[T34/BL0937] Teardown Generic Wifi Smart Plug with Energy Measurement

Name: [T34/BL0937] Teardown Generic Wifi Smart Plug with Energy Measurement
Uploaded: 2024-03-15T16:43:55+01:00
Description: I ordered some more cheap Smart Sockets / Smart Plugs from a big chinese online warehouse. The box with a badly copied label. The plug itself has label or so. Then i got my good old Tamron Macro lens and took some pictures of the internals. Better lighting on the interesting chips: And the...

Question

I ordered some more cheap Smart Sockets / Smart Plugs from a big chinese online warehouse. The box with a badly copied label. The plug itself has label or so. Then i got my good old Tamron Macro lens and took some pictures of the internals. Better lighting on the interesting chips: And the...

Raufaser · Accepted Answer

I just flashed the second T34 smart plug I got from Aliexpress. This time I did it like recommended before. Nice username by the way Please add the device to the list: Code: text Expand Select all Copy to clipboard{   vendor: QNCX,   bDetailed: 0,   name: Generic Smart Plug with Energy Measurement (T34),   model: T34 Smart Plug,   chip: BK7231N,   board: T34,   flags: 1024,   keywords: [     power metering,,,     smart plug,     bl0937   ],   pins: {     6: BL0937CF;0,     7: BL0937CF1;0,     8: BL0937SEL;0,     24: Rel;0,     26: Btn;0,     28: WifiLED;0   },   command: ,   image:    wiki:  }

p.kaczmarek2 · Answer

This indeed looks like somewhat problematic. Are TX1/RX1 routed out anywhere, maybe to a button or a LED? If not, in the worst case scenario, you can desolder T34 itself and use approach from this topic: Hm, I did a brief analysis myself, it seems that only one of UART lines is broken out. You need some flux and some precise soldering.

Raufaser · Answer

At first i tried to solder the wires to the T34 as it was still soldered to the board. It didn't work.Then i desoldered the T34 from the board using my rework station. I soldered the wires directly to the pads on the bottom of the T34. Unfortunately i seem to have too much leverage when i was connecting the cables to the UART-USB converter and the pad 25 fell off the T34. So RIP my T34 XDI would try to avoid these kind of plugs. Much harder to work with than the user variants. I will try to get these probe tips for the next time.This is the item i bought. Maybe it helps someone to avoid it. Or if he is seeking for adventure, to get exactly this one.

p.kaczmarek2 · Answer

The problem is it looks like a classic LSPA9 device, already described in several versions on our forum. I already had ESP8266-based LSPA9s, WB2S and CB2S based ones. So it's hard to tell from the outside which version you'll get.

rufus4 · Answer

Today I received three smart plugs like the ones here in the pictures from @Raufaser.I did try to solder the critical RXD wire directly to the microprocessor and had luck. TXD was easy because of the missing resistance and 3V3 / GND are as well easy to solder. CEN is not needed.After a few times trying to backup the original FW always ending in errors I did flash the T34 with newest OpenBeken. For sure I must have done something wrong with the backup process, but so far everything else works well.Now I do have to find the right pins and make things working again.Before messing everything up I did measure the power consumption of the device with the Tuya FW. And was surprised about efficiency: 2.5-5mA relay off and 6.5-8.5 relay on There must be something wrong about measuring after my isolating-transformator. Measured again and now it's 5-7mA relay off and 11-15mA relay on.And it seems that they set a power save mode even with the BL0937. Is there something special to know for backing up original FW? So I can try with the other two devices. (I only did experiment with different baud rates, but this was not the problem.)

rufus4 · Answer

--updated-- Pin setting is quiet tricky because T34 and BK7231N have completely different pinouts. (pin numbers are different) So far I found these pins working: Code: text Expand Select all Copy to clipboard {   vendor: Tuya,   bDetailed: 0,   name: Full Device Name Here,   model: enter short model name here,   chip: BK7231N,   board: TODO,   flags: 1024,   keywords: [     TODO,     TODO,     TODO   ],   pins: {     6: BL0937CF;0,     7: BL0937CF1;0,     8: BL0937SEL;0,     24: Rel;0,     26: Btn;0,     28: WifiLED;0   },   command: ,   image:    wiki:  } Added after 4 [hours] 6 [minutes]: optional startup command text: Code: text Expand Select all Copy to clipboardbacklog startDriver NTP; ntp_setServer 192.168.1.1; ntp_timeZoneOfs +1; PowerSave 1 optional autoexec.bat: Code: text Expand Select all Copy to clipboard startDriver NTP ntp_setServer 192.168.1.1 ntp_timeZoneOfs +1 PowerSave 1 Additional setting: -remember relay channel state -1 at startup Maybe there are still some optimizations missing. But like this, everything works perfect. And once more mesured amps now whith all services working: 8mA and 16mA with relay on. (PowerSave 0) PowerSave 1 works after some minutes. 6-8mA and 11-15mA with relay on (mesured with clamp ammeter) and even less without open GUI in browser it is 4-6mA and 9-13mA. Power consumption looks the same like with original FW and is very efficient. Now I did magage to backup the original Tuya FW: readResult...-57-17.bin (2 MB)You must be logged in to download this attachment.

Mickaelf · Answer

hi, thank you for the work, you were faster than me, in your configuration you put 28: LED_n;0 but this pin is that of the wifi led replaced by 28: WifiLED_n;0 and you have the two LEDs that work, I just tested.

rufus4 · Answer

thank you! So I updated my config. Another thing: setting PowerSave 1 doesn't make any difference. But in general it should work with BK7231N? Is this right? PowerSave 1 works after some minutes. 6-8mA and 11-15mA with relay on (mesured with clamp ammeter) Power consumption looks the same like with original FW.

p.kaczmarek2 · Answer

Yes, PowerSave is a bit tricky. It works, but it's easy to disturb it by, for example, having the Web App Log open. Well, maybe even having the main native page open can disturb power save more or less, that's because the native main http page is also often refreshing the state of the device thus preventing it from sleeping.

rufus4 · Answer

That is truth. Leaving the device overnight without active GUI, power dropped much more. Now I can measure 4-6mA and 9-13mA with relay on with my clamp ammeter. But like I said before, there would be an oscilloscope needed for accurate measuring power consumption. Finally I added a DHT22 and do start to really love it, even with the T34.

p.kaczmarek2 · Answer

I am glad to hear it's working. It is also worth to mention that PowerSave is implemened on the most of our supported platforms (well, maybe except LN882H, currently). For example, here is a PowerSave test on WinnerMicro chip:

Raufaser · Answer

Yesterday I thought: Hold my beer, while I try to unrip my T34You can see the ripped off pad No. 26 (which is TXD) Under the microscope, I could see, that there is a tiny trace under the coating going to a slightly bigger trace very close to pad No. 24. So i took a very fine needle and started to scrape off the coating. I was able to get to the underlying trace without damaging it. Soldering something to it didn't work. Everything fell off. So: It worked I was even able to dump the firmware. And then I flashed OpenBeken readResult...-03-06.zip (1.04 MB)You must be logged in to download this attachment.To establish a connection, I had to solder the chip back in place. I have never soldered QFN before. But even that i managed to do.The energy measurement isn't working.At first I was wondering why, then i discovered, that is somehow yeeted a cap of the PCB. You can see that there is a cap missing on my pic of the main PCB on the far right side. I will just take a similar plug and measure what cap is used at this place. I will find a replacement.Another thing is, that the Wifi reception is really really bad. I seems, like the antenne is not connected at all. But the solder joint seems to be ok. I am wondering if that can have something to do with the not connected pad 26 ... The trace from this pad is connected to antenna ground via a 10k resistor. Maybe someone has in idea?So for me that is an absolute success. Even when i can only use the plug right next to my access point

Raufaser · Answer

Obviously not that easy to measure capacitance in place. Does someone have an idea what this can be? It is a cap right? But what value? ...The part above that cap is an AMS1117 3,3V voltage regulator. And the missing cap has something to do with its input.

rufus4 · Answer

Nice one! You didn't give up. :)Yes, the marked SMD is a cap. Unluckily I glued my LSPA9 together already. So I can't measure the size atm.But I'm not sure if size does matter much.About the resistance from TX. My PCB version does not have this resistor at all.And another resistance on the line between pin 16 and pin 17 is missing as well.Added after 7 [minutes]:It's not a good picture but here we can see little differences:Added after 13 [minutes]:Managed to open the plug again without damaging it.I measured 9.5uF at the cap without desoldering. Don't know if this is reliable.Added after 9 [minutes]:I do like these little contact-clamps you have. They seem to be very useful.One thought about your wifi problems. Antenna is connected to pin 2 only when you check the schematics design from T34.

p.kaczmarek2 · Answer

The capacitor value at AMS117-3.3V is not critical. It seems to be usually 10uF. You can check out application schematics of AMS1117 for more info.

Raufaser · Answer

No success yet. I soldered a 5uF cap in place. I salvaged that from somewhere else.These are my pin settings: I noticed something very strange wifi-related. When I bring my plug to emergency mode and scan for wifi networks I get this:I reworked all pins with flux and solder. The joints look OK...Added after 1 [hours] 12 [minutes]: Success I replaced the 5uF with a 10uF!Wifi is still &!&$

rufus4 · Answer

Did you try already clear all and reflash with the BK7231flasher?

Raufaser · Answer

Wouldn't i have to rewire everything? No way

rufus4 · Answer

There you go!

p.kaczmarek2 · Answer

Clear All and Restore RF partition are not recommended. The default RF partition (factory settings) are the best. Does your MAC end with 00 00 00 ? That could indicate that you actually already broke your RF and lost factory calibration.

Raufaser · Answer

Nope. It ends in AC:DD ... Added after 1 [hours] 19 [minutes]:Hey guys! Big success 👍 I reworked the T34 again completely. Took it off, cleaned the pads and everything (actually twice) and soldered in back in place using hot air. At the end i applied a little bit of pleasure on top. Now wifi works beautifully. And even the blinking LED when it is trying to connect to Wifi as well. I didn't even know the device had 2 LEDs And as cherry on top, today another T34 plug arrived from Aliexpress 🤣

p.kaczmarek2 · Answer

So it was hardware issue? At least you didn't clear RF, because if you were to do that, then you'd actually make situation even worse. Hmm so T34 are getting popular?

aliexpress · Answer

I just wanted to mention that I also received this very same T34 type Smart Plug.My strategy to get the device flashed:- keep the T34 on the PCB- use enameled copper wire to attach on the device side (Kupferlackdraht in German), I had one with 0.25 mm diameter. The advantage is that this wire is very thin and can fit better to pins of ICs. It also is light and quite flexible - when you move it, it does not provide high forces to the IC pins, so less chance of breaking them off, or stripping off the copper layer of the PCB. Disadvantage: To get the insulation layer off to be able to apply solder is sometimes a bit of a challenge. Then I used ordinary cables to extend these thin wires to attach to PSU and to Serial converter.- For P25, I soldered directly to IC pin.- For P26, I used the connection at the resistor- 3.3V and GND I attached directly to Pins 1 and 2 of AMS1117For flashing, I had to power cycle for like 5 times or so until the serial connection was established.The dump of original firmware did not contain Tuya keys, according to flasher tool. The socket was Tuya activated before.

p.kaczmarek2 · Answer

Sure, I have added this device: I also added LSPA9 mention because it looks like yet another LSPA9 version from the outside. However, I am not sure, should we treat T34 as a board or as a chip?

rufus4 · Answer

From the sight of an OBK-user T34 is more like an entire board. All components which are used on a board are integrated the same as on an entire board. On the other side physically it is a unique chip. So why not handling it as it is in real. I would go for T34 as a chip. Would there be any difference between this two options for dealing with it on OBK?

Raufaser · Answer

I would go for T34 as a board. On the Tuya developer site, it is handled as a module. Same as for example CB2S.

p.kaczmarek2 · Answer

I think I can agree with that. So T34 will be treated as board and chip will stay as BK7231N.

donotos · Answer

Hey.I just finished flashing my own so thanks for the help provided here.I wasn't able to flash by powering the T34 with the UART. Every time I disconnected 3v3 it disconnected from USB and killed the flasher app so I had to use an external PSU.BTW: inverting polarity did not kill the T34!I had some troubles wiring the chip so here is a small schematic:

p.kaczmarek2 · Answer

Did you invert 3.3V polarity on T34 alone or on the whole smart device board?

[T34/BL0937] Teardown Generic Wifi Smart Plug with Energy Measurement

Best answers

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary