Manhot Store's BK7231N / CB3S Tuya Smart 4 Gang Switch: WiFi not Zigbee, CB3S Chip Inside

celulari 02 Dec 2023 00:36 14 2859 Cool? (+1)

📢 Listen (AI):

TL;DR

Manhot Store’s AliExpress 4-gang Tuya wall switch, advertised as Zigbee, is actually a WiFi switch with a CB3S chip inside.
Soldering a wire to the CEN pin puts the module into bootloader mode, allowing new firmware to be flashed.
The usable flashing pins are CEN, 3VCC, GND, RX1, and TX1, and the OpenBK pin map assigns P6 to the WiFi LED and P7–P14 to relays/buttons.
OpenBK7231N_QIO_1.17.308.bin flashed successfully with BK7231GuiFlashTool on Windows, while Ubuntu flashing failed; the orange relay indicator works, but the blue LED does not.

I've bought a wall switch from Manhot Store in aliexpress with 4 "clicky" buttons.

AliExpress link: https://www.aliexpress.com/item/1005005901971631.html

The device is listed as a Zigbee Smart switch, but it's actually a WiFi switch!! with a CB3S chip inside.

Now the fun part!

Regarding functionality, when a button is pressed, the corresponding relay is triggered.
The button has a light that shows whether the relay is open or closed - it will show up as orange when the relay is ON and blue when the relay is OFF.

The device is powered by a CB3S chip, although not all of its pins are soldered on the PCB. Upon checking the datasheet for the MCU, we can determine the required pins to flash the device:

Datasheet: https://developer.tuya.com/en/docs/iot/cb3s?id=Kai94mec0s076

Soldered a small wire to the CEN pin to put the device into bootloader mode in order to flash a new firmware.

Pin Name	Pin Number
CEN	3
VCC	8
GND	9
RX1	15
TX1	16

I was able to flash OpenBK using the new BK7231GuiFlashTool and the OpenBK7231N_QIO_1.17.308.bin firmware under windows, but no luck using the flash tool under linux (ubuntu).
I've attached the original .json device template.

This is the actual OpenBK pin configuration of the module.

Pin	Type	Channel
P6	WifiLED_n	-
P7	Relay	4
P8	Relay	3
P9	Relay	2
P10	Button	4
P14	Relay	1
P23	Button	3
P24	Button	2
P26	Button	1

Now only the orange led turn on when the relay is on, but the blue light doesn't work. it's fine...

Attachments:

smart switch 4 gang.zip (674 Bytes) You must be logged in to download this attachment.

About Author

celulari wrote 3 posts with rating 1 . Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 02 Dec 2023 10:12

Thanks for the review. That's very strange, you got a WiFi version instead of Zigbee, you should get a refund! Regarding the template, can you also add GPIO in a form of OBK template from the Web App? EDIT:... [Read more]

celulari 03 Dec 2023 04:33

Hi! Playing a bit with the GPIO finder i've dicovered that PIN 11 controls the BLUE LEDS. Selecting "LED" for pin 11 turns on the blue LEDs when the relay is off. when the relay is on, le blue leds... [Read more]

p.kaczmarek2 03 Dec 2023 08:09

That's interesting and very useful. By the way, If you want a permanent setting, you can change LED_n to AlwaysHigh or AlwaysAll. [Read more]

celulari 03 Dec 2023 18:20

Thanks for the tip!! I'm trying to find the way to get the opposite behaviour of the leds. blue when the relay is on and orange when is off. my other light switches work that way and is more intuitive,... [Read more]

chabalalasmike 25 Jun 2024 11:48

What about the reset button at the top, what is the pin number? [Read more]

p.kaczmarek2 25 Jun 2024 12:41

Whoa, very good question! It seems that we've missed one pin: https://obrazki.elektroda.pl/1440584900_1719312080_thumb.jpg It seems I need to add backlit_io_pin to our flasher soon. [Read more]

chabalalasmike 28 Jun 2024 23:11

Any progress on finding that missing pin? [Read more]

p.kaczmarek2 29 Jun 2024 09:11

As I said, have you tried P11? [Read more]

chabalalasmike 29 Jun 2024 18:32

GPI013 [Read more]

p.kaczmarek2 02 Jul 2024 13:04

I can't see this particular GPIO in the JSON. Can you try getting Tuya binary (Web App -> Flash tab) and attach it here so I can investigate if it was correctly extracted? [Read more]

divadiow 20 Nov 2024 08:19

yes. I have a Tuya device with 3 LEDs and this in the keys. "backlit_io_pin": 23 Device configuration, as extracted from Tuya: - Button (channel 1) on P20 - LED (channel 1) on P26 - WiFi... [Read more]

p.kaczmarek2 20 Nov 2024 12:16

Isn't it already added? https://github.com/search?q=repo%3Aopenshwprojects%2FBK7231GUIFlashTool%20backlit_io_pin&type=code Or maybe I need to add a build... [Read more]

divadiow 20 Nov 2024 12:20

ah yes. a few commits not in June 5th build it seems [Read more]

divadiow 24 Nov 2024 10:35

https://obrazki.elektroda.pl/7361657300_1732440883_thumb.jpg https://obrazki.elektroda.pl/5401697800_1732440934_thumb.jpg cool I've rather presumptuously given it a version of 1.3.4 [Read more]

FAQ

TL;DR: This FAQ explains why a 4-gang Manhot wall switch sold as Zigbee was identified as WiFi, with one expert calling it "very strange" after finding a CB3S / BK7231N module inside. It helps buyers, flashers, and OpenBK users confirm the real radio, wire the correct pins, and restore LED behavior after flashing. [#20842494]

Why it matters: If a listing promises Zigbee but ships WiFi hardware, it changes pairing, flashing, local-control options, and whether you should request a refund.

Aspect	Listed product	Hardware found in teardown
Wireless type	Zigbee smart switch	WiFi smart switch
Main module	Not confirmed in listing	CB3S
Platform	Expected Zigbee stack	BK7231N-based Tuya module
Channels	4-gang	4 relays + 4 buttons mapped in OpenBK

Key insight: The most valuable finding is that GPIO11 controls the blue backlight LEDs. Without configuring P11, OpenBK can switch all 4 relays, but the blue LED behavior looks broken or incomplete. [#20843825]

Quick Facts

The switch is a 4-gang wall model with 4 clicky buttons, and each button directly triggers its matching relay. Orange indicates relay ON, while blue indicates relay OFF in the stock behavior. [#20842321]
The confirmed flashing pads on the CB3S module are CEN pin 3, VCC pin 8, GND pin 9, RX1 pin 15, and TX1 pin 16. [#20842321]
One successful flash used BK7231GuiFlashTool on Windows with firmware OpenBK7231N_QIO_1.17.308.bin; the same user reported no luck under Linux Ubuntu. [#20842321]
The initial OpenBK map exposed 4 relays on P7, P8, P9, P14 and 4 buttons on P10, P23, P24, P26, which was later extended by finding the blue LED function on P11. [#20843825]
Support for Tuya's backlit_io_pin was discussed later, and a participant noted the feature existed in code but not in the June 5th build, explaining why some extra LED GPIOs could stay hidden. [#21310982]

1. Why is the Manhot Store 4 gang switch sold as Zigbee actually showing up as a WiFi device with a CB3S module inside?

Because the teardown showed a CB3S module on the board, and CB3S is the WiFi-based hardware used in this unit, not a Zigbee radio. The buyer explicitly reported that the AliExpress listing called it a Zigbee smart switch, but the opened device contained a CB3S chip and behaved as a WiFi switch instead. [#20842321]

2. How do I flash OpenBK on a Tuya CB3S / BK7231N smart wall switch using BK7231GuiFlashTool?

You flash it by wiring the CB3S serial pins and forcing bootloader mode with CEN. 1. Solder wires to CEN, VCC, GND, RX1, and TX1. 2. Pull CEN as needed to enter bootloader mode, then connect the UART flasher. 3. Use BK7231GuiFlashTool and write OpenBK7231N_QIO_1.17.308.bin; this worked on Windows in the thread. [#20842321]

3. What pins on the CB3S module do I need for flashing, including CEN, VCC, GND, RX1, and TX1?

You need five pins for the flashing setup shown in the thread: CEN pin 3, VCC pin 8, GND pin 9, RX1 pin 15, and TX1 pin 16. Those are the exact CB3S pad numbers the user identified from the datasheet and then used for flashing. [#20842321]

4. What is the CEN pin on a CB3S module, and how does it help put the BK7231N into bootloader mode?

CEN is the control pin the user wired to force bootloader entry for flashing. "CEN" is a module control pin that enables or resets the chip for startup, and in this case the user soldered a wire to it specifically to place the BK7231N-based CB3S into bootloader mode. [#20842321]

5. What is a CB3S chip in Tuya devices, and how is it related to the BK7231N platform?

CB3S is the Tuya module board used in this switch, and it is built on the BK7231N platform. "CB3S" is a Tuya WiFi module that provides the radio and MCU section for smart devices, and in this thread it is explicitly identified as the board carrying the BK7231N chip. [#20842494]

6. Why does the blue backlight LED not work after flashing OpenBK on this Tuya 4 gang switch until GPIO11 is configured?

Because the first OpenBK mapping did not include the GPIO that drives the blue backlight. The user initially flashed a working relay and button setup, but later discovered that P11 controls the blue LEDs, so blue light behavior stayed missing until GPIO11 was assigned. [#20843825]

7. How should I configure the OpenBK pin mapping for the Manhot / Tuya 4 gang BK7231N switch with relays on P7, P8, P9, and P14 and buttons on P10, P23, P24, and P26?

Use the mapping published in the thread: P6 WifiLED_n, P7 Relay 4, P8 Relay 3, P9 Relay 2, P10 Button 4, P14 Relay 1, P23 Button 3, P24 Button 2, and P26 Button 1. A later revision also added P11 = LED_n;52 for the blue backlight line. [#20843825]

8. Which GPIO controls the blue LEDs or backlight on this Tuya 4 gang switch, and how do LED vs LED_n settings change the behavior?

GPIO P11 controls the blue LEDs on this switch. The user found that setting P11 as LED turned the blue LEDs on when the relay was off, while setting P11 as LED_n kept the blue LEDs off all the time and left only the orange LEDs active when the relay turned on. [#20843825]

9. What is backlit_io_pin in a Tuya device configuration, and why can missing support for it hide an extra LED or button GPIO?

backlit_io_pin is a Tuya configuration key for a separate backlight control line that may not appear in a simple relay/button template. "backlit_io_pin" is a Tuya device-configuration field that identifies a dedicated backlight GPIO, separate from the main relay or button pins, and missing parser support can leave that extra LED-related pin undiscovered. [#21310683]

10. How can I keep the blue LEDs permanently off on this BK7231N switch using AlwaysHigh or AlwaysAll in OpenBK?

You can keep the blue LEDs permanently off by changing the P11 role from LED_n to a fixed-state output such as AlwaysHigh or AlwaysAll. That tip was given directly in the thread as the way to make the setting persistent instead of relying on the default LED behavior. [#20843872]

11. Is there a way to invert the LED behavior so the blue light is on when the relay is on and the orange light is on when it is off?

The thread does not provide a confirmed working method to invert the colors that way on this switch. The user asked for blue-on when the relay is on and orange-on when it is off, but no later post in the thread gave a tested OpenBK mapping or command that achieved that result. [#20844726]

12. What is the pin number for the small reset or top button on this Tuya CB3S 4 gang switch?

The later follow-up says the small top or reset button is GPIO13. That value appeared after the missing extra pin was discussed, so the thread's final stated answer for that button is GPI013 / GPIO13. [#21136946]

13. Why might BK7231GuiFlashTool work under Windows for this CB3S switch but fail under Linux Ubuntu?

The thread only confirms the outcome, not the exact root cause: Windows succeeded, while Linux Ubuntu failed in that user's setup. This is a real edge case for this device, because the same user reported a successful Windows flash with OpenBK7231N_QIO_1.17.308.bin but no luck using the Linux flasher. [#20842321]

14. How do I convert a Tuya JSON device template into an OpenBK template with the OpenBeken web app template importer?

Use the OpenBeken web app's templateImporter to convert the extracted Tuya JSON into OBK format. In the thread, the converted output produced an OpenBK template naming the device as a Tuya 4-gang WiFi switch, with BK7231N, CB3S, and the detected GPIO pin map already filled in. [#20842494]

15. WiFi smart switch vs Zigbee smart switch for wall controls like this Tuya 4 gang model — what are the practical differences for flashing, local control, and refunds when the listing is wrong?

For this device, the practical difference is simple: WiFi hardware let the owner flash OpenBK on a CB3S/BK7231N board, while the Zigbee listing was wrong enough that a refund was recommended. One reply even said, "you should get a refund!" That makes radio type a buying, flashing, and dispute issue, not just a naming issue. [#20842494]