Flashing OTA on Finger Touch Dual In-wall Outlet Xenon SM-PW801-U2: WB3s' CEN to VCC

Name: Flashing OTA on Finger Touch Dual In-wall Outlet Xenon SM-PW801-U2: WB3s' CEN to VCC
Uploaded: 2023-11-20T18:51:33+01:00
Description: VERY low range, low quality, xenon is a bad company, gave me much hassles with a return, had to escalate to Amazon Updated (corrected) 20240207 This device was kindly added to repository, thanks. Anybody know how to flash this OTA? WB3's CEN is hardwired to VCC

Question

VERY low range, low quality, xenon is a bad company, gave me much hassles with a return, had to escalate to Amazon Updated (corrected) 20240207 This device was kindly added to repository, thanks. Anybody know how to flash this OTA? WB3's CEN is hardwired to VCC

p.kaczmarek2 · Accepted Answer

It's not just about template, we need 2MB dump to flash next pieces by OTA.

Here is a guide for flashing device via WiFi, without soldering wires:
https://www.elektroda.com/rtvforum/topic4016459.html#20827829
For your device, you need to use Xenon SM-PW801-US Wall Outlet profile.

p.kaczmarek2 · Accepted Answer

it's for toggler driver. You might rather use: Code: text Expand Select all Copy to clipboard setChannelLabel 1 Xyz

p.kaczmarek2 · Accepted Answer

Here's a screenshot from our docs: Link:

p.kaczmarek2 · Answer

Flashing via OTA is only possible if someone earlier has dumped 2MB of flash and created a profile. I would suggest to use wires, UART method. It's easy and reliable.
You can find UART flashing examples here:
https://www.youtube.com/@elektrodacom
I will help you if you encounter a problem, just ask.

omniron · Answer

I tried that, but as you can see in the schematic I drew, both CEN and EN are tied to VCC.
Couldn't get the reader Program start/synch.

And I cannot solder this small, can only flash OTA unfortunately.
Thanks for your help with these, hope to get them going.

p.kaczmarek2 · Answer

You can do the reset without CEN.
Just:
1. connect common GND, RX and TX and 3.3V
2. start flasher tool
3. disconnect 3.3V (you can also connect 3.3V from the BK7231 side to GND for a second, just remember, the BK7231 side, not the power supply one! That would make a short circuit!)
4. reconnec that 3.3V from BK7231 to 3.3V from power supply
The flasher should "get bus" correctly. I've tested it many times.

These days I do not even use CEN/EN for flashing.

omniron · Answer

Ok, will try that, thanks!Should I useltchiptoolor bk_writer1.60 ??

p.kaczmarek2 · Answer

Please only keep using tested tools, unproven tools can brick your device. Here are our tutorials: Here is our newest flasher: Here is a sample of WB3S flashing: Here is a sample of CB2S flashing:

omniron · Answer

Watched videos etc, connected RX to TX and versa, used 3.3V USB serial.
Can see serial data at 115200 Baud like

V:BK7231S_1.0.5
CPSR:000000D3
R0:ADFDA1BB
R1:637DADAF
R2:CCDBD74E
R3:62A7FA76
R4:2ADF9C3F
R13:C3FFDDC3
R14(LR):FFDE5AD5
ST:C1C54D64
J 0x10000
prvHeapInit-start addr:0x426670, size:104848
[01-01 18:12:15 TUYA Debug][uni_thread.c:215] Thread:sys_timer Exec Start. Set to Running Status
[01-01 18:12:15 TUYA Err][online_log_serv.c:280] log stats ufread fail.
[01-01 18:12:15 TUYA Debug][online_log_serv.c:540] log serv init success
[01-01 18:12:15 TUYA Debug][tuya_device.c:180] < TUYA IOT SDK V:2.0.0 BS:30.05_PT:2.2_LAN:3.3_CAD:1.0.2_CD:1.0.0 >
< tuya_iot_lib BUILD AT:2018_12_05_17_03_30 BY tuya_iot_team AT 8710_2M >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSDAR:RELIABLE_TRANSDAR ENABLE_LAN_ENCRYPTION:1 ENABLE_SIGMESH:0 >

[01-01 18:12:15 TUYA Debug][tuya_device.c:181] oem_bk7231s_rnd_switch:1.0.6
[01-01 18:12:15 TUYA Notice][tuya_device.c:182] firmware compil2A at Apr 14 2020 14:27:29
0xcb 0x9e 0x3d 0xa4 0x0 0x62 0x9d 0xa3 0x65 0xf2 0x8d 0xbf 0xe4 0xb9 0x3f 0x35
10:23:11: [01-01 18:12:15 TUYA Notice][tuya_main.c:193] **********[oem_bk7231s_rnd_switch] [1.0.6] compil2A at Apr 14 2020 14:27:24**********
[rx_iq]rx_amp_err_rd: 0x005
[rx_iq]rx_phase_err_rd: 0xffffff26
[rx_iq]rx_ty2_rd: 0x017
*********** finally result **********

tried the flasher but it would just loop for the "bus"
checked with my scope to see how the signals look, all fine, both ways.
rebooted with suggested methods, long and short, no change.
Just to make sure, removed the 10K pullup at RXD2, no change, loop for the "bus".

It's insane how much time and effort we both wasted on this.
Sorry for our efforts, it just doesn't work.
Is there a OTA way to get this flashed?
Thanks

p.kaczmarek2 · Answer

We will flash it soon, we just need to work a bit more.

I think you may be using wrong port.

TXD2/RXD2 is debug log output, here you can read that log.

TXD1/RXD1 is flashing port.

Are you using TXD1/RXD1 for flashing?

Can you make a photo of your circuit?

omniron · Answer

Yes, I was using the second serial port, bummer!
So another soldering session and now this:

Backup name is set to test14.
Starting read!
Now is: Monday, November 20, 2023 11:32:07 PM.
Flasher mode: BK7231N
Going to open port: COM11.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
failed with serial.BytesToRead 0 (expected 15)
The beginning of buffer in UART contains data.
Failed to read device MID!
Going to start reading at offset 0x00...
Reading 0x00... Got exception: System.Threading.ThreadAbortException: Thread was being aborted.
at Microsoft.Win32.UnsafeNativeMethods.ClearCommError(SafeFileHandle hFile, Int32& lpErrors, COMSTAT& lpStat)
at System.IO.Ports.SerialStream.get_BytesToRead()
at System.IO.Ports.SerialPort.get_BytesToRead()
at BK7231Flasher.BK7231Flasher.Start_Cmd(Byte[] txbuf, Int32 rxLen, Single timeout) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 423!
Exception caught: System.Threading.ThreadAbortException: Thread was being aborted.
at BK7231Flasher.BK7231Flasher.Start_Cmd(Byte[] txbuf, Int32 rxLen, Single timeout) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 500
at BK7231Flasher.BK7231Flasher.readSector(Int32 addr) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 1487
at BK7231Flasher.BK7231Flasher.readSectorTo(Int32 addr, MemoryStream tg) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 1344
at BK7231Flasher.BK7231Flasher.readChunk(Int32 startSector, Int32 sectors) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 1212
at BK7231Flasher.BK7231Flasher.doReadInternal(Int32 startSector, Int32 sectors) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 1335
at BK7231Flasher.BK7231Flasher.doRead(Int32 startSector, Int32 sectors) in W:\GIT\BK7231GUIFlashTool\BK7231Flasher\BK7231Flasher.cs:line 780
Backup name is set to test15.
Starting read!
Now is: Monday, November 20, 2023 11:33:16 PM.
Flasher mode: BK7231N
Going to open port: COM11.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
failed with serial.BytesToRead 0 (expected 15)
The beginning of buffer in UART contains data.
Failed to read device MID!
Going to start reading at offset 0x00...
Reading 0x00... failed with serial.BytesToRead 0 (expected 4111)
The beginning of buffer in UART contains data.
Failed! There was no result to save.
Backup name is set to test16.
Starting read!
Now is: Tuesday, November 21, 2023 12:27:41 AM.
Flasher mode: BK7231N
Going to open port: COM11.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus failed, will try again - 1/100!
Getting bus failed, will try again - 2/100!
Getting bus failed, will try again - 3/100!
Getting bus success!
Going to set baud rate setting (115200)!
Will try to read device flash MID (for unprotect N):
failed with serial.BytesToRead 0 (expected 15)
The beginning of buffer in UART contains data.
Failed to read device MID!
Going to start reading at offset 0x00...
Reading 0x00... failed with serial.BytesToRead 0 (expected 4111)
The beginning of buffer in UART contains data.
Failed! There was no result to save.

I checked power, steady 3.25V, did many short/long resets, it always gets stuck at
"Reading 0x00..."

By now I probably could have made some silicon chips out of sand and heated some stones for the metals and played with some oil to get the plastics and be done with it all.

Moderated By p.kaczmarek2:

I can see now that you used BK7231N mode for BK7231T... no wonder that it failed! Next time, please make sure you are using BK7231N mode for BK7231N chips and BK7231T mode for BK7231T chips....

p.kaczmarek2 · Answer

Can you try with bkWriter 1.60, just make sure to first read 2MB of device flash, to get a 2MB file that I can extract GPIO from?

omniron · Answer

this is the result, it's just 1Mb, don't know how to make it read 2MB. I read twice, to make sure I got the right thing. Thanks

p.kaczmarek2 · Answer

You need to enter 0x200000 in read lenght

omniron · Answer

It was all default, I don't see read lenght, are you talking about Operate Length? What about Start Address?

p.kaczmarek2 · Answer

Do not change start address, it will wrap, but it will be okay. Just set operate length to 2 megabytes. Then if you provide flash 2MB dump here, I can try to decode GPIO config for that.

You can also then flash OpenBeken.

omniron · Answer

Now each file is different, I tried many times.Restarted 160, restarted USB/serial, and the unit itself etc. pp.All hashes are different.Here is one:

p.kaczmarek2 · Answer

The following read is correct. Good job!

Log in, to see the code

Extracted GPIO (it seems NETLEd failed to extract):


Device configuration, as extracted from Tuya: 
- Button (channel 1) on P24
- Relay (channel 2) on P9
- Button (channel 2) on P10
- Relay (channel 1) on P6
Device seems to be using WB3S module, which is using BK7231T.
And the Tuya section starts at UNCOMMON POSITION 1953792

Now you can flash OBK...

Added after 2 [minutes]:

@omniron btw I also noticed now why previously flash read failed. You used BK7231N mode to read BK7231T... no wonder that it didnt work.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

omniron · Answer

Super!Finally.Thank you for your patience, I was going to drop that days ago.Sorry about BK7231N mode vs BK7231T, don't know where to set that??Should I make another read just to make sure?I have several of these and must program them OTA, can't open them one by one.Is that possible? If not, I have to return them.But since this is open and wired, how do I go ahead and flash this one with OBK? The videos were a bit generic.Thanks Added after 2 [minutes]:Yes, I noted WB3s in the schematic above

p.kaczmarek2 · Answer

We are here to help, don't give up, just ask on our forum Well: The created binary is 100% correct, there is no need for that. It should be possible since we got 2MB flash dump of one device, I will try to do the preparations and ask the guys on Github for a profile, I will post futher instructions later. Yes, please flash it, then we will configure it

omniron · Answer

That would be great!If it was just about the template couldn't we just use the schematic I made?I hooked up the unit again and tested it with the other flash program and it worked as you said, mostly probably because of the swapped serial ports, right? I'm going to hook up the other units (with serial #1) especially this one:

omniron · Answer

Ok, will try. I'm also looking to OTA this unit: mjspez submitted the needed info.

omniron · Answer

My unit was still connected by wires so I flashed it (after the backups), as mentioned above.
Then I reinstated the template with the backup.
Went to the unit's website, etc.
Now all works fine, thanks again!

omniron · Answer

I'm trying to rename the buttons of the freed Xenon SM-PW801-U2:

In Tasmota it was a simple
WebButton1 xyz (I tried that, thought commands are compatible)
WebButton2 zyx

So I researched
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands-extended.md
which talks about
toggler_name0
toggler_name1 etc.

That command didn't work, so I tried
https://www.elektroda.com/rtvforum/find.php?q=toggler_name

None of those worked either.

Question, how do I change the names of these buttons please???

omniron · Answer

Got it, now that this is not a toggle unit, how do I get rid of the Toggle text in the labels? Thanks! (for all)

omniron · Answer

So cool!I really searched that page for name and text as mentioned, never thought of label.Thanks

omniron · Answer

Is there a way to set one of the switches to turn on/off at sunset/rise?
This is sooo easy with Tasmota

I checked the autoexecs, like here:
https://github.com/openshwprojects/OpenBK7231.../autoexecs/automatic_day_and_night_lights.bat
but the times are hardwired.
Maybe I didn't search well the code on GitHub, does a sunset/rise feature exist for Tuya chips?
thanks!

omniron · Answer

I found that the blue LED on the device (P1 please see schematic at the top) is not mentioned in the unit's template.
Had it wrong in the schematic anyway (corrected).
It was always on, tested it with WifiLED at P1 (RXD2) and it works/blinks!
Could this please be added to its template?

p.kaczmarek2 · Answer

It has been added recently, please see this topic: OpenBeken Scripting - Time and scheduling with NTP and addClockEvent Ok, so the final template is: Code: JSONLog in, to see the code I've added it to our devices list.

Tool / method	Best use in this thread	What worked or failed
BK7231GUIFlashTool	Guided flashing and backups	Worked after using BK7231T mode and TXD1/RXD1; failed in BK7231N mode or on TXD2/RXD2
bkWriter 1.60	Reading a full flash dump	Used to read the dump; Operate Length had to be set to `0x200000`
OTA profile	Flashing additional unopened units	Became possible only after obtaining one correct 2MB dump

Flashing OTA on Finger Touch Dual In-wall Outlet Xenon SM-PW801-U2: WB3s' CEN to VCC

How can I flash this Xenon SM-PW801-U2 outlet over OTA when the WB3S CEN pin is tied to VCC?

Topic summary

FAQ

Quick Facts

1. How can I flash a Xenon SM-PW801-U2 with a WB3S/BK7231T module when CEN and EN are tied to VCC?

2. Why does BK7231GUIFlashTool get stuck on "Getting bus" or "Reading 0x00" when flashing a WB3S smart outlet?

3. What is the difference between TXD1/RXD1 and TXD2/RXD2 on BK7231T, and which UART port should I use for flashing versus debug logs?

4. BK7231T vs BK7231N mode in the flasher: how do I choose the correct chip setting and what errors happen if I pick the wrong one?

5. What is a 2MB flash dump on a Tuya WB3S device, and why is it needed to create an OTA profile or extract GPIO settings?

6. How do I read the full 2MB flash from a Xenon SM-PW801-U2 in bkWriter 1.60, including the correct Operate Length and Start Address settings?

7. ltchiptool vs bkWriter 1.60 vs BK7231GUIFlashTool: which one is safest and most reliable for flashing BK7231T/WB3S devices?

8. How do I flash OpenBeken OTA on the Xenon SM-PW801-U2 using the correct Xenon SM-PW801-US Wall Outlet profile?

9. What is OpenBeken, and how does it differ from the stock Tuya firmware or Tasmota on a dual in-wall outlet?

10. How can I rename the relay buttons in OpenBeken on a Xenon dual wall outlet and remove the default "Toggle" label text from the web UI?

11. How do I set up sunrise and sunset scheduling in OpenBeken for one switch on a BK7231T outlet using NTP and addClockEvent?

12. Why does a BK7231T device show a MAC address ending in 00:00:00 after flashing, and how do I restore the RF config or original MAC behavior?

13. What is the RF partition or TLV header on BK7231, and why can erasing it reduce Wi-Fi range or break the MAC address?

14. How should the blue LED on pin P1/RXD2 be configured in the Xenon SM-PW801-U2 template, and when should I use WifiLED versus WifiLED_n?

15. Why do BtnScriptOnly events in OpenBeken start AllLights_on.bat or AllLights_off.bat but appear not to run the script, and what does "Label // not found" actually mean?