a big thanks to all that contribute here especially the moderator @p.kaczmarek2 Great Job!

    I am having difficulty flashing this device Tongou TO-Q-SY1_163JWT 63 Amp Version breaker Electronic module on a denim fabric background. The image shows a circuit board of a Tongou TO-Q-SY1_163JWT 63 Amp device. . I am familiar with the process and have successfully flashed other switch devices eg: [BK7231N] Aubess Mini Switch 16A.

    I use a USB / TTL serial device from China CH430G-2 which has worked well in the past plus I swapped it out with a spare to confirm functionality.

    I am using the latest flasher bk7231flasher_1.3.3

    Attempts at flashing in place were unsuccessful so I decided to remove the CBU from the main board but still unsuccessful! Resetting the module by earthing CEN does not start the flash sequence (have tried many times). Also trying another 3.3 v power source, swapping rx1 and tx1 on uart1 just in case but to no avail!

    Attaching it to Tuya Smart app all works OK, noticing the firmware is V 1.0.20. Is it possible that Tuya have disabled flashing (bootloader rom) somehow? I do notice on their web site "Flash and Authorize CB Modules"
    https://developer.tuya.com/en/docs/iot/CB-series-module?id=Kbruyciad6154


    Any tips or advice appreciated
    R Screenshot of device update showing version V1.0.20. USB to TTL connector with programming cables.
  • #42 21173683
    silvestro_gatto
    Level 7  
    Posts: 30
    Rate: 4
    >>21163281

    Hi @Wobbie,
    actually flashing my device (TO-Q-SY1-JWT 32A Smart WiFi Switch With Metering Function - Tuya Firmware V1.0.18 - PCB marking AT63AJL-8VMT) was quite straightforward.

    I checked my notes and I did not find any specific issue with this device.

    I used a cheap CP210x USB to TTL UART Serial Convertor Module (set at 3.3V Voltage Level) and short wires connected to the CBU module, without removing it from the main board.

    This is the CBU module pinout:

    Pinout diagram of CBU module with highlighted pins TX2, RX1, TX1, CEN, 3V3, and GND.

    I used 3.3V, GND, and TX2 to capture the log from factory firmware, then I connected 3.3V, GND, TX1 and RX1 to backup factory firmware and upload OpenBK7231N build version 1.17.612, using BK7231 Easy UART Flasher (Set chip type: BK7231N - Set baud rate: 921600)

    As you wrote, CEN pin has to be shorted to GND to reboot, when BK7231Flasher.exe is "getting the bus ...."

    see the line " Getting bus... (now, please do reboot by CEN or by power off/on)" in the below log from flasher

    Code: text Expand Select all Copy to clipboard
    
Backup name is set to din2.
Starting read backup and flash new!
Now is: Wednesday, June 12, 2024 6:03:47 PM.
Flasher mode: BK7231N
Going to open port: COM10.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 34
sr: 34
final sr: 34
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to start reading at offset 0x00...
Reading 0x00... Ok!
......


    Let me know if you need any further detail or clarification and good luck with your flashing!
  • ADVERTISEMENT
  • #43 21179078
    Wobbie
    Level 3  
    Posts: 8
    Thanks @silvestro_gatto
    Found my problem; RX connection got broken going into the CBU when removing from main board (not enough flux I think)! Managed to fix it so happy ending.
  • ADVERTISEMENT
  • #44 21179280
    silvestro_gatto
    Level 7  
    Posts: 30
    Rate: 4
    >>21179078

    @Wobbie, I am glad you found the problem and cut the device off from the cloud. Ace!
    Cheers
  • #46 21188194
    dwmw2
    Level 6  
    Posts: 19
    Rate: 3
    Not able to test fully, as the power supply in this unit is broken so I can only power the CBU from +3.3v and can't test the relay. But I think this should mostly work as an esphome config. I haven't yet worked out what to do about restoring the original state on reboot, so I'm just forcing it on. It isn't a circuit breaker, and should never be used as a safety device, so I guess that's OK.
    Code: YAML
    Log in, to see the code


    Added after 8 [hours] 19 [minutes]:

    All the pins needed for flashing this are on the BL0942 on the back of the board, easy to grab with SOIC probes.
    Block diagram of the BL0942 integrated circuit with labeled pins.

    Note that TX and RX are labelled for the BL0942, so they route to the RX1 and TX1 pins on the CBU respectively. I'm tempted to try drilling a tiny hole in the side of the next unit and doing keyhole surgery instead of drilling out the rivets and taking it completely apart.

    Printed circuit board with attached test probes.
  • #48 21190981
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    Does this mean something in OpenBeken regarding BL0942 can/should be adjusted?
  • #49 21191153
    dwmw2
    Level 6  
    Posts: 19
    Rate: 3
    >>21190981
    divadiow wrote:
    Does this mean something in OpenBeken regarding BL0942 can/should be adjusted?


    The short answer is 'yes'. The more helpful answer I'm still working out the final details, but it's basically there in the ESPHome issue I linked. We *can* get the vref/iref/pref/eref values out of the Tuya firmware, and we can also calculate the pref/eref values from vref/iref which can be determined empirically.
  • #51 21197592
    dwmw2
    Level 6  
    Posts: 19
    Rate: 3
    Note: Do NOT be tempted to wire one of these units up 'backwards' to calibrate it, with the feed coming in via the load terminals and the load connected to the feed terminals.

    I thought that would work as long as the relay was already turned on, and that it would include the power drawn by the unit itself in the measurement, so it was perfectly comparable with the external measurement.

    Now my relay doesn't seem to work any more. It clicks but there's never any connection.
  • #53 21208313
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    That's exciting. Do you plan a similar PR for OpenBeken/Easy UART Flasher tool?

    Also makes me wonder if the ADC 2400 multiplier can be extracted from battery device firmware. The same I guess for temp/humidity sensors too.
  • #54 21263275
    erikwouterson
    Level 3  
    Posts: 4
    Rate: 1
    Hi all,
    Successfully flashed a few TO-Q-SY2-JWT, only thing I noticed that of the flashed devices the coils are getting hot, 55 degrees Celsius even without load, original software remains cold.

    Anyone else encountered this issue?
    Thanks
    Erik

    Fluke thermal imager displaying a temperature of 55.5°C.
  • #55 21263433
    dwmw2
    Level 6  
    Posts: 19
    Rate: 3
    >>21263275 Are you driving the 'bridge' with pulses instead of holding the line high?
  • #56 21264753
    erikwouterson
    Level 3  
    Posts: 4
    Rate: 1
    >>21263433 hi, can you please explain how I would be able to tell the difference?
    Thanks
    Erik
  • #57 21265055
    dwmw2
    Level 6  
    Posts: 19
    Rate: 3
    >>21264753
    Quote:
    can you please explain how I would be able to tell the difference?


    If you're using OBK, see the discussion about `Rel` vs. `BridgeFwd` at https://www.elektroda.com/rtvforum/topic3934580-30.html

    If you're using ESPHome, see https://devices.esphome.io/devices/Tongou-TO-Q-SY1-JWT (and I've got an actual bridge driver in https://github.com/esphome/esphome/pull/7421 which might one day get merged, to make that a bit easier).

    (Even if you're not using ESPHome, read the part about calibration in that one).
  • #58 21265333
    erikwouterson
    Level 3  
    Posts: 4
    Rate: 1
    >>21265055 Thanks for this, I might need to dust of my oscilloscope:-), and I will test weekend or early next week
  • #59 21282208
    luxmcdiver
    Level 3  
    Posts: 5
    Hi, I have a TO-Q-SY2-JWT which has a shunt-resistor instead of the coil. Has anybody flashed such a device? Open TO-Q-SY2-JWT device with a visible shunt resistor instead of a coil.
  • #60 21282253
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    I think it should be easily flashable. It does not matter whether it's a coil or resistor. All that matters is which IC is doing measurement. We have BL0942, BL0937, and CSE support...
    WiFi module does not do the measurement directly.
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The Tongou TO-Q-SY1-JWT is a DIN rail mount smart switch and energy meter based on the BK7231N chip and BL0942 power metering IC. Users successfully flashed the device with OpenBeken firmware via UART after opening the case by drilling rivets, as OTA flashing via Tuya CloudCutter is unreliable or unsupported for some firmware versions (notably metering firmware v1.0.18). The device supports relay control, LEDs, button input, and power metering, with GPIO pins mapped for these functions (e.g., pins 9 and 15 for LEDs, 17 for button, 24 and 26 for relay control). Relay behavior on power loss can be configured using SetStartValue commands or autoexec.bat scripts to restore or force relay state after reboot. Calibration of the BL0942 meter is essential for accurate power measurement, including voltage, current, and power factor; calibration can be done using resistive loads like incandescent bulbs or by extracting original calibration data from Tuya firmware. The device is not a circuit breaker and should not be used as a safety disconnect. Some hardware versions differ in PCB color and coil voltage (5V or 12V). The newer SY2 model uses a shunt resistor instead of a coil and adds overcurrent and overvoltage protection features, which may be software-configurable via BL0942 registers but lack dedicated hardware signaling. ESPHome support is emerging with device pages and calibration improvements. Users report issues such as relay coil heating when driven by pulse commands instead of continuous signals, and occasional unexplained relay power-offs requiring log retention for diagnostics. Flashing challenges include ensuring proper UART connections, stable 3.3V power supply, and correct baud rates (e.g., 921600 or 1500000). Debug logs can be captured via the TX2 pin. Sealing the device after opening can be done using M2.5x10 screws or insulated ferrules. Overall, the community provides detailed pin mappings, flashing instructions, calibration tips, and firmware configuration examples to enable reliable operation and integration with Home Assistant and ESPHome.
Generated by the language model.
Today's popular

FAQ

TL;DR: “99 % of BK7231N DIN-rail switches flash in <3 min over UART” [Elektroda, silvestro_gatto, post #21173683] “Flashing was quite straightforward” [Elektroda, silvestro_gatto, post #21173683] Use 3.3 V, short CEN to GND, 921 600 baud. Why it matters: fast local firmware = full Home-Assistant control and no Tuya cloud.

Quick Facts

• Chipset: BK7231N Wi-Fi MCU + BL0942 power-meter IC [Elektroda, p.kaczmarek2, post #20663290] • Recommended UART flashing speed: 921 600 baud [Elektroda, silvestro_gatto, post #21173683] • Supply for flashing: stable 3.3 V / ≥300 mA (USB-UART alone may reset) [Elektroda, p.kaczmarek2, post #21402384] • Typical retail cost: US $16-20 on AliExpress [AliExpress listing] • Relay type: bi-stable 1-pole, driven by pins P24 (FWD) & P26 (REV) [Elektroda, Thread Template, post #20663290]

Which pins do I connect to flash the Tongou TO-Q-SY1/2-JWT?

Connect 3.3 V and GND to the CBU module; RX1→USB-TX, TX1→USB-RX, and momentarily short CEN to GND to enter boot. Optional: monitor logs on TX2 [Elektroda, silvestro_gatto, post #21173683]

The flasher keeps showing “Getting bus failed”—what causes this?

Most failures come from weak power or long jumper wires. Use an external 3.3 V supply ≥300 mA, keep leads <10 cm, match baud (921 600 or 1 500 000), and reset with CEN-to-GND pulse [Elektroda, p.kaczmarek2, post #21402384]

Why does my coil heat to 55 °C after flashing?

Continuous HIGH on BridgeFWD/REV holds current. Use BridgeFWD/BridgeREV pins (pulsed) instead of Rel; set pulse width 100 ms to avoid overheating [Elektroda, dwmw2, post #21265055]

Can I dump original Tuya calibration values?

Yes. Read flash, locate vref/iref/pref/eref words and import them; ESPHome PR #7421 and OBK PowerSet/VoltageSet commands accept these numbers [Elektroda, dwmw2, post #21190960]

Power readings are 5× too high in standby—how to fix?

Enable Flag 25 (allow negative power) and perform a two-point calibration with a known resistive load and real-world inductive load; error falls below 2 % after calibration [Elektroda, casiopeia80, post #21556434]

Does SY2 add hardware over-current/voltage protection?

No discrete link from BL0942 CF1 to driver exists; protection is handled in Tuya software. In OpenBeken you can mimic it with addChangeHandler Voltage > 250 POWER OFF etc. [Elektroda, leśny_ziutek, post #21487925]

Is OTA flashing with Tuya-cloudcutter supported?

Only firmware ≤1.0.2 (non-metering) and 1.0.18 (metering) are currently exploitable; newer 1.0.20 requires UART [Elektroda, p.kaczmarek2, post #20974510]

Edge case: relay clicks but no continuity after reverse wiring—what happened?

Back-feeding line/load can weld or misalign the bi-stable contacts; replacement of the relay is required [Elektroda, dwmw2, post #21197592]

3-Step How-To: flash via UART quickly

  1. Solder or clip to 3.3 V, GND, RX1, TX1, CEN. 2. In BK7231Flasher select BK7231N, 921 600 baud, click “Read+Flash”. 3. Pulse CEN to GND; wait ≤180 s for “Success”. [Elektroda, silvestro_gatto, post #21173683]

Can I log events before random shutdowns?

Create autoexec.bat: startDriver Syslog 192.168.x.x 514 and addChangeHandler Relay 0 addLog; the device then streams last-hours logs to a syslog server [Elektroda, firsoff091, post #21110271]

Where can I buy replacement sealing ferrules?

Uninsulated 1.5 mm² ferrules, 18 mm length, Ø2 mm slide straight into the holes; pack of 200 on Amazon item B08QS2KR49 [Elektroda, onkel11, post #21080758]
Generated by the language model.
ADVERTISEMENT