logo elektroda
logo elektroda
X
logo elektroda

Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

vklimk 78 0
ADVERTISEMENT
  • #1 21924301
    vklimk
    Level 1  
    Posts: 1
    I purchased a smart socket a couple years ago and use it to automatically switch off my Electric Unicycle charger when power consumption is very small for specific period of time. Just for safety reason – if charger consumes less than 7 Watts during the recent 15 minutes then I suppose than my EUC is charged and I want to cut power, just in case. The smart socket works with Yandex Smart Home.
    It was a cheap socket with “ATMT” brand and no model code on it. The only information is the following:
    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

    And one day it stopped working and did not react on button press.
    I disassembled it and found out that it runs on BKN7231N MCU (CB2S module) and has BL0937 chip for power metering. 5V power supply is made on kp15051sp.
    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button responseTeardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button responseTeardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button responseTeardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

    Then I checked capacitors, 5V and 3,3V power supplies – they are OK. So, main suspect is MCU.
    Then I soldered power (directly to 5V capacitor) and UART (at CB2S pins) wires and connected them to USB-TTL adapter (switched to 3,3V level mode via jumper). (More details on CB2S and USB-TTL connection and MCU flashing can be found in topic https://www.elektroda.com/rtvforum/topic4087228.html )

    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

    And tried to dump flash with BK7231GUIFlashTool and ltchiptool. Both tools failed with CRC errors. I have found that CRC errors happened for the first 0x100 bytes only – so, bootloader was corrupted. Then I connected to UART2 pins on CB2S module and saw in terminal that boot started but then freezed in some seconds.
    So, flash was faulty, but I still had a chance to re-write faulty page in hope that it will recover.
    I verified that my smart socket has the same bootloader as OpenBeken - the first 64k bytes of OpenBK7231N_QIO and the first 64k bytes of my smart socket's dump were the same excluding those faulty bytes in the beginning. So, I have cut the first 4096 bytes from OpenBK7231N_QIO_1.18.288.bin file into a separate file and write it into BK7231N at 0x0 offset using Custom Write functionality.

    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

    And it helped, the socket booted and worked correctly!
    But I wanted to try OpenBeken itself. So, I have written it to my socket. Then I applied config from original dump, set WiFi SSID and password. And wrote OBK config.
    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button responseTeardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

    I dind't use the following information since everything has configured automatically. But let it be here:
    Spoiler:
    Device configuration, as extracted from Tuya:
    - BL0937 SEL on P26
    - Button (channel 1) on P24
    - BL0937 VI (CF1) on P7
    - WiFi LED on P23
    - BL0937 ELE (CF) on P6
    - Relay (channel 1) on P8
    Device seems to be using CB2S module, which is using BK7231N.
    Device internal platform - bk7231n, equals BK7231N.
    And the Tuya section starts, as usual, at 2023424 (0x1EE000)
    It has converted to the following configuration after socket reboot:

    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response



    Rebooted the socket, and opened its web-page in web-browser to check that power metering works fine – Power, Voltage and Amperage values shown in web-app were correct (compared with another power metering device) – so, no calibration was required.
    Then created the following autoexec.bat to implement required functionality (if power consumption is less than 7 Watts during the recent 15 minutes then turn power off):
    startDriver NTP
    
    ntp_timeZoneOfs 3
    ntp_setServer 10.0.0.1
    
    SetupEnergyStats 1 90 180
    
    [inContentAd]
    
    # channel 1  - relay
    # channel 8  - min Power check control, on/off
    # channel 10 - min Power, W
    # channel 12 - period, min
    # channel 14 - counter
    
    SetChannelLabel 1 "Power"
    
    SetChannelType 8 Toggle
    SetChannelLabel 8 "Min power check"
    SetChannel 8 1
    
    SetChannelType 10 ReadOnly
    SetChannelLabel 10 "Min power, Watts"
    SetChannel 10 7
    
    SetChannelType 12 ReadOnly
    SetChannelLabel 12 "Min power, minutes"
    SetChannel 12 15
    
    SetChannelType 14 TimerSeconds
    SetChannelLabel 14 "Min power timer"
    SetChannelPrivate 14 true
    
    alias reset_counter SetChannel 14 0
    alias tick_counter AddChannel 14 1
    alias start_counter addRepeatingEventID 1 -1 1 if $power<$CH10 then check_minpower else reset_counter
    alias stop_counter backlog reset_counter; cancelRepeatingEvent 1
    
    alias check_minpower backlog tick_counter; if $CH14>=$CH12*60 then power off
    
    AddChangeHandler Channel1 == 0 stop_counter
    AddChangeHandler Channel1 != 0 if $CH8!=0 then start_counter
    
    AddChangeHandler Channel8 == 0 stop_counter
    AddChangeHandler Channel8 != 0 if $CH1!=0 then start_counter
    
    if $CH1!=0 then start_counter


    Everything works as I want!

    Teardown and How to recover ATMT BK7231N CB2S smart socket with BL0937 - no button response

    JSON template from Web Application main tab :
    Code: JSON
    Log in, to see the code
  • ADVERTISEMENT
ADVERTISEMENT