[T34 ] Teardown & Flashing Guide for Aoyan Tuya Smart Plug (EU)

Hi all,

I want to share a teardown and flash experience for a device I couldn't find in the database so far. It's a single on/off power socket WiFi switch with power monitoring feature.

Tuya Smart Plug (EU)
Manufacturer: Aoyan
Chip: T34 (same setting as BK7231N)
Connection: WiFi

bought here: https://de.aliexpress.com/item/1005006777059625.html





After usual disassembly for this device type (best working with a pipe wrench on all 4 corners at the top), I was quite surprised to find a different PCB layout without separate module - just a T34 chip without any test solder points and antenna integrated in the mainboard - note that on the following photo, the T34 chip has already been removed, it sits where the 4 big ground pads are located:





I found some useful information about the chip and how to deal with it here: https://www.elektroda.com/rtvforum/topic4036975.html
- so I did following steps:
1. desoldering the chip with hot air
2. tracing back possible solder points for GND, 3V3, TX & RX
3. either flashing the chip desoldered and then put it back or, soldering it back first and then flashing
4. setting up OpenBK firmware

I share some photos of the important places:



The tracing back resulted in following finding: all points can be easly accessed via connected BL0942 chip (I assume power monitoring chip):



By connecting 4 wires to the mentioned points (I chose 3 pins at BL0942 chip and 1 convenient big pad for GND) and flashing with OpenBK Flasher (setting to BK7231N), the flashing can be done without need to desolder. I have 4 devices of the same kind, so I used one for analysis and flashed the 3 other ones without any desoldering, very easy. CEN is not necessary, just interrupt 3V3 in the process to reset and start flashing.



Last step is finding the pinout - I used OpenBK Web application and found following settings:

P14 - Rel [Channel 1]
P24 - WifiLED
P26 - Btn [Channel 1]

Comment: The LED on P24 is blue and is optional if required for WiFi connection. There is a red LED as well that is linked to the relay on P14, so this one will automatically switch on and off with the relay.

EDIT: to enable power monitoring, add 'startDriver BL0942' either to autoexec.bat or startup commands. My autoexec.bat is as follows:


I also recommend to set following flags: 2; 10; 25; 38; 40

Here I also attach the read result.


Hope that this device can be added to the database and hopefully it helps others who bought the same device. Cheers =)

auntlydia wrote:

If someone wants to give some guidance or experience on how to assign the BL0942 power monitoring correctly, welcome!

Have you got 'startDriver BL0942' running in your startup command or autoexec.bat?

Nice! That was easy! Thanks a lot. It's working perfectly now. I didn't know that enabling the driver is enough and there was no need to assign any pins like some other of my switches have with the BL0937.

I get all important data for energy monitoring in Home Assistant, very useful indeed.

Good morning everyone,
I would ask you to clarify "CEN is not necessary, just interrupt 3V3 during the reset process and start flashing.". Should CEN be in low state before starting flashing (to GND) or high state and interrupt during startup? On the ESP8266 you should specify a high state before programming if I remember correctly. The T34 datasheet note is modest about CEN. My purchased socket design differs slightly, RX, TX hang in the air but are on the edge, TX leads to the inactive pad. BL0937 is controlled by other pins.

Greetings
.
.
.

>>21409603 Hi, I just flashed few of those T34 devices with green board (just assuming they are same or similar) and it worked as described earlier and in other post about T34 teardown; I connected one 3v3 to BL0937, GND to big relay pin, and TX/RX directly to the chip on the top right corner. With interrupting 3v3 before flashing it worked with every device, so CEN is really not necessary and it seems not connected to the board circuits.

You may check this guide:
https://www.elektroda.com/rtvforum/topic4042412.html#21044837
it looks like your device or similar one.

Hello,
Actually, just unplugging the ground and plugging it in makes the flasher snap. I had a bit of trouble with the RX, TX pins, I wanted to solder them on molybdenum wire, but they didn't want to catch the tin too much, so ended up with thin copper wires from some braided wire. Now I'm still templating QNCX/bl0937/6, 7, 8, 24, 26, 28, and I'll see if it starts.

QNCX profile with pins

Hello,
However, there is a problem, but not on the socket, but on the LED controller chip LF686C20. The symptom is that the web interface stops responding after about a minute. The chip pings, I can see by the serial that MQTT is transmitting. Admittedly it is not set, but this is a sign that the chip is working. The chip is loaded with openbl602_1.17.822.The story is developmental, as I previously had a driver on bl602l10 (LED driver) and it behaved similarly, I assumed it was broken. It was only with this one on an LF686C20 with identical symptoms that I leaned towards them. I should add that I have two other bl602l20's (1.17.822 2 days, 1.17.601 198 days) and they work stably. Anyone perhaps encountered a similar symptom? I have a snapshot of the serial from startup, however there is nothing suspicious there, particularly when the chip is rejetting.

.