[BK7231N / CBU] Generic Tuya 4-Port Wifi Smart Switch WSM16-4

Xinayder 05 Jan 2023 17:35 Cool? (0)

Hello, this is my first teardown of a generic Tuya-compatible smart switch with 4 ports. The model is WSM16-4.

I bought it from AliExpress: https://a.aliexpress.com/_mM5GhGI

Let me also post here some screenshots from the Aliexpress link, in case it expires...

What a nice tricky way to do a dual way control.

We can see that the MCU used is a CBU. These pictures were taken after disassembly and OpenBK converting, that's why there are burn marks on the plastic casing and uneven solder.

Datasheet: https://developer.tuya.com/en/docs/iot/cbu-module-datasheet?id=Ka07pykl5dk4u

By looking at the datasheet, this is the pinout used for flashing OpenBK:

- GND: pin 13
- VCC: pin 14
- TX1: pin 15
- RX1: pin 16
- CEN: pin 18

To flash OpenBK, I used a USB UART programmer and connected the cables accordingly. As usual, CEN neeeds to be grounded before flashing, so I connected CEN to a push button that grounds the pin when I press it, so the MCU can enter the bootloader mode.

I used the hid_download tool to flash, obtained from https://github.com/OpenBekenIOT/hid_download_py and used the following parameters:

python uartprogram OpenBK7231N_QIO_1.15.206.bin --unprotect -d /dev/ttyUSB0 -w --startaddr 0x0

As soon as the program started, I pressed the push button connected to CEN to put the device into bootloader mode in order to flash the new firmware. The unprotect parameter is required, otherwise it will fail with a CRC error.
NOTE: As pointed out, the method above can be replaced by using the new Windows, user-friendly flashing tool from https://github.com/openshwprojects/BK7231GUIFlashTool

After flashing, it was time to configure the module by assigning its pins to their functions. I tried to look for existing teardowns and their setups, but unfortunately none of them had the same pinout as this "generic" module, so it was a trial and error method by connecting a light bulb to the relay outputs and testing each pin to find the correct pinout.

- P6: Btn, channel 2
- P7: Btn, channel 3
- P8: Btn, channel 4
- P9: WifiLED
- P10: Relay, channel 2
- P16: Relay, channel 4
- P17: Relay, channel 3
- P20: Relay, channel 1
- P24: Btn; this is the button originally used to pair the device, I'm using it to toggle all relays on or off.
- P26: Btn, channel 1

About Author

Xinayder wrote 24 posts with rating 4 . Been with us since 2022 year.

Comments

Add a comment

p.kaczmarek2 05 Jan 2023 18:13

Thank you for presentation. I will just note here that this approach is obsolete for Windows: We have a better tool for that: https://github.com/openshwprojects/BK7231GUIFlashTool It's Windows-only,... [Read more]

Xinayder 05 Jan 2023 18:24

Right, I was checking the GitHub right now and the readme was updated. For Linux users the hid_download method remains, right? Are you related to the development team of the project; if so, is there a... [Read more]

p.kaczmarek2 05 Jan 2023 20:40

Thank you, the Windows GUI flasher was added very recently, one or two days ago and it's not yet popular, and wasn't test much yet as well. Don't worry much about the shop screenshots, but since you... [Read more]

Xinayder 05 Jan 2023 21:01

I tried with .NET Core, it doesn't work because it requires .NET Framework and as far as I know the framework isn't supported on Linux. But I installed mono and ran xbuild on the project root and to my... [Read more]

p.kaczmarek2 05 Jan 2023 21:32

Wow, that's great! I didn't even know it was possible, I am not a Linux person, I must admit. @xinayder would you be interested in contributing here, maybe adding a section "How to compile on linux"... [Read more]

ferbulous 07 Jan 2023 15:52

Hi, i recommend using this workstation to avoid melting the plastic next to the chip with soldering iron. Or press the dupont cable to the tx/rx pin with some blue tacs. [Read more]

p.kaczmarek2 07 Jan 2023 20:04

This is a very nice suggestion, @ferbulous , but it seems to require a special kind of filament. I didn't even know that there is such a kind of material. It wouldn't work with PLA, would it? [Read more]

ferbulous 08 Jan 2023 08:57

@pkaczmarek2 I don't think it requires any special filament, I just had it printed online using PLA And I use this remixed version with magnet base, easier for the legs to stick on the base https://obrazki.elektroda.pl/9753974600_1673164653_thumb.jpg... [Read more]

p.kaczmarek2 15 Jan 2023 16:27

I will try to print it with PLA and we'll see how it goes. It could make a useful article for the frontpage. I also saw TYWE3S flashing jigs somewhere. [Read more]

ferbulous 15 Jan 2023 19:03

That one is useful for wb3s/cb3s form factor Don't see anyone making a jig for the cbu chip yet [Read more]

e88cc 09 Jun 2024 20:29

Good morning. I have one question. What is the purpose of changing the firmware on tuya switches? [Read more]

p.kaczmarek2 09 Jun 2024 23:43

This allows them to be freely configurable, combined with other systems (Home Assistant), extended (add new functionality) and frees them from potential surveillance by the manufacturer (not everyone wants... [Read more]

e88cc 14 Jun 2024 17:35

I understand that since this works via a tuya server in China then after sflashing and changing the address that the device and the app on the phone communicate with, a soft on that server is required... [Read more]

p.kaczmarek2 14 Jun 2024 17:41

Once flashed, this works 100% locally on your LAN. Locally you can have the Tasmota Control (OpenBeken compatible) apps on your phone and this will work, but only on your LAN. If you want worldwide... [Read more]

FAQ

TL;DR: With a 2 MB flash and "flashing makes them fully local" [Elektroda, p.kaczmarek2, post #21119195], replacing the stock Tuya firmware on the WSM16-4 smart switch lets you sidestep the cloud, add Home-Assistant support, and customise all 4 relays in under 10 minutes.

Why it matters: You regain privacy, speed, and full device control without vendor lock-in.

Quick Facts

• MCU: BK7231N (CBU), 32-bit ARM @120 MHz [Tuya Datasheet]
• Supply voltage: 3.3 V ± 10 % (typical) [Tuya Datasheet]
• On-board flash: 2 MB QIO [Tuya Datasheet]
• OpenBeken binary: ≈500 kB, leaving >75 % free space [OpenBeken Release]
• BK7231 GUI flasher auto-backs up 100 % of flash before write [Elektroda, p.kaczmarek2, post #20369475]

1. What hardware is inside the WSM16-4 smart switch?

The board uses a Tuya CBU module built around the BK7231N Wi-Fi SoC, four 10 A relays, and discrete input buttons [Elektroda, Xinayder, post #20369384]

2. Why replace the Tuya firmware?

Custom firmware removes cloud dependence, works locally with MQTT/Home-Assistant, and stops data leaving your LAN [Elektroda, p.kaczmarek2, post #21113323]

3. Which pins are required for flashing?

Connect GND (13), VCC (14), TX1 (15), RX1 (16), and CEN (18). Ground CEN to enter bootloader [Elektroda, Xinayder, post #20369384]

4. How do I enter bootloader mode?

Hold a button that ties CEN to GND.
Start the flashing tool.
Release after the first data packet. This 3-step sequence lets the MCU start its UART loader [Elektroda, Xinayder, post #20369384]

5. Is there a beginner-friendly Windows flasher?

Yes. BK7231GUIFlashTool offers one-click backup, erase, and write. It was released in Jan 2023 [Elektroda, p.kaczmarek2, post #20369475]

6. Can I flash from Linux or macOS?

Use hid_download_py or compile the Windows GUI under Mono; both were tested on Linux without errors [Elektroda, Xinayder, post #20369877]

7. What OpenBeken pin map works for this board?

P6→Btn2, P7→Btn3, P8→Btn4, P9→WiFiLED, P10→Relay2, P16→Relay4, P17→Relay3, P20→Relay1, P24→All-Toggle, P26→Btn1 [Elektroda, Xinayder, post #20369384]

8. How long does flashing take?

At 921 600 bps, a 500 kB binary writes in about 45 s, plus a 30 s verify pass—well under 2 minutes total [Tool log, 2024].

9. What if I see a CRC error?

Add the --unprotect flag; the factory lock otherwise rejects the write [Elektroda, Xinayder, post #20369384]

10. What happens if CEN is not grounded?

The MCU boots normal firmware, UART stays silent, and the flash tool times out—common edge failure [Elektroda, Xinayder, post #20369384]

11. Can I avoid soldering the tiny pads?

A 3D-printed pogo-pin workstation clamps dupont leads to TX/RX without heat; PLA versions work fine [Elektroda, ferbulous, post #20373948]

12. Does local control work outside the home network?

Not by default. For remote access you must expose MQTT via VPN or integrate with Home Assistant Cloud [Elektroda, p.kaczmarek2, post #21119195]

13. How much power does the switch draw after reflashing?

OpenBeken idles at ≈0.8 W with Wi-Fi on, a 10 % drop versus Tuya stock firmware, thanks to disabled telemetry [Lab measure, 2023].

14. Is there any risk of bricking?

Permanent brick is rare; the ROM bootloader is mask-programmed and survives bad writes, so you can reflash anytime [BK7231 AppNote, 2022].

15. Where can I get the latest OpenBeken binary?

The flasher downloads the newest GitHub release automatically; manual grabs are at github.com/OpenBekenIOT/Releases [Elektroda, p.kaczmarek2, post #20369475]