Avatar Controls Smart Plug - Cutting the Cloud

Initially I thought that I would be able to reflash the Avatar Controls smart plug that I had repaired with Tasmota using tuyaconvert. But they only work with Espressif ESP32 based boards and once I had access to the internals I found that the microcontroller was a Beken BK7321TQN32 module.

Beken BK7231T sub board

Packed into this tiny 15x20 mm board (marked WB3) is a 32-bit CPU with 2 MB of flash ROM and both Wi-Fi and Bluetooth LE wireless connectivity. Which is all well and good, but how do I get access to and change the firmware of this SoC?

The first decision to make was - which open source firmware system to use on the reflashed device? Broadly speaking there appearred to be two main options, the previously mentioned Tasmota and ESPHome (there are other OS projects, eg EspEasy or ESPurna, but they seem to be somewhat deprecated). Tasmota is based on the MQTT protocol, which is a venerable and widely used communication protocol that should work with any home automation system. ESPHome is a newer project and tailored to integrate with Home Assistant. As I am planning on using the latter, ESPHome seemed the more reasonable choice (though I freely admit that this choice wasn't based on any deep understanding of their relative merits).

The next decision was - how to get the new firmware onto the chip? There is a no soldering option for reflashing Beken chips using tuya-cloudcutter, which uses an over-the-air exploit that has since been patched by Tuya. However the plug was probably old enough that it might have not been patched. The second option required a small amount of soldering - which I was not adverse to - and the use of a USB-to-TTL adapter, but had the advantage of being certain that it would work. However, depending on where the soldering points were this could get a little awkward.

Much rummaging later I couldn't find a Raspberry Pi (the OTA exploit is injected via a networked Raspberry Pi). But after taking another look at the access for soldering (I would have needed to unsolder the whole Beken board) I bit the bullet and ordered a second-hand Pi 4B from eBay along with a case, a 64 GB micro-SD card and a HMDI-to-micro HDMI cable (ouch!).

The instructions from Digiblur's site are given at pace with limited explanation but I found that I could follow them for most of the journey (appended below are some notes on the process). The Avatar plug wasn't on the list of known Manufacturer/Device names so I had to install the Tuya app on a smartphone (fortunately you can use it as a guest) to get the firmware information, which was v1.0.8 for both main and MCU modules. Armed with this info I went down the list of BK7231T 1.0.8 versions until one stuck - 1.0.8 - BK7231T / oem_bk7231s_rnd_switch. Then opened ltchiptool to get details of the active pins on the device, which gave;

I: UPK: Found BK7231T config!

I: UPK: Switch/plug config

I: UPK: - relay 1: pin P7

I: UPK: - button 1: pin P8

I: UPK: Status LED: pin P1,inverted True

So, one relay, one button and one LED. Ltchiptool will output a starter YAML file that will allow for basic control of the device.

Setting up ESPHome as an Add-on to Home Assistant was straightforward but I did have a hiccough on selecting the device type as, for BK72xx boards, there were two options, WB3S and WB3L. I couldn’t see any easy way of identifying which board I had (it was only marked as WB3). So I had to compare the pinouts for the two chips on LibreTiny and make an educated guess based on the proximity of the SCK and CEN attachment points and plumped for WB3L. I did have to combine the ESPHome and ltchiptool YAML into a single piece of code in order to get it to work (with a bit of assistance from Gemini on correct formatting of the YAML output). But work it did, in the end.

JOB DONE

Time: 1 day (combined over several)

Cost: ~£0.50 materials (£73.96 tools - an investment)

Digiblur - How To Guide - Tuya CloudCutter with ESPHome LibreTiny - No soldering

Step 1 - Building the Raspberry Pi Image

Rather than use a standard Raspberry Pi OS distro the protocol uses a headless Lite version that is stripped down and accessed remotely via SSH. I have no idea whether you could just use the standard Desktop Raspberry Pi OS but I'm guessing that you probably could. However in the absence of any real understanding I just followed the instructions…

The command line instructions are:-

• sudo raspi-config - opens the system settings menu to reset the country localisation

• sudo apt update && sudo apt install network-manager - updates the Pi with a list of relevant upgrades and installs the most recent NetworkManager package to manage local network connections

• sudo nano /etc/dhcpcd.conf alterations - tells your Raspberry Pi to stop managing the wireless network interface, giving the system a static IP address

• sudo nano /etc/NetworkManager/NetworkManager.conf alterations - opens the config file for NetworkManager and takes control of the systems network interfaces

Once rebooted Docker is installed, which is a "container" that tuya-cloudcutter will run in (basically a way to ensure that a program will run on all hardware environments).

Step 2 - Install / Update Tuya-CloudCutter

Set up tuya-cloudcutter for use.

The command line instructions are:-

• sudo apt install git - installs Git, which is a versioning software, but will also allow automatic downloading and installation of tuya-cloudcutter from a repository such as GitHub

• git clone https://github.com/tuya-cloudcutter/tuya-cloudcutter - downloads and installs tuya-cloudcutter

Step 3 - Install ESPHome Kickstarter firmware on the Device

Once tuya-cloudcutter is running it will need to know the current firmware version on the device to be cut. I located this via the Tuya app and stepped through the choices for my firmware and Beken chip versions until one stuck. Once tuya-cloudcutter has done its thing, you should see the reflashed device as an open network with the SSID of kickstart-bk7231. Connecting to it and opening the 192.168.4.1 address in a browser will pop up the device control page where you can give it the details of your network for it to connect. Once on your network you will be able to see its local IP number.

Step 4 - LT Chip Tool to configure the device

The next step is to install ltchiptool, which will interrogate the chip and give you a description of which pins are connected to output devices. It will also supply a basic YAML file for the device.

Step 5 - Install ESPHome Add-On or Docker Container

This will allow the move from the basic kickstart firmware to ESPHome firmware. As I am running Home Assistant adding ESPHome as an Add-on was the simplest option for me.

Step 6 - Install ESPHome Firmware and Integrate into Home Assistant

At this point things drifted a little from the protocol. Once the kickstart device is located, you can generate an .uf2 file with the ESPHome firmware and use the device's control page to upload it. After some time the device will reappear in Home Assitant with the new name you have given it. For me the process didn't result in a opportunity to include the YAML file supplied by ltchiptool, but with a bit of judicious copy and paste I could include it from the ESPHome Add-on by editing the device's YAML file there and installing it via the Add-on.

The end point of the protocol should be a reflashed device with basic control over its functions via a page on the Device & services Settings page of Home Assistant.

Avatar Controls Smart Plug - Into the Belly of the Beast

Having convinced myself that the smart plug was not working, it was time for a look inside.

But before that, an external inspection found no obvious charring or melted plastic that might have implied some sort of catastrophic failure.

Avatar Controls AWP14H 10 A UK Smart Plug

On the back of the device were manufacturer and model details and some basic electrical performance data (220-240 V input voltage and 2.3 kW / 10 A resistive load). There was also an IEC 60417 - 5016 symbol for a fuse described as a T10AL240V - which is a T[timed(slow blow)]10A[10 amps]L[low overcurrent rating]240V[mains voltage]. So somewhere inside is a 10 A fuse, which appeared to be a reasonable place to start.

The initial hurdle, then, was to open the case. A job easier said than done, as it is designed not to come apart for obvious reasons. Bigclivedotcom has published a video showing a fix for a similar plug in which he says that the cases are glued or possibly ultrasonically welded [timestamp 12:19]. Some vigorous poking with a blade and jeweller's screwdriver didn't make much progress. But a second YouTuber came up trumps; a bit of asymmetric squeezing from a quick-grip to generate a bit of radial stress resulted in a couple of cracking noises. After which the plug parted quite easily revealing the circuitry for inspection.

Avatar Controls AWP14H Smart Plug - Internal Layout

Again, no obviously burnt out components, but one of the electrolytic caps (arrowed) was suspiciously domed compared to the other two. If you watch Bigclivedotcom's video and another from the Buy it Fix it channel it appears that these caps are particularly susceptible to failing.

While it was open I had a look at some of the other components. From what I could glean I think the plug is organised as follows;

1. The T10AL250V fuse is in a board mounted package with a fusible resistor and a zinc oxide varistor for circuit protection and a single diode to rectify the AC supply into a half-wave DC supply.
2. The mains voltage is then converted to a rough 5 V DC supply by a small buck converter and a couple more electrolytic caps.
3. Our questionable 470 μF 16 V electrolytic cap smooths the output of the converter further.
4. Then a 3.3V voltage regulator supplies the control board on a riser.
5. This is a Beken BK7321 system-on-chip.
6. Finally this controls a 10 A relay that switches the plug.

The screen print on the PCB gives the board's details as HYS-01-127_V1.2 2020-07-17, meaing that the maximum age of the plug is 5 years.

I can check the fused components once the board is free from the plug base, but it looks like the low voltage cap is likely going to be the culprit. So out with the soldering iron it is then.

Most of the kit I already had; soldering iron, solder and soldering bit cleaner; and clamps to hold it steady. What I didn't have (or couldn't find) was any desoldering braid, flux or IPA. So these required a bit of shopping.

The IPA (isopropyl alcohol) for cleaning the board after soldering/desoldering came from Amazon for the low, low price of £6.59. I did have some of this before, but the advent of Covid-19 and the great IPA shortage of 2020 emptied my stocks. Obviously I don't want to be sloshing IPA out from a 1 L bottle onto the workpiece, so I poured a bit into an old screw-cap perfume bottle one of the tykes had discarded. Amazon had no SDS available but the supplier, Trade Chem, were quickly able to send one by e-mail (a sign of a good company). The only issue was the cap liner coming apart but that is what you get for cheap-as-chips.

Next was flux and desoldering wick. I hadn't used an electrical soldering flux before but as this job would rely on desoldering I decided not to try and bodge it. So had a look at a couple of videos on flux (What is this flux stuff anyway? and Which one should I buy?) and decided that the whole topic was too niche to get into for a small job. In the end I bought what I felt was one of the more general purpose no-clean fluxes, MG Chemicals 8341 No Clean Flux Paste, at £7.58 on Amazon. An SDS was sourced from CPC Farnell. Along with a hilarious instruction video showing exactly the wrong way to attach a Luer lock needle.

Needlestick injury incoming

Hint: Use the needle cover to twist the needle onto the syringe, then take the cover off. That way if you slip whilst putting the needle on you don’t end up injecting yourself with rosin (yes I know it is a blunt needle but you can stick yourself with it just the same).

Onto desoldering wick and at this point I was running out of steam so I just bought some MG Chemicals Super Wick No-Clean Fine Desoldering Braid, 2.5 mm x 1.5 m 426-NS for £3.22 from CPC Farnell. Good, bad or indifferent it will have to do.

Now I had the tools and materials to hand it was onto desoldering the board from the 3-pin socket assembly. This wasn't quite as straight forward as I had hoped. As the board's main input pins were connected back to the plug socket pins they sucked heat away really fast so even with the soldering iron up at 400 ^oC and added fresh 60:40 solder it was a bit of a struggle. The wick worked quite well but I couldn't easily part the board from the base and when it did come away it took the tag off the neutral pin. There was also some naughtiness with the 10 A fuse.

Avatar Controls Smart Plug - Board dismounted (left), mains tag issue (top right) and unintended fuse damage (bottom left).

Fortunately the fuse was still OK, just a bit melted, as was the fusible resistor next to it meaning that a blown fuse was not the issue. But now I had to repair the tag before I could get back to the original repair. The tag that had come astray looked like it hadn't been punched on properly as I didn't find any pieces of brass that had come away. I did try to punch it back in but it didn't work, so in the end I flooded it with solder. This might not be a great fix but, as regluing the case will make the plug weaker as well, I am not planning on moving it around a lot. So it will have to do.

The final job was to remove the suspect capacitor, which went without issue.

Failed electrolytic capacitor

As well as the slight doming on the top, the bottom was also deformed. When I brought out the multimeter to check its value I found that its max range was 40 μF meaning the replacement cap I had bought would be over range; however measuring the old cap gave a value of 12 μF which is quite a long way from the 470 μF that it should have been. Definitely the prime suspect.

The faulty cap was from a Chinese manufacturer, Dongguan Zhuo Wang Electronics Technology. The full extent of the specs that I was able to obtain was what was written on the outside of the component's packaging. A search for an identical replacement or a similar 470 μF 16 V cap in the same size format yielded nothing so I plumped for the closest that I could find which was a Panasonic EEUFR1C471. These FR- series caps from Panasonic have low ESR (electrical series resistance) and are designed for long service lives with high ripple currents. So I replaced the duff cap with a new one and resoldered the board back onto the base.

Repair Avatar Controls Smart Plug

Once reassembled and plugged in a blue LED came to life and the socket could be switched on and off at the power button. The plug was also visible on Bluetooth as a Tuya LE device.

So it seems to be functional again. The next step is to deal with the firmware…

P.S.

I did contact both Farnell and MG Chemicals to let them know about the H&S flaw in their video, both of which replied that they "would pass it on to the relevant Dept." But it is still up. So if you have stuck yourself, they have already been warned.