logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it?

casiopeia80 5283 55
Best answers

Can the Tongou TO-Q-SA1 WiFi smart energy meter be identified and flashed with custom firmware, and what chips or UART wiring does it use inside?

Yes: the unit appears to use a Tuya CB2S Wi‑Fi module with a BK7231N, an STC8H3K64S2 secondary MCU, and a BL0942 energy-measurement chip [#21562880] That means it behaves like a TuyaMCU device, so in OpenBeken you can map the meter data via dpID 6 using `RAW_V2C3P3`, with voltage/current/power packed as 8 bytes big-endian; one user got it working with `startDriver TuyaMCU`, `tuyaMcu_setBaudRate 115200`, `tuyaMcu_defWiFiState 4`, and `linkTuyaMCUOutputToChannel 6 RAW_V2C3P3` [#21563065][#21569350][#21570955] However, several users found the readings stop after about 25–30 minutes or only resume briefly, and `tuyaMcu_sendQueryState` still did not bring back dpID 6 reliably [#21576465][#21576531][#21576703] The most reliable workaround reported was to remove the STC chip entirely and wire the BL0942 directly to the BK7231N UART (RX1/TX1), then use OBK’s BL0942 driver; after that, calibration with a known load was needed [#21577273][#21577386][#21576775]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21557070
    casiopeia80
    Level 3  
    Posts: 15
    Hi everyone,

    I recently came across a very compact and seemingly well-designed smart energy meter called **Tongou TO-Q-SA1**. https://tongousmart.com/products/to-q-sa1-smart-energy-accessory-tongou

    It's a WiFi-enabled DIN-rail mounted meter, based on the Tuya platform. What's interesting is that it **doesn't have a relay inside**, which makes it potentially safer for inline monitoring use.
    It looks like a new device — I couldn’t find any threads or teardowns on Elektroda or anywhere else online. Even on Tongou’s official website, details are quite limited.
    Some key features:
    - WiFi connectivity (likely Tuya-based)
    - Measures voltage, current, active power, energy, and internal temperature
    - No relay, just pure monitoring
    - Easily disassembled (snap-fit case)
    - Two versions: Single-wire and Dual-wire input

    📌 **Questions:**
    1. Has anyone opened this unit and identified the **main controller or energy measurement chip**?
    2. Does it use **BK7231N** (Tuya’s Wi-Fi SoC), or something else?
    3. Has anyone successfully **flashed it with OpenBeken, Tasmota, ESPHome, or any other custom firmware**?
    4. Any info on UART pads or programming headers inside?

    I’d appreciate any pictures, insights, or experiences you can share!

    TO-Q-SA1-Single-wire Version

    Automatic circuit breaker with a red switch, brand tongou, model TOMD6-63.

    TO-Q-SA1-Dual-wire Version

    Tongou circuit breaker with smart control module attached.
  • ADVERTISEMENT
  • #2 21557914
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    We have flashed similar devices, but not this specific model. We can help you with whole process, but first you need to take one apart and make some photos from the inside. I can help with PCB analysis.
    Helpful post? Buy me a coffee.
  • Helpful post
    #4 21563065
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    STC chip and only 4 pads of WB2S soldered? Well, it looks like TuyaMCU. We have a good TuyaMCU support in OBK.
    Helpful post? Buy me a coffee.
  • Helpful post
    #5 21563237
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    Yea, only 4 pins.
  • Helpful post
    #6 21563266
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    Can you take 2MB flash backup?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • Helpful post
    #7 21563307
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    I hope i did that correctly.
    ( also edited post with pictures and added link to the power measuring chip for convinience)

    Code: text Expand Select all Copy to clipboard
    {
   "baud":"115200"
}

    Code: text Expand Select all Copy to clipboard
    
Sorry, no meaningful pins data found. This device may be TuyaMCU or a custom one with no Tuya config data.
Baud keyword found, this device may be TuyaMCU or BL0942. Baud value is 115200
No module information found.
And the Tuya section starts, as usual, at 2023424
    Attachments:
    • readResult_BK7231N_QIO_TO-Q-SA1_2025-28-5-23-51-41.bin (2 MB) You must be logged in to download this attachment.
  • #8 21569073
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    I'm quite new here, but if I understand it correctly, I can't configure Tasmota MCU because everything goes through that second MCU (STC8).
    Right?
  • ADVERTISEMENT
  • #9 21569184
    divadiow
    Level 38  
    Posts: 4859
    Help: 424
    Rate: 860
    with TuyaMCU devices it'll not be a case of setting up devices from the dropdown menus in the "Configure Module" page but rather mapping dpIDs in an autoexec script.

    https://www.elektroda.com/rtvforum/topic4038151.html





    autoexec examples https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md

    there are many TuyaMCU journeys searchable from device list that can be used as a template for how to approach this sort of device https://openbekeniot.github.io/webapp/devicesList.html

    to start you off here are the dpIDs for your device.

    Code: JSON
    Log in, to see the code


    Note this is not a config to be imported anywhere as-is, but only displayed as json here for readability.
  • #10 21569307
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    Thank you for reply.
    Yesterday I tried to get DpIDs by using TuyaMCU analyzer (as I found tutorial) but it wasn't helpful at all. Mainly keep alive packets and switch from UI. I wasn't able to catch any data related to voltage (I had it connected through variac), which confuses me because in Tuya app I could see how it's changing but no data on serial.

    Also I tried to find in database but I guess that I used wrong keywords.

    I try to extract them by that linked tutorial (which I didn't find because I wasn't looking enough), just to learn how to do it (hopefully).
  • #11 21569350
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    This is VCP:
    Code: text Expand Select all Copy to clipboard
    
      "desc_en": "1. Phase A voltage, current and power\n2. Big-endian HEX format, total 8 bytes\n3. Units: voltage 2 bytes (0.1V), current 3 bytes (0.001A), power 3 bytes (0.001kW)\n4. Example: 08 80 00 03 E8 00 27 10 means 217.6V, 1.000A, 10.000kW\n5. Communication: (1) Panel queries on entry, sends 0x08 to meter, meter reports to cloud, panel displays data (WiFi supported). (2) Meter periodically reports: every 15 seconds for WiFi, every hour for NB.",

    It seems I need to add a special key for this format, because the one we have, RAW_TAC2121C_VCP, does not match.
    Helpful post? Buy me a coffee.
  • #12 21569363
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    Tell me if you need any data. I'll try to provide them as far as I will be able ( and I still have it disassembled and wires are hooked ).
    But I guess that method through tuya development is more "friendly" ?
  • #13 21569419
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    I've tried doing that blindly, here is commit:
    https://github.com/openshwprojects/OpenBK7231...mmit/59f6d3549f2facf4bc23647952e405d32b9addd5
    It should build a release soon, so you can do OTA and try.

    Do you know how to use it? What is your autoexec.bat now?

    Still, I didn't test that. If you provide me a sample capture with packed of dpID 6, I may be able to verify that.
    Helpful post? Buy me a coffee.
  • #14 21569496
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    I'm not that far, I'm affraid. And still tuya original FW ( as you wrote in that tutorial - it is better for indentifying most DpIDs ).
    Also I had read a lot of things here. There are some things that I yet don't understand.
    I guess that for what you asking I will have to flash OBK FW , right?

    I'm struggling with basics ( I guess) because something isn't obvious at first look or it is confusing for me. And I don't want bother here with questions that I can answer by reading informations here.
    Spoiler:
    Also things are scattered kinda everywhere.
    I'm not complaining in any way, just sharing how I see it as a novice here . I'm more HW guy, I have to do to some SW work here and there so I can comprehend some things ( and sometimes to do some light code ), also my english is pretty bad so all those things are factor in mine understanding in all this.
    Again no complains from my, I'm aware that lot of this work is done in your free time and shared freely. But this will be better in some "feedback" threat.
  • #15 21569503
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    I see, don't worry, we can help you step by step. But first:
    TuyaMCU flashing, setup and configuration guide - configure dpIDs for Home Assistant
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/autoexecExamples.md
    And if you have already connected TuyaMCU analyzer in a safe way (take care - device may not be isolated from mains, so if you connect it to your PC, you may cause a short, explosion and fire), please take some packets capture for later reference.

    Then proceed along tutorial. If you have any specific questions, then feel free to ask. Also if something is not clear on tutorial - just give us a specific question and we will help.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #16 21570161
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    There is some capture. Didn't have much time today to play with it.
    Device with original FW, powered from socket (through variac, I also discovered that it works if you supply it with 26V DC - connected to wires that supposed to go on 230V).
    Device was booted up and I went through most clickable things in UI (see. screenshots) in that order.
    Captured HEX
    Code: text Expand Select all Copy to clipboard
    
55AA00060008720200040000001CA155AA0006000568040001007755AA00000000FF55AA0006000568040001017855AA00060008730200040000010E9555AA00060008730200040000010E9555AA00060008730200040000010D9455AA0006000566040001007555AA0006000566040001017655AA00060008740200040000006BF255AA0006000567040001007655AA0006000567040001017755AA0006000877020004000004831155AA0006000569040001007855AA0006000569040001017955AA000600087602000400000244CF55AA000600087602000400000243CE55AA00000000FF55AA000600056B040001007A55AA00060008780200040000000A9555AA00060008780200040000000A9555AA0006000565040001007455AA0006000565040001017555AA000600050B010001011855AA000600050B010001001755AA00000000FF55AA000600050C010001011955AA000600080E020004000003E80C55AA00000000FF55AA000600050B010001011855AA00000000FF55AA00000000FF55AA00000000FF55AA000600050B010001001755AA0006000522010001012F55AA00000000FF55AA00000000FF


    I guess it didn't catch any measurements - I switched on 100W bulb as load. And I also changed voltage few times (from roughly 230V to 150V and back) - saw that in app but not in console (or maybe I'm doing something wrong) .


    A screen from an energy monitoring app showing voltage, current, and power consumption data.App screen for energy management with current, voltage, power, and temperature alarm settings.A screen of an app managing a smart energy meter with current, voltage, power, and temperature settings.App screen for managing a smart energy meter, displaying 10 kWh of remaining electricity.Smart energy app screen showing 10 kWh remaining and an electricity recharge input window.App screen for energy monitoring showing real-time voltage, current, CPU temperature and power.
  • #17 21570955
    kymlalu
    Level 10  
    Posts: 13
    Help: 3
    Rate: 3
    more i read, more i am lost and confused.

    Anyway, i flashed it and there could be that DpID 6 ? ( only powered up, no current flowing through )

    Screenshot of TuyaMCU Explorer/Analyzer software, showing decoded UART communication data in text format.

    EDIT: I did some config ( use some examples and changed it to RAW_V2C3P3 ) and it seems that reading is almost correct. It is possible to do some "calibration" to have it more precise (voltage is off by 1V and current is off by 2mA )?

    Screenshot from OpenBK7231N interface showing device voltage, current, and power readings.

    Autoexec.bat

    Code: text Expand Select all Copy to clipboard
    
// Start TuyaMCu driver
startDriver TuyaMCU
// set TuyaMCU baud rate
tuyaMcu_setBaudRate 115200
// set TuyaMCU default wifi state 0x04, which means "paired",
// because some TuyaMCU MCUs will not report all data
// unless they think they are connected to cloud
tuyaMcu_defWiFiState 4
// Measurements - Dpid 6 "phase_a" - channel RAW_V2C3P3
// TAC2121C VoltageCurrentPower Packet
// This will automatically set voltage, power and current
linkTuyaMCUOutputToChannel 6 RAW_V2C3P3
setChannelType 0 Voltage_div10
setChannelLabel 0 "Voltage"
setChannelType 1 Current_div1000
setChannelLabel 1 "Current"
setChannelType 2 Power
setChannelLabel 2 "Power"
  • #18 21576465
    casiopeia80
    Level 3  
    Posts: 15
    >>21570955 Hi! Is your module working properly?

    I'm configuring it like this:

    setChannelType 0 Voltage_div10
    setChannelLabel 0 Voltage
    setChannelType 1 Current_div1000
    setChannelLabel 1 Current
    setChannelType 2 Power
    setChannelLabel 2 Power
    In the startup command list, I add:

    startDriver TuyaMCU
    tuyaMcu_setBaudRate 115200
    tuyaMcu_defWiFiState 4
    linkTuyaMCUOutputToChannel 6 RAW_V2C3P3
    Everything starts working — I get voltage, current, and power readings.

    But after about 25 minutes, the data stops coming. I only see zero values.
    Either the MCU is waiting for something from the Tuya cloud, or I just got a faulty unit and it's a hardware issue :(
  • #19 21576478
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    When it goes silent,can you try running tuyaMcu_sendQueryState command?

    When it goes silent, what is in the web app log, are TuyaMCU heartbeats received?

    Do you have TuyaMCU queue flag enabled?

    I think I can add calibration to RAW_V2C3P3, I'll add it and let you know. So, we need three adjustable offsets - for Voltage, Current and Power?
    Helpful post? Buy me a coffee.
  • #20 21576508
    casiopeia80
    Level 3  
    Posts: 15
    p.kaczmarek2 wrote:
    When it goes silent,can you try running tuyaMcu_sendQueryState command?

    Code: text Expand Select all Copy to clipboard
    tuyaMcu_sendQueryState' Result] OK
Info:TuyaMCU:Received: 55 AA 03 03 00 00 05 
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 3 (WiFiState) len 7
Info:TuyaMCU:Received: 55 AA 03 07 00 08 01 02 00 04 00 00 00 AF C7 
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
Info:TuyaMCU:ParseState: id 1 type 2-val len 4
Info:TuyaMCU:ParseState: int32 175
Info:TuyaMCU:Received: 55 AA 03 07 00 05 0B 01 00 01 00 1B 
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
Info:TuyaMCU:ParseState: id 11 type 1-bool len 1
Info:TuyaMCU:ParseState: byte 0
Info:TuyaMCU:Received: 55 AA 03 07 00 05 65 04 00 01 00 78 
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
Info:TuyaMCU:ParseState: id 101 type 4-enum len 1
Info:TuyaMCU:ParseState: byte 0
Info:TuyaMCU:Received: 55 AA 03 07 00 05 66 04 00 01 01 7A 
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
Info:TuyaMCU:ParseState: id 102 type 4-enum len 1
Info:TuyaMCU:ParseState: byte 1
Info:TuyaMCU:Received: 55 AA 03 07 00 05 67 04 00 01 01 7B 
Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
Info:TuyaMCU:ParseState: id 103 type 4-enum len 1
Info:TuyaMCU:ParseState: byte 1


    p.kaczmarek2 wrote:
    Do you have TuyaMCU queue flag enabled?


    Yes, I have this flag set. I checked three times. The same amount of time always passes (about half an hour), and the MCU stops giving current and voltage values.
  • #21 21576526
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    So it sends more data after tuyaMcu_sendQueryState , but did it resend dpID 6? Voltage, current, etc?
    Helpful post? Buy me a coffee.
  • #22 21576531
    casiopeia80
    Level 3  
    Posts: 15
    >>21576526 Yes, after issuing tuyaMcu_sendQueryState, the MCU does send multiple dpIDs, but unfortunately dpID 6 (RAW_V2C3P3 — voltage, current, power) is not among them. Here's what I received in the log after sending the command:
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 01 02 00 04 00 00 00 AF C7
    Info:TuyaMCU:ParseState: id 1 type 2-val len 4 -> int32 175

    Spoiler:
    tuyaMcu_sendQueryState' Result] OK
    Info:TuyaMCU:Received: 55 AA 03 03 00 00 05
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 3 (WiFiState) len 7
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 01 02 00 04 00 00 00 AF C7
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 1 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 175
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 0B 01 00 01 00 1B
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 11 type 1-bool len 1
    Info:TuyaMCU:ParseState: byte 0
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 65 04 00 01 00 78
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 101 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 0
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 66 04 00 01 01 7A
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 102 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 1
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 67 04 00 01 01 7B
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 103 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 1
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 68 04 00 01 01 7C
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 104 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 1
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 69 04 00 01 00 7C
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 105 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 0
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 6B 04 00 01 01 7F
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 107 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 1
    Info:TuyaMCU:Received: 55 AA 03 07 00 05 6E 04 00 01 00 81
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 12
    Info:TuyaMCU:ParseState: id 110 type 4-enum len 1
    Info:TuyaMCU:ParseState: byte 0
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 72 02 00 04 00 00 00 32 BB
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 114 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 50
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 73 02 00 04 00 00 01 18 A3
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 115 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 280
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 74 02 00 04 00 00 00 64 EF
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 116 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 100
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 76 02 00 04 00 00 03 20 B0
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 118 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 800
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 77 02 00 04 00 00 07 D0 65
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 119 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 2000
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 78 02 00 04 00 00 00 0A 99
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 120 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 10
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 7D 02 00 04 00 00 00 AF 43
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 125 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 175
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 83 02 00 04 00 00 02 3A D6
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 131 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 570
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 20 02 00 04 00 00 13 8E D8
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 32 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 5006
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 32 02 00 04 00 00 00 46 8F
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 50 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 70
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 01 02 00 04 00 00 00 B0 C8
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 1 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 176
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 7D 02 00 04 00 00 00 B0 44
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 125 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 176
    Info:TuyaMCU:Received: 55 AA 03 07 00 08 0D 02 00 04 00 00 00 00 24
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 7 (State) len 15
    Info:TuyaMCU:ParseState: id 13 type 2-val len 4
    Info:TuyaMCU:ParseState: int32 0
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8
    Info:TuyaMCU:Received: 55 AA 03 00 00 01 01 04
    Info:TuyaMCU:ProcessIncoming[v=3]: cmd 0 (Hearbeat) len 8



    As you can see, dpID 6 is completely missing, and only other IDs like 1, 11, and 101–103 are returned. This confirms that the MCU is alive and responding, but simply stops sending measurement data after ~30 minutes, even when explicitly queried.

    This strongly suggests that the MCU is intentionally suppressing dpID 6, probably due to missing Tuya cloud handshake or timeout. I don’t believe this is a hardware fault — it seems more like Tuya MCU firmware behavior.

    Let me know if you want me to try anything else.

    Added after 34 [minutes]:

    Add some photos of the device

    Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it? Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it? Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it? Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it? Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it? Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it? Tongou TO-Q-SA1 WiFi Smart Energy Meter – Anyone tried flashing it?
  • #23 21576585
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    Try what this guy used.
    https://www.elektroda.com/rtvforum/topic3959907.html#20465272
    he has equivalent of "send query state" with some extra commands
    Helpful post? Buy me a coffee.
  • #24 21576587
    casiopeia80
    Level 3  
    Posts: 15
    I’ve noticed another thing. As I mentioned earlier, the transmission of voltage and current values stops after about 30 minutes of operation. After that, the MCU seems to “sleep” exactly for one hour. Then it sends voltage, current, and power values once, and goes back to sleep again.

    Added after 29 [minutes]:

    p.kaczmarek2 wrote:
    Try what this guy used.
    https://www.elektroda.com/rtvforum/topic3959907.html#20465272
    he has equivalent of "send query state" with some extra commands

    I didn't understand anything from that link ((
    Isn't it possible to just connect the BL0942 directly to the BK7231N and throw the 8H3K64S2 chip to hell?))
    I know how to solder.
  • #25 21576633
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    I just meant that you can try the same thing as @xury , add this to autoexec.bat and check again for few hours:
    Code: text Expand Select all Copy to clipboard
    
addRepeatingEvent 10 -1 backlog uartSendHex 55AA000300010407; uartSendHex 55AA0008000007;uartSendHex 55AA00000000FF


    I just want to know. If it fails, we'll try to connect BL0942 directly to WiFi module.
    Helpful post? Buy me a coffee.
  • #26 21576662
    casiopeia80
    Level 3  
    Posts: 15
    p.kaczmarek2 wrote:
    I just meant that you can try the same thing as @xury , add this to autoexec.bat and check again for few hours:

    I added the following commands to the startup set:

    startDriver TuyaMCU
    tuyaMcu_setBaudRate 115200
    tuyaMcu_defWiFiState 4
    linkTuyaMCUOutputToChannel 6 RAW_V2C3P3
    addRepeatingEvent 10 -1 backlog uartSendHex 55AA000300010407; uartSendHex 55AA0008000007; uartSendHex 55AA00000000FF

    Then I power-cycled the module so that the MCU would start sending data every five seconds again, instead of once per hour like it does now.
    I’ll report back the results after half an hour.

    By the way, the idea of removing the 8H3K64S2 chip still lingers in my mind. Because if I do that, won’t I get proper readings not only for current and voltage but also for the cumulative energy meter data?
  • #27 21576675
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    casiopeia80 wrote:

    By the way, the idea of removing the 8H3K64S2 chip still lingers in my mind. Because if I do that, won’t I get proper readings not only for current and voltage but also for the cumulative energy meter data?


    You can connect BL0942 directly to WiFi module via UART (RX1/TX1), make sure to put BL0942 in UART mode, check datasheet. OpenBeken has BL0942 driver, it will calculate some data like total energy usage, today energy, etc. This may work for you, however, you will need to calibrate BL0942 first by connecting a known load, like 60W bulb, to the device, measuring it with a third party, reliable meter and then use commands PowerSet, VoltageSEt, CurrentSet to set expected measurements. You can also do the same in the obk web App, tools section
    Helpful post? Buy me a coffee.
  • #28 21576703
    casiopeia80
    Level 3  
    Posts: 15
    Well, half an hour has passed, and the device stopped sending readings again. :(
    The commands addRepeatingEvent 10 -1 backlog uartSendHex 55AA000300010407; uartSendHex 55AA0008000007; uartSendHex 55AA00000000FF didn’t change anything.
    If you have any other suggestions, please let me know. I'll try to implement them. It's a pity — I really liked the device for its ease of installation and compactness.
  • #29 21576730
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14416
    Help: 650
    Rate: 12371
    There is one reliable method that can help us. You would need to be able to capture traffic between WiFi module with Tuya firmware and the MCU in a safe manner, without exploding your PC. You would need a galvanic signal isolation for that. It could be done with adum1201 . Then we would compare what Tuya firmware sends versus things send by OBK. We have a TuyaMCU Analyzer tool for that. https://github.com/openshwprojects/TuyaMCUAnalyzer

    Added after 46 [seconds]:

    To be sure - it does not stop with Tuya firmware?
    Helpful post? Buy me a coffee.
  • #30 21576755
    casiopeia80
    Level 3  
    Posts: 15
    p.kaczmarek2 wrote:
    To be sure - it does not stop with Tuya firmware?

    So, why is galvanic isolation needed? I can just use an old laptop and connect to UART1 through a USB-UART adapter. I’ll only supply 3.3V to power the chips. Yes, voltage and current readings will be zero, but the device will still be sending zeros. I’ll see it through MQTT in Grafana. I think it’s worth trying.

    As for the Tuya firmware, I only tested it for a few minutes, so that part still remains in question.
Reply | New topic
Report a violation of the law

Topic summary

✨ The Tongou TO-Q-SA1 is a compact WiFi-enabled smart energy meter based on the Tuya platform, featuring no internal relay and designed for inline monitoring. Internally, it uses an STC8H3K64S2 MCU, a Tuya WB2S WiFi module, and a BL0942 power measurement chip. The device communicates via TuyaMCU protocol at 115200 baud, with data including voltage, current, active power, energy, and temperature. Users encountered issues with the MCU ceasing to send measurement data (dpID 6) after approximately 30 minutes, likely due to the Tuya MCU firmware requiring a cloud handshake or timing out. Attempts to maintain data flow using repeated UART commands (e.g., tuyaMcu_sendQueryState and custom repeating events) were partially successful but did not fully resolve the issue. A practical solution involved physically removing the STC8 MCU and directly connecting the BL0942 chip to the BK7231N WiFi SoC via UART, enabling the use of OpenBK7231T firmware with the BL0942 driver for stable readings and calibration. Calibration was performed using a known load (60W incandescent bulb), achieving high accuracy with minimal error (~0.012% over six days). The device’s power-saving behavior and reporting intervals were discussed, with suggestions to use TuyaMCU analyzer tools and galvanic isolation for safe UART traffic capture. The BL0942 chip was noted as more reliable than alternatives like BL0937, which can have issues with MCU power-saving modes. Overall, flashing and modifying the device firmware with OpenBK7231T and bypassing the secondary MCU provided a robust method for stable, accurate energy monitoring.
Generated by the language model.
Today's popular

FAQ

TL;DR: Over 6 days, one user measured just 0.012% energy error after saying "It works fine with the chip removed." This FAQ is for TO-Q-SA1 owners who want stable OpenBeken flashing, dpID 6 decoding, and the proven hardware bypass when TuyaMCU stops live measurements after about 25–30 minutes. [#21585026]

Why it matters: The thread shows that software-only TuyaMCU integration can work briefly, but the most reliable long-term fix is a simple hardware reroute from the BL0942 metering IC directly to the Wi-Fi module.

Method Live V/I/P data Long-term stability Difficulty Notes
OpenBeken + TuyaMCU dpID 6 Yes, initially Poor Low Often stops after about 25–30 minutes
OpenBeken + repeated UART queries Sometimes Poor Medium Did not fix the timeout in the thread
STC removed, BL0942 wired direct Yes Good Medium Confirmed stable by multiple users

Key insight: The TO-Q-SA1 hardware is usable with OpenBeken, but the stock STC TuyaMCU path throttles or suppresses dpID 6 over time. Direct BL0942-to-BK7231/WB2S wiring was the only confirmed stable solution in the thread.

Quick Facts

  • Internal parts identified from teardown photos were STC8H3K64S2 as the main MCU, a CB2S/WB2S-class Tuya Wi-Fi module, and BL0942 as the power-measurement chip. [#21562880]
  • The successful TuyaMCU mapping used dpID 6 as RAW_V2C3P3, decoding an 8-byte big-endian payload into voltage, current, and active power. [#21569184]
  • Users reported that live voltage/current/power updates worked at first, then stopped after about 25–30 minutes, later dropping to roughly one update per hour. [#21576587]
  • The direct-wire BL0942 mod was calibrated with a known 60 W incandescent bulb, and one six-day comparison against a certified apartment meter showed only 0.012% difference. [#21577386]
  • The board can run from about 26 V DC on the mains-input side during bench testing, but the power supply is non-isolated, so UART capture can put lethal mains potential onto signal ground. [#21570161]

How do you flash OpenBeken on the Tongou TO-Q-SA1 and configure TuyaMCU to read voltage, current, and power from dpID 6?

Flash OpenBeken to the Tuya Wi-Fi module first, then map dpID 6 as RAW_V2C3P3. 1. Install OBK on the WB2S/CB2S-class module. 2. Start the TuyaMCU driver at 115200 baud and force Wi-Fi state 4. 3. Link dpID 6 to channels for voltage, current, and power. This worked immediately for live readings before the later timeout issue appeared. [#21570955]

What chips are inside the Tongou TO-Q-SA1, and how are the STC8H3K64S2, WB2S/CB2S Wi-Fi module, and BL0942 connected?

The TO-Q-SA1 contains an STC8H3K64S2 MCU, a Tuya CB2S/WB2S-family Wi-Fi module, and a BL0942 metering IC. The STC MCU sits between the Wi-Fi module and the BL0942, so the Wi-Fi chip does not read the metering IC directly in the stock design. Only four pads were seen on the Wi-Fi module, which strongly suggested a TuyaMCU architecture. [#21563065]

Why does the Tongou TO-Q-SA1 stop sending dpID 6 voltage/current/power data after about 25–30 minutes when running OpenBeken?

It stops because the STC-based TuyaMCU path appears to suppress or change reporting of dpID 6 after about 25–30 minutes. Users still received heartbeats and other dpIDs, but dpID 6 disappeared. One user then observed a pattern of a single measurement report about once per hour. That behavior matches the thread’s suspicion that the MCU falls back to an NB-like reporting mode or requires a cloud-side trigger OBK does not reproduce. [#21576531]

What autoexec.bat commands are needed for the Tongou TO-Q-SA1 to map dpID 6 as RAW_V2C3P3 in OpenBeken?

Use the TuyaMCU driver, set 115200 baud, force Wi-Fi state 4, and map dpID 6 to RAW_V2C3P3. A working startup set was: startDriver TuyaMCU; tuyaMcu_setBaudRate 115200; tuyaMcu_defWiFiState 4; linkTuyaMCUOutputToChannel 6 RAW_V2C3P3; then assign channel 0 as Voltage_div10, channel 1 as Current_div1000, and channel 2 as Power. That configuration produced almost-correct readings right away. [#21570955]

How can you calibrate voltage, current, and power on the Tongou TO-Q-SA1 after switching to the BL0942 driver in OpenBeken?

Calibrate it in OpenBeken against a known load and a trusted reference meter. The thread recommends a load like a 60 W bulb, then using PowerSet, VoltageSet, and CurrentSet to match the expected values. One user reported that calibration worked cleanly with a 60 W OSRAM incandescent bulb after rewiring BL0942 directly to the Wi-Fi module. [#21576675]

What is TuyaMCU, and how does it affect flashing and configuration on devices like the Tongou TO-Q-SA1?

"TuyaMCU is a secondary microcontroller architecture that handles device logic and sensors, while the Wi-Fi module mainly relays serial datapoints to Tuya or custom firmware, usually over UART." On the TO-Q-SA1, that means flashing the Wi-Fi module alone does not replace the STC meter logic. You must decode dpIDs, not just assign GPIO roles, because voltage, current, and power arrive as TuyaMCU datapoints such as dpID 6. [#21569184]

What is dpID 6 on the Tongou TO-Q-SA1, and how is its RAW_V2C3P3 payload decoded into voltage, current, and power values?

dpID 6 is the Phase A voltage, current, and active-power report. It uses an 8-byte big-endian payload: 2 bytes for voltage at 0.1 V resolution, 3 bytes for current at 0.001 A, and 3 bytes for power. The thread’s example payload decodes to 217.6 V, 1.000 A, and 10.000 kW, which matches the RAW_V2C3P3 mapping used in OpenBeken. [#21569184]

What’s the difference between using the TO-Q-SA1 through TuyaMCU and bypassing the STC MCU to connect the BL0942 directly to the BK7231/WB2S module?

TuyaMCU mode is easier to try, but direct BL0942 wiring is the stable fix. Through TuyaMCU, users got live values without board surgery, yet dpID 6 often stopped after about 30 minutes. After removing the STC8H3K64S2 and wiring BL0942 straight to the Wi-Fi module UART, users reported normal continuous operation and full OpenBeken BL0942-driver support. [#21577273]

How do you safely capture UART traffic on a non-isolated mains-powered Tuya energy meter without risking damage to your PC?

Use galvanic isolation between the meter UART and your computer. The thread specifically recommends an ADuM1201-class isolator because the TO-Q-SA1 uses a non-isolated power supply, so RX/TX can sit at live mains potential. Directly connecting a USB-UART adapter can create a live short through grounded USB and may cause fire, explosion, or equipment damage. [#21576730]

Why do current readings become negative on the Tongou TO-Q-SA1 when the meter is installed in the opposite direction?

They go negative because the meter senses energy flow direction. After the BL0942 direct-wire mod, a user confirmed that reversing installation direction made current readings negative. Another expert replied that this is not a bug but a useful feature for photovoltaic systems, where reverse energy flow matters. [#21577379]

Which TuyaMCU commands or periodic UART queries can be tried to keep the TO-Q-SA1 reporting measurements instead of falling back to hourly updates?

Try tuyaMcu_sendQueryState and, if needed, periodic raw UART queries. The thread also tested this repeating command every 10 seconds: backlog uartSendHex 55AA000300010407; uartSendHex 55AA0008000007; uartSendHex 55AA00000000FF. It did not restore stable dpID 6 reporting on this device, but it is the main workaround explored before the hardware bypass. [#21576633]

How do OpenBeken and Tasmota differ when dealing with a TuyaMCU-based energy meter like the Tongou TO-Q-SA1?

OpenBeken handled this device better in the thread because it supports TuyaMCU dpID mapping and custom autoexec scripts. Tasmota was described as less straightforward here because the STC MCU hides the real metering path, so standard module dropdown configuration is not enough. OpenBeken users could map dpID 6 as RAW_V2C3P3 and later switch to the native BL0942 driver after hardware rewiring. [#21569073]

What is the purpose of the BL0942 energy metering chip, and why might it be more reliable than BL0937 for OpenBeken-based power monitoring?

"BL0942 is an energy-metering IC that measures voltage, current, power, and accumulated energy, using a direct serial interface that OpenBeken can read without GPIO pulse counting." In the thread, experts said BL0942 is generally more reliable than BL0937 and less prone to odd readings tied to MCU sleep behavior. That made BL0942 a strong candidate for direct wiring after the STC MCU was removed. [#21577830]

How accurate is the Tongou TO-Q-SA1 after the STC MCU is removed and the BL0942 is calibrated with a known load?

It was very accurate in the thread. After calibration with a 60 W incandescent bulb, one user compared the device against a certified apartment meter for 6 days and found only 0.012% difference in total energy. That is the strongest real-world accuracy data reported for the direct BL0942 setup. [#21585026]

What’s the best way to modify the Tongou TO-Q-SA1 hardware to remove the STC8H3K64S2 and wire the BL0942 directly to the Wi-Fi module for stable operation?

Remove the STC8H3K64S2, then jumper the BL0942 UART directly to the Wi-Fi module UART and enable the BL0942 driver in OpenBeken. One user said, “Nothing else needed to be done,” beyond the rewiring and driver selection. Multiple later posts confirmed that this direct-connect mod fixed the 25–30 minute dropout and stayed stable. [#21734387]
Generated by the language model.
ADVERTISEMENT