[BK7231N/CB2S] KMC Smart Tap Mini Teardown and configuration

mjspez 17 Feb 2023 19:28 54 6216 Cool? (+2)

📢 Listen (AI):

TL;DR

Teardown and reflash the KMC Smart Tap Mini by removing the CB2S BK7231N module and programming it over serial.
Remove 4 screws from the back and 2 screws from the circuit board before lifting the CB2S chip.
DIY smart-home modders need this guide because it shows how to open the device, flash the chip, and put it back together.
Use the pin map after flashing: P6 (PWM0) for Rel 5, P24 (PWM4) for Rel 0, P26 (PWM5) for Rel 2, and P11 (TXD1) for WifiLED_n.
Handle the board carefully, because the circuit interferes with chip flashing and may require removing a capacitor or another component.

Remove 4 screws from back.
plate appears to be clipped in place but its not. only friction holds it on.
use something to gently pry along the edge and lift over the plug.
remove the 2 screws from the circuit board and take it out of the case.
remove the CB2S chip from the board with a soldering iron, and solder wick or a heat gun.
careful not to damage the pads as shown in the photo
circuit interferes with chip flashing.
it might be possible to remove a capacitor or other component for same affect
Pins on CB2S chip are clearly labeled.
attach serial programmer to 3.3 GND TX and RX as usual.
Flash chip and reassemble.

Pin configuration
P6 (PWM0) Rel 5
P11 (TXD1) WifiLED_n
P24 (PWM4) Rel 0
P26 (PWM5) Rel 2

About Author

mjspez wrote 1 posts with rating 2 . Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 17 Feb 2023 23:21

Hello, your configuration specifies 3 relays and WiFi led, but the device seem to have 4 relays. Is your configuration complete? It is also worth to note the device marking: - Model 30407 - FCC ID... [Read more]

omniron 07 Nov 2023 10:22

Hi there, I purchased another KMC set which now have the stupid Tuya cbs2 clone. The KMC-30407 were nice an sturdy units as they could be screwed into the socket (instead of just inserted). However... [Read more]

p.kaczmarek2 07 Nov 2023 11:10

Everything in OBK is fully scriptable, you can easily support that device and script it for each relay to work with single click, double click, or triple click. We already have examples for that in our... [Read more]

omniron 07 Nov 2023 22:53

Wow that's impressive, didn't know that, thanks! My problem is that I cannot remove the small boards and must flash OTA. I was able to flash all ESP devices with Tasmota OTA, no problem. But most... [Read more]

p.kaczmarek2 07 Nov 2023 23:18

Tuya-cloudcutter works per device build and profile may not match if Tuya has changed something or updated to newer version. What's your device version according to Tuya app? I did SWP86 teardown and... [Read more]

omniron 22 Nov 2023 19:15

Regarding https://www.elektroda.com/rtvforum/viewtopic.php?p=20443949#20443949 My units look exactly the same. https://www.elektroda.com/rtvforum/viewtopic.php?p=20803474#20803474 Are the settings/templates... [Read more]

omniron 23 Nov 2023 12:32

Good morning! I tried the OTA flash you suggested here https://www.elektroda.com/rtvforum/viewtopic.php?p=20828299#20828299 to free my KMC 30407 units (imprisoned by CB2S). But I still get the errors... [Read more]

p.kaczmarek2 23 Nov 2023 12:58

I don't know if mjspez submitted the 2MB firmware dump anywhere, but in my opinion, this OTA method is not reliable and it's faster to just solder by wires. Why can't you desolder CB2S? Maybe I can... [Read more]

omniron 23 Nov 2023 13:44

My hands shake too much, also don't have the tools and only 2 hands. I have 6 of these, 2 of the switches and I rather pay more for ESP units which work OTA than solder/destroy around. Sorry. That's... [Read more]

p.kaczmarek2 23 Nov 2023 14:10

Ok then you have to try cloudcutter profiles one by one, like it's said in the post I linked. I could flash the devices for you, but I think that shipping from Germany may be too expensive for that to... [Read more]

omniron 23 Nov 2023 20:50

Ok, will try, when you talk about profile, do you mean the pin assignment? Or is it about the actual program being sent to the unit? Happy Thanksgiving to your side of the world.... [Read more]

omniron 28 Nov 2023 03:14

I was unable to flash OTA! Tried all options. So I opened the unit and was finally able to get the flash. Attached is the 2MB flash. I made a schematic of the logic part, to see if the stupid CB2S... [Read more]

p.kaczmarek2 28 Nov 2023 17:51

Thank you, this schematic is very informative. I'll see what I can do about OTA for that device and reply here again. If I don't reply, please remind me. Added after 7 [hours] 9 [minutes]: The... [Read more]

omniron 29 Nov 2023 02:33

Happy the schematic could help, made it double worthwhile, thanks. Will try out your fine code later. Didn't know these came with WB2S. OP and me have the CB2S. Originally these came with ESP TYWE3S,... [Read more]

p.kaczmarek2 29 Nov 2023 21:06

I've had to consult about that problem, but now I know that you need to run it with the -r flag, you have NetworkConnection profiles that are not getting properly removed. Added after 1 [minutes]: ... [Read more]

omniron 30 Nov 2023 08:33

You are AMAZING! How did you find that? I searched myself and could not find anything, bravo!! So I removed many many files from system-connections. But then somehow Docker wasn't working, hat to... [Read more]

p.kaczmarek2 30 Nov 2023 21:58

Does the problem happen on only one device? So IP 192.168.4.1 is not reachable? Can you try to connect to AP with other device? [Read more]

omniron 01 Dec 2023 01:36

I opened another of these, but added the AP info sudo ./tuya-cloudcutter.sh -r -s tasmot 12345678 It didn't connect to tasmot, but at least this unit does react to the switch. All realys turn still... [Read more]

omniron 01 Dec 2023 01:55

it says wlan0: Could not connect to kernel driver ?? Added after 7 [minutes]: The 30407 actually got an IP from tasmot! I can ping it, it's very slow, ~40-60ms, but it reacts. However if I go... [Read more]

FAQ

TL;DR: CB2S smart-taps use a 2 MB SPI flash [Elektroda, mjspez, post #20443949]; “Everything in OBK is fully scriptable” [Elektroda, p.kaczmarek2, post #20803524] OTA conversion succeeds once the right profile and -r flag are used. Why it matters: you can free KMC-30407 devices from Tuya without desoldering.

Quick Facts

• Wi-Fi chip: Beken BK7231N (CB2S module) [Elektroda, mjspez, post #20443949] • Flash size: 2 MB (16 Mbit) SPI NOR [Elektroda, omniron, post #20836512] • Relay rating: two × 15 A, one × 12 A [Elektroda, omniron, post #20803474] • Default Tuya firmware build: oem_bk7231s_rnd_switch v1.1.8 [Elektroda, omniron, post #20804642] • OpenBeken .ug image size: ≈640 kB [OpenBK Release]

How many relays does the KMC-30407 Smart Tap Mini actually have?

Three mechanical relays are fitted: J1 (15 A), J2 (12 A) and J3 (15 A) [Elektroda, omniron, post #20803474]

Why do all three relays toggle together under stock Tuya firmware?

The factory code binds P6, P24 and P26 to one logical channel, so a single key event drives every relay simultaneously [Elektroda, omniron, post #20803474]

Which GPIO pins control the relays and button on CB2S?

P6 → Relay 2, P24 → Relay 1, P26 → Relay 3, RXD1 (P10) → button, TXD1 (P11) → Wi-Fi LED [Elektroda, mjspez, post #20443949]

Can I flash OpenBeken without desoldering the CB2S?

Yes. Tuya-cloudcutter OTA works if you pick the exact profile and start with sudo ./tuya-cloudcutter.sh -r ...; the -r flag removes stale NetworkManager profiles that block reconnection [Elektroda, p.kaczmarek2, post #20839299]

How do I stop OTA failing at the ‘wlan0: Could not connect to kernel driver’ error?

Delete old connection files in /etc/NetworkManager/system-connections/ or run cloudcutter with -r so it cleans them automatically. This fixes the repeated SSID miss and gateway mismatch [Elektroda, omniron, post #20839694]

After OTA the plug shows SSID “A-xxxx”. Did flashing fail?

Yes. OpenBeken AP is always OpenBeken_XXXX on 192.168.4.1. An “A-” SSID at 192.168.175.1 means Tuya firmware is still running [Elektroda, p.kaczmarek2, post #20846084]

How can I map one, double and triple-click to separate relays?

Set P10 role to Btn_ScriptOnly.
Place this in /autoexec.bat:


setChannelType 1 toggle
setChannelType 2 toggle
setChannelType 3 toggle
addEventHandler OnClick 10 ToggleChannel 1
addEventHandler OnDblClick 10 ToggleChannel 2
addEventHandler On3Click 10 ToggleChannel 3
setButtonTimes 6 4 4

Reboot. [Elektroda, omniron, post #20856237]

What is a safe debounce setting for the button?

setButtonTimes 2 1 1 (200 ms long-press, 100 ms click) preserves double-click detection while avoiding false repeats [Elektroda, p.kaczmarek2, post #20854725]

Wi-Fi range is half that of my ESP-based plug—normal?

Edge-case: several users report BK7231N RSSI 8–12 dB weaker than ESP8266 in identical enclosures [Elektroda, omniron, post #20850804] Position the tap farther from metal and update to firmware ≥1.17.335 which boosts TX power by ~1 dB [OpenBK Changelog].

Can I back up and clone a working configuration?

Yes. In Web-App → Flash → Download OBKConfig (JSON) and LittleFS.tar. Restore them on another unit after flashing the same .ug image. Do not copy RF partition; each plug needs its own MAC [Elektroda, p.kaczmarek2, post #20852326]

Is it possible to flash firmware, template and autoexec in one pass?

Not today. Flash the .ug image first, then POST /upload for obkconfig.json and finally upload autoexec.bat. Batch support is on the OpenBeken roadmap (Q2-2025) [OpenBK Issue #642].

What if I bricked the plug and only relays click?

Hold the button 5× quickly to enter Safe-Config mode (fast LED blink). Connect to its AP, re-flash the .ug file via Web → OTA. This recovery works unless bootloader region is corrupted (<1 % of cases) [Elektroda, omniron, post #20860450]