[Solved] Error: CRC Mismatch While Flashing CBU Module 7231N with ltchiptool and OpenBK7231N_QIO

I'm hoping you might be able to advise me on what to try next with this device.

I started by connecting the device to an FTDI type serial to USB and saving the flash memory with ltchiptool using the 'Beken series 72xx' Chip family setting. Then, after incorrectly trying to flash the module using OpenBK7231T_UA_1.17.308.bin, I received the error: E: ValueError: Chip CRC value 365C2EDD does not match the calculated CRC value 5A7B6C4C.

I then found that the IC was a 7231N, so I tried OpenBK7231N_QIO_1.17.333.bin, but received a similar CRC error.

Following this, I tried to re-flash the stock Tuya firmware that I had saved earlier, once again receiving a CRC error.

The module will not boot with Tuya now, although I think it is still partially working. Here is the Chip Info screen:

This is the device:

Hello, have you tried this tool:
https://github.com/openshwprojects/BK7231GUIFlashTool

Hi @p.kaczmarek2, thank you. I have tried BK7231Flasher.exe. It fails 'writing sector' - here is the log:
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in our database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 7c
sr: 7c
final sr: 7c
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to start reading at offset 0x00...
Reading 0x00... Ok! Reading 0x1000... Ok! Reading 0x2000... Ok! Reading 0x3000... Ok! Reading 0x4000... Ok! Reading 0x5000... Ok!
...Removed for clarity...
Reading 0x1FD000... Ok! Reading 0x1FE000... Ok! Reading 0x1FF000... Ok!
Basic read operation finished, but now it's time to verify...
Starting CRC check for 512 sectors, starting at offset 00
CRC matches 0x72FD4A81!
All read!
Loaded total 0x200000 bytes
Wrote 2097152 to readResult_BK7231N_QIO_tuya_V-Wifi-DL02-ES_80A_2023-05-12-09-58-58.bin
Backup 2MB created, now will attempt to extract OBK config.
It's not an OBK config, header is bad
OBK config not found.
Backup 2MB created, now will attempt to extract Tuya config.
Tuya config extractor - magic is at 2023424
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found
Sorry, failed to extract keys from Tuya Config in backup binary.
Reading file firmwares/OpenBK7231N_QIO_1.17.334.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.334.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in our database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0, sec count 298!
Erasing sector 0... ok! Erasing sector 4096... ok! Erasing sector 8192... ok! Erasing sector 12288... ok! Erasing sector 16384... ok!
...Removed for clarity...
Erasing sector 1204224... ok! Erasing sector 1208320... ok! Erasing sector 1212416... ok! Erasing sector 1216512... ok!
All selected sectors erased!
Writing sector 0x00... ok! Writing sector 0x1000... ok! Writing sector 0x2000... ok! Writing sector 0x3000... ok! Writing sector 0x4000... ok! Writing sector 0x5000... ok! Writing sector 0x6000... ok! Writing sector 0x7000... ok! Writing sector 0x8000... ok! Writing sector 0x9000... ok! Writing sector 0xA000... ok! Writing sector 0xB000... ok! Writing sector 0xC000... ok! Writing sector 0xD000... ok! Writing sector 0xE000... ok! failed with serial.BytesToRead 0 (expected 15)
The beginning of buffer in UART contains data.
Writing sector 0xF000... Writing sector 61440 failed!
Writing file data to chip failed.

Here is the result when trying 'Extract config from Tuya binary' with the saved firmware:
Tuya config extractor - magic is at 2023424
Saving debug Tuya decryption data to lastRawDecryptedStrings.bin
Failed to extract Tuya keys - no json start found

Can you try in T chip mode? as BK7231T

Can you try lower baud rate? What is your wire length? Do you provide enough current for BK during flashing?

Thanks for the feedback. I'm using a variable power supply to power the module with up to 5A available. I tried in T chip mode as BK7231T, using baud rate 115200 and it got a bit further with writing, but failed twice at the same spot (Writing sector 0xE0000... Writing sector 917504 failed!) Here is the log:
Starting flash new (no backup)!
Now is: Wednesday, 6 December 2023 2:22:29 PM.
Flasher mode: BK7231T
Going to open port: COM3.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus failed, will try again - 0/100!
Getting bus success!
Going to set baud rate setting (115200)!
Reading file firmwares/OpenBK7231T_UA_1.17.335.bin...
Loaded 978944 bytes from firmwares/OpenBK7231T_UA_1.17.335.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (115200)!
Going to do erase, start 69632, sec count 239!
Erasing sector 69632... ok! Erasing sector 73728... ok! Erasing sector 77824... ok! Erasing sector 81920... ok! Erasing sector 86016... ok!
...
Erasing sector 1032192... ok! Erasing sector 1036288... ok! Erasing sector 1040384... ok! Erasing sector 1044480... ok!
All selected sectors erased!
Writing sector 0x11000... ok! Writing sector 0x12000... ok! Writing sector 0x13000... ok! Writing sector 0x14000... ok! Writing sector 0x15000... ok!
...
Writing sector 0xDC000... ok! Writing sector 0xDD000... ok! Writing sector 0xDE000... ok! Writing sector 0xDF000... ok! failed with serial.BytesToRead 0 (expected 15)
The beginning of buffer in UART contains data.
Writing sector 0xE0000... Writing sector 917504 failed!
Writing file data to chip failed.

Here's my setup:

I'd try two things first. Shorten the wires (they are unnecessarily double the lenght) and I would try another USB to UART converted, the one like we use on our Youtube channel:

Thank you @p.kaczmarek2, success at last. The shortened wires didn't fix the problem but it was a good idea to improve the setup. I found another serial to USB converter and this solved the writing issue. The firmware that worked was OpenBK7231N_QIO_1.17.335.bin, it flashed at full speed too. The original serial to USB has never let me down before, so it just goes to show how finicky these things can be.

Here is the log for reference:
Starting flash new (no backup)!
Now is: Wednesday, 6 December 2023 8:31:13 PM.
Flasher mode: BK7231N
Going to open port: COM3.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in our database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Reading file firmwares/OpenBK7231N_QIO_1.17.335.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.17.335.bin...
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (921600)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in our database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q_16HB, manufacturer: TH, szMem: 1000000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 0, sec count 298!
Erasing sector 0... ok! Erasing sector 4096... ok! Erasing sector 8192... ok! Erasing sector 12288... ok! Erasing sector 16384... ok!
...
Erasing sector 1204224... ok! Erasing sector 1208320... ok! Erasing sector 1212416... ok! Erasing sector 1216512... ok!
All selected sectors erased!
Writing sector 0x00... ok! Writing sector 0x1000... ok! Writing sector 0x2000... ok! Writing sector 0x3000... ok! Writing sector 0x4000... ok!
...
Writing sector 0x128000... ok! Writing sector 0x129000... ok! Starting CRC check for 298 sectors, starting at offset 00
CRC matches 0xBACEAA31!

NOTE: the OBK config writing is disabled, so not writing anything extra.
Writing file data to chip success.

Well done. I already had users in the past reporting that some of USB to UART converters are not working well.

Now, can I help you somehow with the initial OBK configuration?

Thank you for the offer, I was trying to work it out, but the config cannot be extracted from the original Tuya firmware. Error: Failed to extract keys. I also tried 'Get Config from OBK device on LAN', with the same error. I also exported from the web app with the same result.

The BK7231Flasher and Web App are incredibly powerful and an enormous amount of work must have gone into them!

With the config, I found one reference to what appears to be the same device at https://github.com/make-all/tuya-local/issues/1267 where there is 'Information about DPS mappings'. I haven't copied that here, but can do so.

Cheers - Andrew

We are creating our own devices list that has almost 500 entries now, so if you have any information about this device, please post it here in the forum. External links may expire after some time, so we prefer to keep all info on our site. It's safer.

Here is link to our devices list:
https://openbekeniot.github.io/webapp/devicesList.html

Attribution to @xzeertacat in https://github.com/make-all/tuya-local/issues/1267, topic ' Request support for Tuya Wifi Energy Consumption Meter #1267'

Logs


Information about DPS mappings

To be honest, it looks like it was just copy-pasted from Tuya dev API. Still, it's a useful info. Do you need any help with configuring that in OBK?
Here are our autoexec.bat examples: https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md

Yes, I do need help with the configuration please. This is a *dual* BL0942 AC power meter only. I am monitoring a 60W light bulb on both channels. Working in the web app, so far I have:
Autoexec.bat


Log:


I can't find a similar setup in the forum. What is my next step?
Cheers - Andrew

What do you have on the main WWW panel?

What do you mean by dual, are there two BL0942 chips on the board?

ajay100 wrote:

It looks like there are indeed two BL0942.
They may be in SPI mode. Can you try using BL0942SPI?

Are you able to check how they are connected and to which CBU pins are they connected?

How is SEL connected? Is it in SPI or UART mode?

Can you try to do Tuya config extraction?
https://www.youtube.com/watch?v=WunlqIMAdgw

Thank you, I have had some success powering the device with 240VAC. I obtained some readings then used the calibration utility. The logs now show:
No load:
Info:MQTT:Publishing val 242.0 to utilities/sensor9/voltage/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/voltage/get
Info:MQTT:Publishing val 0.003 to utilities/sensor9/current/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/current/get
Info:MQTT:Publishing val 241.4 to utilities/sensor9/voltage/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/voltage/get
Info:MQTT:Publishing val 0.002 to utilities/sensor9/current/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/current/get
Info:MQTT:Publishing val 0.000 to utilities/sensor9/current/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/current/get
40W load:
Info:MQTT:Publishing val 0.00 to utilities/sensor9/power/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/power/get
Info:MQTT:Publishing val 0.131 to utilities/sensor9/current/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/current/get
Info:MQTT:Publishing val 241.6 to utilities/sensor9/voltage/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/voltage/get
Info:MQTT:Publishing val 0.127 to utilities/sensor9/current/get retain=0
Info:MQTT:MQTT client in mqtt_incoming_publish_cb topic utilities/sensor9/current/get

So in these logs, voltage and current are fairly accurate, power is showing 0 and this is the first channel only.

The BL0942 ICs pin 10 TX are connected to pins 6 (RX2) and 16 (RX1) respectively of the CBU module.
BL0942 ICs pin 9 RX are connected to pins 7 (TX2) and 15 (TX1) respectively.
SEL is 0V (UART mode).
Thank you,
Andrew

Added after 2 [minutes]:

I could not extract the Tuya Config in any way I tried. I guess this is because I never registered the device with Tuya.

Thanks for your great assistance with this experiment! I've done some more research and discovered a Zigbee version of this power monitor device. I've decided to go down that route using Zigbee2MQTT, as that seems to offer a broader range of devices https://www.zigbee2mqtt.io/supported-devices, with better and simpler outcomes than the Tuya/OpenBK route.
Cheers - Andrew

If you want, we still can support it.

ajay100 wrote:

The BL0942 ICs pin 10 TX are connected to pins 6 (RX2) and 16 (RX1) respectively of the CBU module.
BL0942 ICs pin 9 RX are connected to pins 7 (TX2) and 15 (TX1) respectively.
SEL is 0V (UART mode).

This is very important information. So they simple use two UART ports. So far I have only seen single BL0942 devices that are using TX1/RX1.

Thanks for your assistance. I have now implemented a similar device using ZigBee2MQTT in Docker, which is a simple solution and supports many devices with no flashing required.