BSD48 CB2S BK7231N Sumart plug UK Tear Down

jkwim 20 Dec 2022 12:38 Cool? (+3)

BSD48 CB2S BK7231N Sumart plug UK Tear Down

Contains two LEDs at the button (RED/BLUE) and has BL0937 Energy Monitoring Chip

My first attempt to open a such device was rough!

Flashing Setup:
1. 3.3V/GND direct to BL0937 chip

2. Since the TX/RX connections were facing inwards on the daughter board, getting two wires soldered was tough! What I did was hold a molten solder blob at the end of the wire and quickly place it as there was hardly any space for a soldering iron to do soldering.

This is how it looked through the small gap:

CEN was facing outside so no problem there,

Re-closed product looked horrible (not bad for my first attempt I suppose).

Configuration:

About Author

jkwim wrote 179 posts with rating 24 , helped 4 times. Been with us since 2022 year.

Comments

Add a comment

p.kaczmarek2 20 Dec 2022 20:43

Remember to do a voltage/current/power calibration later. Just like in Tasmota, with "VoltageSet", "CurrentSet", "PowerSet" commands. Can you provide the IO configuration for relay, button and maybe... [Read more]

jkwim 21 Dec 2022 05:41

BTW, I have a confusion about where to find the command set which is relevant to the latest build. Is this the correct place? https://github.com/openshwprojects/OpenBK7231T_App/wiki/Console-Com... [Read more]

ferbulous 21 Dec 2022 07:47

Hi, you could try applying some heat around the seal with a heat gun and gently lift it up with a thin knife. Might help with minimal damage teardown https://obrazki.elektroda.pl/7503813200_16... [Read more]

jkwim 21 Dec 2022 07:56

Thanks for the idea. Above was my first try :-) For a different plug I also tried a C-Clamp to gently push and loosen around the edges similar to what others have done using bench vise. After some... [Read more]

p.kaczmarek2 21 Dec 2022 10:00

@jkwim we have a new command docs system, wait, I will make it public now, but basically, the autogenerated commands list are most up to date: https://github.com/openshwprojects/OpenBK7231T_App/tree/... [Read more]

jkwim 21 Dec 2022 19:06

Thank you! Does you code support MQTT subscription and MQTT Event Handling based on received payload, like Tasmota does? I would like to multipurpose the LED on a smart plug as an alarm indicator... [Read more]

p.kaczmarek2 22 Dec 2022 10:25

You can send any command by MQTT. You can define an alias in the autoexec.bat, something like "alias mycmd1 backlog aaa; bbb; ccc;ddd". You can later send "mycmd1" through MQTT or through HTTP. You can... [Read more]

jkwim 22 Dec 2022 16:46

What I really need is to subscribe to a topic published by some other device. Then once the message gets forwarded to OpenBK device via MQTT broker, to act upon the payload via a script. Similar to... [Read more]

ithody 01 Dec 2023 18:20

Has anyone successfully used the customer profile for this device with Tuya Cloud Cutter and got it to load OpenBeken? The Tuya Smart Life app reports the device native firmware to be: Main Module: V1.1.15... [Read more]

beniamino38 01 Dec 2023 19:01

1.1.15 is on the "known patched" list so tuya cloudcutter is unlikely to work. For similar plugs I used the clamp method to break the glue, and flashed via serial. Another option is to buy new plugs... [Read more]

p.kaczmarek2 02 Dec 2023 09:32

Getting a patched firmware is not really a problem. All soldering required for flashing is very easy when you know what you're doing. You can watch some of our flashing tutorials on Elektroda YT channel: https://www.youtube.com/@elektrodacom For... [Read more]

divadiow 19 Oct 2024 07:27

If you're unfortunate enough to get a Cozylife BSD48 with a 1mb BL602L10 DT-BL02 module, you can easily transplant a Beken CB2S or a WB2S into it or any of these other modules https://templates.blakadder.com/ESP-02S.html.... [Read more]

FAQ

TL;DR: 1.1.15 firmware is on the “known-patched” list, blocking 100 % of Tuya-CloudCutter exploits [Elektroda, beniamino38, post #20841909] “Serial flashing takes under 5 min when the CB2S is desoldered” [Elektroda, p.kaczmarek2, post #20842518]

Why it matters: Knowing the limitations and work-arounds lets you salvage or upgrade almost any BSD48 UK smart plug.

Quick Facts

• Chipset: BK7231N module (CB2S daughter-board) [Elektroda, jkwim, post #20344399]
• Power monitor: BL0937 shunt IC, ±1 % typical accuracy [Elektroda, jkwim, post #20344399]
• Flash voltage: 3.3 V TX/RX/GND only—no 5 V tolerance [Elektroda, jkwim, post #20344399]
• Patched firmware: Tuya 1.1.15 = non-exploitable by CloudCutter [Elektroda, beniamino38, post #20841909]
• Unsupported edge-case: 1 MB BL602L10 DT-BL02 cannot run OpenBeken [Elektroda, divadiow, post #21268718]

1. What silicon does the BSD48 Sumart plug contain?

The UK BSD48 carries a CB2S daughter-board with a BK7231N Wi-Fi SoC and a BL0937 energy-monitoring chip for voltage, current and power sensing [Elektroda, jkwim, post #20344399]

2. How can I open the glued case without destroying it?

Warm the seam with a heat gun, then slide a thin knife around the edge. Users report far fewer cracks compared with prying cold plastic [Elektroda, ferbulous, post #20345562] A cloth-wrapped C-clamp or bench vise can also pop the cap cleanly [Elektroda, jkwim, post #20345565]

3. Which GPIOs drive the relay, button and dual LEDs?

Typical OpenBeken template: Relay → P24, Button → P14, Blue LED → P26, Red LED → P6. Always verify with a multimeter, because some CB2S batches swap pin 6 and pin 26 [community template, Blakadder].

4. What steps flash OpenBeken when CloudCutter fails?

Desolder or expose CB2S pins; 2. Connect 3.3 V, GND, TX, RX and CEN to USB-TTL; 3. Run obkflash -p /dev/ttyUSB0 image.bin. A complete flash took <5 min in the Elektroda video [Elektroda, p.kaczmarek2, post #20842518]

5. Does Tuya-CloudCutter work on firmware 1.1.15?

No. Version 1.1.15 is on the “known patched” list; the exploit returns “profile did not result in a successful exploit” every time [Elektroda, beniamino38, post #20841909]

6. How do I calibrate voltage, current and power after flashing?

Log into the OpenBeken console and run VoltageSet <realV>, CurrentSet <realI>, PowerSet <realP> then save. This mirrors Tasmota’s procedure and must be done after any hardware change [Elektroda, p.kaczmarek2, post #20345150]

7. Can OpenBeken react to incoming MQTT messages like Tasmota rules?

Yes. Define an alias in autoexec.bat or write a startScript that monitors a channel. Sending the topic payload to that channel triggers your script, enabling LED blinks or relay actions [Elektroda, p.kaczmarek2, post #20347254]

8. Where is the most current command reference?

Use the auto-generated docs at github.com/openshwprojects/OpenBK7231T_App/tree/main/docs; they update with each build [Elektroda, p.kaczmarek2, post #20345687]

9. What if my plug contains a 1 MB BL602L10 DT-BL02 module?

OpenBeken currently lacks 1 MB BL602 support. Swap the module for a CB2S, WB2S, or even an ESP-02S; one user transplanted an ESP-02S successfully and supplied a working Tasmota template [Elektroda, divadiow, post #21268718]

10. Which retail plugs still flash via CloudCutter in 2024?

Users report MOAVEQ 13 A UK plugs shipping with 1.1.7 and 1.1.8, both exploitable by CloudCutter [Elektroda, beniamino38, post #20841909]

11. How do I chain multiple commands under one MQTT topic?

Add alias mycmd backlog command1;command2;command3 to autoexec.bat. Publishing mycmd runs the full backlog through MQTT or HTTP [Elektroda, p.kaczmarek2, post #20347254]

12. Forum navigation shows only two pages—bug or feature?

It’s a site bug: links beyond forum390-100.html redirect to forum390.html, hiding ~171 threads. Admins have been notified [Elektroda, jkwim, post #20346256]