Lenovo SE-341AC

From Leo's Notes
Last edited on 21 November 2022, at 04:39.

The Lenovo SE-341AC smart plug (model number ZA7F0000WW) is a smart plug based on the ESP8285N08 / TYWE2S module. This model supposedly has power measurement from its reviews even though it isn't advertised on the product page. After playing with it using the Tuya app, it indeed does have power measurement capabilities.

It is similar to the other Tuya based smart plugs. While the user manual says that it works with the Lenovo Link Pro app, it should also work with the Tuya Smart Life app.

I bought a pair of these smart plugs for $8 CAD each.

Hardware[edit | edit source]

This plug is based on the TYWE2S module.

The pinouts for the module in this plug are listed below.

Pin number Symbol I/O type Function
1 3V3 P Power supply pin (3.3 V)
2 IO5 I/O HLWBL CF1
3 GND P Power supply reference ground
4 IO4 I/O BL0937 CF
5 RX / IO3 I/O UART0_RXD and button 1
6 IO13 I/O Relay 1
7 TX / IO1 I/O UART0_TXD and red LED
8 ADC AI Same with module Silkscreen AD, ADC interface, a 10-bit-precision SAR ADC
9 IO12 I/O Blue LED Led_i 1
10 RST I/O Hardware reset pin (active low, a resistor has been pulled up internally)
11 IO14 I/O HLWBL SEL_i

The switch is a AFE BRD-SS-105LM which is rated at 15A 125VAC.

The PCB looks well designed with thick traces to handle the 16A load. There are some additional pictures of the underside on the reddit post linked below.

The stock firmware dump contains the following pin configuration:

{
    "sw": {
        "dltj": {
            "v_ref": {
                "value": 0
            },
            "ct": {
                "value": false
            },
            "p_ref": {
                "value": 0
            },
            "ov_cr": {
                "value": 17000
            },
            "ivcpin": {
                "pin": {
                    "value": 14
                },
                "lv": {
                    "value": true
                }
            },
            "e_ref": {
                "value": 0
            },
            "ivpin": {
                "pin": {
                    "value": 5
                }
            },
            "v_def": {
                "value": 220
            },
            "ri": {
                "value": 1
            },
            "i_ref": {
                "value": 0
            },
            "epin": {
                "pin": {
                    "value": 4
                }
            }
        },
        "ch": [
            {
                "bt": {
                    "pin": {
                        "value": 3
                    },
                    "lv": {
                        "value": false
                    }
                },
                "rl": {
                    "pin": {
                        "value": 13
                    },
                    "lv": {
                        "value": true
                    }
                },
                "led": {
                    "pin": {
                        "value": 12
                    },
                    "lv": {
                        "value": false
                    }
                }
            }
        ],
        "net": {
            "netn": {
                "value": true
            },
            "owm": {
                "value": "true"
            },
            "rsthold": {
                "value": 5
            },
            "wfst": {
                "pin": {
                    "value": 1
                },
                "lv": {
                    "value": false
                }
            },
            "nety": {
                "value": false
            }
        }
    }
}

Basically, tuya's configuration is:

  • Button = pin 3
  • Relay = pin 13
  • energy data = pin 4, BL0937
  • LED pin = pin 12
  • current/voltage pin = pin 5 & 14 (sel pin), HLW8012

Installing Tasmota[edit | edit source]

This plug is not compatible with tuya-convert since the preloaded firmware is too new. The only way to load Tasmota is via serial (see also Gosund WP5).

The smart plug's cover is held on by 8 plastic clips. There are 3 on each of the round ends which is hard to unclip. The best way to open these without damaging the plastic casing too badly is to use a flathead screwdriver. At the rear of the plug, jam a flathead screwdriver starting at the center top and center bottom of the casing. Wiggle it to one of the sides until you see a hole on the lip of the back cover. Use a blade or spudger to pry the back cover up using this hole (take care not to put too much force on the cover as it can deform it). With the cover partially lifted, try to unclip the end clip with another spudger (if you can, it's very tight) or by using brute force (lift the cover as hard and far as you can until it snaps out of the clip). Repeat this again on the other side.

Wiring[edit | edit source]

After opening the plug, you should see the wireless chip pictured below. To flash Tasmota, you need to connect to 5 pins: the RX/TX pins, 3v3, ground, and GPIO0.

  • RX and TX Serial pins: Since the wireless module is soldered on with the underside of the PCB inaccessible, the only way to access the RX/TX pins without desoldering the chip is to scrape the solder mask off the vias adjacent to the RX/TX label on the module.
  • The 3.3v and GND pins: Can be accessed by the bypass capacitor that's next to the LD1117 voltage regulator.
  • GPIO0 is exposed as test pad on the module itself.

See the pictures below for an idea of how I connected the pins:

The pinouts for all 5 connections are:

Smart plug module Logic level converter USB UART
TX <-> RX
RX <-> TX
3.3v 3.3V (LO) <-> 5V (HI) 5V
GND GND <-> GND GND
IO0 to GND (via 10K)

Here's what that wiring looks like.

SE-341AC Wiring
SE-341AC Wiring

Dumping the stock firmware[edit | edit source]

Use esptool to read the firmware. Run the following command to extract the firmware from the ESP chip.

./esptool --port /dev/ttyUSB0 --baud 115200 --chip auto read_flash 0 0x100000 lenovo2a.bin
esptool.py v3.2
Serial port /dev/ttyUSB0
Connecting....
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting...
Detecting chip type... ESP8266
Chip is ESP8285N08
Features: WiFi, Embedded Flash
Crystal is 26MHz
MAC: c4:dd:57:22:6b:b4
Uploading stub...
Running stub...
Stub running...
1048576 (100 %)
1048576 (100 %)
Read 1048576 bytes at 0x0 in 95.9 seconds (87.5 kbit/s)...
Hard resetting via RTS pin...

After obtaining the firmware, you can extract the stock PSK key by running strings on the binary. This information might be useful for the tuya-convert community to help them potentially finding out how the PSK keys are generated.

Loading Tasmota[edit | edit source]

Download the most recent version of Tasmota from http://ota.tasmota.com/tasmota/release/. You will want to get the tasmota.bin file.

Using esptool, erase and then flash the firmware. I was unable to erase the flash for some reason, Make sure you are using the latest version of esptool.

$ esptool --port /dev/ttyUSB0 erase_flash
esptool.py v3.2
Serial port /dev/ttyUSB0
Connecting...
Detecting chip type... Unsupported detection protocol, switching and trying again...
Connecting...
Detecting chip type... ESP8266
Chip is ESP8285N08
Features: WiFi, Embedded Flash
Crystal is 26MHz
MAC: 70:03:9f:51:79:72
Uploading stub...
Running stub...
Stub running...
Erasing flash (this may take a while)...
Chip erase completed successfully in 1.1s
Hard resetting via RTS pin...

$ esptool --port /dev/ttyUSB0 write_flash -fs 1MB -fm dout 0x0 tasmota.bin 
esptool.py v2.8
Serial port /dev/ttyUSB0
Connecting....
Detecting chip type... ESP8266
Chip is ESP8285
Features: WiFi, Embedded Flash
Crystal is 26MHz
MAC: c4:dd:57:24:11:8f
Enabling default SPI flash mode...
Configuring flash size...
Erasing flash...
Took 2.47s to erase flash block
Wrote 642048 bytes at 0x00000000 in 63.2 seconds (81.3 kbit/s)...

After flashing, disconnect GPIO0 and power cycle the device. It should boot and the blue LEDs should be lit. You should see the plug appear as an access point. Connect to it with your phone and configure the WiFi details on the captive portal page.

Once Tasmota is running and you're able to reach the web page on your network, desolder all the connection wires and re-assemble the plug. If your outter case is slightly mangled from the disassembly process, some hot air can be used to remold the plastic casing.

Configuring pins[edit | edit source]

The Tasmota template for this device is available at https://templates.blakadder.com/avatar_AWP04L.html. At the time of this writing, the pinouts do not have the appropriate configuration for the power monitoring feature that's available in this device and the red LED.

Through some trial and error, I was able to come up with the following template that also gets power measurement readings.

{"NAME":"Lenovo SE-341AC","GPIO":[0,321,0,32,2720,2656,0,0,320,224,2624,0,0,0],"FLAG":0,"BASE":18}

The pinouts for this plug are:

Pin Feature
GPIO1 Red LED - LED_i 1
GPIO3 Button 1
GPIO4 BL0937 CF
GPIO5 HLWBL CF1
GPIO12 Blue LED - Led_i 3
GPIO13 Relay 1
GPIO14 HLWBL SEL_i

Since Tasmota doesn't support multiple LEDs per relay (as far as I can tell), you can either keep the blue light on all the time (by setting its LED number to 3) so that it appears magenta when on and blue when off.

Calibration[edit | edit source]

Connect a kill-a-watt or other power meter and attach a load to the plug. Use the voltageset and currentset commands to calibrate its power measurements.

I read 122 volts and 0.441 amps, so I ran the following in the console:

voltageset 122
currentset 441

If the power factor doesn't seem to agree, you can use the powerset command to set the active power reading. The active power is usually the value that your reference meter / kill-a-watt is reporting. In my case, I have a LED bulb using 53.6 watts with a power factor of ~0.9 while the smart meter is reporting 60 watts at 1.0 power factor. To correct this, I ran:

powerset 53.6

This should correct the power factor being reported down to ~0.9.

The calibration values that I ended up with for both my smart plugs were:

10:06:13.832 CMD: powercal
10:06:13.839 MQT: tasmota/SE341AC-2/stat/RESULT = {"PowerCal":10633}
10:06:15.760 CMD: currentcal
10:06:15.767 MQT: tasmota/SE341AC-2/stat/RESULT = {"CurrentCal":3490}
10:06:17.451 CMD: voltagecal
10:06:17.458 MQT: tasmota/SE341AC-2/stat/RESULT = {"VoltageCal":1673}

These smart plugs have good voltage readings even under load, unlike my older AWP04L units which reads ~10 volts under at 6 amp load.

See also[edit | edit source]