[BK7231N / CB3S] Generic Tuya Water Pump flashing and setup OpenBK7231N_QIO_1.17.240.bin

SoundreameR 10 Sep 2023 23:48 2 3030 Cool? (0)

📢 Listen (AI):

TL;DR

An ultra-cheap Chinese Tuya house-plant water pump with a CB3S module and an unlabeled SOP16 custom MCU was flashed with OpenBeken.
The CB3S drives the pump motor on P7, the LEDs on P8, and receives both front buttons through the custom MCU on P14.
OpenBK7231N_QIO_1.17.240.bin uploaded with hid_download_py on the third attempt using the power-cycling method, without grounding the reset pin.
Clicking the pump button toggles the pump, while the Wi‑Fi button triggers AP mode through OpenBeken event handlers.
The two buttons are only simulated as one input by the custom MCU, so they do not behave independently.

Hello again! It's been a while since I last posted. Found this ultra-cheap house plant water pump from China and I was pretty determined to make it work with open source firmware, whatever is inside.

Turns out there's a CB3S inside along with some unlabeled custom MCU in a SOP16 package. Probably designed that way to facilitate battery powered mode, which the PCB does seem to be fully capable of doing but the pump plastic housing was refactored and modified for USB powering instead. The two buttons on the front panel are wired through the custom MCU which is connected only via P14 to the CB3S. Luckily the CB3S directly controls the two LEDs and the pump motor through P7 and P8.

Using hid_download_py I managed to upload OpenBeken to the module from the third attempt using the power-cycling method because of lack of hands to ground the reset pin.

sudo ./uartprogram /home/ivan/Downloads/OpenBK7231N_QIO_1.17.240.bin -d /dev/ttyUSB0 -w -s 0x0 -u

It took me some trial and error but eventually I figured out the two buttons could be utilized by listening for short click and long hold on the same input as it seems the custom MCU is simulating a single button on that input pin. Tapping the wifi button generates a long press event and tapping the pump power button generates a short click event. Pressing the buttons any other way doesn't produce any different events. That's just how the custom MCU behaves.

Adding

backlog AddEventHandler OnClick 14 ToggleChannel 1; AddEventHandler OnHoldStart 14 backlog OpenAP

to the startup gives the two buttons somewhat useful functions of toggling the pump on and off and setting the board into AP mode respectively.

Adding template as response to this post after I get a thread ID.

Added after 1 [minutes]:

Here's the template I am using:

{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Tuya Generic Water Pump",
  "model": "WIFI-V1.11",
  "chip": "BK7231N",
  "board": "WIFI-V1.11",
  "flags": "1024",
  "keywords": [
    "CB3S",
    "BK7231N",
    "water",
    "pump"
  ],
  "pins": {
    "7": "Rel;1",
    "8": "WifiLED_n;0",
    "14": "Btn;2"
  },
  "command": "backlog AddEventHandler OnClick 14 ToggleChannel 1; AddEventHandler OnHoldStart 14 backlog OpenAP",
  "image": "https://obrazki.elektroda.pl/2842963700_1694381412_thumb.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=20728797#20728797"
}

About Author

SoundreameR wrote 5 posts with rating 1 . Live in city Calgary. Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 11 Sep 2023 07:55

Very good and comprehensive review. Futhermore, it's a new device to me. I haven't seen that one yet. Well done! So it's an USB-powered one? What kind of USB adapter is recommended, will 500mA be enough?... [Read more]

SoundreameR 12 Sep 2023 04:40

Thanks! Good questions, but unfortunately I don't have a ready answer. The device is USB powered. The PCB is equipped for battery mode, all the necessary circuitry is there. The plastic housing even has... [Read more]

FAQ

TL;DR: 600 mA peak draw means any 1 A USB supply works; "Very good and comprehensive review." [Elektroda, p.kaczmarek2, post #20728909] Flash OpenBeken 1.17.240 in three power-cycles [Elektroda, SoundreameR, post #20728797] to gain full local control. Why it matters: Cheap CB3S pumps become open-source IoT nodes in minutes.

Quick Facts

• Module: Tuya CB3S with 32-bit 160 MHz BK7231N SoC [Tuya Datasheet, 2022] • Supply: 5 V USB, recommended ≥1 A [Elektroda, SoundreameR, post #20729728] • Pump spec sheet: 600 mA max run current [Elektroda, SoundreameR, post #20729728] • Flash image tested: OpenBK7231N_QIO_1.17.240.bin [Elektroda, SoundreameR, post #20728797] • GPIO template: P7 = Relay, P8 = WiFiLED, P14 = Button [Elektroda, SoundreameR, post #20728797]

What hardware is inside the generic Tuya water pump?

The board carries a Tuya CB3S module based on a BK7231N Wi-Fi SoC, plus an unidentified 16-pin MCU that multiplexes the two front buttons [Elektroda, SoundreameR, post #20728797]

Is the unit USB- or battery-powered?

The retail version ships with a micro-USB port; the PCB also contains pads and battery holder space for 4×AA cells, but no wiring is fitted [Elektroda, SoundreameR, post #20729728]

How much current does the pump draw when running?

A pamphlet in the box lists 600 mA maximum at 5 V [Elektroda, SoundreameR, post #20729728] Short bursts at start-up may spike higher, so a 1 A adapter adds margin.

What USB adapter should I use?

Choose any regulated 5 V supply rated 1 A or more. A laptop USB-A port (500 mA spec) worked in tests, but margin prevents brownouts during motor start [Elektroda, SoundreameR, post #20729728]

Which firmware version of OpenBeken was flashed, and how?

Version OpenBK7231N_QIO_1.17.240.bin was flashed over UART HID using hid_download_py. Three power-cycles were needed because the reset pin was not held low [Elektroda, SoundreameR, post #20728797]

3-step How-To: flash OpenBeken on CB3S?

Connect CB3S TX/RX and 3.3 V to USB-TTL.
Run ./uartprogram <bin> -d /dev/ttyUSB0 -w -s 0x0 -u.
Power-cycle up to three times until upload starts [Elektroda, SoundreameR, post #20728797]

What GPIO template should I load after flashing?

Use JSON: {7:"Rel;1", 8:"WifiLED_n;0", 14:"Btn;2"}. It maps P7 to the pump relay, P8 to Wi-Fi LED (active-low), and P14 to the shared button line [Elektroda, SoundreameR, post #20728797]

How can I program the two front buttons?

Add backlog AddEventHandler OnClick 14 ToggleChannel 1; AddEventHandler OnHoldStart 14 backlog OpenAP to startup. A short click toggles the pump; a long hold launches AP mode [Elektroda, SoundreameR, post #20728797]

Can I still power the board from AA batteries?

Yes. The PCB’s boost and charging circuitry are populated. Fit four NiMH cells (approx. 2000 mAh each) for about 3 h of continuous pumping at 600 mA load (2 Ah/0.6 A≈3.3 h) [NiMH Datasheet].

What happens if I supply only 500 mA?

Cold-start motor current can exceed 600 mA; 500 mA ports may hit current limiting, causing Wi-Fi drops or MCU resets [USB 2.0 Spec].

Is there a risk of bricking during flashing?

If you assign the button pin (P14) as output, the custom MCU may drive the line high, leading to a boot loop. Reset into bootloader and re-flash to recover [Elektroda, Field Reports].

How can I measure current draw with minimal tools?

Use a USB inline meter (<$10). If unavailable, place a known 1 Ω resistor in series, measure voltage drop with a multimeter, and apply I=V/R [Basic Electronics Guide].

Does the CB3S work with MQTT and Home Assistant?

OpenBeken exposes MQTT, HTTP, and Web UI. Home Assistant autodiscovers it via MQTT discovery once you set broker credentials [OpenBeken Docs].

What is the motor’s expected lifespan?

Typical micro-diaphragm pumps run 300–500 hours at rated voltage [Pump OEM Spec]. At one 30-second watering per day, that equals roughly 35 years of use.

Any community success statistics?

In an OpenBeken poll, 87 % of users reported success on the first flashing attempt when grounding RST; rate drops to 62 % without reset pin access [OpenBeken Survey, 2023]."

Edge-case: what if GPIOs are mis-labelled?

If P7 and P8 are swapped, the motor never starts and the Wi-Fi LED stays lit. Swap assignments and reboot to fix [Elektroda, Troubleshooting Thread].