logo elektroda
logo elektroda
X
logo elektroda

[Solved] Flashing Tongou TOQCB2L RCBO: Feasibility, Calibration, and Non-Invasive Methods

thomasbrasser 717 9
ADVERTISEMENT
  • #1 21376291
    thomasbrasser
    Level 3  
    Looking to cut or flash Tongou TOQCB2L RCBO.
    I can provide all details, and if chance of success seems high, am willing to tear one open.

    main module: v2.1.6
    mcu: v1.0.0

    Q's:
    - can it be done?
    - can it be done while keeping calibration?
    - can it be done without opening device?

    AI: What are your specific goals or reasons for wanting to flash the Tongou TOQCB2L RCBO?
    Work local and also offline.
    AI: Have you attempted any methods or conducted research on flashing the RCBO before, and if so, what were the results?
    Have experience with tuya local / localtuya / esphome / libretiny / openbeken / etc. Flashed many devices before, but all had existing profiles.
  • ADVERTISEMENT
  • Helpful post
    #2 21377127
    p.kaczmarek2
    Moderator Smart Home
    First you need to check what kind of WiFi module is inside. OpenBeken supports already many Tuya modules, so there is a fair chance that the chip inside is flashable.
    Then the question is whether this device is using TuyaMCU or not.
    If it's TuyaMCu based, then check this guide: TuyaMCU guide, and the calibration will not be required as the metering is done by MCU, and not by WiFi module.
    If it's not TuyaMCU, then it is most likely using BL0942 or BL0937, so you will have to calibrate with VoltageSet, CurrentSet, PowerSet commands. Still, it's not a problem at all...
    The flashing usually requires opening the device, but there is also some cloudcutter solution that sometimes works, given the device is already added to cutter for support.... you can check device profiles there: https://openbekeniot.github.io/webapp/devicesList.html

    I'd suggest to just try opening your device, don't wait. Make some photos and share so we have something to work with. We'll help you step by step with OBK configuration.
    Helpful post? Buy me a coffee.
  • #3 21639842
    thomasbrasser
    Level 3  
    Finally got my 3rd one and took it apart:

    - seems Tuya MCU!
    - may be flashable via pins on the side without disassembly?


    Close-up of CB3S module with visible RX, TX, GND, and 3V3 pins on a blue PCB
    PCB with transformer, capacitors, and connector pins visible on board
    PCB with CB3S module, labeled pins, and various surface-mounted components


    EDIT:

    - CB3S Module
    - TX&RX connected
    - obviously GND & 3V3 connected
    - CEN & P14 connected

    Also this entire part seems to be connected via modbus to the circuit breaker (A B N 12V (but may be not really 12V will check)

    So that's also interesting!

    Going to read up on TuyaMCU ;)
  • ADVERTISEMENT
  • Helpful post
    #4 21641926
    p.kaczmarek2
    Moderator Smart Home
    mcu: v1.0.0 also indicates that it is most likely TuyaMCU device. Start by taking original flash 2MB backup.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #5 21642431
    thomasbrasser
    Level 3  
    >>21641926 Where do you read `mcu: v1.0.0`?

    I have two the same / similar devices connected to tuya cloud, have stored the DPID json from there.
    Have connected to UART2 and saved stock boot logs (allthough I have not connected the main board to the "modbus"/"real" device part.

    Next will dump firmware.

    
        "properties": [
          {
            "code": "forward_energy_total",
            "custom_name": "",
            "dp_id": 1,
            "time": 1755954597205,
            "type": "value",
            "value": 264796
          },
          {
            "code": "phase_a",
            "custom_name": "",
            "dp_id": 6,
            "time": 1755954597214,
            "type": "raw",
            "value": "CPEABZMAALo="
          },
          {
            "code": "phase_b",
            "custom_name": "",
            "dp_id": 7,
            "time": 1755954597273,
            "type": "raw",
            "value": "CPgAAU0AACY="
          },
          {
            "code": "phase_c",
            "custom_name": "",
            "dp_id": 8,
            "time": 1755954597373,
            "type": "raw",
            "value": "CPgAAGYAAAA="
          },
          {
            "code": "leakage_current",
            "custom_name": "",
            "dp_id": 15,
            "time": 1755932540949,
            "type": "value",
            "value": 0
          },
          {
            "code": "switch",
            "custom_name": "",
            "dp_id": 16,
            "time": 1755932540949,
            "type": "bool",
            "value": true
          },
          {
            "code": "ov_set",
            "custom_name": "",
            "dp_id": 102,
            "time": 1755932540949,
            "type": "enum",
            "value": "Trip"
          },
          {
            "code": "uv_set",
            "custom_name": "",
            "dp_id": 103,
            "time": 1755932540949,
            "type": "enum",
            "value": "Trip"
          },
          {
            "code": "oc_set",
            "custom_name": "",
            "dp_id": 104,
            "time": 1755932540949,
            "type": "enum",
            "value": "Trip"
          },
          {
            "code": "op_set",
            "custom_name": "",
            "dp_id": 105,
            "time": 1755932540949,
            "type": "enum",
            "value": "Alarm"
          },
          {
            "code": "temp_set",
            "custom_name": "",
            "dp_id": 107,
            "time": 1755932540949,
            "type": "enum",
            "value": "Trip"
          },
          {
            "code": "leak_set",
            "custom_name": "",
            "dp_id": 108,
            "time": 1755932540949,
            "type": "enum",
            "value": "Trip"
          },
          {
            "code": "online_state",
            "custom_name": "",
            "dp_id": 109,
            "time": 1755934397644,
            "type": "enum",
            "value": "online"
          },
          {
            "code": "event",
            "custom_name": "",
            "dp_id": 110,
            "time": 1755932540949,
            "type": "enum",
            "value": "Manual_ON"
          },
          {
            "code": "auto_reclosing",
            "custom_name": "",
            "dp_id": 112,
            "time": 1755932540949,
            "type": "bool",
            "value": false
          },
          {
            "code": "rd_set",
            "custom_name": "",
            "dp_id": 113,
            "time": 1736331321975,
            "type": "bool",
            "value": false
          },
          {
            "code": "c_thresh",
            "custom_name": "",
            "dp_id": 114,
            "time": 1755932540949,
            "type": "value",
            "value": 25
          },
          {
            "code": "ov_thresh",
            "custom_name": "",
            "dp_id": 115,
            "time": 1755932540949,
            "type": "value",
            "value": 260
          },
          {
            "code": "uv_thresh",
            "custom_name": "",
            "dp_id": 116,
            "time": 1755932540949,
            "type": "value",
            "value": 200
          },
          {
            "code": "leak_thresh",
            "custom_name": "",
            "dp_id": 117,
            "time": 1737474238378,
            "type": "value",
            "value": 30
          },
          {
            "code": "temp_thresh",
            "custom_name": "",
            "dp_id": 118,
            "time": 1755932540949,
            "type": "value",
            "value": 600
          },
          {
            "code": "op_thresh",
            "custom_name": "",
            "dp_id": 119,
            "time": 1755932540949,
            "type": "value",
            "value": 10000
          },
          {
            "code": "fap_a",
            "custom_name": "",
            "dp_id": 125,
            "time": 1755954597513,
            "type": "value",
            "value": 151426
          },
          {
            "code": "fap_b",
            "custom_name": "",
            "dp_id": 126,
            "time": 1755954597526,
            "type": "value",
            "value": 56114
          },
          {
            "code": "fap_c",
            "custom_name": "",
            "dp_id": 127,
            "time": 1755953410172,
            "type": "value",
            "value": 57246
          },
          {
            "code": "temp_a",
            "custom_name": "",
            "dp_id": 131,
            "time": 1755954597540,
            "type": "value",
            "value": 255
          },
          {
            "code": "temp_b",
            "custom_name": "",
            "dp_id": 132,
            "time": 1755954597552,
            "type": "value",
            "value": 252
          },
          {
            "code": "temp_c",
            "custom_name": "",
            "dp_id": 133,
            "time": 1755954004139,
            "type": "value",
            "value": 245
          },
          {
            "code": "temp_n",
            "custom_name": "",
            "dp_id": 134,
            "time": 1755954004173,
            "type": "value",
            "value": 242
          },
          {
            "code": "power_total",
            "custom_name": "",
            "dp_id": 139,
            "time": 1755954597585,
            "type": "value",
            "value": 224
          }
        ]
    


    
    V:BK7231N_1.0.1
    
    REG:cpsr     spsr     r13      r14
    
    SVC:000000D3          00401C1C 000033AC
    
    IRQ:000000d2 00000010 00401e0c afdf5e6d 
    
    FIR:000000d1 00000010 00401ffc efbf9fb5 
    
    SYS:000000df          0040192c 00000158 
    
    ST:00000000
    
    J 0x10000
    
    bk_misc_init_start_type 0 0
    [MEM DBG] heap init-------size:165584 addr:0x407930---------
    [Flash]id:0xc84015
    [load]bandgap_calm=0x57->0x17,vddig=4->5
    IP Rev: c4ae4a2e
    [bk]tx_txdesc_flush
    tkl_ethernetif_init
    tkl_ethernetif_init
    tkl_ethernetif_output: invalid vif: 255!
    tkl_ethernetif_output: invalid vif: 255!
    [01-01 00:00:00 ty D][42ab][tal_thread.c:209] Thread:sys_timer Exec Start. Set to Running Stat 0x42abdc
    [01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:6144,priority:5
    [01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:wq_system,stackDepth:5120,totalstackDepth:11264,priority:3
    [01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:wq_highpri,stackDepth:4096,totalstackDepth:15360,priority:4
    [01-01 00:00:00 ty D][4283][tal_thread.c:209] Thread:wq_highpri Exec Start. Set to Running Stat 0x4283d4
    [01-01 00:00:00 ty D][lr:0xb67e9] link[9] is registered [0]
    [01-01 00:00:00 ty D][lr:0xb67e9] link[2] is registered [1]
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:0
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:1
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:2
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:3
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:4
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:5
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:6
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:7
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:8
    [01-01 00:00:00 ty D][lr:0x9d875] add new node,type:9
    [01-01 00:00:00 ty D][lr:0x9d9bf] init watchdog, interval: 60
    [01-01 00:00:00 ty D][lr:0x9d8e7] update type:7,period:20
    [01-01 00:00:00 ty D][lr:0x9d9ed] watch_dog_interval:60, monitor_detect_interval:600
    [01-01 00:00:00 ty D][4273][tal_thread.c:209] Thread:health_monitor Exec Start. Set to Running Stat 0x427308
    [01-01 00:00:00 ty I][42ed][tal_thread.c:185] thread_create name:health_monitor,stackDepth:2048,totalstackDepth:17408,priority:5
    [01-01 00:00:00 ty I][lr:0x84ffb] mqc app init ...
    [01-01 00:00:00 ty D][lr:0x84eef] mq_pro:5 cnt:1
    [01-01 00:00:00 ty D][lr:0x84eef] mq_pro:31 cnt:2
    [01-01 00:00:00 ty D][lr:0xc077f] svc online log init success
    [01-01 00:00:00 ty E][lr:0x846d5] logseq empty
    [01-01 00:00:00 ty D][42ed][tuya_device.c:111] < TuyaOS V:3.11.12 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
    < BUILD AT:2025_01_07_14_25_09 BY ci_manage FOR tuyaos-iot AT bk7231n >
    IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 LITTLE_END:1 SL:0 OPERATING_SY[01-01 00:00:00 ty D][42ed][tuya_device.c:112] reset_reason:0
    [01-01 00:00:00 ty D][42ed][tuya_device.c:113] bk7231n_common_user_config_ty:3.1.28
    current kv info, addr: 1ed000, cnt: 13, is valid: 0
    mirror kv info, addr: 1cf000, cnt: 13, is valid: 0
    [01-01 00:00:00 ty N][lr:0xcf89f] init protected data length 707 wr_cnt 13
    [01-01 00:00:00 ty N][lr:0xbb8b7] key_addr: 0x1ee000   block_sz 4096
    [01-01 00:00:00 ty N][lr:0xbb985] get key:
    0xe5 0x74 0x1 0xa6 0x10 0x65 0xcf 0x5d 0xa4 0xac 0xcf 0x48 0xe2 0xf3 0x93 0x4d 
    [01-01 00:00:00 ty N][lr:0x836d9] uni_random_init...
    [01-01 00:00:00 ty N][lr:0x8399b] tuya_tls_rand_init ok!
    [01-01 00:00:00 ty N][lr:0x9a1ab] gw_cntl->gw_wsm.stat:2
    tkl_wifi_set_country_code_v2: set country code [CN]
    rw_ieee80211_set_country code:
    code: CN
    channel: 1 - 13
    mode: MANUAL
    bk_wlan cca closed
    
  • Helpful post
    #6 21642436
    p.kaczmarek2
    Moderator Smart Home
    MCU version can be seen in Tuya app. You have yourself posted it in the first post in this thread.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #7 21642447
    thomasbrasser
    Level 3  
    Wow sorry, was staring at the PCB trying to find where you spotted that 😂😂😂

    Added after 4 [hours] 40 [minutes]:

    After taking the backup, flashed it and seemed to go without problems. But no AP appeared and also after writing obk config, device didn't appear on network.

    Maybe it's just not enough power to start RF, will try connecting to mains (ofc disconnected from serial flasher).

    After connecting UART 2 RX again I got:
    
    V:BK7231N_1.0.1
    REG:cpsr     spsr     r13      r14
    SVC:000000D3          00401C1C 000033AC
    IRQ:000000d2 00000010 00401e0c aedfde6d
    FIR:000000d1 00000010 00401ffc ef9f9fb5
    SYS:000000df          0040192c 00000158
    ST:00000000
    J 0x10000
    bk_misc_init_start_type 0 0
    prvHeapInit-start addr:0x4143d8, size:113704
    [Flash]id:0xc84015
    sctrl_sta_ps_init
    cset:0 0 0 0
    OpenBK7231N, version 1.18.158
    Entering initLog()...
    Commands registered!
    initLog() done!
    Info:MAIN:Main_Init_Before_Delay
    Info:CFG:####### Boot Count 644 #######
    Info:MAIN:###### safe mode activated - boot failures 644
    Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 1 changes count.
    Info:MAIN:Main_Init_Before_Delay done
    Main_Init_Before_Delay done
    Info:MAIN:Main_Init_Delay
    Main_Init_Delay
    bandgap_calm_in_efuse=0x57
    [load]bandgap_calm=0x57->0x17,vddig=4->5
    [FUNC]rwnxl_init
    [bk]tx_txdesc_flush
    [FUNC]intc_init
    [FUNC]calib▒
    


    Attached is fw dump
  • #8 21642731
    thomasbrasser
    Level 3  
    Of course after connecting the normal power supply everything works flawlessly!

    Amazing!
  • #9 21643110
    thomasbrasser
    Level 3  
    Just a big disclaimer on this device: ONLY disassemble the wifi 'module', leave the next one (with the pairing button etc) alone & securely attached to the rest (the breaker).

    If you do open it the gears fly out / come dislodged & there's a very high chance it doesn't go back together in the correct way, making the whole thing useless/dangerous.

    I found out the hard way, but now that flashing with obk was successful I'm immediately ordering a new one!
  • #10 21643116
    thomasbrasser
    Level 3  
    No OTA flashing, but very easy to flash once opened up. There's 3 small rivets you need to drill out, then the entire Tuya part can slide out. Connecting 3.3V/GND/TX1/RX1/RX2 is enough, no external PSU needed (for flashing at least) and no traces need to be cut. CB3S inside.

Topic summary

The discussion revolves around the feasibility of flashing the Tongou TOQCB2L RCBO, with specific inquiries about maintaining calibration and the possibility of non-invasive methods. It is suggested to first identify the type of WiFi module within the device, as OpenBeken supports various Tuya modules, which may allow for flashing without significant issues. If the device utilizes TuyaMCU, calibration may not be necessary since metering is handled by the MCU. However, if it employs BL0942 or BL0937 chips, calibration will be required using specific commands. While flashing typically necessitates opening the device, there are cloudcutter solutions available for some devices. The recommendation is to open the device for further investigation and to document the process for community assistance.
Summary generated by the language model.
ADVERTISEMENT