[BK7231N/CB2S/BL0942] LSPA7 Tuya Smart Plug teardown and flashing OpenBeken via UART procedure

electrikphone 29 Jan 2024 00:58 4 3156 Cool? (0)

📢 Listen (AI):

TL;DR

LSPA7 Tuya smart plug teardown identifies a CB2S module with BK7231N, a BL0942 energy-metering chip, a relay, and a KP3210SG power-supply chip.
Tuya configuration exposes the wiring: button on P6, WiFi LED on P8, and relay on P26, which helps map the UART flashing setup.
Flashing used a CP2102 USB-to-UART adapter and BK7231 GUI Flash Tool, with the adapter powering the CB2S during the entire process.
OpenBeken configuration write succeeded after erasing sector 1904640, and the device now has an OBK config named OpenBK_E2D100031 / obk_E2D100031.
One CB2S pad was broken during disassembly, and the binary backup may still contain SmartLife-linked data that needs stripping.

Generated by the language model.

Tare down of LSPA7 tuya smart plug.

I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
i've gathered all the info i can see the images of various steps along the way.
I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.

Here is a portion of the flashing process

Spoiler:

Device configuration, as extracted from Tuya: 
- Button (channel 1) on P6
- WiFi LED on P8
- Relay (channel 1) on P26
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424


json format
{
	"rl1_lv":"1",
	"bt1_pin":"6",
	"net_trig":"2",
	"jv":"1.0.3",
	"netled1_lv":"0",
	"netled_reuse":"0",
	"bt1_type":"0",
	"ffc_select":"0",
	"nety_led":"1",
	"over_cur":"16000",
	"bt1_lv":"0",
	"reset_t":"5",
	"netled1_pin":"8",
	"chip_type":"3",
	"lose_vol":"70",
	"over_vol":"300",
	"module":"CB2S",
	"ch_cddpid1":"9",
	"ch1_stat":"2",
	"rl1_type":"0",
	"ch_num":"1",
	"ele_fun_en":"1",
	"rl1_pin":"26",
	"netn_led":"0",
	"vol_def":"0",
	"ch_dpid1":"1",
	"crc":"29",
	"}hfX^Agw_dieAmf_test_close":"40.00",
	"pv":"2.2",
	"lpv":"3.3",
	"pk":"<secret>",
	"firmk":"<secret>",
	"cadv":"true",
	"cdv":"1.0.0",
	"dev_swv":"1.1.7",
	"s_id":"null",
	"dtp":"0",
	"sync":"0",
	"attr_num":"0",
	"mst_tp_0":"0",
	"mst_ver_0":"null",
	"mst_tp_1":"0",
	"mst0dAtls_ca_cntpasswd":"<secret>",
	"md":"0",
	"random":"0",
	"wfb64":"1",
	"stat":"2",
	"token":"<secret>",
	"region":"null",
	"reg_key":"null",
	"dns_prio":"0^Atimer_arr08Atls_ca_cnt0fBastro_timer{abi",
	"id":"<secret>",
	"swv":"1.1.7",
	"bv":"40.00",
	"mst_ver_1":"null",
	"mst_tp_2":"0",
	"mst_ver_2":"null",
	"mst_tp_3":"0",
	"mst_ver_3":"null }<secret>",
	"mode":"rw",
	"property":"{type"
}

(True) success!
Going to do erase, start 1904640, sec count 1!
Erasing sector 1904640... ok! 
All selected sectors erased!

Now will also write OBK config...
Long name from CFG: OpenBK_E2D100031
Short name from CFG: obk_E2D100031
Web Root from CFG: https://openbekeniot.github.io/webapp/
Writing config sector 0x1D1000...Writing file data to chip successs.

I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
I hope the all the pictures are good enough ?

Attachments:

IMG_20230708_194053610_HDR.jpg (757.76 KB) You must be logged in to download this attachment.
IMG_20230708_194202743_HDR.jpg (963.21 KB) You must be logged in to download this attachment.
IMG_20230708_194228623_HDR.jpg (916.59 KB) You must be logged in to download this attachment.
IMG_20240108_183518997_HDR.jpg (732.52 KB) You must be logged in to download this attachment.
IMG_20240108_183531465_HDR.jpg (648.26 KB) You must be logged in to download this attachment.
IMG_20240111_014717270.jpg (503.04 KB) You must be logged in to download this attachment.
IMG_20240111_014818700_HDR.jpg (394.33 KB) You must be logged in to download this attachment.
IMG_20240111_014840332_HDR.jpg (470.25 KB) You must be logged in to download this attachment.
IMG_20240111_014858511_HDR.jpg (532.05 KB) You must be logged in to download this attachment.
IMG_20240112_175918551_HDR.jpg (1.38 MB) You must be logged in to download this attachment.
IMG_20240112_184731238_HDR.jpg (739.53 KB) You must be logged in to download this attachment.
IMG_20240112_184940475_HDR.jpg (1.3 MB) You must be logged in to download this attachment.
IMG_20240112_190257779_HDR.jpg (1.07 MB) You must be logged in to download this attachment.
IMG_20240112_185038163_HDR.jpg (1.04 MB) You must be logged in to download this attachment.
IMG_20240112_221135032_HDR.jpg (617.59 KB) You must be logged in to download this attachment.

About Author

electrikphone wrote 8 posts with . Been with us since 2024 year.

Comments

Add a comment

p.kaczmarek2 29 Jan 2024 04:05

Which pad of CB2S is broken, maybe we can fix it? Judging by the voltage of the relay, I would guess it's using 5V power supply, then it uses LDO to get 3.3V for WiFi module Here is OBK template: ... [Read more]

electrikphone 30 Jan 2024 03:23

I broke p26 pad off :-( the one for the relay. The OBK template is missing the details for the BL0942, isn't it? I did think I could just move the relay in software to p7 as it doesn't look like it gets... [Read more]

p.kaczmarek2 30 Jan 2024 12:11

All required BL0942 details are in the template. BL0942 is always on UART1, so there is no need to select GPIO for that. You just need to start the driver. Yes, you can route relay to P7, it's a good... [Read more]

electrikphone 30 Jan 2024 18:32

I used P7 for my relay pin assignment and it worked just fine. What are the minimum values the BL chip can read? I am currently running the whole thing from a 5vdc source and I see the 5v on the index... [Read more]

FAQ

TL;DR: This FAQ helps OpenBeken users recover and flash an LSPA7 Tuya plug with 3 key pins already identified, and confirms that “P7 is a good solution” when the original relay pad is damaged. It solves UART flashing, GPIO mapping, and BL0942 setup questions for the CB2S/BK7231N version of this plug. [#20936155]

Why it matters: The thread turns a failed smart plug teardown into a reusable OpenBeken procedure, including a proven relay-pad workaround and the correct BL0942 driver setup.

Item	Original / default	Verified workaround	Result
Relay control pin	P26	P7	Worked correctly
BL0942 setup	Start driver only	No GPIO remap needed	Uses UART1
Flash power source	CP2102 at 3.3 V	Same adapter through full flash	Reported sufficient

Key insight: The most important finding is that BL0942 does not need dedicated GPIO entries in the template. On this LSPA7, OpenBeken only needs startDriver BL0942, and a broken relay pad can be bypassed by moving the relay to P7. [#20936155]

Quick Facts

The extracted Tuya configuration maps the button to P6, WiFi LED to P8, and relay to P26 on the CB2S/BK7231N board. [#20934148]
The posted OpenBeken template identifies the device as LSPA7, with chip BK7231N, board CB2S, and keywords KP3210SG and BL0942. [#20934177]
The flash log shows OpenBeken wrote the config sector at 0x1D1000 after erasing 1 sector starting at 1904640. [#20934148]
The board includes a BL0942 energy-measurement chip and a relay, while the power section was observed around 5 V or possibly 10 V DC before regulation. [#20934148]
A live test used a 5 V DC source and a water pump drawing 0.300 A, with voltage visible in OpenBeken but current not yet displayed. [#20936819]

How do I flash an LSPA7 Tuya smart plug with a CB2S/BK7231N module to OpenBeken over UART using a CP2102 adapter?

You can flash it over UART with a CP2102 adapter that provides enough 3.3 V power for the CB2S during the whole process. 1. Open the plug, connect the CB2S, and use a CP2102 USB-to-UART adapter. 2. Flash the module with BK7231 GUI Flash Tool. 3. Write the OpenBeken config, which the log shows at sector 0x1D1000 after a successful erase. [#20934148]

Which GPIO pins are used on the LSPA7 smart plug for the button, WiFi LED, relay, and BL0942 energy metering?

The LSPA7 uses P6 for the button, P8 for the WiFi LED, and P26 for the relay. BL0942 is not assigned to a normal GPIO in the template because this device uses it through UART1, so you start the driver instead of mapping a pin. [#20934177]

What is the BL0942 chip in the LSPA7 smart plug, and what measurements is it supposed to provide?

BL0942 is the plug’s energy-measurement chip, and it is supposed to provide voltage, current, and power data. "BL0942" is a metering IC that measures electrical load data, using a serial interface so firmware can report values like voltage and current without assigning it to a normal relay or button GPIO. In the thread, voltage appears on the index page during a 5 V test, but current still needed setup or calibration. [#20936819]

What is the CB2S module, and how does it relate to the BK7231N chip in Tuya smart plugs?

CB2S is the Wi-Fi module on this plug, and it uses the BK7231N chip. "CB2S" is a Tuya Wi‑Fi module that hosts the main wireless SoC, and in this plug its core chip is BK7231N, which OpenBeken targets during UART flashing and GPIO configuration. The thread explicitly identifies the device as CB2S with BK7231N. [#20934177]

Why doesn’t the OpenBeken template list BL0942 GPIO pins, and how is the BL0942 driver started instead?

The template omits BL0942 GPIO pins because BL0942 is always on UART1 on this device. You do not select a GPIO for it. You start it with the template command startDriver BL0942, which the maintainer states is all that is required. [#20936155]

What can I do if I accidentally break the P26 pad off a CB2S module while tearing down or flashing a Tuya smart plug?

You can recover by moving relay control to another free pin and wiring the relay there. In this thread, the damaged pad was P26, which originally drove the relay. The recommended fix was to route the relay to P7, then reconnect it with a link wire. [#20936155]

How can I remap the relay from P26 to P7 in OpenBeken on an LSPA7 plug after PCB pad damage?

Remap the relay to P7 in OpenBeken and physically reconnect the relay to that pin. The user proposed moving the relay from broken P26 to unused P7, and that exact workaround was approved. A follow-up test confirmed that using P7 for the relay pin worked fine. [#20936819]

P26 vs P7 for relay control on a BK7231N CB2S smart plug — which is the better workaround when the original relay pad is gone?

P26 is the original relay pin, but P7 is the better workaround once the P26 pad is gone. P26 matches the factory mapping in the Tuya config, yet it is unusable after pad damage. P7 was specifically recommended as a good solution and later verified to work. [#20936155]

Why does the LSPA7 smart plug show voltage in OpenBeken but not current or power when I’m testing it from a 5V DC source?

The thread shows that voltage can appear without current or power when testing from a 5 V DC source, but it does not confirm a final cause. The test load was a 5 V water pump drawing 0.300 A, and the user saw 5 V on the index page. That means the BL0942 path was at least partially active, but current reporting still needed correct setup or calibration. [#20936819]

What are the minimum voltage, current, or power values that the BL0942 can reliably detect and report?

The thread does not provide minimum detectable voltage, current, or power values for BL0942. The only concrete low-load example shown is a 5 V source with a 0.300 A pump, where voltage displayed but current did not. That establishes a tested condition, not a published detection limit. [#20936819]

Which command should I use in OpenBeken to calibrate BL0942 readings, and why might commands like 'VoltageSet 0.1, CurrentSet 0.1, PowerSet 0.01' not work?

The thread does not provide a confirmed working calibration command sequence for this case. The user tried VoltageSet 0.1, CurrentSet 0.1, PowerSet 0.01, and stated that it did not work. The only setup command explicitly confirmed in the discussion is startDriver BL0942, because BL0942 runs on UART1. [#20936819]

How is the KP3210SG used in the LSPA7 plug power supply, and does the board run from 5V or 10V internally before regulation?

KP3210SG appears to be part of the power supply, but the exact internal rail is not fully confirmed in the thread. One teardown note guessed it might produce about 10 V DC, while a later reply judged the relay voltage more likely indicates a 5 V supply plus an LDO down to 3.3 V for the Wi‑Fi module. [#20934177]

Can a CP2102 USB-to-UART adapter safely provide enough 3.3V power to flash a CB2S module through the entire OpenBeken process?

In this case, yes—the reported CP2102 adapter provided enough 3.3 V power for the entire CB2S flashing process. The user specifically used a multi-function CP2102 USB serial adapter and said it could power the module through the full flash. That is a thread-confirmed result for this exact setup, not a universal guarantee. [#20934148]

What’s the purpose of making a full binary backup before flashing a Tuya BK7231N/CB2S device, and what private data should be removed before sharing it?

A full binary backup preserves the original firmware and device data, which helps recovery and template work. The user said they had a binary backup and might need to strip some data before sharing because the dump still seemed linked to the Smart Life app. The posted config also contained fields replaced with <secret>, such as keys and tokens. [#20934148]

How do I verify that the BL0942 driver is actually running on UART1 in OpenBeken after flashing an LSPA7 smart metering plug?

Verify it by starting the BL0942 driver and checking whether measurement data begins to appear, because this device uses BL0942 on UART1 by default. The maintainer states, “You just need to start the driver,” and adds that no GPIO selection is required. In practice, the thread’s user already saw voltage on the index page, which suggests partial driver activity. [#20936155]

Generated by the language model.