logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Discover miniature XIAO boards »
Discover miniature XIAO boards » ESP32-S3 • nRF52840 • RP2040
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

Exploring the Features and Specifications of Tuya WiFi Energy Meter PJ-1103a [BK7231N][CB2S]

taktlos 16749 69
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #31 21377004
    alexan_e
    Level 10  
    >>21374393 My device is a two clamp energy meter, model number PJ-1103A and uses a HLW8112 IC for measurement. It is identical to the device photos posted in the first post of this thread. The code I have posted is for this model
  • ADVERTISEMENT
  • #32 21377652
    exotsk
    Level 8  
    Are you sure this code isn't for BL0492 and that your chip is different? On my device, all my attempts only result in zeros.

    Screenshot of OpenBK7231N device configuration menu.

    Application interface with energy calibration and reporting rate settings.
    Screenshot of a text editor with the file autoexec.bat open, containing configuration commands for a device.
  • ADVERTISEMENT
  • #33 21377741
    p.kaczmarek2
    Moderator Smart Home  
    If the power metering chip is connected via TuyaMCU (external MCU), then you don't need BL0942/BL0937 driver, you need TuyaMCU driver and mapped dpIDs. dpIDs must match the ones used by Tuya in your device. If you try to run BL0942 driver on TuyaMCU device, or set wrong dpIDs on TuyaMCU device, it will not work. You can't just copy around configs blindly.

    @exotsk , in your case, you need to do two things.
    First. config extraction, maybe it will tell us if your baud is correct:
    https://www.youtube.com/watch?v=WunlqIMAdgw
    Second, open web App Log, and check what are TuyaMCU messages saying, are there at least heartbeats received? Is there any communication at all?

    You should also show us inside of your device, so at least we can tell whether your device is using TuyaMCU or not...

    You may have incorrect baud setting.
    Helpful post? Buy me a coffee.
  • #34 21377847
    alexan_e
    Level 10  
    >>21377652 yes my device uses HLW8112 but internally I see printed PJ1103C/v1.1 2024-09-23

    Close-up of a device's printed circuit board with visible electronic components and markings PJ1103C/v1.1 and date 2024-09-23.

    Looking again at the images of the device posted in the first post of the thread I see that the carton box says PJ1103A and then the internal images have PJ1203 v8 printed.
    In comparison mine has PJ1103AN on the box and PJ1103C/v1.1 on the PCB.

    here is my box (I got it from aliexpress about a month ago)

    Label on a box with information about the electricity energy monitor model PJ-1103AN.

    The PCBs look almost identical with some minor differences in a couple of wire pads. Not sure why this isn't working for you, what does your PCB have as a model?

    Added after 21 [minutes]:

    exotsk, I looked back and found your post here, you have a different device from the one I have. It used HLW8112 but everything else is different so it probably uses different ids and maybe even different baud rate.
  • #35 21377891
    divadiow
    Level 38  
    @exotsk if you have a firmware backup from this device we can probably get the TuyaMCU dpIDs
  • ADVERTISEMENT
  • #37 21378125
    divadiow
    Level 38  
    >>21378054

    please extract the 72kb tuya config file and post here


    Web page of OpenBK7231N device showing USB plug status information.
  • #38 21378137
    exotsk
    Level 8  
    one more.
    will be remove if need
    Attachments:
    • t2.bin (72 KB) You must be logged in to download this attachment.
  • #39 21378170
    divadiow
    Level 38  
    OK. those 2 72kb files have no material difference between them, which is fine.

    Not immediately sure how this helps, but this was extracted from them

    Code: JSON
    Log in, to see the code


    which does make it the same as the extract from the previous full firmware posted here https://www.elektroda.com/rtvforum/topic4016609.html#21213563 but there I posted less information- I probably didn't pair it with Tuya before extraction.

    Not sure if this helps though. It's a pain this thread is a mix of TuyaMCU and non-TuyaMCU devices.
  • #40 21378215
    exotsk
    Level 8  
    >>21378170
    So, I understand that it won't be possible to launch my board?
  • #41 21378232
    divadiow
    Level 38  
    I do not know enough about this type of device or the HLW8112 chip/driver to answer that with any authority.
  • #42 21378269
    p.kaczmarek2
    Moderator Smart Home  
    If this is your device:
    exotsk wrote:

    A blue circuit board with green terminals and capacitors on a wooden table. Circuit board with a purple circuit and electronic module on a wooden surface.

    Then I would probably need to get one on site to develop a driver. It don't seem to be TuyaMCU. Is it HLW8112 ? Then HLW8112 driver is needed.
    Helpful post? Buy me a coffee.
  • #44 21381228
    exotsk
    Level 8  
    If there are no prospects with this firmware, is it possible to restore the Tuya firmware without a lost backup?
  • #45 21381257
    alexan_e
    Level 10  
    >>21381228 you said you had two of those, have you replaced the firmware of the second one too? Maybe you can get the firmware from there
  • #47 21381785
    exotsk
    Level 8  
    >>21381257
    Yes, there is a second board, but I have already installed it in another apartment 3000 km away from me. Now access to it is only through the SmartHome app, which means I won't be able to create a dump.

    divadiow wrote:
    is this not the full backup already posted for this specific device? https://www.elektroda.com/rtvforum/topic4016609.html#21212779

    I don't know if I can use a non-native Tuya dump, and whether the one available in this thread, which is not from my board, will work.
  • #48 21390310
    paulkayBlack6spdZ
    Level 1  
    also have the purple PCB meter board.. what else is needed besides using "startDriver HLW8112SPI" in startup?
  • #49 21400668
    alexan_e
    Level 10  
    >>21373100

    After further investigation, it appears that Tuya channels 1 and 2 are not in use.

    I was able to extract this information from LocalTuya, indicating that forward_energy_total is 130 and reverse_energy_total is 131.
    Code: text Expand Select all Copy to clipboard
    101        (code: power.a, value: 0)
102        (code: direction.a , value: FORWARD, cloud pull)
103        (code: tbd , value: False, cloud pull)
104        (code: directions, value: FORWARD, cloud pull)
105        (code: power_b, value: 0)
106        (code: energy_forword_a , value: 0)
107        (code: energy_reverse_a , value: 1665)
108        (code: energy_forword_b, value: 0)
109        (code: energy_reserse_b, value: 0)
110        (code: power_factor, value: 100)
111        (code: freq, value: 4997)
112        (code: voltage.a, value: 2319)
113        (code: current_a , value: 0)
114        (code: current_b, value: 0)
115        (code: totaLpower, value: 0)
116        (code: voltage.coef, value: 996)
117        (code: current_a_calibration, value: 1000)
118        (code: power_a_calibration, value: 1000 )
119        (code: energy_a_calibration_fwd, value: 1000)
120        (code: coef_a_reset, value: False, cloud pull)
121        (code: power_factor_b, value: 100)
122        (code: freq.calibration, value: 1020 )
123        (code: current_b_calibration, value: 1000)
124        (code: power_b_calibration, value: 1000)
125        (code: energy_b_calibration_fwd , value: 1000)
126        (code: coef_b_reset, value: False, cloud pull)
127        (code: energy_a_calibration_rev, value: 1000)
128        (code: energy_b_calibration_rev, value: 1000)
129        (code: report_rate_control, value: 10)
130        (code: forward_energy_total, value: 0)
131        (code: reverse_energy_total, value: 1665)


    I have updated the configuration file (autoexec.bat) for PJ-1103A (CB2S+HLW8112)
    Code: text Expand Select all Copy to clipboard
    startDriver TuyaMCU
tuyaMcu_setBaudRate 9600
tuyaMcu_defWiFiState 4

startDriver NTP
ntp_setServer 129.250.35.251

// set for your timezone
ntp_timeZoneOfs +2

setChannelType 2  EnergyTotal_kWh_div100
setChannelType 3  EnergyTotal_kWh_div100
setChannelType 4  Power_div10
setChannelType 5  ReadOnly
setChannelType 6  ReadOnly
setChannelType 7  Power_div10
setChannelType 8  EnergyTotal_kWh_div100
setChannelType 9  EnergyTotal_kWh_div100
setChannelType 10 EnergyTotal_kWh_div100
setChannelType 11 EnergyTotal_kWh_div100
setChannelType 12 PowerFactor_div100
setChannelType 13 Frequency_div100
setChannelType 14 Voltage_div10
setChannelType 15 Current_div1000
setChannelType 16 Current_div1000
setChannelType 17 Power_div10
setChannelType 18 PowerFactor_div100
setChannelType 19 TextField
setChannelType 20 TextField
setChannelType 21 TextField
setChannelType 22 TextField
setChannelType 23 TextField
setChannelType 24 TextField
setChannelType 25 TextField
setChannelType 26 TextField
setChannelType 27 TextField
setChannelType 28 TextField
setChannelType 29 TextField

SetChannelLabel  2   "Total Forward energy"
SetChannelLabel  3   "Total Reverse energy"
SetChannelLabel  4   "Power A"
SetChannelLabel  5   "Direction A (0=forward - 1=reverse)"
SetChannelLabel  6   "Direction B (0=forward - 1=reverse)"
SetChannelLabel  7   "Power B"
SetChannelLabel  8   "Forward Energy A"
SetChannelLabel  9   "Reverse Energy A"
SetChannelLabel  10  "Forward Energy B"
SetChannelLabel  11  "Reverse Energy B"
SetChannelLabel  12  "Power Factor A"
SetChannelLabel  13  "AC Frequency"
SetChannelLabel  14  "Voltage"
SetChannelLabel  15  "Current A"
SetChannelLabel  16  "Current B"
SetChannelLabel  17  "Total Power"
SetChannelLabel  18  "Power Factor B"
SetChannelLabel  19  "Voltage Calibration (800-1200)"
SetChannelLabel  20  "Current A Calibration (800-1200)"
SetChannelLabel  21  "Power A Calibration (800-1200)"
SetChannelLabel  22  "Energy A Calibration Forward (800-1200)"
SetChannelLabel  23  "Frequency Calibration (800-1200)"
SetChannelLabel  24  "Current B Calibration (800-1200)"
SetChannelLabel  25  "Power B Calibration (800-1200)"
SetChannelLabel  26  "Energy B Calibration Forward (800-1200)"
SetChannelLabel  27  "Energy A Calibration Reverse (800-1200)"
SetChannelLabel  28  "Energy B Calibration Reverse (800-1200)"
SetChannelLabel  29  "Adjust Reporting Rate (3-60)"

linkTuyaMCUOutputToChannel 130 2 2
linkTuyaMCUOutputToChannel 131 2 3
linkTuyaMCUOutputToChannel 101 2 4
linkTuyaMCUOutputToChannel 102 2 5
linkTuyaMCUOutputToChannel 104 2 6
linkTuyaMCUOutputToChannel 105 2 7
linkTuyaMCUOutputToChannel 106 2 8
linkTuyaMCUOutputToChannel 107 2 9
linkTuyaMCUOutputToChannel 108 2 10
linkTuyaMCUOutputToChannel 109 2 11
linkTuyaMCUOutputToChannel 110 2 12
linkTuyaMCUOutputToChannel 111 2 13
linkTuyaMCUOutputToChannel 112 2 14
linkTuyaMCUOutputToChannel 113 2 15
linkTuyaMCUOutputToChannel 114 2 16
linkTuyaMCUOutputToChannel 115 2 17
linkTuyaMCUOutputToChannel 121 2 18
linkTuyaMCUOutputToChannel 116 2 19
linkTuyaMCUOutputToChannel 117 2 20
linkTuyaMCUOutputToChannel 118 2 21
linkTuyaMCUOutputToChannel 119 2 22
linkTuyaMCUOutputToChannel 122 2 23
linkTuyaMCUOutputToChannel 123 2 24
linkTuyaMCUOutputToChannel 124 2 25
linkTuyaMCUOutputToChannel 125 2 26
linkTuyaMCUOutputToChannel 127 2 27
linkTuyaMCUOutputToChannel 128 2 28
linkTuyaMCUOutputToChannel 129 2 29

// do not send to MQTT the following channels
SetChannelPrivate 19 true
SetChannelPrivate 20 true
SetChannelPrivate 21 true
SetChannelPrivate 22 true
SetChannelPrivate 23 true
SetChannelPrivate 24 true
SetChannelPrivate 25 true
SetChannelPrivate 26 true
SetChannelPrivate 27 true
SetChannelPrivate 28 true
SetChannelPrivate 29 true

// you can use these to force initial configuration values
//SetChannel 19 1000
//SetChannel 20 1000
//SetChannel 21 1000
//SetChannel 22 1000
//SetChannel 23 1000
//SetChannel 24 1000
//SetChannel 25 1000
//SetChannel 26 1000
//SetChannel 27 1000
//SetChannel 28 1000
//SetChannel 29 10

PowerSave 1


    I'm still not sure about the following channels and how we can use them
    Code: text Expand Select all Copy to clipboard
    103        (code: tbd , value: False, cloud pull)
120        (code: coef_a_reset, value: False, cloud pull)
126        (code: coef_b_reset, value: False, cloud pull)


    I’m encountering another issue: the only input type I found that works for setting the calibration values is the TextField type, but it only functions on the web interface page. The TextField type is not published to MQTT, even after removing the SetChannelPrivate setting.

    I’m trying to publish the calibration values so they can be adjusted in Home Assistant. Any ideas on how to resolve this issue? We need an input type that can handle values up to 1200, so a dimmer type won’t work.
  • #50 21488650
    fcol95
    Level 1  
    >>21221637 hello dicamarques! any progress on the hlw8112 driver? i've got a PC311-W-TY energy meter that also has it, but connected to a WBR3 chip on my side.

    Circuit diagram with HLW8112 and WBR3 components.
  • ADVERTISEMENT
  • #51 21603483
    jiyaad
    Level 1  
    >>21224768 >>21224768
    still no drivers available for this?
  • #52 21608416
    booskiboomkin
    Level 3  
    [postid:32ba670f72][/postid:32ba670f72] I have exactly the same model, the 2ch version however mine stopped working - I couldn't reset the device and get it to pair with WiFi.

    I've downloaded and flashed the firmware you included here and it now works again however the power and current calibration is way, way off. Even setting the calibration in the settings doesn't even get me close.

    Is there something I can modify in the firmware before flashing to fix that?

    Added after 4 [minutes]:

    [postid:32ba670f72][/postid:32ba670f72]

    Please provide dump - trying to fix faulty unit with corrupt firmware.


    https://www.aliexpress.com/item/1005007288504....order_list.order_list_main.42.21ef1802ZdW589

    This is the version I have - 120A - might explain why firmware above failed.

    My firmware attached - doesn't allow for reset to connect to WiFi - LED stays off.
    Attachments:
    • readResult_BK7231N_QIO_meter_2025-16-7-10-00-46.bin (2 MB) You must be logged in to download this attachment.
  • #53 21608428
    insmod
    Level 31  
    Flash your tuya config from backup with "Custom operation"
    Cut data from 0x1D0000 to 0x200000 and flash it.

    Or do it alternatively, flash your non-working backup, in working firmware delete everything after 0x1D0000 and flash resulting binary normally.
  • #54 21608435
    booskiboomkin
    Level 3  
    [postid:0fc85c2b9d][/postid:0fc85c2b9d]

    My version of BK flasher doesn't include custom operation and trying to download BK7231GUIFlashTool from GitHub gives me warnings about containing a virus :S


    Sorted - I'll have to unplug it all in a bit and try again in a bit.
  • #55 21609806
    booskiboomkin
    Level 3  
    [postid:5810495568][/postid:5810495568]

    Apologies, I'm struggling to understand this. I've never used this CBU flashing system before.

    Would you mind expanding on your instructions please?

    Edit:
    So flashed non-working backup
    Then removed everything including 0x1D0000 from the working bin to a now shorter file
    Then flashed the shortened file and the unit turns on, I can't reset or detect wifi

    I've also tried taking everything from and including 0x1D0000 from the non-working flash and overwritten everything from and including 0x1D0000 from the working flash, which also didn't work.
  • #56 21610115
    booskiboomkin
    Level 3  
    Doing a custom write, despite selecting a 0x1D0000 offset still starts from 0x11000
  • #57 21610120
    p.kaczmarek2
    Moderator Smart Home  
    It's probable that custom write is not finished, I'll look into it
    Helpful post? Buy me a coffee.
  • #58 21610132
    insmod
    Level 31  
    [postid:12ac1169fb][/postid:12ac1169fb]
    Try this
    Attachments:
    • bk7231n_dump_fixed.bin (2 MB) You must be logged in to download this attachment.
  • #59 21610357
    booskiboomkin
    Level 3  
    >>21610132
    No such luck I'm afraid.
    First time I flashed it, I managed from holding the reset button down get the device to start blinking, slowly, but there was no AP to connect to.

    Now, the LED just stays on. Holding the reset, it blinks off and back on but no AP to connect to.

    Starting to think this might be a dead end, annoying too as this was £17!
  • #60 21712696
    marschr
    Level 3  
    taktlos wrote:
    Jailbreaking procedure:

    1. Easy as can be done with OTA method so follow instructions from tuya-cloudcutter project and flash OpenBeken-v1.17.262_bk7231n.ug.bin firmware with profile tuya-generic-pj-1103a-energy-meter.


    Is this section tested for real? The device PCB image shows a N32G430 MCU but the file mentioned here is for a BK7231n, I'm skeptical that this would brick the device, can someone confirm?
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the Tuya WiFi Energy Meter PJ-1103a, featuring the BK7231N chip and CB2S clamp, with variants using HLW8112 or BL0942 energy metering ICs. Users share specifications, internal photos, and firmware details, highlighting challenges in firmware customization and driver support. The PJ-1103a supports 1CT or 2CT configurations, 0.2-80A current range, 110-240V input, and 2.4GHz WiFi. The device often uses a TuyaMCU interface at 9600 baud, but some units employ HLW8112 ICs connected via SPI, requiring dedicated drivers. Efforts to develop an HLW8112 driver for OpenBK7231T firmware are ongoing, with references to external repositories (e.g., BabyOS, MahdaSystem HLW811x driver). Users report difficulties in obtaining frequent data updates via TuyaMCU commands and in extracting calibration data from original firmware dumps. Flashing OpenBeken firmware is straightforward, but full functionality depends on proper driver implementation and correct dpID mapping. Some users note differences in PCB versions (PJ1103A, PJ1103AN, PJ1103C) affecting compatibility. The community exchanges configuration scripts, pinout diagrams, and firmware dumps to facilitate development. Restoration of original Tuya firmware without backups remains a concern. Overall, the thread documents collaborative troubleshooting, firmware development, and hardware analysis for the PJ-1103a energy meter and its HLW8112-based variants.
Today's popular

FAQ

TL;DR: Tuya PJ-1103A handles up to 80 A and can be OTA-flashed in under 2 min; “It should be possible to link old BL0942 energy stats to TuyaMCU” [Elektroda, p.kaczmarek2, post #21164859] Update rate adjustable to 3 s via dpID 129. Why it matters: Rapid, cloud-free energy data lowers home-automation latency.

Quick Facts

• Measurement range: 0.2 – 80 A, 110–240 V AC [Elektroda, taktlos, post #20828178] • Wireless: 2.4 GHz Wi-Fi, BK7231N/CB2S module [Elektroda, taktlos, post #20828178] • Flash method: CloudCutter OTA, profile “tuya-generic-pj-1103a-energy-meter” [Elektroda, taktlos, post #20828178] • Reporting interval: 3 – 60 s via dpID 129 (default 10 s) [Elektroda, alexan_e, post #21400668] • Calibration coefficients: 800 – 1200 (voltage/current/power), stored in dpIDs 116-128 [Elektroda, alexan_e, post #21400668]

What chips and sensors does the PJ-1103A use?

Most retail units combine a BK7231N Wi-Fi SoC on a CB2S module with a HLW8112 dual-channel metering IC; older sub-variants used TuyaMCU plus BL0942 [Elektroda, taktlos, #20828178; alexan_e, #21377847].

How do I jailbreak and flash OpenBeken OTA?

  1. Run Tuya CloudCutter, select profile “tuya-generic-pj-1103a-energy-meter”.
  2. Upload OpenBeken-v1.17.262_bk7231n.ug.bin.
  3. Reboot; create autoexec.bat to load TuyaMCU driver and map dpIDs [Elektroda, taktlos, post #20828178]

Which dpIDs map to the main electrical values?

Voltage 112, Current 113/114, Power 101/105, Frequency 111, Energy Fwd/Rev A 106/107, Energy Fwd/Rev B 108/109, Total Energy 130/131, Reporting rate 129 [Elektroda, alexan_e, post #21400668]

tuyaMcu_sendQueryState every 5 s still shows few updates—why?

The MCU itself limits how often it pushes fresh registers. Manual polling does not bypass its internal 10 s sample window, so extra commands yield identical data [Elektroda, taktlos, post #20837502]

Can cumulative energy be handled like the BL0942 driver?

Not yet. “TuyaMCU may not provide frequent enough updates for it to work good. It is currently not implemented” [Elektroda, p.kaczmarek2, post #21164859]

How can I display direction channels as enums instead of text hacks?

Enums require a dedicated channel type. The maintainer confirmed it can be added for dpIDs 102 and 104, but the feature is still pending [Elektroda, p.kaczmarek2, post #21164859]

Is there a native OpenBeken driver for HLW8112?

Development has begun (branch drv_hlw8112) and basic SPI communication works, but register writes can fail (error at reg 0x80) and no stable readings yet [Elektroda, dicamarques, #21333858; nhsqr, #21333875].

What causes the “Failed to write reg 80 val A04” boot error?

The HLW8112’s SPI_EN pin or CLK/MISO/MOSI lines are mis-routed or clocked while the chip sleeps. Confirm CS low, SPI_EN high, and 2 MHz clock. Edge-case logs show read 0x410000 instead of 0x0 A04 [Elektroda, nhsqr, post #21333875]

How do I calibrate voltage and current?

Set dpID 116 to 800-1200 for voltage, 117/123 for current A/B, and 118/124 for power. Use known loads, then issue SetChannel <dpID> <coef>; coefficients persist in flash [Elektroda, alexan_e, post #21400668]

Does the meter lose energy totals after a blackout?

Forward and reverse totals (dpIDs 130, 131) survive power loss, but some per-channel counters reset—an observed edge case on early firmware 1.0.10 [Elektroda, rohanb, post #21157458]

I lost my Tuya backup—can I restore stock firmware?

Yes. Another full dump from the same hardware (link in post #21212779) can be flashed with BKWriter. Device-specific UUID/keys regenerate on first boot [Elektroda, divadiow, post #21378170]

What else is needed after `startDriver HLW8112SPI`?

Map the SPI pins in pinRole, reboot, then run EnergyMeter_Init HLW8112 and assign channel types. Without proper pin mapping, register writes fail and all readings show zero [Elektroda, paulkayBlack6spdZ, post #21390310]

Typical cost and availability?

Aliexpress listings range from US $18–25 for 1-CT units and US $24–30 for dual-CT versions (March 2025 search). Prices include two 80 A clamps and shipping to EU [Aliexpress listing ID 1005005861421515].
ADVERTISEMENT