logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N / CB3S] Atorch AT2P - "HD Color Screen" DIN-rail relay/energy meter with RS485

js9658850 2340 15

TL;DR

  • Teardown of the Atorch AT2P “HD Color Screen” DIN-rail relay/energy meter with RS485 from AliExpress.
  • Inside, a CB3S TuyaMCU handles WiFi/Tuya Cloud, while a CH573F MCU manages power monitoring, screen, buttons, and RS485 over UART.
  • Pins 1 and 2 carry RS485 TX/RX, and ESPHome works when they connect to RX/TX with a 120 Ohm resistor across A and B.
  • The RS485 protocol is proprietary rather than Modbus, and the meter is not bi-directional, so it cannot measure exported power.
  • The daughterboard uses a 10-pin standard interface, the power electronics are neatly arranged, and a small beeper provides audible alerts.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Teardown of this energy meter from AliExpress https://www.aliexpress.com/item/1005004917583615.html

    Electrical energy meter with a display showing various measurement data.

    The overall build quality is excellent. The screen is bright and clear, and the device offers a full set of features. However, there are a couple of drawbacks:
    •The RS485 interface does not use Modbus; instead, it relies on a proprietary protocol developed by Atorch.
    •The device is not bi-directional, meaning it cannot measure exported power. This I believe to be a software limitation.

    Atorch electrical energy meter with a display and buttons for DIN rail mounting.
    Front of an energy measurement device with visible inputs labeled N-IN and L-IN.
    Nameplate of an electricity meter from AliExpress

    Opening the device is simple, remove the locking mechanism and 2 Philips screws.
    Back of an electronic module case with a label, open space for the screw.

    Once opened, the construction appears high quality. The daughterboard is connected via a 10-pin standard interface, the power electronics are well-arranged, and there's a small beeper for audible alerts.
    CB3S module on a green board with electronic components.
    Interior of an electronic energy meter.
    Interior of an energy meter showing a circuit board and wiring.

    The meter contains a CB3S TuyaMCU, which is responsible for WiFi connectivity and integration with the Tuya Cloud/App. This connects via UART to a secondary CH573F MCU, which handles power monitoring, screen, buttons and RS485 communication. Pins 1 and 2 are TX and RX for RS485.
    Close-up of CB3S module on a printed circuit board with labeled pins.

    The RS485 module works directly with ESPHome if you connect Pins 1 and 2 to RX/TX respectively (I have tested this) and it works fine as long as a 120 Ohm resistor is placed across A and B.
    Close-up of a circuit board with electronic components and labels.
    If Pins 1 and 2 were disconnected from the CH573F and instead connected to the CB3S TuyaMCU, Modbus control via ESPHome could theoretically be enabled.

    This IC seems to be there for 3.3V DC power regulator:
    Close-up of a circuit board with visible chips and markings.

    One key IC is the AC power metering chip, but unfortunately, all its markings have been removed. I have attempted to mark it as best as possible. If anyone can identify it, please let me know!
    Interior of an energy meter with visible printed circuit board and pin labels.

    I still have the device and it is currently unused. If anyone has questions or wants me to de-solder the TuyaMCU to read the flash, or perform any other modifications, let me know!

    Cool? Ranking DIY
    About Author
    js9658850
    Level 2  
    Offline 
    js9658850 wrote 3 posts with rating 2. Been with us since 2025 year.
  • ADVERTISEMENT
  • #2 21419752
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14388
    Help: 650
    Rate: 12308
    Thank you for this interesting presentation!
    Would you be able to dump the 2MB Flash of the BK7231 module?
    https://github.com/openshwprojects/BK7231GUIFlashTool
    This would be very useful for us, as that could be used to extract data points information: TuyaMCU guide
    I didn't see this Atorch device yet, so far I had only Atorch plug with similiar screen: https://www.elektroda.com/rtvforum/topic4088414.html

    PS: Have you tried using this RS485 interface?
    Helpful post? Buy me a coffee.
  • #4 21420295
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14388
    Help: 650
    Rate: 12308
    I think I may need to go through all the topics and check if each has entry on list... because we sometimes forget about it.
    Helpful post? Buy me a coffee.
  • #5 21420305
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    yes. I have caught quite a few by going back through, but there's undoubtedly more, I wasn't terribly methodical.
  • ADVERTISEMENT
  • #6 21420310
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14388
    Help: 650
    Rate: 12308
    I can get a list of all topics in IoT section and then write a little script to compare it with what we have on Teardowns List, would that help?
    Helpful post? Buy me a coffee.
  • #7 21420894
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    Hmm. Maybeee.
  • #8 21422467
    mfac
    Level 17  
    Posts: 242
    Help: 18
    Rate: 63
    Board Language: polish
    Not so cool at all. It has a residual current protection option, using an external transformer. The trouble is that although this function is disabled, or even if there is no transformer, this protection causes unnecessary trips every few minutes. Neither short-circuiting the input nor inserting a capacitor as a filter helps. Such a defect was revealed to me in one of the two units I own. The meter sees supposed leakage currents of a few hundred mA.
    Navigating the menu is also tedious for me.
  • ADVERTISEMENT
  • #9 21422473
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14388
    Help: 650
    Rate: 12308
    Maybe a faulty copy? Isn't there an option to turn it off?
    Helpful post? Buy me a coffee.
  • #10 21422803
    mfac
    Level 17  
    Posts: 242
    Help: 18
    Rate: 63
    Board Language: polish
    p.kaczmarek2 wrote:
    Maybe a faulty copy? Isn't there an option to turn it off?
    .
    There isn't. You can only raise the threshold, but the maximum is probably 300mA, but that's not enough.
  • ADVERTISEMENT
  • #11 21431308
    js9658850
    Level 2  
    Posts: 3
    Rate: 2
    @p.kaczmarek2 >>21419752

    As requested, I have de-soldered the MCU and performed a firmware backup. I presume this is what you were looking for.
    readResult...-46-31.bin (2 MB)You must be logged in to download this attachment.

    Also, Atorch is sometimes branded as HiDANCE, which I believe is the same company.

    I have tested the RS485 interface, and it works fine with their proprietary software. However, as mentioned before, it does not use Modbus but rather Atorch's own communication protocol. It is possible to make it use Modbus over RS485 by connecting the RS485 to your own MCU.
  • #12 21431320
    js9658850
    Level 2  
    Posts: 3
    Rate: 2
    >>21420255

    It is a very similar device! I believe Atorch is sometimes branded as HiDANCE, which seems to be the same company. However, that particular unit doesn’t include RS485, and some of the PCB layouts are different.

    Added after 5 [minutes]:

    >>21422467

    Interesting fault you found. The unit I have has the residual current protection option disabled, and I haven’t experienced any trips. How long did it take before a trip would happen? Did you have any load on the device when it occurred, or would it happen even if the device was idle?

    I also agree—the menu is a pain to navigate!
  • #13 21431334
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    >>21431308

    hefty list of dpIDs for this device

    Code: Text
    Log in, to see the code
  • #14 21432896
    mfac
    Level 17  
    Posts: 242
    Help: 18
    Rate: 63
    Board Language: polish
    js9658850 wrote:
    Interesting fault you have found. The unit I have has the residual current protection option disabled and I have not experienced any trips. How long did it take before the trip occurred? Was the unit loaded when the fault occurred, or did it occur even when the unit was idle?
    .

    It was loaded, I also don't rule out that it might have scored some sort of short circuit.

    Do you know how to turn it off?
  • #15 21569997
    franciscowmorante
    Level 1  
    Posts: 1
    >>21422467 Hello, good morning. I'm having problems with something very similar. It makes it impossible to use the device, as it only displays "Lakage Protection" and doesn't allow me to do anything else, I've even deactivated it. Have you been able to do anything? I tried to find a solution or a clue where to start. I tried to contact Torch's technical support via email, but they haven't responded at all. I'm confused. I would try to reset the firmware to see if this option is disabled.
  • #16 21570259
    mfac
    Level 17  
    Posts: 242
    Help: 18
    Rate: 63
    Board Language: polish
    >>21569997 No. I removed it and put the old meter back in.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The Atorch AT2P energy meter, featuring a bright HD color screen and DIN-rail mounting, was disassembled revealing high build quality and a BK7231N MCU with 2MB flash memory. The device uses a proprietary RS485 communication protocol rather than standard Modbus, limiting interoperability. Firmware dumping was performed to facilitate data extraction and analysis of device datapoints (dpIDs). The meter supports various parameters including voltage, current, power, leakage current, and pricing modes. A notable hardware/software limitation is the lack of bi-directional measurement, preventing export power monitoring. Some units exhibit a problematic residual current protection feature that causes frequent nuisance trips even when disabled or without an external transformer; this protection threshold can be raised but not fully disabled. Navigation through the device menu is considered cumbersome. Attempts to resolve the leakage protection fault via firmware reset or manufacturer support have been unsuccessful. Atorch is sometimes branded as HiDANCE, with similar but not identical devices. The RS485 interface can potentially be adapted to Modbus by interfacing with a custom MCU. A comprehensive list of device datapoints was shared, aiding in further firmware and protocol analysis.
Generated by the language model.
Today's popular

FAQ

TL;DR: With a 2MB firmware dump and a tested 120 Ω RS485 termination, this FAQ helps Atorch AT2P owners who want safe teardown and integration details; one teardown called the build "excellent," but the RS485 port uses Atorch’s own protocol instead of Modbus. [#21431308]

Why it matters: This thread shows where the hardware is solid, where the protocol is closed, and where leakage protection can make the meter unusable.

Feature Atorch AT2P Similar HiDANCE unit
RS485 hardware Present Not included
PCB layout One layout shown in teardown Different in the compared unit
Branding link Sometimes sold as HiDANCE Believed to be same company
Overall similarity Very similar product family Similar, but not identical

[#21431320]

Key insight: The biggest practical takeaway is that the AT2P hardware is hackable, but its stock RS485 link is not Modbus. To get Modbus-style control, users would need to reroute RS485 to their own MCU or firmware path. [#21419503]

Quick Facts

  • The enclosure opens after removing the DIN locking mechanism and 2 Philips screws, which makes non-destructive disassembly straightforward. [#21419503]
  • The Wi-Fi section uses a CB3S/BK7231 module with 2MB flash, and the dump was successfully backed up after desoldering the module. [#21431308]
  • The tested RS485 hookup worked with ESPHome when pin 1 and pin 2 were wired to RX/TX and a 120 Ω resistor was added across A and B. [#21419503]
  • The daughterboard connects through a 10-pin interface, and the suspected regulator stage provides 3.3 V DC for logic power. [#21419503]
  • Leakage protection appears limited in software: one owner could only raise the threshold to about 300 mA, which still did not stop nuisance trips. [#21422803]

How do you open the Atorch AT2P DIN-rail energy meter without damaging the case or locking mechanism?

Open it by removing the DIN locking mechanism first, then taking out the 2 Philips screws. The teardown reports that this method opens the case cleanly and reveals the main board and daughterboard without forcing the plastic shell. Work slowly so the latch is not bent during removal. [#21419503]

What is a CB3S TuyaMCU, and what role does it play inside the Atorch AT2P energy meter?

The CB3S handles Wi‑Fi connectivity and links the meter to the Tuya cloud and app. "CB3S TuyaMCU" is a Wi‑Fi module that provides Tuya-based network control, using a UART link to exchange data with the main device controller. In this meter, it talks over UART to the CH573F MCU, while the CH573F runs the screen, buttons, power monitoring, and RS485 functions. [#21419503]

What is a dpID in Tuya devices, and how do the extracted dpIDs help with reverse engineering this Atorch meter?

A dpID is a Tuya data-point identifier that maps app functions to device features. "dpID" is a Tuya protocol identifier that labels one controllable or readable function, letting reverse engineers match firmware data points to real features such as voltage, current, alarms, or settings. The extracted list is unusually large and includes IDs for switch state, voltage, current, power, frequency, CPU temperature, leakage current, and display settings. That mapping tells you what the firmware exposes without probing every menu item manually. [#21431334]

Why doesn't the RS485 port on the Atorch AT2P use Modbus, and what proprietary Atorch protocol does it use instead?

It does not use Modbus because the stock firmware speaks Atorch’s own proprietary RS485 protocol. The teardown author tested the interface with Atorch software and confirmed that communication works, but not through Modbus registers. The thread never names a public protocol standard beyond calling it Atorch’s proprietary protocol, so the practical conclusion is simple: stock RS485 is vendor-specific, not Modbus-compatible. [#21431308]

How can I connect the Atorch AT2P RS485 interface to ESPHome, including the correct pin mapping and 120 ohm termination?

Use the RS485 daughterboard pins directly and add proper bus termination. 1. Connect pin 1 and pin 2 from the RS485 module to your controller’s RX and TX respectively. 2. Add a 120 Ω resistor across the A and B RS485 lines. 3. Test communication in ESPHome with the module still wired as described. The thread reports this exact setup worked fine in practice. [#21419503]

What steps are involved in dumping the 2MB flash from the BK7231N/CB3S module with BK7231GUIFlashTool?

The reported workflow was desolder, back up, then share the 2MB image. 1. Desolder the CB3S/BK7231 module from the board. 2. Read its 2MB flash using BK7231GUIFlashTool, which was explicitly requested in the thread. 3. Save the firmware backup for later dpID extraction or analysis. The thread confirms that this backup was completed successfully after desoldering the MCU module. [#21431308]

How could you reroute the RS485 pins from the CH573F MCU to the CB3S module to make Modbus control possible through your own firmware?

You would disconnect RS485 pins 1 and 2 from the CH573F and wire them to the CB3S instead. The teardown states that pins 1 and 2 are the RS485 TX and RX lines, and it explicitly suggests that moving those lines away from the CH573F to the TuyaMCU could enable Modbus-style control through custom firmware. That means the hardware path exists, but the stock routing keeps RS485 under the CH573F’s proprietary protocol. [#21419503]

Which MCU handles the screen, buttons, power monitoring, and RS485 in the Atorch AT2P, and how does it communicate with the CB3S Wi-Fi module?

The CH573F MCU handles the screen, buttons, power monitoring, and RS485. The teardown states that the CB3S TuyaMCU is responsible for Wi‑Fi, while the CH573F manages the meter’s local functions and communicates with the CB3S over UART. That split explains why cloud control and display logic are separated across two processors. [#21419503]

What is the unidentified AC power metering IC in the Atorch AT2P, and how can you identify a chip with its markings removed?

The exact IC is still unidentified because all package markings were removed. The teardown author photographed the chip and asked others to identify it, but no answer in the thread names the part. In this case, the only thread-supported method is board-level comparison: use package shape, pin count, nearby analog components, and matching layouts from similar meters to narrow candidates. [#21419503]

Atorch AT2P vs the similar HiDANCE energy meter: what are the actual hardware differences, especially around RS485 and PCB layout?

The compared HiDANCE unit is very similar, but it lacks RS485 and does not share the same PCB layout. The thread states that Atorch is sometimes branded as HiDANCE and may be the same company, yet the referenced similar unit omits RS485 and shows layout differences on the board. So the family resemblance is real, but the hardware is not identical. [#21431320]

Why does the residual current or leakage protection on some Atorch units trigger false trips every few minutes even when the function appears disabled?

The thread points to a fault condition or flawed leakage implementation, not a user setup mistake. One owner reported repeated trips every few minutes, even with the residual-current transformer absent and the function supposedly disabled. Shorting the input and adding a capacitor filter did not help, and the meter still reported leakage currents of a few hundred mA. That combination strongly suggests a defective unit or unstable leakage-detection path. [#21422467]

How do you turn off the leakage protection on this Atorch/HiDANCE meter when it is stuck showing 'Lakage Protection'?

You cannot fully turn it off from the menu based on the thread. A later user reported the device stayed stuck on “Lakage Protection” even after deactivation, and an earlier owner said the menu only lets you raise the threshold, with a maximum around 300 mA. That means the thread offers no confirmed disable procedure, only a threshold adjustment that may still fail. [#21569997]

What troubleshooting steps can help if the Atorch meter reports phantom leakage currents of a few hundred milliamps with no external transformer connected?

Start by treating it as a fault, not a normal calibration issue. 1. Verify whether the external residual-current transformer is absent or miswired. 2. Raise the leakage threshold in the menu as far as the device allows, about 300 mA in one report. 3. If the meter still trips, replace or remove it; one owner abandoned the unit and reinstalled the old meter. Shorting the input and adding a capacitor did not solve the reported case. [#21422467]

Why can't the Atorch AT2P measure exported power, and what makes users suspect this is a software limitation rather than a hardware one?

It cannot measure exported power in its shipped form because the device is not bi-directional in software behavior. The teardown author states that the meter does not measure exported power and specifically says this is believed to be a software limitation. That suspicion comes from the otherwise full feature set and the device’s capable dual-MCU design, which suggests the limitation is not obviously caused by missing hardware blocks. [#21419503]

What safety considerations should I keep in mind before desoldering the CB3S module or modifying the RS485 wiring on a mains-powered DIN-rail energy meter?

Treat the meter as live mains hardware and only work on it when fully isolated and unused. The thread discusses desoldering the CB3S, rerouting UART and RS485 lines, and opening a DIN-rail meter that contains power electronics and a 3.3 V logic section. That creates an edge case: low-voltage logic mods sit next to mains circuitry. Disconnect power, remove the unit from service, and avoid powered probing during rework. [#21419503]
Generated by the language model.
ADVERTISEMENT