logo elektroda
logo elektroda
X
logo elektroda
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Flashing OTA on Finger Touch Dual In-wall Outlet Xenon SM-PW801-U2: WB3s' CEN to VCC

omniron 4509 39
Best answers

How can I flash this Xenon SM-PW801-U2 outlet over OTA when the WB3S CEN pin is tied to VCC?

OTA flashing is only possible after someone has first dumped the full 2 MB flash and created a profile for the device; otherwise, the recommended path is UART/wired flashing [#20818301] For this outlet, the later recommendation was to use the Xenon SM-PW801-US Wall Outlet profile, and a Wi‑Fi flashing guide was provided for flashing without soldering wires [#20828299] If you do use UART, the thread says CEN is not required: connect GND, RX, TX and 3.3 V, start the flasher, then momentarily disconnect/reconnect 3.3 V to make the flasher get bus [#20819236]
ADVERTISEMENT
  • #31 20950201
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6

    I have
    "pins": {
    "1": "WifiLED;0",

    Should it be what you posted?
  • ADVERTISEMENT
  • #32 20950202
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14649
    Help: 655
    Rate: 12661
    Well, both WifiLED and WifiLED_n are acceptable, but people usually prefer to have WiFiLED_n set, because it's off when it's connected and people don't like extra distracting light. Still, the final choice is up to you.
    Helpful post? Buy me a coffee.
  • #33 20950219
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6

    Got it, yes, I prefer that too, like Tasmota!
    Good to know, I have some other devices which bother me, they have "flashlight" white LEDs.
    But this is at the (dark at night) entrance, so some guide light is good.
    Now it is quite bright, can I set it so it's just powered by the pullup?

    Added after 6 [minutes]:

    I immediately changed that setting for these units:
    https://www.elektroda.com/rtvforum/topic3958242.html
    They had annoyingly ultra bright light on all the time.
    Since that "WiFi" LED has "reversed" powering, it should be WiFiLED there.
    Maybe you can kindly fix that, too?
    Thanks!
  • ADVERTISEMENT
  • #34 20950236
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14649
    Help: 655
    Rate: 12661
    omniron wrote:

    Since that "WiFi" LED has "reversed" powering, it should be WiFiLED there.
    Maybe you can kindly fix that, too?

    Are you saying that I should swap the behaviour of two WiFi LED pin roles? Well, I am not sure. I already have a lot of users, and now swapping WifiLED_n with WifiLED would suprise everyone who does firmware update, don't you think?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #36 20954014
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6

    This BK7231T has a strange MAC, ending in :00:00:00.
    It causes a few issues and I'm just wondering where that MAC came from, since its original MAC was not :00:00:00.
    I read a few things there but mostly refer to BL602.
    Is there a way to get the original MAC back?
    Should I reflash it with portions (?which) from the original dump in case other parameters are also missing?
    I did update it a few times OTA.
    Here is the original dump
  • ADVERTISEMENT
  • #37 20954290
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14649
    Help: 655
    Rate: 12661
    I think you'd benefit a lot from reading our FAQ:
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/faq.md
    Screenshot of the FAQ section related to configuring BK7231T devices with questions and answers about MAC and buttons.
    Quote:

    Question: My device name ends with 00000, is it normal?
    A: Device name is generated based on MAC, that would mean you have accidentally cleared your MAC, so see question below.

    Question: I somehow lost my MAC address and I am unable to change it in Options! My MAC ends with 000000, how to fix?
    A: You have most likely overwrote the TLV header of RF partition of BK7231. You might have done something wrong while flashing or/and done unnecessary 'Erase all' for the chip. The RF partition is normaly NOT overwritten when a device is flashed correctly, because it starts far after the end of OBK binary. For BK7231, we have a way to restore it - open Web App, go to Flash tab, and press 'Restore RF Config'. Note that removing original RF partition (which was already done, if you have 00000) may slightly reduce your device WiFi range and performance
    Helpful post? Buy me a coffee.
  • #38 20954978
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6

    Yes, thank you, I saw that note in the "Web App, Flash" "MAC ends with 00 00 00 and is unable to change bug", read about it in forums etc. also.
    It says it will replace it with a random MAC address.
    So I thought that maybe the RF data and MAC can be extracted from the dump I posted?
    I tried to look for the MAC with a hex editor but got nowhere, I think the first part of the current MAC is not correct also.

    I got two of these and both had extremely low range out of the box, around 6m.
    Returned the other (uncracked) already, still waiting for the money back, xenon is a bad bad company.
    In any case, if you think the RF and MAC are not in the dump, will I then use your nice 00 00 00 repair tool.
    Thanks!
  • #39 20990193
    p.kaczmarek2
    Moderator Smart Home
    Posts: 14649
    Help: 655
    Rate: 12661
    omniron wrote:

    So I thought that maybe the RF data and MAC can be extracted from the dump I posted?

    RF data can be indeed extracted from a backup file if you have it, but it would require some little manual work, we don't have a tool for that. It could be done even in Linux terminal I think. And indeed, using original RF calibration instead of a stub one is better for your WiFi range.

    I would need to actually check myself what's the offset for that is.

    Hmm
    https://github.com/OpenBekenIOT/webapp/blob/gh-pages/vue/flash.vue
    JavaScript code snippet determining the RF address for different chipsets.
    This is the offset at the binary where you would need to copy a one sector from (0x1000 - 4096 bytes).
    Helpful post? Buy me a coffee.
  • #40 21064467
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6
    Hi
    as mentioned here
    https://www.elektroda.com/rtvforum/topic4033215.html#21052330
    after flashing to Build on Apr 3 2024 07:20:17 version 1.17.532 my precious autoexec etc files were gone!
    It was a work in progress and I hadn't backed up those files yet.
    "It's a recurring bug due to the OTA file size growing, we will update WebApp to have a warning or something"
    "Autoexec.bat should work, just restore old script and it should be ok."
    As mentioned, I cannot even get the simple btn_scriptonly going, what am I doing wrong?

    Attached please find the files I tried to run plus a (cleaned) log.
    I left one channel (pin24) with Btnand that works, the relay switches on and off.

    But the other channel (pin10) with longpress etc and using "Btnscriponly" doesn't work.
    It seems it cannot find "AllLights_off.bat"
    Label // not found in AllLights_off.bat - will go to the start of file

    but then

    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //

    the log:
    Info:GEN:24 Button_OnInitialPressDown
    Info:GEN:24 key_short_press
    Info:MQTT:Channel has changed! Publishing 1 to channel 1
    Info:GEN:24 Button_OnInitialPressDown
    Info:GEN:24 key_short_press
    Info:MQTT:Channel has changed! Publishing 0 to channel 1

    Info:GEN:10 Button_OnInitialPressDown
    Info:GEN:10 Button_OnLongPressHoldStart
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //
    Info:GEN:10 Button_OnLongPressHold
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_off.bat // long pressing (2+ seconds) the button calls AllLights_off.bat
    Info:CMD:Label // not found in AllLights_off.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_off.bat at label //

    Info:GEN:10 Button_OnInitialPressDown
    Info:GEN:10 key_short_press
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_on.bat // short pressing the button calls AllLights_on.bat
    Info:CMD:Label // not found in AllLights_on.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_on.bat at label //
    Info:GEN:10 Button_OnInitialPressDown
    Info:GEN:10 key_short_press
    Info:EVENT:EventHandlers_FireEvent: executing command startScript AllLights_on.bat // short pressing the button calls AllLights_on.bat
    Info:CMD:Label // not found in AllLights_on.bat - will go to the start of file
    Info:CMD:CMD_StartScript: started AllLights_on.bat at label //


    Screenshot of a file editor with three .bat script files. Screenshot of an autoexec.bat editor with code configuring button events. Screenshot of the AllLights_on.bat script editor window with relay activation commands. AllLights_off.bat script editor with commands turning off relays. Table displaying configuration of various channels, with labels like WifiLED_n, Rel, and Btn_ScriptOnly.

Topic summary

✨ The discussion revolves around flashing the OTA (Over-The-Air) firmware on the Xenon SM-PW801-U2 dual in-wall outlet, specifically addressing issues related to low range and quality concerns with the device. Users share methods for flashing, including UART connections and the necessity of obtaining a 2MB flash dump for successful OTA updates. Various tools such as bk_writer and ltchiptool are discussed, with emphasis on using reliable methods to avoid bricking the device. The conversation also touches on extracting GPIO configurations and modifying button labels in the firmware. Additionally, users express frustrations with the manufacturer's support and the device's performance, while seeking solutions for programming multiple units without physical access.

FAQ

TL;DR: If your Xenon SM-PW801-U2 uses a WB3S/BK7231T module, read a full 2MB dump first and use the correct UART. The key fix was: "TXD1/RXD1 is flashing port". This FAQ helps owners recover, flash OpenBeken, and prepare OTA profiles when CEN is tied to VCC. [#20825513]

Why it matters: This thread shows the exact failure points that stop BK7231T flashing, then documents the settings that finally make both wired flashing and later OTA migration work.

Tool / method Best use in this thread What worked or failed
BK7231GUIFlashTool Guided flashing and backups Worked after using BK7231T mode and TXD1/RXD1; failed in BK7231N mode or on TXD2/RXD2
bkWriter 1.60 Reading a full flash dump Used to read the dump; Operate Length had to be set to 0x200000
OTA profile Flashing additional unopened units Became possible only after obtaining one correct 2MB dump

Key insight: The outlet was not blocked by CEN tied to VCC. The real blockers were the wrong UART port, the wrong chip mode, and an incomplete or inconsistent dump.

Quick Facts

  • The working serial supply measured 3.25V, and the recommended wired connection used GND, RX, TX, and 3.3V only; CEN was not required for reset entry. [#20825801]
  • The full backup required for profile work was 2MB; in bkWriter 1.60, the thread explicitly says to enter 0x200000 as the read length. [#20827028]
  • The extracted Tuya configuration identified a WB3S module on BK7231T, with relays on P6 and P9, and buttons on P24 and P10. [#20827147]
  • The final template added the blue status LED on P1/RXD2 as WifiLED_n;1, while WifiLED;0 remained an acceptable user preference. [#20950196]
  • One device showed very poor wireless performance, reported as about 6 m range out of the box, and later RF-partition discussion linked bad calibration loss to reduced Wi‑Fi behavior. [#20954978]

1. How can I flash a Xenon SM-PW801-U2 with a WB3S/BK7231T module when CEN and EN are tied to VCC?

You can flash it without using CEN. Follow this 3-step method: 1. Connect common GND, RX, TX, and 3.3V. 2. Start the flasher. 3. Briefly remove 3.3V from the BK7231 side, then reconnect it to force reset and let the tool catch the bus. The thread states this worked repeatedly and that CEN/EN was no longer needed for flashing. [#20819236]

2. Why does BK7231GUIFlashTool get stuck on "Getting bus" or "Reading 0x00" when flashing a WB3S smart outlet?

It usually stalls because the wrong UART port or wrong chip mode is selected. In this thread, debug logs appeared at 115200 baud on TXD2/RXD2, but flashing had to use TXD1/RXD1. A second failure came from using BK7231N mode on a BK7231T device, which caused repeated "Reading 0x00" errors and bad reads. [#20825801]

3. What is the difference between TXD1/RXD1 and TXD2/RXD2 on BK7231T, and which UART port should I use for flashing versus debug logs?

Use TXD1/RXD1 for flashing and TXD2/RXD2 only for debug logs. The thread explicitly states that TXD2/RXD2 outputs the Tuya boot log, while TXD1/RXD1 is the programming port. That is why the user could read boot messages first but could not flash until moving to the first serial port. [#20825513]

4. BK7231T vs BK7231N mode in the flasher: how do I choose the correct chip setting and what errors happen if I pick the wrong one?

Choose BK7231T mode for a WB3S-based Xenon outlet, because the module in this thread was identified as BK7231T. Picking BK7231N mode caused bus sync problems, failed flash MID reads, and repeated hangs at Reading 0x00. After correcting the mode, the dump was accepted as valid. [#20827147]

5. What is a 2MB flash dump on a Tuya WB3S device, and why is it needed to create an OTA profile or extract GPIO settings?

A 2MB flash dump is a complete raw backup of the module’s flash contents. "OTA" is a wireless flashing method that updates firmware over Wi‑Fi, without opening the device, after a matching device profile is prepared. In this thread, the 2MB dump let the maintainer decode GPIO roles and prepare the profile needed to OTA-flash additional unopened units. [#20828299]

6. How do I read the full 2MB flash from a Xenon SM-PW801-U2 in bkWriter 1.60, including the correct Operate Length and Start Address settings?

Set Operate Length to 2MB and leave Start Address unchanged. The exact value given in the thread is 0x200000, and the maintainer says not to change Start Address because it will wrap correctly anyway. That full dump is the version needed for GPIO extraction and later OTA profile work. [#20827066]

7. ltchiptool vs bkWriter 1.60 vs BK7231GUIFlashTool: which one is safest and most reliable for flashing BK7231T/WB3S devices?

Use the tested tools from the thread, not unproven ones. The maintainer explicitly warned that unverified tools can brick the device, then pointed to BK7231GUIFlashTool as the newest tested flasher and used bkWriter 1.60 for reading the dump. In this case, reliability came from correct settings more than from trying more tools. [#20824911]

8. How do I flash OpenBeken OTA on the Xenon SM-PW801-U2 using the correct Xenon SM-PW801-US Wall Outlet profile?

Use the Wi‑Fi flashing guide referenced in the thread and select the Xenon SM-PW801-US Wall Outlet profile. That profile became available after the 2MB dump was captured and processed. The same post says this method is specifically for flashing without soldering wires on the remaining unopened units. [#20828299]

9. What is OpenBeken, and how does it differ from the stock Tuya firmware or Tasmota on a dual in-wall outlet?

OpenBeken is the replacement firmware the thread flashed onto this BK7231T outlet after backing up the original Tuya image. In practice here, it exposed a local web UI, accepted device templates, and later added scheduling, labels, and LED options. The user also compared its commands with Tasmota, noting that some names differ, such as label commands. [#20829348]

10. How can I rename the relay buttons in OpenBeken on a Xenon dual wall outlet and remove the default "Toggle" label text from the web UI?

Use channel labels, not Tasmota-style WebButton commands. The maintainer gave the direct command setChannelLabel 1 Xyz, and then pointed to the docs screenshot for changing the visible label text. That is why toggler_name0 failed here: it applies to the toggler driver, not this outlet’s relay UI. [#20838808]

11. How do I set up sunrise and sunset scheduling in OpenBeken for one switch on a BK7231T outlet using NTP and addClockEvent?

Use the newer OpenBeken scripting approach with NTP and addClockEvent. The thread says sunrise and sunset support was added recently and points to the scripting topic dedicated to time and scheduling. That means hard-coded times in older autoexec examples are no longer the only option for this outlet. [#20950196]

12. Why does a BK7231T device show a MAC address ending in 00:00:00 after flashing, and how do I restore the RF config or original MAC behavior?

That MAC usually means the RF configuration area was overwritten. The FAQ quoted in the thread says the TLV header of the RF partition was likely cleared, often by incorrect flashing or an unnecessary erase. The built-in recovery path is the Web App’s Restore RF Config, but it restores a usable config, not necessarily the factory-original MAC. [#20954290]

13. What is the RF partition or TLV header on BK7231, and why can erasing it reduce Wi-Fi range or break the MAC address?

"RF partition" is a flash area that stores radio calibration and identity data, including the TLV header that controls MAC-related settings and Wi‑Fi tuning. If you erase it, the device can lose its original MAC behavior, and the thread warns that replacing it with a stub can slightly reduce Wi‑Fi range and performance. [#20954290]

14. How should the blue LED on pin P1/RXD2 be configured in the Xenon SM-PW801-U2 template, and when should I use WifiLED versus WifiLED_n?

The final template mapped P1 to WifiLED_n;1. The maintainer later confirmed that both WifiLED and WifiLED_n are acceptable, but many users prefer WifiLED_n because the light stays off when Wi‑Fi is connected. The completed Xenon SM-PW801-U2 template also kept relays on P6 and P9, with buttons on P24 and P10. [#20950196]

15. Why do BtnScriptOnly events in OpenBeken start AllLights_on.bat or AllLights_off.bat but appear not to run the script, and what does "Label // not found" actually mean?

The event system did start the script, but it did not find a label named //. The log explicitly says Label // not found ... will go to the start of file, then confirms started AllLights_off.bat at label //. So BtnScriptOnly was firing on pin 10, but the thread does not show a final fix for why the script body still produced no visible action. [#21064467]
ADVERTISEMENT