logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

TUYA PC473 3-Phase Energy Meter Teardown: CT Clamp & CB3S Module Insights

ipasitt 6411 26
Best answers

How can I make the Tuya PC473 3-phase energy meter work in OpenBeken after flashing the CB3S/BK7231N, when no dp_id profile fits?

You cannot use a standard TuyaMCU dp_id template here; this meter appears to use a CB3S/BK7231N Wi‑Fi module talking to an HT7032 over a custom SPI-like interface, not UART TuyaMCU [#21263544] [#21265401] OpenBeken will run on the CB3S, but it will not be a fully working non-cloud meter until the HT7032 protocol is reverse engineered; the suggested next steps are a device-specific HT7032 datasheet/register map, a logic-analyzer capture of the SPI lines, or a reference driver [#21263926] [#21265401] Cloudcutter profiles were later added for both firmware versions, so they may help you get from factory firmware to OpenBeken, but they do not solve the meter communication problem [#21263926] A later-shared HT7032 document with formatted read/write examples and register data may be useful for implementing support [#21280945] [#21285031]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21261496
    ipasitt
    Level 3  
    Posts: 13
    Bidirectional 3-phase energy meter with a relay and three sensors.

    This device is two-way 3-phase energy metering with 1 channel relay communicating over wi-fi. It reports voltage, current, power factor, active energy, and reverse energy.
    The body can be removed by unscrewing 2 screws at the back and lightly pressing the 2 latches on top and bottom; be gentle at the latches as they easily break.


    There are 2 layers of PCBs stacked over each other, securely soldered and with precise spacing to fit top and bottom cases. I recommend not de-soldering the part.
    I closely looked at the chip and it is CB3S. I managed to flash BK7231N, but cannot proceed with the config on dp_ids, still searching for a profile and template that would fit.
    Bidirectional 3-phase energy meter with visible PCB.

    Two-phase energy meter with visible two PCB layers.

    Flashing can be done by wiring to GND UIRXD UITXD 3V3.
    Close-up of a PCB with pin markings and a red arrow pointing to the UART section.
  • ADVERTISEMENT
  • #2 21262695
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    Hey, are you sure it's a TuyaMCU device? Have you tried our TuyaMCU guide?
    https://www.elektroda.com/rtvforum/topic4038151.html

    Is the device already flashed with OpenBeken? If you've flashed it already, we can try by checking for communication with a basic TuyaMCU config (start driver, set wifi state 0x04) and with request state command.
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md

    Or maybe can you provide better photos of the device? Maybe it's not a TuyaMCU device after all?
    Helpful post? Buy me a coffee.
  • #4 21262967
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    So HT7032 connects to the WiFi module via UART?

    What did it report in Tuya app, did it report both WiFi module and MCU versions?

    Do you have 2MB flash backup?

    By the way... HT7032 ?
    https://patents.google.com/patent/CN216211301U/en
    Quote:

    6. The three-phase intelligent electric energy meter with the built-in electronic local load switch of claim 5, wherein the type of the metering chip is HT7032, the sampling resistor of the current sampling circuit is 0805 chip resistor, and the sampling resistor of the voltage sampling circuit is 1206 chip resistor.


    Electronic circuit schematic with HT7032 chip.
    Helpful post? Buy me a coffee.
  • #5 21263124
    ipasitt
    Level 3  
    Posts: 13
    Circuit board with labels and connectors for Wi-Fi communication.

    These 4 pins are which HT7032 communicates with Wi-Fi. 

    Added after 17 [minutes]:
    Attachments:
    • Three Phase Energy Meter with CT Clamp.txt (7.26 KB) You must be logged in to download this attachment.
  • #6 21263503
    ipasitt
    Level 3  
    Posts: 13
    2MB backup file
    Attachments:
    • readResult_BK7231N_QIO_2024-14-10-16-46-40.bin (2 MB) You must be logged in to download this attachment.
  • #7 21263505
    ipasitt
    Level 3  
    Posts: 13
    This is another 2MB bin file download from another device, same module 3-phase energy meter but I cannot read it.
    Attachments:
    • readResult_BK7231N_QIO_Tuya3phasewithCT_2024-12-10-15-15-45.bin (2 MB) You must be logged in to download this attachment.
  • #8 21263544
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    Well, I can't see even UART baud rate in this file... what do you think, @divadiow ? It seems this device may be using a custom SPI protocol.
    Block diagram of the HT7032 chip with marked interface pins.
    This is not a TuyaMCU at all...
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #9 21263559
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    >>21263503

    storage area in this file contains:

    Code: JSON
    Log in, to see the code


    and the boot log

    Code: Text
    Log in, to see the code


    When pairing with Tuya app you get offered an update from 1.0.5 to 1.0.10

    Device update to version 1.0.10 App display for device PC473 with on/off toggle option. Screenshot of an app with a software update notification.

    after pairing and on 1.0.5 the storage area now contains all the dpID info:

    Code: JSON
    Log in, to see the code


    not seeing any mention of baud speeds

    Added after 3 [minutes]:

    >>21263505

    this secondary binary is already 1.0.10 and contains the dpIDs. did you pair and update this one?

    Added after 9 [minutes]:

    strings from 1.0.5 bin
    Attachments:
    • readResult_BK7231N_QIO_2024-14-10-16-46-40.bin.txt (66.52 KB) You must be logged in to download this attachment.
  • #10 21263573
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    ipasitt wrote:
    These 4 pins are which HT7032 communicates with Wi-Fi.

    could this mean it's either SPI, QSPI or SSI?

    Added after 1 [hours] 17 [minutes]:

    attached is the output log of 1.0.5 boot, pairing to Tuya app, subsequent upgrade to 1.0.10 then boot of 1.0.10
    Attachments:
    • PC473_105-1010_boot_upgrade.txt (280.77 KB) You must be logged in to download this attachment.
  • #12 21263784
    ipasitt
    Level 3  
    Posts: 13
    >>21263559

    I had already paired with TUYA app and upgraded to 1.0.10. Somehow the device still shows 1.0.5 maybe I did not power the device with AC current when I pair with Tuya app, but the upgrade process gone through. Currently I had already flash BK7231N. I don't know how to go from here.

    Added after 36 [minutes]:

    >>21263544

    Is there any chance to get this device working with OpenBeken?
  • #13 21263926
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    ipasitt wrote:
    Is there any chance to get this device working with OpenBeken?

    well I guess OpenBeken will run now on the CB3S but it won't be much use. The communication with the HT7032 will need deciphering and some code writing to accommodate this meter.

    So no, OpenBeken will not give you a fully working non-cloud/Tuya device at present.

    Added after 3 [hours] 22 [minutes]:

    Cloudcutter profiles added for both fw versions https://github.com/tuya-cloudcutter/tuya-clou...mmit/1cd52f62b0fe41e291c28d4aeecd82ac9b93c8e1
  • #14 21264326
    ipasitt
    Level 3  
    Posts: 13
    >>21263926

    Thank you, what great news, I was using cloudcutter a few days ago without any luck. I will go back and try again.
  • ADVERTISEMENT
  • #15 21264343
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    cool. still, HT7032 is an unknown
  • #16 21265256
    ipasitt
    Level 3  
    Posts: 13
    >>21263573

    I saw many config mention it is SPI communication between HT7032 to wifi. Correct me if I am wrong.

    Added after 3 [minutes]:

    >>21263926

    I had already flashed my device to openBeken, and I went back to Tuya-CloudCutter and failed again. It looks for SmartLive AP !!!
    Any way to work around.

    Thanks
  • #17 21265285
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    ipasitt wrote:
    I had already flashed my device to openBeken, and I went back to Tuya-CloudCutter and failed again. It looks for SmartLive AP !!!Any way to work around.

    im not sure I understand. Cloudcutter is just a way to convert from factory firmware to OpenBeken on devices with exploitable firmware. The end result when running OpenBeken is not any different to UART flashing the device.
  • #18 21265324
    ipasitt
    Level 3  
    Posts: 13
    >>21265285
    Screenshot of the OpenBK7231N configuration with a list of available pins and their assignments.
    I mean I am stuck at the config page going nowhere. If I do it from the CloudCutter I would get the dp_id from there. Perhaps I am wrong.
  • #19 21265401
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    TuyaMCU is UART only protocol, as far as I know. In order to support your device, we need either:
    - a full documentation of used chip along with SPI protocol specs (commands, etc)
    - some well described communication captures of the SPI lines made with some logic analyzer like Sigrok
    - a reference code of already existing and working driver for the mentioned SPI measurement chip
    Helpful post? Buy me a coffee.
  • #20 21266519
    ipasitt
    Level 3  
    Posts: 13
    >>21265401

    This is getting out of my knowledge. I am trying my very best to get more information. Would it be best to send one unit to you?

    Best regards.
  • ADVERTISEMENT
  • #22 21279592
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    The article you linked is only showing a generic basics of what SPI protocol is. It's a device-independent description of SPI and it's modes.

    We, on other hand, need a device-specific documentation of SPI commands and registers of HT7032.

    The best I can find is this chinese patent, but there doesn't seem to be any protocol details there...
    Attachments:
    • CN216211301U.pdf (1.08 MB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • #23 21279861
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    is any of this of help?
    Attachments:
    • HT7032 User manual V1.1.pdf (4.71 MB) You must be logged in to download this attachment.
    • HT6025_190719_钜泉三相698（lib）.rar (3.04 MB) You must be logged in to download this attachment.
  • #24 21280945
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    Very nice, they even include read operation sample, where did you find it?
    SPI read operation example in a Hi-Trend Technology document.
    There is also registers data in this document, but there is a lot of those registers.
    Helpful post? Buy me a coffee.
  • #25 21280952
    divadiow
    Level 38  
    Posts: 4874
    Help: 425
    Rate: 865
    p.kaczmarek2 wrote:
    where did you find it?

    persistence. spamming the right company and contacts :)

    Added after 1 [hours] 7 [minutes]:

    and in response to query "I notice the rar file attached was labelled as for the HT6025, please confirm this can be used with HT7032."

    Code: Text
    Log in, to see the code
  • #26 21285031
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14439
    Help: 650
    Rate: 12407
    So here is formatted Read:
    Code: C / C++
    Log in, to see the code

    Write is in this document as well:
    Fragment of documentation showing an example of an SPI write operation.
    Hopefully I've wrote it down without errors:
    Code: C / C++
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #27 21321680
    ipasitt
    Level 3  
    Posts: 13
    Hi,
    Any development to support SPI protocol ?
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion revolves around the TUYA PC473 three-phase energy meter, which features a two-way energy metering system with Wi-Fi communication. Users are exploring the device's capabilities, including its ability to report various electrical parameters and the potential for firmware flashing. The main focus is on the CB3S chip and its compatibility with OpenBeken firmware. Participants are troubleshooting issues related to communication protocols, specifically the HT7032 chip's connection to the Wi-Fi module via UART and potential SPI communication. There are inquiries about flashing the device, obtaining configuration files, and the challenges faced in transitioning from factory firmware to OpenBeken. The conversation highlights the need for specific documentation and communication captures to support the SPI protocol for the HT7032 chip.
Generated by the language model.
Today's popular

FAQ

TL;DR: With 2 PCB layers and a CB3S Wi-Fi board, this TUYA PC473 teardown shows why “This is not a TuyaMCU at all” matters: OpenBeken can boot on BK7231N, but full local metering still needs the HT7032/HT7038 communication protocol reversed. This FAQ helps modders decide whether to open, flash, back up, or reverse-engineer the meter. [#21263544]

Why it matters: This thread separates simple Wi-Fi reflashing from the much harder task of restoring full 3-phase measurement and relay control without Tuya cloud.

Method What it does well What it does not solve Best use here
UART flashing to CB3S Directly loads OpenBeken through 3V3, GND, UIRXD, UITXD Does not reveal HT7032 protocol or working dpIDs by itself Fast recovery and firmware replacement
Tuya-CloudCutter Can convert factory firmware without opening when firmware is exploitable Useless after OpenBeken is already flashed; end state matches UART flashing Best only on untouched factory units
Factory Tuya firmware Exposes dpIDs after pairing and can offer OTA 1.0.10 Keeps cloud dependence and hides meter-side protocol details Best for backup, logs, and reverse engineering

Key insight: The CB3S side is the easy part. The blocker is the metering side: until the HT7032-style link is documented or captured, OpenBeken on this PC473 is functional Wi-Fi firmware, not a fully working local 3-phase meter. [#21263926]

Quick Facts

  • The housing opens by removing 2 rear screws and gently pressing 2 latches on the top and bottom; the latches were reported as easy to break. [#21261496]
  • The device uses 2 stacked PCBs and the Wi-Fi module was identified as CB3S, which the poster successfully flashed as BK7231N. [#21261496]
  • The meter reports voltage, current, power factor, active energy, and reverse energy, and includes 1 relay channel with Wi-Fi connectivity. [#21261496]
  • A boot log from the 2 MB backup shows BK7231N_1.0.1, Tuya firmware 1.0.5, and a build timestamp of May 8, 2024 10:04:55. [#21263559]
  • After pairing, the app offered an OTA update from 1.0.5 to 1.0.10, and the thread later noted CloudCutter profiles were added for both firmware versions. [#21263926]

How do you safely open the TUYA PC473 3-phase energy meter without breaking the top and bottom latches?

Remove the 2 rear screws first, then press the top and bottom latches lightly while sliding the body free. Do not pry hard. The poster warned that both latch points break easily. The unit also has 2 stacked PCBs fitted tightly to the case, so avoid forcing the shell once the screws are out. [#21261496]

What is the CB3S module in this Tuya energy meter, and how does it relate to the BK7231N platform?

The CB3S is the meter’s Wi-Fi module, and this thread identified it as a BK7231N-based board that can run OpenBeken. The poster inspected the chip closely, named it CB3S, and said they had already flashed BK7231N successfully. In this device, CB3S handles Tuya connectivity, while metering logic appears to sit on a separate HT7032-side interface. [#21261496]

Which pins do you use to flash OpenBeken onto the CB3S in the TUYA PC473 meter, and what wiring sequence is needed for GND, UIRXD, UITXD, and 3V3?

Use four pins: GND, UIRXD, UITXD, and 3V3. A practical sequence is: 1. wire GND and 3V3 to the adapter, 2. cross-connect UIRXD and UITXD, 3. start the flash process with the CB3S powered at 3.3 V. The thread explicitly states flashing can be done through those four pads and shows their location in a close-up photo. [#21261496]

Why was this PC473 meter identified as not being a standard TuyaMCU device, even though it uses Tuya firmware and exposes dpIDs after pairing?

It was identified as non-TuyaMCU because the backup and boot analysis did not show the expected TuyaMCU UART behavior. One developer stated, “This is not a TuyaMCU at all,” after failing to find even a UART baud rate in the 2 MB file. The device still uses Tuya cloud firmware and stores dpIDs after pairing, but that does not prove a TuyaMCU UART link. [#21263544]

What is the HT7032 metering chip, and what role does it play in a 3-phase bidirectional energy meter with CT clamps and a relay?

“HT7032” is a metering IC that measures electrical parameters for a multi-phase power monitor, acting as the meter-side processor for sampled voltage and current data. In this thread, it is tied to a 3-phase bidirectional meter that reports voltage, current, power factor, active energy, and reverse energy, and works alongside 1 relay channel and external CT clamp sensing. [#21262967]

How can you tell whether the HT7032 talks to the Wi-Fi module over UART, SPI, QSPI, or SSI on this hardware?

You tell by tracing the actual signal lines and capturing traffic, not by the Tuya app view. The thread showed 4 interconnect pins between HT7032 and Wi-Fi, which pushed the discussion away from UART and toward SPI, QSPI, or SSI. Later, the OpenBeken developer said TuyaMCU is UART-only and asked for logic-analyzer captures of the SPI lines to support this device properly. [#21265401]

What dpIDs were discovered after pairing the meter with the Tuya app, and which measurements or controls do they likely map to?

After pairing, the storage area exposed dpIDs including 1, 26, 38, 101–130. The likely map is: dpID 1 relay on/off; 26 and 123 status bitmaps; 38 an enum mode; 101–124 mostly read-only measurement values; 125–127 writable threshold-style values; and 128–130 writable booleans. The value metadata shows scales of 0, 1, 2, and 3, with ranges up to 2,000,000,000. [#21263559]

Why might the Tuya app offer an update from firmware 1.0.5 to 1.0.10 while the device still appears to report 1.0.5 afterward?

The most likely reason is that the OTA process and the displayed version were not aligned on that boot cycle. The thread reports an offered update from 1.0.5 to 1.0.10, yet the owner still saw 1.0.5 afterward and suspected the device was not powered with AC during pairing. A second binary from another unit was already on 1.0.10 and contained the dpIDs, which supports the idea that version state varied by unit or update path. [#21263784]

Tuya-CloudCutter vs UART flashing for CB3S/OpenBeken: which approach is better for this PC473 meter, and what information does each method preserve or expose?

Use CloudCutter on untouched factory units; use UART flashing when the unit is already open or already modified. CloudCutter can preserve more of the original behavior during transition and is useful when exploitable factory firmware exists. UART flashing is direct and reliable, but it does not magically reveal the HT7032 protocol or auto-build a working template. The thread states that once OpenBeken is running, the end result is no different from UART flashing. [#21265285]

How should you troubleshoot getting stuck on the OpenBeken config page when a flashed Tuya energy meter no longer behaves like factory SmartLife firmware?

Treat the config page as expected, not as proof something is broken. 1. Confirm you already replaced factory firmware with OpenBeken. 2. Stop expecting the SmartLife AP or Tuya onboarding flow to return. 3. Focus on mapping pins and the HT7032 link instead of waiting for dpIDs to appear in OpenBeken. The user got stuck because they expected CloudCutter-like discovery after flashing, but the thread explains that OpenBeken and factory Tuya firmware behave differently. [#21265324]

What evidence from the 2MB flash backup and boot log suggests this meter uses a custom SPI-style protocol instead of TuyaMCU UART commands?

The strongest evidence is negative and structural. The 2 MB dump did not reveal a clear UART baud setting, even though TuyaMCU devices usually expose UART-oriented clues. The boot log showed BK7231N threads, cloud init, and dp storage, but no standard TuyaMCU exchange was identified. The hardware also showed 4 signal pins between HT7032 and Wi-Fi, which matches the later SPI-style reverse-engineering path better than a simple UART pair. [#21263544]

Which documentation, logic analyzer captures, or reference code would be needed to add OpenBeken support for the HT7032 communication protocol?

OpenBeken support needs one of three things: full HT7032 protocol documentation, clean logic-analyzer captures of the live bus, or working reference code for the same chip family. The developer listed those requirements explicitly and even named Sigrok as a suitable capture tool. Without commands, registers, timing, and sample transactions, the CB3S can run OpenBeken but cannot reconstruct full local metering support. [#21265401]

Where was the OTA firmware for version 1.0.10 pulled from, and how can that OTA package help analyze Tuya firmware behavior on this meter?

The 1.0.10 OTA package was pulled from Tuya’s firmware host as an RBL file. That package helps because it gives reverse engineers a second firmware image to compare against 1.0.5 for dpIDs, strings, upgrade flow, and protocol clues. It is especially useful when the live device still reports an older version after an apparent OTA. [#21263671]

How do the published SPI read and write examples for HT7038 or related designs help reverse-engineer HT7032 register access for this 3-phase meter?

They provide a concrete starting point for bus timing, address width, and data length. The published read example uses a 7-bit address range of 0x00 to 0x7F and returns 24 bits, with the slave sampling on the falling edge and outputting data on the rising edge. Later vendor feedback said the design used HT7038 and that it is similar to HT7032, so those examples are directly useful for first-pass driver work. [#21285031]

What progress has been made toward OpenBeken support for the HT7032 SPI protocol in the TUYA PC473 3-phase energy meter?

Progress was real but incomplete. By late October 2024, the thread had moved from “unknown” HT7032 behavior to sample SPI read/write code and register data from a related design. CloudCutter profiles were also added for firmware 1.0.5 and 1.0.10. However, no post in the thread reports a finished OpenBeken driver or a fully working non-cloud meter, and a November 27 follow-up still asked whether support had advanced. [#21321680]
Generated by the language model.
ADVERTISEMENT