Flashing Tongou TOQCB2L RCBO: Feasibility, Calibration, and Non-Invasive Methods

Question

Looking to cut or flash Tongou TOQCB2L RCBO. I can provide all details, and if chance of success seems high, am willing to tear one open. main module: v2.1.6 mcu: v1.0.0 Q's: - can it be done? - can it be done while keeping calibration? - can it be done without opening device? AI: What are your...

p.kaczmarek2 · Accepted Answer

First you need to check what kind of WiFi module is inside. OpenBeken supports already many Tuya modules, so there is a fair chance that the chip inside is flashable.
Then the question is whether this device is using TuyaMCU or not.
If it's TuyaMCu based, then check this guide: TuyaMCU guide, and the calibration will not be required as the metering is done by MCU, and not by WiFi module.
If it's not TuyaMCU, then it is most likely using BL0942 or BL0937, so you will have to calibrate with VoltageSet, CurrentSet, PowerSet commands. Still, it's not a problem at all...
The flashing usually requires opening the device, but there is also some cloudcutter solution that sometimes works, given the device is already added to cutter for support.... you can check device profiles there: https://openbekeniot.github.io/webapp/devicesList.html

I'd suggest to just try opening your device, don't wait. Make some photos and share so we have something to work with. We'll help you step by step with OBK configuration.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

p.kaczmarek2 · Accepted Answer

mcu: v1.0.0 also indicates that it is most likely TuyaMCU device. Start by taking original flash 2MB backup.

p.kaczmarek2 · Accepted Answer

MCU version can be seen in Tuya app. You have yourself posted it in the first post in this thread.

thomasbrasser · Answer

Finally got my 3rd one and took it apart:

- seems Tuya MCU!
- may be flashable via pins on the side without disassembly?

EDIT:

- CB3S Module
- TX&RX connected
- obviously GND & 3V3 connected
- CEN & P14 connected

Also this entire part seems to be connected via modbus to the circuit breaker (A B N 12V (but may be not really 12V will check)

So that's also interesting!

Going to read up on TuyaMCU

thomasbrasser · Answer

>>21641926 Where do you read `mcu: v1.0.0`?

I have two the same / similar devices connected to tuya cloud, have stored the DPID json from there.
Have connected to UART2 and saved stock boot logs (allthough I have not connected the main board to the "modbus"/"real" device part.

Next will dump firmware.


    "properties": [
      {
        "code": "forward_energy_total",
        "custom_name": "",
        "dp_id": 1,
        "time": 1755954597205,
        "type": "value",
        "value": 264796
      },
      {
        "code": "phase_a",
        "custom_name": "",
        "dp_id": 6,
        "time": 1755954597214,
        "type": "raw",
        "value": "CPEABZMAALo="
      },
      {
        "code": "phase_b",
        "custom_name": "",
        "dp_id": 7,
        "time": 1755954597273,
        "type": "raw",
        "value": "CPgAAU0AACY="
      },
      {
        "code": "phase_c",
        "custom_name": "",
        "dp_id": 8,
        "time": 1755954597373,
        "type": "raw",
        "value": "CPgAAGYAAAA="
      },
      {
        "code": "leakage_current",
        "custom_name": "",
        "dp_id": 15,
        "time": 1755932540949,
        "type": "value",
        "value": 0
      },
      {
        "code": "switch",
        "custom_name": "",
        "dp_id": 16,
        "time": 1755932540949,
        "type": "bool",
        "value": true
      },
      {
        "code": "ov_set",
        "custom_name": "",
        "dp_id": 102,
        "time": 1755932540949,
        "type": "enum",
        "value": "Trip"
      },
      {
        "code": "uv_set",
        "custom_name": "",
        "dp_id": 103,
        "time": 1755932540949,
        "type": "enum",
        "value": "Trip"
      },
      {
        "code": "oc_set",
        "custom_name": "",
        "dp_id": 104,
        "time": 1755932540949,
        "type": "enum",
        "value": "Trip"
      },
      {
        "code": "op_set",
        "custom_name": "",
        "dp_id": 105,
        "time": 1755932540949,
        "type": "enum",
        "value": "Alarm"
      },
      {
        "code": "temp_set",
        "custom_name": "",
        "dp_id": 107,
        "time": 1755932540949,
        "type": "enum",
        "value": "Trip"
      },
      {
        "code": "leak_set",
        "custom_name": "",
        "dp_id": 108,
        "time": 1755932540949,
        "type": "enum",
        "value": "Trip"
      },
      {
        "code": "online_state",
        "custom_name": "",
        "dp_id": 109,
        "time": 1755934397644,
        "type": "enum",
        "value": "online"
      },
      {
        "code": "event",
        "custom_name": "",
        "dp_id": 110,
        "time": 1755932540949,
        "type": "enum",
        "value": "Manual_ON"
      },
      {
        "code": "auto_reclosing",
        "custom_name": "",
        "dp_id": 112,
        "time": 1755932540949,
        "type": "bool",
        "value": false
      },
      {
        "code": "rd_set",
        "custom_name": "",
        "dp_id": 113,
        "time": 1736331321975,
        "type": "bool",
        "value": false
      },
      {
        "code": "c_thresh",
        "custom_name": "",
        "dp_id": 114,
        "time": 1755932540949,
        "type": "value",
        "value": 25
      },
      {
        "code": "ov_thresh",
        "custom_name": "",
        "dp_id": 115,
        "time": 1755932540949,
        "type": "value",
        "value": 260
      },
      {
        "code": "uv_thresh",
        "custom_name": "",
        "dp_id": 116,
        "time": 1755932540949,
        "type": "value",
        "value": 200
      },
      {
        "code": "leak_thresh",
        "custom_name": "",
        "dp_id": 117,
        "time": 1737474238378,
        "type": "value",
        "value": 30
      },
      {
        "code": "temp_thresh",
        "custom_name": "",
        "dp_id": 118,
        "time": 1755932540949,
        "type": "value",
        "value": 600
      },
      {
        "code": "op_thresh",
        "custom_name": "",
        "dp_id": 119,
        "time": 1755932540949,
        "type": "value",
        "value": 10000
      },
      {
        "code": "fap_a",
        "custom_name": "",
        "dp_id": 125,
        "time": 1755954597513,
        "type": "value",
        "value": 151426
      },
      {
        "code": "fap_b",
        "custom_name": "",
        "dp_id": 126,
        "time": 1755954597526,
        "type": "value",
        "value": 56114
      },
      {
        "code": "fap_c",
        "custom_name": "",
        "dp_id": 127,
        "time": 1755953410172,
        "type": "value",
        "value": 57246
      },
      {
        "code": "temp_a",
        "custom_name": "",
        "dp_id": 131,
        "time": 1755954597540,
        "type": "value",
        "value": 255
      },
      {
        "code": "temp_b",
        "custom_name": "",
        "dp_id": 132,
        "time": 1755954597552,
        "type": "value",
        "value": 252
      },
      {
        "code": "temp_c",
        "custom_name": "",
        "dp_id": 133,
        "time": 1755954004139,
        "type": "value",
        "value": 245
      },
      {
        "code": "temp_n",
        "custom_name": "",
        "dp_id": 134,
        "time": 1755954004173,
        "type": "value",
        "value": 242
      },
      {
        "code": "power_total",
        "custom_name": "",
        "dp_id": 139,
        "time": 1755954597585,
        "type": "value",
        "value": 224
      }
    ]


V:BK7231N_1.0.1

REG:cpsr     spsr     r13      r14

SVC:000000D3          00401C1C 000033AC

IRQ:000000d2 00000010 00401e0c afdf5e6d 

FIR:000000d1 00000010 00401ffc efbf9fb5 

SYS:000000df          0040192c 00000158 

ST:00000000

J 0x10000

bk_misc_init_start_type 0 0
[MEM DBG] heap init-------size:165584 addr:0x407930---------
[Flash]id:0xc84015
[load]bandgap_calm=0x57->0x17,vddig=4->5
IP Rev: c4ae4a2e
[bk]tx_txdesc_flush
tkl_ethernetif_init
tkl_ethernetif_init
tkl_ethernetif_output: invalid vif: 255!
tkl_ethernetif_output: invalid vif: 255!
[01-01 00:00:00 ty D][42ab][tal_thread.c:209] Thread:sys_timer Exec Start. Set to Running Stat 0x42abdc
[01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:6144,priority:5
[01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:wq_system,stackDepth:5120,totalstackDepth:11264,priority:3
[01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:wq_highpri,stackDepth:4096,totalstackDepth:15360,priority:4
[01-01 00:00:00 ty D][4283][tal_thread.c:209] Thread:wq_highpri Exec Start. Set to Running Stat 0x4283d4
[01-01 00:00:00 ty D][lr:0xb67e9] link[9] is registered [0]
[01-01 00:00:00 ty D][lr:0xb67e9] link[2] is registered [1]
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:0
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:1
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:2
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:3
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:4
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:5
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:6
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:7
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:8
[01-01 00:00:00 ty D][lr:0x9d875] add new node,type:9
[01-01 00:00:00 ty D][lr:0x9d9bf] init watchdog, interval: 60
[01-01 00:00:00 ty D][lr:0x9d8e7] update type:7,period:20
[01-01 00:00:00 ty D][lr:0x9d9ed] watch_dog_interval:60, monitor_detect_interval:600
[01-01 00:00:00 ty D][4273][tal_thread.c:209] Thread:health_monitor Exec Start. Set to Running Stat 0x427308
[01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:health_monitor,stackDepth:2048,totalstackDepth:17408,priority:5
[01-01 00:00:00 ty I][lr:0x84ffb] mqc app init ...
[01-01 00:00:00 ty D][lr:0x84eef] mq_pro:5 cnt:1
[01-01 00:00:00 ty D][lr:0x84eef] mq_pro:31 cnt:2
[01-01 00:00:00 ty D][lr:0xc077f] svc online log init success
[01-01 00:00:00 ty E][lr:0x846d5] logseq empty
[01-01 00:00:00 ty D][42ed][tuya_device.c:111] < TuyaOS V:3.11.12 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
< BUILD AT:2025_01_07_14_25_09 BY ci_manage FOR tuyaos-iot AT bk7231n >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 LITTLE_END:1 SL:0 OPERATING_SY[01-01 00:00:00 ty D][42ed][tuya_device.c:112] reset_reason:0
[01-01 00:00:00 ty D][42ed][tuya_device.c:113] bk7231n_common_user_config_ty:3.1.28
current kv info, addr: 1ed000, cnt: 13, is valid: 0
mirror kv info, addr: 1cf000, cnt: 13, is valid: 0
[01-01 00:00:00 ty N][lr:0xcf89f] init protected data length 707 wr_cnt 13
[01-01 00:00:00 ty N][lr:0xbb8b7] key_addr: 0x1ee000   block_sz 4096
[01-01 00:00:00 ty N][lr:0xbb985] get key:
0xe5 0x74 0x1 0xa6 0x10 0x65 0xcf 0x5d 0xa4 0xac 0xcf 0x48 0xe2 0xf3 0x93 0x4d 
[01-01 00:00:00 ty N][lr:0x836d9] uni_random_init...
[01-01 00:00:00 ty N][lr:0x8399b] tuya_tls_rand_init ok!
[01-01 00:00:00 ty N][lr:0x9a1ab] gw_cntl->gw_wsm.stat:2
tkl_wifi_set_country_code_v2: set country code [CN]
rw_ieee80211_set_country code:
code: CN
channel: 1 - 13
mode: MANUAL
bk_wlan cca closed

thomasbrasser · Answer

Wow sorry, was staring at the PCB trying to find where you spotted that 😂😂😂

Added after 4 [hours] 40 [minutes]:

After taking the backup, flashed it and seemed to go without problems. But no AP appeared and also after writing obk config, device didn't appear on network.

Maybe it's just not enough power to start RF, will try connecting to mains (ofc disconnected from serial flasher).

After connecting UART 2 RX again I got:


V:BK7231N_1.0.1
REG:cpsr     spsr     r13      r14
SVC:000000D3          00401C1C 000033AC
IRQ:000000d2 00000010 00401e0c aedfde6d
FIR:000000d1 00000010 00401ffc ef9f9fb5
SYS:000000df          0040192c 00000158
ST:00000000
J 0x10000
bk_misc_init_start_type 0 0
prvHeapInit-start addr:0x4143d8, size:113704
[Flash]id:0xc84015
sctrl_sta_ps_init
cset:0 0 0 0
OpenBK7231N, version 1.18.158
Entering initLog()...
Commands registered!
initLog() done!
Info:MAIN:Main_Init_Before_Delay
Info:CFG:####### Boot Count 644 #######
Info:MAIN:###### safe mode activated - boot failures 644
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
Info:MAIN:Main_Init_Before_Delay done
Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Main_Init_Delay
bandgap_calm_in_efuse=0x57
[load]bandgap_calm=0x57->0x17,vddig=4->5
[FUNC]rwnxl_init
[bk]tx_txdesc_flush
[FUNC]intc_init
[FUNC]calib▒

Attached is fw dump

thomasbrasser · Answer

Of course after connecting the normal power supply everything works flawlessly!Amazing!

thomasbrasser · Answer

Just a big disclaimer on this device: ONLY disassemble the wifi 'module', leave the next one (with the pairing button etc) alone & securely attached to the rest (the breaker).

If you do open it the gears fly out / come dislodged & there's a very high chance it doesn't go back together in the correct way, making the whole thing useless/dangerous.

I found out the hard way, but now that flashing with obk was successful I'm immediately ordering a new one!

thomasbrasser · Answer

No OTA flashing, but very easy to flash once opened up. There's 3 small rivets you need to drill out, then the entire Tuya part can slide out. Connecting 3.3V/GND/TX1/RX1/RX2 is enough, no external PSU needed (for flashing at least) and no traces need to be cut. CB3S inside.

[Solved] Flashing Tongou TOQCB2L RCBO: Feasibility, Calibration, and Non-Invasive Methods

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Didn't find an answer? Ask Artificial Intelligence

Topic summary