[T34 ] Teardown & Flashing Guide for Aoyan Tuya Smart Plug (EU)

Hi all,

I want to share a teardown and flash experience for a device I couldn't find in the database so far. It's a single on/off power socket WiFi switch with power monitoring feature.

Tuya Smart Plug (EU)
Manufacturer: Aoyan
Chip: T34 (same setting as BK7231N)
Connection: WiFi

bought here: https://de.aliexpress.com/item/1005006777059625.html





After usual disassembly for this device type (best working with a pipe wrench on all 4 corners at the top), I was quite surprised to find a different PCB layout without separate module - just a T34 chip without any test solder points and antenna integrated in the mainboard - note that on the following photo, the T34 chip has already been removed, it sits where the 4 big ground pads are located:





I found some useful information about the chip and how to deal with it here: https://www.elektroda.com/rtvforum/topic4036975.html
- so I did following steps:
1. desoldering the chip with hot air
2. tracing back possible solder points for GND, 3V3, TX & RX
3. either flashing the chip desoldered and then put it back or, soldering it back first and then flashing
4. setting up OpenBK firmware

I share some photos of the important places:



The tracing back resulted in following finding: all points can be easly accessed via connected BL0942 chip (I assume power monitoring chip):



By connecting 4 wires to the mentioned points (I chose 3 pins at BL0942 chip and 1 convenient big pad for GND) and flashing with OpenBK Flasher (setting to BK7231N), the flashing can be done without need to desolder. I have 4 devices of the same kind, so I used one for analysis and flashed the 3 other ones without any desoldering, very easy. CEN is not necessary, just interrupt 3V3 in the process to reset and start flashing.



Last step is finding the pinout - I used OpenBK Web application and found following settings:

P14 - Rel [Channel 1]
P24 - WifiLED
P26 - Btn [Channel 1]

Comment: The LED on P24 is blue and is optional if required for WiFi connection. There is a red LED as well that is linked to the relay on P14, so this one will automatically switch on and off with the relay.

EDIT: to enable power monitoring, add 'startDriver BL0942' either to autoexec.bat or startup commands. My autoexec.bat is as follows:


I also recommend to set following flags: 2; 10; 25; 38; 40

Here I also attach the read result.


Hope that this device can be added to the database and hopefully it helps others who bought the same device. Cheers =)

auntlydia wrote:

If someone wants to give some guidance or experience on how to assign the BL0942 power monitoring correctly, welcome!

Have you got 'startDriver BL0942' running in your startup command or autoexec.bat?

Nice! That was easy! Thanks a lot. It's working perfectly now. I didn't know that enabling the driver is enough and there was no need to assign any pins like some other of my switches have with the BL0937.

I get all important data for energy monitoring in Home Assistant, very useful indeed.

Good morning everyone,
I would ask you to clarify "CEN is not necessary, just interrupt 3V3 during the reset process and start flashing.". Should CEN be in low state before starting flashing (to GND) or high state and interrupt during startup? On the ESP8266 you should specify a high state before programming if I remember correctly. The T34 datasheet note is modest about CEN. My purchased socket design differs slightly, RX, TX hang in the air but are on the edge, TX leads to the inactive pad. BL0937 is controlled by other pins.

Greetings
.
.
.

>>21409603 Hi, I just flashed few of those T34 devices with green board (just assuming they are same or similar) and it worked as described earlier and in other post about T34 teardown; I connected one 3v3 to BL0937, GND to big relay pin, and TX/RX directly to the chip on the top right corner. With interrupting 3v3 before flashing it worked with every device, so CEN is really not necessary and it seems not connected to the board circuits.

You may check this guide:
https://www.elektroda.com/rtvforum/topic4042412.html#21044837
it looks like your device or similar one.

Hello,
Actually, just unplugging the ground and plugging it in makes the flasher snap. I had a bit of trouble with the RX, TX pins, I wanted to solder them on molybdenum wire, but they didn't want to catch the tin too much, so ended up with thin copper wires from some braided wire. Now I'm still templating QNCX/bl0937/6, 7, 8, 24, 26, 28, and I'll see if it starts.

QNCX profile with pins

Hello,
However, there is a problem, but not on the socket, but on the LED controller chip LF686C20. The symptom is that the web interface stops responding after about a minute. The chip pings, I can see by the serial that MQTT is transmitting. Admittedly it is not set, but this is a sign that the chip is working. The chip is loaded with openbl602_1.17.822.The story is developmental, as I previously had a driver on bl602l10 (LED driver) and it behaved similarly, I assumed it was broken. It was only with this one on an LF686C20 with identical symptoms that I leaned towards them. I should add that I have two other bl602l20's (1.17.822 2 days, 1.17.601 198 days) and they work stably. Anyone perhaps encountered a similar symptom? I have a snapshot of the serial from startup, however there is nothing suspicious there, particularly when the chip is rejetting.

.

Hello,
I've bought my socket on AliExpress under the name Girier, Model JR-PM10. Looks the same as the images in the original post, only in green color.
But connected in the same way doesn't work for me. I have to change the ground and solder it to the BL0942 chip. And it works perfectly!
Thanks, author of the post!

>>21702688 Thanks for your post. Stangely enough, I had the same issue when I flashed it recently and it seems that the ground connection point that I originally suggested in the above photos doesn't work, and it worked for me when soldering it directly to the BL0942 chip as well. So thanks for updating the post, please everyone who has this device, try the direct points of the chip if you face issues, and it should work.

I got this a couple days ago. It's the same. Well - almost the same. It seems to me, they don't connect RX and TX to power chip any more and I can't see if it is BL0942 or BL0937


Edit: Zooming large enough does give it BL0937.

Here you have one more version of this device:



the chinese have made it impossible to connect RX/TX nicely, but as you can see, my good ol' Dremel made some magic to expose those pads.

Here is my flashing rig:



and I took backup first. I try to attach it here too:

>>21741840 Yea, I came across another model that was aforementioned in another post about T34 sockets that didn't have the RX pin traced to anywhere - for me, it worked with gentle soldering of a very thin wire to the excess solder of the chip's bottom pads. One shall be lucky to receive a socket that exposes pins or pads directly.



Really awesome to know the trick with the Dremel! I wouldn't have thought of that, and in some cases it might be a good alternative to desoldering the whole chip. If I ever come across a tricky one, I will try it out. Thanks for sharing this!

Hello, I have exactly the same board as in the 1st post with a BL0942.
I could read the config and flash version 1.18.245 for BK7231N.
The Tuya config I could read out looks like this:

This is my autoexec.bat: "backlog startDriver NTP; ntp_setServer 192.53.103.108; ntp_timeZoneOfs 1"
And my main screen looks like this:

But when I try to calibrate the BL0942 I see these errors in the log:


A 200 W resistive load (PF = 1) is connected and the relay is ON.

What can it be?

Do I have to set something for P10 & P11 (RX/TX) to get the communication with the BL0942?
Besides, I have read here that there are no settings for BL0942 needed in the module configuration.

EDIT: I found this in the log after restart:


Does it mean that it can communicate with the BL0942 ?
The problem is that I can't access the pins below the T34 to verify the RX/TX lines.
I have soldered the cables for flashing to the BL0942 - I hope I have not killed the BL0942 while soldering.

>>21741840 Dear, thanks for sharing your flashing method. I was initially upset when I found out I had the same boards, but I had no choice—desoldering would have taken significantly longer—so I decided to try your method. And it worked. I used a stone bit on my Dremel, so I was able to cut out the part where the UART contacts are. Incidentally, inside the chip, there's a copper layer of GND above them, and by drilling through it, you can access the TX and RX pins. I tinned them without any problem and soldered one tip of each small wire to them, which allowed me to flash the firmware.

>>21741840
Thanks for the post. I quite easily flashed a couple of Tuya Smart plugs from QNCX as described here https://www.elektroda.com/rtvforum/topic4166348.html, but now I have received a new device which is a variant that doesn't expose the pins anymore to the sides, but has the plastic covering all pins. I hope I will succeed with the dremel trick.

I recently ordered some more plugs and received the revision with T34 and no accessible pads, like @Tilator posted here before. Because of some bad experiences on another chip and board with my dremel tool, I decided to give up on this method and desolder the chip with hot air. But this doesn't always work out for me either, I had some attempts that ended up with dead chips for different reasons, probably they are a bit fragile too and a lot of things can go wrong in that process. Luckily, I was able to use a donor module (I believe it was CBU with BK7231N), and in order to wire it up, I had do do some tracing to find spots that are a bit more convenient to reach for soldering, but of course the chip's pads would have worked too, they are just so very tiny. So I'd like to share the photos of this board's revision and the spots that I chose.




After all, I was able to rescue this plug and it runs perfectly well with the donor module now =)

>>21741840
I did manage to get access to the pins with a Dremel and after a few soldering attempts I managed to successfully flash OpenBeken.
Alas, I can't find the correct pin definitions.
My device has a blue Wi-Fi LED and a red relay LED, and the settings which I did use for my earlier sockets do not work.
The settings from 21388711 for the relay, LED, and button did work, but I can't find the correct setting for the BL0937 chip.

>>21870421 you can see in my photo the pinout:
P6 - BL0937CF
P7 - BL0937CF1
P8 - BL0937SEL
if your board revision is the same as mine, these settings should work.

>>21870430
In your picture I see a BL0942 and my chip is a BL0937, but your settings did work. Thanks a lot.

>>21870720 there are different revisions of boards with T34 onboard, some with blue PCB, some with green PCB, some have BL0937 and some have BL0942. In my previous reply, I had included some photos of a blue board version with desoldered chip and marked traces, three of the markings say "BL0937.." Please check posts and pictures carefully, it can be confusing Happy if I was able to help.