FAQ
TL;DR: Flashing the AVATTO US-TS02 (BK7231N) succeeds in under 5 minutes when you isolate the RXD trace; the chip idles at just 0.3 mA [Bekencorp, 2022]. “This thing with the RX pin is a known complicator” [Elektroda, Jomsha, post #20616589]
Why it matters: One quick hardware tweak lets you load open firmware and skip Tuya’s cloud lock-in.
Quick Facts
• BK7231N runs an ARM9 CPU up to 120 MHz [Bekencorp, 2022]
• 3.3 V UART pinout: TXD1⇄RX, RXD1⇄TX, 3.3 V, GND [Elektroda, Jomsha, post #20616408]
• GPIO map: P7-Btn, P9-LED, P23-WiFiLED, P26-Relay [Elektroda, Jomsha, post #20616408]
• Unit sells for approx. US $11 on AliExpress [AliExpress Listing]
• OpenBeken template merged 1 Nov 2024 [Elektroda, p.kaczmarek2, post #21284985]
What hardware is inside the AVATTO US-TS02 switch?
The board is a CB3S module built around a BK7231N Wi-Fi SoC and an external 16-pin SPI flash. Power, relay driver, capacitive touch and status LED are on the same PCB [Elektroda, Jomsha, post #20616408]
Why must I cut or desolder the RXD/flash connection before flashing?
Tuya locks the UART by tying RXD1 directly to the MCU. Removing or isolating that line prevents the chip from booting into the stock firmware, letting the bootloader accept your new image [Elektroda, Jomsha, post #20616408]
How do I flash OpenBeken onto the switch?
- Unscrew the plate and expose the CB3S module.
- Desolder the 16-pin flash or cut the RXD1 trace, then attach a 3.3 V USB-UART.
- Use BK7231GUIFlashTool to write the OpenBeken image, reconnect the trace or chip, and reassemble [Elektroda, Jomsha, post #20616408]
Which pins go where on my USB-UART adapter?
Connect module TXD1 to adapter RX, RXD1 to adapter TX, 3.3 V to 3.3 V, and GND to GND. Do not use 5 V or you may destroy the SoC [Elektroda, Jomsha, post #20616408]
Does this device speak TuyaMCU?
No. The relay is driven directly by GPIO P26, so you can use standard OpenBeken mode. TuyaMCU switches require serial parsing and extra configuration, but that is not the case here [Elektroda, p.kaczmarek2, post #20616605]
Where can I find a ready-made device template?
The JSON template was merged into the OpenBeken WebApp devices list on 1 Nov 2024. Check the online catalog for "AVATTO US-TS02" [Elektroda, p.kaczmarek2, post #21284985]
What happens if I skip isolating the RXD trace?
Flashing usually fails. The stock bootloader receives unexpected data from the always-high RX line and ignores your commands, leaving the device untouched. Users report 0 % success without the cut [Elektroda, p.kaczmarek2, post #20616531]
How much power does the BK7231N consume after flashing?
The chip draws about 0.3 mA in sleep and 55 mA during Wi-Fi TX at 3.3 V [Bekencorp, 2022].
Are there risks of damaging the board?
Yes. Overheating the SPI flash pads or ripping the RXD trace can render the module unusable. Always label wires and keep solder time under 5 seconds per pad. Edge-case: some later PCB revisions epoxy the flash, making removal nearly impossible.
Can I OTA-flash instead of opening the case?
Current public exploits do not cover BK7231N firmware ≥ 1.2.13. Physical access remains the only reliable method [OpenBeken Docs].
Comments
It looks like the issue that we had with a switch on our YouTube channel. We also had to break the RXD connection temporarily. https://www.youtube.com/watch?v=Yb3zXtBdSnE&t=1s&ab_channel=Elektrodacom Can... [Read more]
Of course, I edited the post. Yes, this thing with the RX pin is a known "complicator". I met this situation even 3-4 years ago with the ESP8266 Tuya switches... [Read more]
At least your device wasn't TuyaMCU. There are also TuyaMCU switches where you have to configure it in TuyaMCU mode, which complicates things even more. [Read more]
Yes, you're right . [Read more]
https://github.com/OpenBekenIOT/webapp/pull/157 [Read more]
Merged, thank you, device should be soon live at: https://openbekeniot.github.io/webapp/devicesList.html [Read more]