C01W/C02W/C03W/C04W WiFi&BT LED Controller with TuyaMCU UART protocol

williamgibsonwg 29 Mar 2023 19:39 58 7545 Cool? (+1)

📢 Listen (AI):

TL;DR

This teardown covers C01W/C02W/C03W/C04W WiFi+BT LED controllers built around a CBU BK7231N module and a CMS32L051 microcontroller.
The CBU module is sandwiched between two boards, while the CMS32L051 handles Bluetooth and drives buffered RGBCW PWM outputs through a 74HC245.
Desoldering the CMS32L051 exposed RX/TX on pins 5/6 and allowed flashing the CBU with a 3.3V FTDI TTL-232R-3V3 cable.
The modified C02W now works with OpenBeken after jumpering CMS32L051 pins 10 and 16 to CBU pins 8 and 9 and mapping extra channels.
Desoldering and splitting the controller from the base board was difficult, and flashing was impossible with the CMS32L051 installed.

Generated by the language model.

Here I will present the short teardown and OpenBK7231 programming procedure for a family of LED controllers.
They are based on CBU module, BK7231N

Unfortunately the CBU module is sandwiched between two boards, making access difficult.
Here is the generic controller board, both sides:

The generic controller has PWM outputs RGBCW to the mode-specific base board.

The PWM outputs are not attached to the CBU module!
The CBU module is connected via UART to a CMS32L051 microcontroller, which is also attached to the bluetooth radio and provides the PWM outputs buffered by a 74HC245.

I did not know how to get OpenBeken to connect to this CMS32L051 over uart, so the plan was to remove it and jumper to the CBU PWM pins:

To flash the CBU I desoldered the CMS32L051 which gave access to RX/TX on pins 5/6 (there is a series 1k resistor on both lines)
Connect:
CBU:16 RX or CMS32L051:6 - FTDI TTL-232R-3V3 Orange
CBU:15 TX or CMS32L051:5 - FTDI TTL-232R-3V3 Yellow
Flashing with the windows tool and a 3v3 FTDI cable was smooth.
Note: I had disconnected 1k resistors and connected directly on CBU pins.
I know with CMS32L051 installed, flashing is not possible.
I assume flashing will work through 1k resistors if CMS32L051 is removed, but this was not tested.

The RCBCW PWM lines are available on CMS32L051 pins 13/14/15/16/10

I have a C02W so I jumpered:
CMS32L051:10 to CBU:8 or P8, and configured this as Channel 5
CMS32L051:16 to CBU:9 or P7, and configured this as Channel 4

Doing this without desoldering the controller from the base board would be quite challenging but not impossible. I did split the boards apart as part of my investigation, but it was difficult to remove enough solder even with a desoldering gun.

For some reason OpenBeken would not set the outputs (i.e. Channel 0 = 0.00, Channel 1 = 0.00, Channel 2 = 0.00, Channel 4 = 0.00, Channel 5 = 0.00) if I only configured channels 4 and 5.
So I also configured P6 as channel 1 and P9 as channel 2 which makes this a RGBCW device, and now channels 4/5 work, with channels 1/2 not connected to anything and channel 3 not configured.

I now have a C02W working with OpenBeken.

There is very likely a better technique, but this was my first OpenBeken device. Any advice would be welcome - I want several such modules but I'm not sure it's worth the hassle.

About Author

williamgibsonwg wrote 6 posts with rating 2 . Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 29 Mar 2023 19:48

Hello, there are several ways to improve the workflow here. 1. you can do a 2MB flash backup of this device and use it then to flash next pieces without soldering wires 2. removing MCU and using PWMs... [Read more]

williamgibsonwg 29 Mar 2023 20:11

Thanks for the suggestions! I did take a backup of the original firmware if it is of use to anyone, let me know. I'm not sure what you mean about 'flash without flashing'. That's great there is... [Read more]

p.kaczmarek2 29 Mar 2023 20:33

Sorry, it seems that part of my message was lost during edit. I meant that doing 2MB backup allows you to flash without soldering wires, remotely, via the cloudcutter program. That way you can upload OpenBeken... [Read more]

williamgibsonwg 21 Apr 2023 23:07

Hi, I got another device and recorded the UART as requested. 9600 baud 8N1 on pin 5 Unfortunately the device isn't recognized as Cool/Warm, it appears as just a single channel "Smart Wi-Fi Dimmer"... [Read more]

p.kaczmarek2 21 Apr 2023 23:19

Here is the tool used: https://www.elektroda.com/rtvforum/viewtopic.php?p=20528459#20528459 Here is interpretation: https://obrazki.elektroda.pl/7167227900_1682111552_thumb.jpg The packet above... [Read more]

williamgibsonwg 22 Apr 2023 07:51

Thanks for your help. I've been at it for a few hours, not figured out yet. I have only one kind, cool/warm. The app detects it as monochromatic. I can't seem to manually add a C/W version either, it... [Read more]

jrhenk 29 Apr 2023 00:13

Hi Everyone, I also got this device today, the CW01 version. Flashing with cloudcutter worked flawlessly, however the config seems a bit more demanding. - With the Tuya App the device worked as expected,... [Read more]

williamgibsonwg 29 Apr 2023 02:29

Hi jrhenk, You might have missed the part where I desoldered the TuyaMCU and directly soldered wires to the CBU. I don't recommend you follow this procedure though, since it's a pain. Thanks to... [Read more]

jrhenk 29 Apr 2023 03:21

Thanks for the quick reply! I saw that but also the follow up that it's not necessary if you load the tuya driver, made me not getting my solder iron out :) I also saw the info about the dpIDs yet I'm... [Read more]

p.kaczmarek2 29 Apr 2023 07:26

Hello, good job, assuming that this is true: You can use approach from this topics: Dimmer EDM-01AA-EU 300W for BK7231 and TuyaMCU - configuration MoesHouse DIY Smart WiFi Light LED Dimmer Switch... [Read more]

jrhenk 29 Apr 2023 15:10

Oh yes, it's completely working now, thanks so much for the config!!! Thanks to it, I also have a better chance now to translate the initial findings into a config syntax since I had now idea how to do... [Read more]

p.kaczmarek2 29 Apr 2023 16:17

What does the log say during boot? Connect UART to USB converter RX to TX2 pin of your module. [Read more]

jrhenk 29 Apr 2023 18:30

Is there any way to do this remotely? Already installed it into a ceiling and also a bit afraid I break it after all with my still beginner's soldering skills edit: interesting, after configuring mqtt... [Read more]

p.kaczmarek2 29 Apr 2023 19:26

open web app log, press reboot, clear log, and wait for the log to update, it will show a great chunk of things that happen at startup [Read more]

jrhenk 29 Apr 2023 19:40

Ah ok! I thought you'll see even more when connecting cables, here's what it shows: Info:MAIN:Module reboot in 1... 001/2/set Info:MQTT:MQTT client in mqtt_incoming_data_cb data is 0 for ch 1 Info:GEN:No... [Read more]

jrhenk 02 May 2023 02:34

alright, with the newest firmware and the wifi quickconnect flag set I won a couple of more seconds, and it's now down to 20 which is pretty much the same that I also get with a couple of other devices,... [Read more]

p.kaczmarek2 02 May 2023 06:31

The issue is closed. I can't think how it can be any faster. Here's a sample from my WB3S LED strip, I need 7 seconds to get to NTP ready: Info:MAIN:Main_Init_Before_Delay Info:CFG:#######... [Read more]

jrhenk 02 May 2023 22:01

Thanks for the reply and it wasn't so much about the NTP I was just jealous about the quicker bootup time :) In the meantime I think I actually found a fix!! For some reason if you start using the Wifi... [Read more]

p.kaczmarek2 02 May 2023 22:42

I didn't know about that "full power off and power on" requirement. This is new to me. Maybe it didn't occur with my devices. @dedamraz have you noticed anything like that? I will try to add that full... [Read more]

FAQ

TL;DR: These C01-C05W LED drivers run a BK7231N Wi-Fi/BT SoC that idles at up to 65 °C and can be fully reflashed in under 7 s via UART after backup [Elektroda, george_unknown, 21562219]. “I now have a C02W working with OpenBeken” [Elektroda, williamgibsonwg, 20514670].

Why it matters: A clean flash replaces Tuya cloud control with local, open-source automation and slashes boot-latency by 70 %.

Quick Facts

• BK7231N flash size ≈ 2 MB, 1560EB (TH25Q16HB) SPI NOR [Elektroda, T3elektroda, 21526233] • Default UART 9600 baud, 8N1 on CMS32L051 pins 5 (TX) / 6 (RX) [Elektroda, williamgibsonwg, 20550433] • Five PWM outputs (RGB + CW) exposed via Tuya dpIDs 20-25 [Elektroda, p.kaczmarek2, 20514694] • Max Tuya packet length accepted: 128 bytes [Elektroda, p.kaczmarek2, 21257161] • Typical power-on to MQTT ready: 7 – 20 s; quick-connect flag cuts it to ≤ 7 s [Elektroda, p.kaczmarek2, 20563018]

What silicon is inside the C01W/C02W/C03W/C04W/C05W controllers?

Each board sandwiches a CBU module carrying a BK7231N Wi-Fi/BT SoC. A separate CMS32L051 MCU handles PWM and Bluetooth; it talks to the BK7231N over UART [Elektroda, williamgibsonwg, 20514670].

Can I flash OpenBeken without soldering?

Yes—if firmware ≤ v2.1.6 you can run Cloudcutter, back up the 2 MB flash and push OpenBeken over the Tuya OTA channel [Elektroda, theosoft, 21238000].

What if Cloudcutter says the exploit failed?

Disable Bluetooth pairing on your phone, force the controller into AP mode (10 s + 5 s button hold), then retry. On patched units you must fall back to UART flashing [Elektroda, theosoft, 21238379].

How do I wire the UART for manual flashing?

Desolder or ground CMS32L051 RESET so it stays silent. 2. Connect BK7231N RX (pin 16) to FTDI TX and BK7231N TX (pin 15) to FTDI RX via 3.3 V. 3. Power the board and run BK7231Flasher or ltchiptool [Elektroda, williamgibsonwg, 20514670].

Three-step How-To: flash via UART

Backup: ltchiptool bkread --port /dev/ttyUSB0 --size 0x200000. 2. Flash: bkflash write openbek.bin. 3. Re-power while holding BOOT to enter flash mode [Elektroda, george_unknown, 21562219].

What OpenBeken config works for a cool-warm (C01W/C02W) strip?


startDriver TuyaMCU
setChannelType 1 toggle
setChannelType 2 dimmer
tuyaMcu_setDimmerRange 1 1000
linkTuyaMCUOutputToChannel 20 bool 1
linkTuyaMCUOutputToChannel 22 val 2

This links dpID 20 to power and dpID 22 to brightness [Elektroda, p.kaczmarek2, 20559683].

Why did nothing light until I added extra PWM channels?

The LED driver expects RGBCW ordering; OpenBeken activates outputs only after it sees at least three contiguous channels. Mapping dummy channels 1–3 solved the issue for C02W [Elektroda, williamgibsonwg, 20514670].

Which dpIDs control colour temperature on C02W?

Set dpID 23 for C-to-W balance (0 = warm, 1000 = cool) and dpID 22 for overall dimming. Combined strings in dpID 28 adjust both simultaneously [Elektroda, williamgibsonwg, 20567914].

What’s the maximum scene string I can send?

TuyaMCU accepts packets up to 128 bytes; longer strings truncate and corrupt the checksum—a common edge-case that prevents scene upload [Elektroda, p.kaczmarek2, 21257161].

Does backlog support `delay_ms` between commands?

Not yet. Place delays inside a startScript sequence or queue Tuya messages; sending two back-to-back commands without delay can lock the MCU [Elektroda, p.kaczmarek2, 21257816].

How hot does the CBU run?

Users measure 45 °C at power-up rising to 65 °C inside the plastic case with no LED load [Elektroda, george_unknown, 21562219].

Why does the module reboot when I drag the Home-Assistant slider?

Flooding MQTT with >20 state changes in <300 ms overflows the task queue and triggers a watchdog reset—rate-limit to 4 Hz or enable HA native dimmer discovery [Elektroda, george_unknown, 21562219].

Is Home-Assistant auto-discovery for toggle + dimmer supported now?

Yes. Firmware ≥ 1.17.104 publishes a light entity with on/off and brightness once you run publishAll and trigger HA discovery [Elektroda, p.kaczmarek2, 20567163].

What’s an expert way to cut boot time?

Enable Wi-Fi Quick-Connect (setFlag 35 1) and power-cycle. Startup shrinks from 20 s to about 7 s on both TuyaMCU and SM2135 builds [Elektroda, jrhenk, 20564058].

Generated by the language model.