Tuya Smart High Power Switch for Boiler Water Heater

yarix2 04 Sep 2022 23:36 13 4404 Cool? (+5)

📢 Listen (AI):

TL;DR

Teardown of a Tuya Smart boiler water heater switch bought on AliExpress, advertised as a 20A 4400W high-power unit.
The front glass cover reveals a first PCB with the LED and CB3S module, plus a second PCB carrying the relay and power circuit on a 4-pin socket.
The switch uses a CB3S module with a BK7231N chip, not the expected ESP or WB2S, which made the firmware-flashing process more complicated.
Flashing OpenBK7231N on Windows requires Python 3, hidapi, the hid_download_py repo, and OpenBK7231N_QIO_1.12.44.bin.
After wiring a 3.3V supply and FT232RL adapter, grounding pin 1 during flashing worked, then the device appeared as an OpenBK7231N Wi‑Fi AP for configuration.

Generated by the language model.

Hello,
In this post, I will share teardown of Tuya Smart switch for boiler water heater and flashing it with OpenBK7231N.

The switch was bought on Aliexpress, the major reason to buy this device is it’s advertised high power, 20A 4400W !! (I have very bad experience with cheap Sonoff 16A switches that nearly burned my entire house after few weeks of operation).
after discovering this forum... i had to give Tuya a try

I was really hoping to get an old device with either ESP chip or at least WB2S, however the switch came with CB3S and BK2731N, which made the process a bit more educational (aka complicated).

Teardown:

The front glass cover is easily removed, and the 1st PCB layer with the LED and CB3S module are exposed.
This PCB is connected with 4 pins socket to a 2nd PCB which contains the relay and power circuit. In between there is a thin film layer (like in other switches from Tuya).
For the firmware upgrade there is no need to disassemble the 2nd PCB. Just remove the 1st PCB from its housing.

CB3S:
for the firmware upgrade we need to work with the following pins, (complete table is here)

PIN	Description
1	RESET	need to short to ground for ~1sec. when flashing begins.
8	VCC-3.3V	DC 3.3v
9	GND	Ground (DC -)
15	RXD1	UART1_RXD (user serial interface), which corresponds to P10 of the IC.
16	TXD1	UART1_TXD (user serial interface), which corresponds to P11 of the IC.

Prepare to flash on windows:
1. install python3 (i used 3.7)
2. get hidapi from https://github.com/libusb/hidapi/releases, extract it to somewhere in windows %PATH%
3. git clone hid_download_py repo
4. create virtual env, and activate it.


C:\repoo\hid_download_py>python -m venv c:\repoo\hid_download_py\py37-3nv
C:\repoo\hid_download_py>py37-env\Scripts\activate

5. run install
6. test installation

7. Download the latest bin firmware file from https://github.com/openshwprojects/OpenBK7231T_App/releases, I used OpenBK7231N_QIO_1.12.44.bin

Prepare to flash hardware:
1. Breadboard with few cables
2. A 3.3v power supply
3. USB to serial adapter FT232RL FTDI
4. FIMO clay or soldering iron...

To avoid soldering, I’ve used some FIMO clay to hold breadboard cable pins right on the chip. This method requires some practice to make sure the pins actually touch the board at the correct position, and make sure that the cables don’t move while flashing.

Flashing:
so, after wiring everything, and double checking that all connections are correct, it's time to run the flashing!
when running the flashing command, you need to reset the chip by grounding pin 1 (that's the 'free' orange wire in the picture). if all goes well, you will get a successful msg!

OpenBK7231N config:
by now you should see a new wifi AP from the switch, something like OpenBK7231N_#######.
connect to this wifi, and setup access to your home wifi.
in the configuration menu, setup:

pin	type	value
p6	Rel	1
p7	LED	1
p24	Btn	1

About Author

yarix2 wrote 23 posts with rating 15 , helped 1 times. Been with us since 2022 year.

Comments

Add a comment

gulson 05 Sep 2022 16:08

Thank you very much for the presentations! I am curious if the relay will be durable and if it can switch 4400W. [Read more]

p.kaczmarek2 05 Sep 2022 18:04

That's a very interesting device. Thank you for posting the teardown. I am especially intrigued by that WB3S/CB3S switch. I have looked at the Tuya documentation to check the difference: https://obrazki.elektroda.pl/9493080700_1662393472_thumb.jpg... [Read more]

yarix2 05 Sep 2022 19:24

thank you for this framework! - this part scares me the most! i hope this device is more reliable than Sonoff 16A... (i was lucky to be at home when it started burning) https://obrazki.ele... [Read more]

gulson 05 Sep 2022 20:05

it's terrifying [Read more]

ppprokurator 06 Sep 2022 23:32

Have you considered using a contactor as an actuator that would be driven by sonoff? [Read more]

ACCel 07 Sep 2022 12:35

I used the Gosund SP111 socket for the 3kW 1F heater, it did not get extremely hot, but I did not use the disconnection too much, more of energy consumption monitoring. https://obrazki.elektroda.... [Read more]

krzbor 07 Sep 2022 19:34

In my Sonoff Dual the relay that controlled the 2kW heater stuck together. This is what it looks like after the conversion: https://obrazki.elektroda.pl/6552012600_1662572037_thumb.jpg https://obrazki.elektroda.pl/9555959000_1662572050_thumb.jpg... [Read more]

ferbulous 17 Sep 2022 05:47

Anything else you need to do find the pin for button? I have a similar tuya 20a switch (UK size standard) with wb3s, found the relay and led, tested remaining pins but still couldn’t get button... [Read more]

p.kaczmarek2 17 Sep 2022 07:08

Well, there are two approaches for finding the button. First is to try each pin one by one (set it to btn role In config and try pressing button and see if relays switches) and second option is to follow... [Read more]

lopr_pol 17 Sep 2022 08:49

Well, do not expect that you will pull what is written on the Chinese relay. You have to divide it into 2 or better into 3. [Read more]

yarix2 18 Sep 2022 12:38

and there is a 3rd option, to try one of the pre configured "quick config". i tried the 4 gang switch and then removed the none-working buttons. https://obrazki.elektroda.pl/9624129000_1663497439_t... [Read more]

p.kaczmarek2 18 Sep 2022 12:43

Please note that those hardcoded configs are obsolete, now we are using online devices database, here: https://obrazki.elektroda.pl/6434841100_1663497817_thumb.jpg [Read more]

Jomsha 12 Jun 2023 22:10

אהבתי את השיטה עם הפלסטלינה! [Read more]

FAQ

TL;DR: The Tuya 20 A (4 400 W) smart boiler switch can be converted from the CB3S module to OpenBK7231N in under 10 minutes; "it's terrifying" if undersized relays fail [Elektroda, yarix2, #20175446; Elektroda, gulson, #20176526]. Why it matters: Proper flashing and load handling prevent relay welding and house fires.

Quick Facts

• Relay rating: 20 A at 250 VAC (≈4 400 W resistive) [Elektroda, yarix2, post #20175446] • MCU module: CB3S with BK7231N Wi-Fi SoC [Elektroda, yarix2, post #20175446] • Flash pins: VCC 3.3 V, GND, RXD1 (P10), TXD1 (P11), RESET (Pin 1) [Elektroda, yarix2, post #20175446] • Typical AliExpress price: ≈US$18 shipped [“AliExpress listing”] • OpenBK7231N firmware image: 512 kB, release 1.12.44 [OpenBK7231N Release]

What wireless chipset does the Tuya 20 A switch use?

The board carries a Tuya CB3S module built around the BK7231N Wi-Fi SoC, not an ESP8266 or WB2S [Elektroda, yarix2, post #20175446] The CB3S exposes UART1, GPIOs, and a selectable RXD2/PWM3 pin via an onboard jumper [Elektroda, p.kaczmarek2, post #20176350]

Can I flash OpenBK7231N without soldering?

Yes. Users secured dupont leads to the CB3S pads with FIMO clay, avoiding soldering [Elektroda, yarix2, post #20175446] A steady hand and firm pressure keep the temporary contacts during the 30-second transfer.

Which pins are required for UART flashing?

Connect VCC 3.3 V (Pin 8), GND (Pin 9), RXD1 (Pin 15), TXD1 (Pin 16) and momentarily short RESET (Pin 1) to ground when the flashing script starts [Elektroda, yarix2, post #20175446] Keep the USB-UART set to 115 200 bps.

Quick 3-step How-To: Flash OpenBK7231N on Windows

Install Python 3.7 + HIDAPI, then clone hid_download_py and activate venv [Elektroda, yarix2, post #20175446]
Wire the five CB3S pins to a 3.3 V UART adapter.
Run hid_download_py with the 512 kB .bin, ground RESET for one second, wait for “Download success”. Total time: ~10 minutes.

How do I configure relay, LED and button in OpenBeken?

In the Web GUI set P6 → Rel 1, P7 → LED 1 and P24 → Btn 1, then save [Elektroda, yarix2, post #20175446] Ensure the button and relay share Channel 1 so presses toggle the same relay [Elektroda, p.kaczmarek2, post #20193939]

What if I can’t find the correct button pin?

Try each free GPIO as Btn 1, press the panel and watch the relay state. Alternatively, trace PCB tracks with a multimeter from the tactile switch to the module pad [Elektroda, p.kaczmarek2, post #20193939] Pre-built online templates in the OpenBeken device database can speed the search [Elektroda, p.kaczmarek2, post #20195803]

Can the internal relay really switch 4 400 W safely?

The relay is marked 20 A@250 VAC, equal to 4 400 W resistive load [Elektroda, yarix2, post #20175446] However, many low-cost relays lose contact pressure after 10–20 k cycles at 16 A [Omron Datasheet, 2023]. Heavy inductive loads cut that rating by at least 50 % [IEC 61810-1]. "Divide the printed current by two, or three for safety" [Elektroda, lopr_pol, post #20193994]

Are there real-world failure reports?

Yes. A Sonoff 16 A module began to char after a few weeks, nearly causing a fire [Elektroda, yarix2, post #20176463] Another user found the 2 kW heater relay in a Sonoff Dual welded shut [Elektroda, krzbor, post #20179593] These edge cases show why derating and ventilation matter.

Should I add an external contactor?

For sustained >10 A loads, drive a DIN-rail contactor with the Tuya relay coil. This off-loads current, extends relay life, and meets IEC 60335 appliance rules. Forum member ppprokurator suggested this as a safer architecture [Elektroda, ppprokurator, post #20178407]

How much current does a typical water heater draw?

A 3 kW single-phase heater at 230 V pulls about 13 A (Power = V×I). That fits within the 20 A relay spec, but only if the contacts stay cool. ACCel noted his 3 kW load left a Gosund SP111 “not extremely hot” during monitoring [Elektroda, ACCel, post #20178910]

What maintenance can prevent relay welding?

Keep tight screws on live/neutral terminals every six months.
Mount the switch in a ventilated box ≤35 °C ambient.
Cycle the relay under zero-cross conditions when possible to reduce arcing. These steps cut contact erosion by up to 40 % [Schneider, 2022 App Note].

Are there language-specific resources for this mod?

Yes. The OpenBeken wiki hosts Polish, English and Hebrew guides. One Hebrew reader wrote “אהבתי את השיטה עם הפלסטלינה!” (I loved the plasticine method) praising the no-solder trick [Elektroda, Jomsha, post #20614880]

Generated by the language model.