Flashing and Configuring Sinotimer TM608 Smart Timer and Meter BK7231T

I got one Sinotimer TM608 Smart Timer and Meter. This is more or less a typical Tuya device. I needed one in DIN rail form factor, so I bought it on Ali, like this one: https://www.aliexpress.com/item/1005006346759481.html


I am not a handyman, so I gave tuya cloudcutter a chance.

Since I couldn't identify what chip it was based on, I first registered it in the Smart Life app and looked it up in the Tuya IoT Cloud Project (sometimes, it gives a clue). But not this time...

Okay, then I identified from the smart life app that my TM608 has the firmware version of 1.3.5. So, I tried to hijack it with cloudcutter.

After several unsuccessful attempts, it worked! I selected the option to choose my device, "By firmware version and name," and then took "1.3.5 - BK7231T / oem_bk7231s_dltj".

Usual procedure: click the button on the front of the device many times to bring it to fast blink mode, then again many times to bring it to AP slow blink mode. Just follow the instructions cloudcutter gives.

Now, the pins. Since there is very scarce info on this device, I tried the GPIO Doctor first and was able to identify all the pins responsible for detecting the switch and the touch button on the front (one pin for both), activating the relay, as well as activating the small LED on the front panel.

Here we go:



So, PIN1 is the switch button (reacts on both the touch button on the front of the device and on connecting C1 and C2 outside device pins).

PIN 2 is to switch on/off the LED on device.

PIN26 controls the relay.

However, my intended use was also to see the power consumption. This was a problem, as I did not identify the pins for the meter itself. I went a mile. I downloaded the Tuya GPIO config, but BK7231GUIFlashTool is not an option to decode it (I have no Windows machine at hand). Frankly speaking, I even tried to convert the corresponding code from this project to Java to be able to run it, but after the first attempt to do so, I searched further, equipped with a better understanding of how config is encoded.

And I found the bk7231tools[cli]. It didn't want to read the Tuya GPIO config I downloaded from the device, as it needs a full firmware dump. I downloaded this one, too (it took a few minutes and showed scary error messages, but it worked). Here is the result I got from this tool:



Basically, this told me what I already knew: pins 1, 6 and 26. However, it also told me a few more things. Namely, that I am dealing with the WB3S module (remember, I did not open the case, as I successfully used cloudcutter).

And, what is more important, that there is something interesting on pins 8, 9, and 24:


So, after some research, I decided to give a chance to the assumption that my power meter is a BL0937 device. It has three pins: the selector pin (SEL), the active power pin (CF), as well as current/voltage pin (CF1). I assumed that "sel_pin_pin" from tuya config (#24) is my selector pin and tried to assign CF and CF1 to the two remaining pins, looking at what values I will see having some load on the relay output.

And it worked!

So, here is the final config:


Now I gonna buy more of these.

Thanks for reading!

Sinotimer, yes, I remember that one. I've reviewed TM609 version once, but that was still ESP based:
https://www.elektroda.pl/rtvforum/topic3860846.html

Anyway, thanks for the review. If you can any photos from inside, please consider attaching them. I will add your JSON to our devices list in few moments.

PS: why dInput and not Button?

Unfortunately, I did not trust myself to disassemble this one. I hijacked it without opening it via tuya-cloudcutter, so I avoided disassembling.

Regarding the PIN1: I am still a novice, so please don't judge me too harshly . I discovered it with GPIO explorer and dInput_n was working. I now tried to change it to Btn_n or Btn, and it did not work.

What is the difference between Btn and dInput?

Regards, Rodion

Btn will toggle target channel on click, so it works as well when you control device both via WiFi and via button. Digital input, on the other hand, just copies the raw input value from pin to channel.

Thanks for explaining.

I do not know why, but changing it to Btn to Btn_n doesn't work. I do not see any changes in channel states once I convert them. Regardless, whether I connect this Btn to the same channel as the relay or to a different channel.

Whatever. I will program this behavior (toggling the relay) with AddHandler in autoexec.bat

Programming dInput with AddHandler is the same as just changing pin role to TglChannelOnToggle (or something like that), so you just may try that role as well, instead of scripting it.

>>20905470
One more question, since you have experience with sibling model (as well as vast experience in the whole topic).
According to the docs, the model can break the circuit in case of overcurrent or overvoltage.
Did you manage to somehow control this functionality from openBK? In the tuya app one can switch the overvoltage/overcurrent protection on and off, so, obviously, it can be controlled somehow.

I tried to add a handler to react to overcurrent, but the reaction time is not acceptable. Usually, circuit breakers react in nanoseconds, and the handler takes much longer. So, I assume the circuit break is implemented on a hardware level.

Do you have any ideas on this? Maybe you can point me to some other devices that were jailbroken and provide circuit break?

Thanks in advance!

I am afraid that there is no internal hardware mechanism to switch off at the overcurrent/overvoltage event. I haven't seen anything like that in my Sinotimer. I'd rather guess that the limiting is done in software, which is indeed a very slow solution. Would ability to set that in OBK firmware suit your needs?

I am not sure whether this will help... Usually, ordinary circuit breakers are reacting within 25 ns. I do not think you can do anything comparable on a software level.

I ordered one more like this - it will arrive within 4 weeks (I am on Canary Islands) and will ensure that these values (overcurrent and overpower) are configurable. Coz I do not remember for sure if they are. If Smart Live allows me to configure them, I will try to play a bit with this device (trying to set values to other GPIOs that seem connected but have no meaning for me now) and see if I can find anything.

It can also be that this functionality is hardcoded on the hardware level, and values in the Tuya configuration are provided just for showing these to the user with no possibility of changing them. I do not remember for sure, so I'd better look at the vanilla device and ensure.

Regards, Rodion

So I finally received it. It seems like the circuit breaker is hardware-based: there are no signs of the possibility of configuring it in the Smart Life app.

In a few days, I'm going to have field tests (put load over 17 kW) and see if it works. I will report on this additionally.

Let us know, some chinese sellers are putting false information in their offers so it's always good to verify everything.