[CB2S/BL0937] No name plug (QNCX) 20A (actually 16A relay)

GP007 29 Apr 2023 13:42 24 5271 Cool? (+4)

Listen:

TL;DR

A no-name AliExpress smart plug sold as a 20A energy-monitoring outlet was torn down, revealing a CB2S module and BL0937 metering.
The enclosure can be opened with a clamp in 2–3 minutes, then the CB2S can be desoldered and flashed with OpenBeken using BK7231 GUI Flash Tool.
The relay inside is only 16A, and the plug cost $2.99 in the promotion.
Pin mapping included P6 BL0937CF1, P7 BL0937CF, P8 blue LED, P10 button, P24 BL0937SEL, and P26 relay.
Calibration with a 60W bulb that measured 62W at 229V gave accurate readings, and flag 38 fixed the strange OFF measurement.

AI summary based on the discussion. May contain errors.

Plug purchased on ali in the promotion "3 items from" for 2.99 USD as 20A with energy measurement. The box is completely noname, there are also no inscriptions on the plug.
Plus there are two diodes - blue for wifi, red for on / off.

Link without promotion: link

Initially I was going to use it with domoticz with Tuya plugin but curiosity prevailed.
Attempts to upload via tuya cloudcutter failed.

Demolition - practically damage-free with such a clamp:

Now I know that such sockets can be dismantled without much problem, only a moment of patience is required, i.e. 2-3 minutes

Inside there is a surprise: a 16A relay, the thickness of the solder and the PE cable is not great.
I opened a dispute on ali and they gave back half the price without resistance.
There we find the CB2S chip and the energy measurement using BL0937

I desoldered the CB2S for programming, the braid is necessary.
Soft uploaded using BK7231 GUI Flash Tool - here I had a small problem at the beginning because WIN10 lost the drivers for CP2102 after the next update, but after realizing the situation it went without major problems.

Configuration with the help of other topics from the electrode:

P6 BL0937CF1
P7 BL0937CF
P8 LED (blue)
P10 Btn
P24 BL0937SEL
P26 Rel (probably also a second red diode here)

After calibrating with a 60W bulb that is actually 62W at 229V and a Fluke multimeter it seems to measure approx.

Only with the OFF position there is a strange measurement instead of 0.

edit: Flag 38 helped with off measurement
If there was such a plugin, please remove it, this is the third device on which I uploaded openbeken, previously two mini switches - one OTA, the other soldering.
Thanks to the creator - respect!

About Author

GP007 wrote 16 posts with rating 7 . Been with us since 2019 year.

Comments

Add a comment

p.kaczmarek2 29 Apr 2023 18:00

Hello, I see this is another LSPA9 style device. I often see such, but another review won't hurt, it's hard to judge what is what if the manufacturer does not sign the product. Strange measurements... [Read more]

GP007 29 Apr 2023 21:21

I have some backup [Read more]

GP007 30 Apr 2023 12:55

Ustawiłem flagę 30 [MQTT] Enable Tasmota TELE etc publishes (for ioBroker etc) i mimo wydania komend: VCPPublishThreshold 0.5 0.01 0.5 oraz VCPPublishIntervals 30 60 średnio co 3 sekundy mam... [Read more]

p.kaczmarek2 30 Apr 2023 12:59

I don't think it interferes with anything, but the Tele Tasmota emulation is changed by another command: https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md https://obrazki.elektroda.pl/3324580000_1682852333_thumb.jpg... [Read more]

GP007 30 Apr 2023 13:14

I tried TasTeleInterval 60 60 but i get the answer: Error:CMD:cmd TasTeleInterval NOT found (args 60 60) unknown command [Read more]

p.kaczmarek2 30 Apr 2023 13:48

Maybe you have too old version. Additionally, you need to run these commands on every boot, eg via autoexec.bat [Read more]

GP007 30 Apr 2023 14:32

Thanks! I had version 1.17.11, after uploading 1.17.74 it's ok. [Read more]

Mateusz_konstruktor 02 May 2023 19:58

Try peeling off the sticker covering some of the markings. https://obrazki.elektroda.pl/1811828600_1683050286_thumb.jpg [Read more]

IDzOR 12 May 2023 09:29

Hello! I've bought similar plug on aliexpress. Paper box, looks the same, however the plug is signed as ELIVCO, model LSPA9. Interesting thing is, unlike to Elivco plug in other ( p.kaczmarek2) posts,... [Read more]

p.kaczmarek2 12 May 2023 09:50

Good job! Remember also to try out our new flasher/configurator: https://github.com/openshwprojects/BK7231GUIFlashTool You can just download it, and drag and drop your 2MB binary, and take a look: ... [Read more]

IDzOR 12 May 2023 11:40

Thanks a lot. You solved it. This pinout perfectly works for me: P6 BL0937CF1 P7 BL0937CF P8 WifiLED //Blue LED P10 Btn (channel 1) P23 LED_n (channel 1) //Red LED lighting when relay is switched... [Read more]

IDzOR 18 Jun 2023 23:06

Hello mister @pkaczmarek2 I have updated version to 1.17.137. I have find out two strange issues and you can help me out. 1) I can see in the log info: Info:GEN:sta:rssi=-67,ssid=Archer,bssid=14:cc:20:0c:63:8e,channel=1,cipher_type:CCMP But... [Read more]

p.kaczmarek2 18 Jun 2023 23:09

Very good spotting. First issue is just caused by a placeholder in our code. We don't have BSSID printed correctly yet. It's just a placeholder that is there all the time for everybody. I will try to fix... [Read more]

Jacekmiel1 18 Jan 2024 17:53

Hi, I have the same no name plug from Polish allegro. My question is as follows. Do I have to solder the CB2S board out of the module (e.g. because of other connections on it that may interfere with... [Read more]

p.kaczmarek2 18 Jan 2024 20:46

@jacekmiel1 first post indicates that P10 (RX1) is used as a button, only now I don't know if there is also a debouncing capacitor there? If so, it needs to be soldered out. If not, it will be possible... [Read more]

Jacekmiel1 18 Jan 2024 22:08

[Read more]

p.kaczmarek2 18 Jan 2024 23:01

[Read more]

Jacekmiel1 18 Jan 2024 23:11

[Read more]

Jacekmiel1 31 Jan 2024 21:54

Okay, I would like to leave information that I finally managed to program this socket with your software ;) The relay control works without any problems, but there is a problem with the button operation,... [Read more]

FAQ

TL;DR: 16A relay, not advertised 20A: “flux and braid” is the key desoldering advice for flashing this CB2S/BL0937 QNCX or ELIVCO LSPA9 smart plug with OpenBeken, setting GPIOs, fixing off-state readings, and controlling MQTT telemetry. [#20916690] Why it matters: This plug can run OpenBeken, but its real relay rating and wiring quality matter for safe load planning.

Alternative	Thread result	Specific note
BK7231 GUI Flash Tool	Worked for flashing	Used after CP2102 driver issue on Windows 10
bk7231tools	Worked for backup	Successful 2MB backup was reported
hid_download_py	Worked faster for backup	Reported as significantly faster than bk7231tools

Key insight: Treat this “20A” plug as a 16A-class device, then configure OpenBeken with the extracted Tuya GPIO map. Flag 38 prevents misleading BL0937 power and current values when the relay is open.

Quick Facts

The AliExpress promotion price was 2.99 USD, but the opened plug contained a 16A relay despite a 20A listing. [#20560043]
The working OpenBeken energy pins are P6 BL0937CF1, P7 BL0937CF, and P24 BL0937SEL. [#20560043]
Calibration used a 60W bulb measured as 62W at 229V with a Fluke multimeter. [#20560043]
OpenBeken 1.17.11 did not recognize TasTeleInterval; version 1.17.74 fixed the command issue. [#20561214]
The Tuya-extracted configuration added P23 as LED channel 1 and P26 as relay channel 1. [#20577028]

How do I flash OpenBeken on a no-name QNCX/ELIVCO LSPA9 smart plug with a CB2S module and BL0937 energy metering?

Flash OpenBeken by accessing the CB2S module, backing up firmware, then writing the correct BK7231 image.

Open the plug carefully; the thread used a clamp and needed about 2–3 minutes.
Desolder CB2S if in-circuit UART fails; use braid for clean pads.
Flash with BK7231 GUI Flash Tool, then set the BL0937 and relay pins. One reported working firmware was OpenBK7231N_QIO_1.17.104 on the ELIVCO LSPA9 variant. [#20576998]

What is the correct OpenBeken GPIO pinout for the CB2S BL0937 no-name 16A/20A smart plug?

Use P6 BL0937CF1, P7 BL0937CF, P8 WiFi LED, P10 button, P23 LED, P24 BL0937SEL, and P26 relay. The initial no-name plug used P8 as blue LED, P10 as button, P24 as BL0937SEL, and P26 as relay. The later ELIVCO LSPA9 backup confirmed P23 as the second LED. Set channel 1 on the button, LED, and relay where OpenBeken asks for a channel. [#20577028]

Why does a BL0937 smart plug show non-zero power or current readings when the relay is off, and how does OpenBeken flag 38 fix it?

The plug can report stray BL0937 power data while the relay is open, so OpenBeken flag 38 forces zero power and current. The thread shows an off-state measurement issue after calibration. The fix was flag 38, described as “Set power and current to zero if all relays are open.” Use it when the relay is off but MQTT or the WebApp still shows non-zero current or power. [#20560296]

How can I calibrate BL0937 power measurement in OpenBeken using a known load like a 60W bulb and a multimeter?

Calibrate BL0937 by comparing OpenBeken readings against a measured load and real mains voltage. The thread used a 60W bulb that actually drew 62W at 229V. A Fluke multimeter supplied the reference voltage. After calibration, the plug measured approximately correctly. Keep the relay on during calibration, then enable flag 38 if off-state readings do not return to zero. [#20560043]

What is CB2S, and how is it related to BK7231T/BK7231N chips used in Tuya smart plugs?

CB2S is a Tuya smart-plug Wi-Fi module that carries the BK7231-class microcontroller and exposes GPIOs used by OpenBeken. In this thread, the no-name plug used CB2S, while a similar ELIVCO LSPA9 had CB2S with a Belon BL2028N marking. OpenBeken was flashed with BK7231 tools, including OpenBK7231N_QIO_1.17.104 on one unit. [#20576998]

What is BL0937, and what role does it play in energy monitoring smart sockets?

BL0937 is an energy-metering chip that reports electrical measurement signals to the Wi-Fi module through CF, CF1, and SEL pins. In this plug, OpenBeken maps it as P6 BL0937CF1, P7 BL0937CF, and P24 BL0937SEL. It produced voltage, current, power, apparent power, reactive power, power factor, and consumption fields in MQTT telemetry. [#20561086]

BK7231 GUI Flash Tool vs bk7231tools vs hid_download_py — which flasher is better for backing up and flashing CB2S smart plugs?

All three tools worked in the thread, but hid_download_py was reported as faster for backup. BK7231 GUI Flash Tool handled flashing and can also inspect a 2MB binary. bk7231tools successfully created a backup. The most practical workflow is backup first, then use BK7231 GUI Flash Tool for configuration review and OpenBeken flashing. One user flashed OpenBK7231N_QIO_1.17.104 successfully. [#20576998]

How do I reduce frequent MQTT tele/SENSOR messages in OpenBeken Tasmota telemetry emulation?

Use TasTeleInterval for Tasmota telemetry emulation, not VCPPublishThreshold or VCPPublishIntervals. The thread showed SENSOR messages every 3 seconds despite VCP commands. The correct command format was TasTeleInterval [SensorInterval] [StateInterval], for example TasTeleInterval 60 60. Store the command in autoexec.bat if you need it after every reboot. [#20561089]

Why does the OpenBeken command TasTeleInterval return “CMD NOT found,” and which firmware version supports it?

TasTeleInterval returns “CMD NOT found” when the OpenBeken firmware is too old. In the thread, version 1.17.11 rejected TasTeleInterval 60 60. After updating to version 1.17.74, the command worked. This is a firmware-version failure, not a wiring issue or MQTT broker issue. [#20561214]

How can I make the red LED on an ELIVCO LSPA9 or no-name CB2S smart plug follow the relay state in OpenBeken?

Set the red LED GPIO to channel 1 and choose the LED role that matches the desired relay state. The extracted configuration showed P23 as LED channel 1. The working user configuration used P23 LED_n channel 1, with red LED behavior synchronized to the relay. P8 controlled the blue Wi-Fi LED, while P26 controlled the relay. [#20577139]

How do I extract the original Tuya GPIO configuration from a 2MB firmware backup using BK7231GUIFlashTool?

Load the 2MB Tuya firmware backup into BK7231GUIFlashTool and inspect the extracted GPIO configuration. The tool can parse Tuya firmware and output an OpenBeken JSON template. In the thread, it extracted P24 BL0937 SEL, P10 button, P23 LED, P6 BL0937 VI, P8 Wi-Fi LED, P7 BL0937 ELE, and P26 relay. Double-check the result because the feature was described as experimental. [#20577028]

When flashing a CB2S module, when is it necessary to desolder the module instead of programming it in-circuit?

Desolder CB2S when connected circuitry interferes with UART flashing, especially around P10 RX1 or a debouncing capacitor. The expert advice was to desolder because it is simple with flux and braid. In-circuit flashing can work if RX/TX lines are not loaded. The thread’s first successful case desoldered CB2S, and a later case also programmed a desoldered board. [#20916690]

What should I check when BK7231 Easy UART Flasher keeps saying “Getting bus failed, will try again” while flashing a CB2S module?

Check RX/TX order, baud rate, reset method, power supply, and solder joint quality. The thread recommended swapping RX and TX, changing baud rate, and resetting by power cycling instead of only grounding CEN. The failing case used a desoldered CB2S board. The final fix was likely cold solder joints on RX/TX, with a Windows restart also possible. [#20938758]

Where can I find alternative TX and VCC connection points on the main board if the CB2S pads are damaged during desoldering?

The thread does not provide confirmed alternative TX or VCC points for damaged CB2S pads. A user asked whether those lines were available on the BL0937 area, but no mapped repair points appeared in the supplied posts. Use the CB2S module pinout and continuity testing as the next practical step, but do not assume BL0937 carries UART TX or module VCC. [#21108410]

What safety concerns should I consider when an AliExpress smart plug is advertised as 20A but contains a 16A relay and thin PE wiring?

Treat the plug as limited by the 16A relay, not the 20A advertisement. The opened unit also had modest solder thickness and a thin PE conductor. The buyer opened an AliExpress dispute and received half the price back without resistance. Avoid using this plug near a claimed 20A load, especially for long-duration heating or high-current appliances. [#20560043]

AI summary based on the discussion. May contain errors.