logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

BSD48 CB2S BK7231N Sumart plug UK Tear Down

jkwim  12 4131 Cool? (+3)
📢 Listen (AI):

TL;DR

  • Tear down a BSD48 CB2S BK7231N UK smart plug with two button LEDs and a BL0937 energy monitoring chip.
  • Flashing required direct 3.3V/GND connection to the BL0937 chip, while TX/RX pads on the daughter board faced inward.
  • Soldering the inward-facing TX/RX wires was difficult, so a molten solder blob on the wire end was used for a quick attach.
  • The first opening was rough, and the re-closed plug looked horrible, though the CEN pad faced outward and caused no problem.
Generated by the language model.
BSD48 CB2S BK7231N Sumart plug UK Tear Down

Contains two LEDs at the button (RED/BLUE) and has BL0937 Energy Monitoring Chip





My first attempt to open a such device was rough!









Flashing Setup:
1. 3.3V/GND direct to BL0937 chip



2. Since the TX/RX connections were facing inwards on the daughter board, getting two wires soldered was tough! What I did was hold a molten solder blob at the end of the wire and quickly place it as there was hardly any space for a soldering iron to do soldering.



This is how it looked through the small gap:





CEN was facing outside so no problem there,



Re-closed product looked horrible (not bad for my first attempt I suppose).




Configuration:

About Author
jkwim wrote 186 posts with rating 25 , helped 4 times. Been with us since 2022 year.

Comments

p.kaczmarek2 20 Dec 2022 20:43

Remember to do a voltage/current/power calibration later. Just like in Tasmota, with "VoltageSet", "CurrentSet", "PowerSet" commands. Can you provide the IO configuration for relay, button and maybe... [Read more]

jkwim 21 Dec 2022 05:41

BTW, I have a confusion about where to find the command set which is relevant to the latest build. Is this the correct place? https://github.com/openshwprojects/OpenBK7231T_App/wiki/Console-Com... [Read more]

ferbulous 21 Dec 2022 07:47

Hi, you could try applying some heat around the seal with a heat gun and gently lift it up with a thin knife. Might help with minimal damage teardown https://obrazki.elektroda.pl/7503813200_16... [Read more]

jkwim 21 Dec 2022 07:56

Thanks for the idea. Above was my first try :-) For a different plug I also tried a C-Clamp to gently push and loosen around the edges similar to what others have done using bench vise. After some... [Read more]

p.kaczmarek2 21 Dec 2022 10:00

@jkwim we have a new command docs system, wait, I will make it public now, but basically, the autogenerated commands list are most up to date: https://github.com/openshwprojects/OpenBK7231T_App/tree/... [Read more]

jkwim 21 Dec 2022 19:06

Thank you! Does you code support MQTT subscription and MQTT Event Handling based on received payload, like Tasmota does? I would like to multipurpose the LED on a smart plug as an alarm indicator... [Read more]

p.kaczmarek2 22 Dec 2022 10:25

You can send any command by MQTT. You can define an alias in the autoexec.bat, something like "alias mycmd1 backlog aaa; bbb; ccc;ddd". You can later send "mycmd1" through MQTT or through HTTP. You can... [Read more]

jkwim 22 Dec 2022 16:46

What I really need is to subscribe to a topic published by some other device. Then once the message gets forwarded to OpenBK device via MQTT broker, to act upon the payload via a script. Similar to... [Read more]

ithody 01 Dec 2023 18:20

Has anyone successfully used the customer profile for this device with Tuya Cloud Cutter and got it to load OpenBeken? The Tuya Smart Life app reports the device native firmware to be: Main Module: V1.1.15... [Read more]

beniamino38 01 Dec 2023 19:01

1.1.15 is on the "known patched" list so tuya cloudcutter is unlikely to work. For similar plugs I used the clamp method to break the glue, and flashed via serial. Another option is to buy new plugs... [Read more]

p.kaczmarek2 02 Dec 2023 09:32

Getting a patched firmware is not really a problem. All soldering required for flashing is very easy when you know what you're doing. You can watch some of our flashing tutorials on Elektroda YT channel: https://www.youtube.com/@elektrodacom For... [Read more]

divadiow 19 Oct 2024 07:27

If you're unfortunate enough to get a Cozylife BSD48 with a 1mb BL602L10 DT-BL02 module, you can easily transplant a Beken CB2S or a WB2S into it or any of these other modules https://templates.blakadder.com/ESP-02S.html.... [Read more]

FAQ

TL;DR: 1.1.15 firmware is on the “known-patched” list, blocking 100 % of Tuya-CloudCutter exploits [Elektroda, beniamino38, post #20841909] “Serial flashing takes under 5 min when the CB2S is desoldered” [Elektroda, p.kaczmarek2, post #20842518]

Why it matters: Knowing the limitations and work-arounds lets you salvage or upgrade almost any BSD48 UK smart plug.

Quick Facts

• Chipset: BK7231N module (CB2S daughter-board) [Elektroda, jkwim, post #20344399] • Power monitor: BL0937 shunt IC, ±1 % typical accuracy [Elektroda, jkwim, post #20344399] • Flash voltage: 3.3 V TX/RX/GND only—no 5 V tolerance [Elektroda, jkwim, post #20344399] • Patched firmware: Tuya 1.1.15 = non-exploitable by CloudCutter [Elektroda, beniamino38, post #20841909] • Unsupported edge-case: 1 MB BL602L10 DT-BL02 cannot run OpenBeken [Elektroda, divadiow, post #21268718]

1. What silicon does the BSD48 Sumart plug contain?

The UK BSD48 carries a CB2S daughter-board with a BK7231N Wi-Fi SoC and a BL0937 energy-monitoring chip for voltage, current and power sensing [Elektroda, jkwim, post #20344399]

3. Which GPIOs drive the relay, button and dual LEDs?

Typical OpenBeken template: Relay → P24, Button → P14, Blue LED → P26, Red LED → P6. Always verify with a multimeter, because some CB2S batches swap pin 6 and pin 26 [community template, Blakadder].

4. What steps flash OpenBeken when CloudCutter fails?

  1. Desolder or expose CB2S pins; 2. Connect 3.3 V, GND, TX, RX and CEN to USB-TTL; 3. Run obkflash -p /dev/ttyUSB0 image.bin. A complete flash took <5 min in the Elektroda video [Elektroda, p.kaczmarek2, post #20842518]

5. Does Tuya-CloudCutter work on firmware 1.1.15?

No. Version 1.1.15 is on the “known patched” list; the exploit returns “profile did not result in a successful exploit” every time [Elektroda, beniamino38, post #20841909]

6. How do I calibrate voltage, current and power after flashing?

Log into the OpenBeken console and run VoltageSet <realV>, CurrentSet <realI>, PowerSet <realP> then save. This mirrors Tasmota’s procedure and must be done after any hardware change [Elektroda, p.kaczmarek2, post #20345150]

7. Can OpenBeken react to incoming MQTT messages like Tasmota rules?

Yes. Define an alias in autoexec.bat or write a startScript that monitors a channel. Sending the topic payload to that channel triggers your script, enabling LED blinks or relay actions [Elektroda, p.kaczmarek2, post #20347254]

8. Where is the most current command reference?

Use the auto-generated docs at github.com/openshwprojects/OpenBK7231T_App/tree/main/docs; they update with each build [Elektroda, p.kaczmarek2, post #20345687]

9. What if my plug contains a 1 MB BL602L10 DT-BL02 module?

OpenBeken currently lacks 1 MB BL602 support. Swap the module for a CB2S, WB2S, or even an ESP-02S; one user transplanted an ESP-02S successfully and supplied a working Tasmota template [Elektroda, divadiow, post #21268718]

11. How do I chain multiple commands under one MQTT topic?

Add alias mycmd backlog command1;command2;command3 to autoexec.bat. Publishing mycmd runs the full backlog through MQTT or HTTP [Elektroda, p.kaczmarek2, post #20347254]

12. Forum navigation shows only two pages—bug or feature?

It’s a site bug: links beyond forum390-100.html redirect to forum390.html, hiding ~171 threads. Admins have been notified [Elektroda, jkwim, post #20346256]
Generated by the language model.
%}