1. What ICs are inside the LSPA7 smart plug?
The board carries a CB2S module with BK7231N Wi-Fi SoC, a BL0942 metering chip on UART1, a KP3210SG buck converter for 5 V, and a 5 V relay driver [Elektroda, electrikphone, post #20934148]
[BK7231N/CB2S/BL0942] LSPA7 Tuya Smart Plug teardown and flashing OpenBeken via UART procedure
TL;DR
- LSPA7 Tuya smart plug teardown identifies a CB2S module with BK7231N, a BL0942 energy-metering chip, a relay, and a KP3210SG power-supply chip.
- Tuya configuration exposes the wiring: button on P6, WiFi LED on P8, and relay on P26, which helps map the UART flashing setup.
- Flashing used a CP2102 USB-to-UART adapter and BK7231 GUI Flash Tool, with the adapter powering the CB2S during the entire process.
- OpenBeken configuration write succeeded after erasing sector 1904640, and the device now has an OBK config named OpenBK_E2D100031 / obk_E2D100031.
- One CB2S pad was broken during disassembly, and the binary backup may still contain SmartLife-linked data that needs stripping.
Generated by the language model.
Tare down of LSPA7 tuya smart plug.
I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
i've gathered all the info i can see the images of various steps along the way.
I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.
Here is a portion of the flashing process
I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
I hope the all the pictures are good enough ?
I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
i've gathered all the info i can see the images of various steps along the way.
I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.
Here is a portion of the flashing process
Spoiler:
Device configuration, as extracted from Tuya:
- Button (channel 1) on P6
- WiFi LED on P8
- Relay (channel 1) on P26
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424
json format
{
"rl1_lv":"1",
"bt1_pin":"6",
"net_trig":"2",
"jv":"1.0.3",
"netled1_lv":"0",
"netled_reuse":"0",
"bt1_type":"0",
"ffc_select":"0",
"nety_led":"1",
"over_cur":"16000",
"bt1_lv":"0",
"reset_t":"5",
"netled1_pin":"8",
"chip_type":"3",
"lose_vol":"70",
"over_vol":"300",
"module":"CB2S",
"ch_cddpid1":"9",
"ch1_stat":"2",
"rl1_type":"0",
"ch_num":"1",
"ele_fun_en":"1",
"rl1_pin":"26",
"netn_led":"0",
"vol_def":"0",
"ch_dpid1":"1",
"crc":"29",
"}hfX^Agw_dieAmf_test_close":"40.00",
"pv":"2.2",
"lpv":"3.3",
"pk":"<secret>",
"firmk":"<secret>",
"cadv":"true",
"cdv":"1.0.0",
"dev_swv":"1.1.7",
"s_id":"null",
"dtp":"0",
"sync":"0",
"attr_num":"0",
"mst_tp_0":"0",
"mst_ver_0":"null",
"mst_tp_1":"0",
"mst0dAtls_ca_cntpasswd":"<secret>",
"md":"0",
"random":"0",
"wfb64":"1",
"stat":"2",
"token":"<secret>",
"region":"null",
"reg_key":"null",
"dns_prio":"0^Atimer_arr08Atls_ca_cnt0fBastro_timer{abi",
"id":"<secret>",
"swv":"1.1.7",
"bv":"40.00",
"mst_ver_1":"null",
"mst_tp_2":"0",
"mst_ver_2":"null",
"mst_tp_3":"0",
"mst_ver_3":"null }<secret>",
"mode":"rw",
"property":"{type"
}
(True) success!
Going to do erase, start 1904640, sec count 1!
Erasing sector 1904640... ok!
All selected sectors erased!
Now will also write OBK config...
Long name from CFG: OpenBK_E2D100031
Short name from CFG: obk_E2D100031
Web Root from CFG: https://openbekeniot.github.io/webapp/
Writing config sector 0x1D1000...Writing file data to chip successs.I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
I hope the all the pictures are good enough ?
Attachments:
-
IMG_20230708_194053610_HDR.jpg
(757.76 KB)
You must be logged in to download this attachment.
-
IMG_20230708_194202743_HDR.jpg
(963.21 KB)
You must be logged in to download this attachment.
-
IMG_20230708_194228623_HDR.jpg
(916.59 KB)
You must be logged in to download this attachment.
-
IMG_20240108_183518997_HDR.jpg
(732.52 KB)
You must be logged in to download this attachment.
-
IMG_20240108_183531465_HDR.jpg
(648.26 KB)
You must be logged in to download this attachment.
-
IMG_20240111_014717270.jpg
(503.04 KB)
You must be logged in to download this attachment.
-
IMG_20240111_014818700_HDR.jpg
(394.33 KB)
You must be logged in to download this attachment.
-
IMG_20240111_014840332_HDR.jpg
(470.25 KB)
You must be logged in to download this attachment.
-
IMG_20240111_014858511_HDR.jpg
(532.05 KB)
You must be logged in to download this attachment.
-
IMG_20240112_175918551_HDR.jpg
(1.38 MB)
You must be logged in to download this attachment.
-
IMG_20240112_184731238_HDR.jpg
(739.53 KB)
You must be logged in to download this attachment.
-
IMG_20240112_184940475_HDR.jpg
(1.3 MB)
You must be logged in to download this attachment.
-
IMG_20240112_190257779_HDR.jpg
(1.07 MB)
You must be logged in to download this attachment.
-
IMG_20240112_185038163_HDR.jpg
(1.04 MB)
You must be logged in to download this attachment.
-
IMG_20240112_221135032_HDR.jpg
(617.59 KB)
You must be logged in to download this attachment.
Comments
Which pad of CB2S is broken, maybe we can fix it? Judging by the voltage of the relay, I would guess it's using 5V power supply, then it uses LDO to get 3.3V for WiFi module Here is OBK template: ... [Read more]
I broke p26 pad off :-( the one for the relay. The OBK template is missing the details for the BL0942, isn't it? I did think I could just move the relay in software to p7 as it doesn't look like it gets... [Read more]
All required BL0942 details are in the template. BL0942 is always on UART1, so there is no need to select GPIO for that. You just need to start the driver. Yes, you can route relay to P7, it's a good... [Read more]
I used P7 for my relay pin assignment and it worked just fine. What are the minimum values the BL chip can read? I am currently running the whole thing from a 5vdc source and I see the 5v on the index... [Read more]