FAQ
TL;DR: At 15 €, this Tuya dual plug can be opened and flashed, and one user confirmed that "115200, and bingo" fixed unstable BK7231N readout. This FAQ helps OpenBK users access CB2S pads, separate the PCB safely, and avoid common CH340G flashing failures on Elworks CLY809M-GE and similar Nedis hardware. [#21391121]
Why it matters: The thread turns a vague teardown into a repeatable flashing path for a mains-powered dual socket with power metering.
| Variant or setting |
What the thread found |
Practical result |
| Elworks CLY809M-GE |
BK7231N + CB2S + BL0937 |
Working template shared |
| Nedis WIFIP141FWT |
Internals looked identical when opened |
Same method worked |
| 1500000 / 921600 baud |
Read often started, then hung |
Unreliable dump |
| 115200 baud |
Full read completed cleanly |
Reliable firmware backup |
Key insight: Mechanical access was only half the job. Stable wiring and a lower UART speed mattered more than the original 1500000 setting for getting a complete BK7231N readout. [#21391121]
Quick Facts
- Approximate purchase price was 15 € in Denmark, described as similar to AliExpress pricing for a Tuya-based dual smart socket. [#20946292]
- The shared Elworks template identified BK7231N as the chip and CB2S as the board, with 7 mapped signals including button, LED, two relays, and three BL0937 lines. [#20946292]
- Required flashing access points were explicitly listed as 3V3, GND, RX1, TX1, and CEN on the CB2S module. [#20946292]
- One successful desoldering method used an old 100 W Weller solder gun plus solder wick to free the mains input pins from the PCB. [#21368780]
- A failing read at 1500000 or 921600 baud became stable at 115200 baud, after better soldering and wire attachment. [#21391121]
How do you open the Elworks Smart Dual Socket CLY809M-GE without damaging the enclosure?
Open it by carefully separating the top and bottom halves with a hobby knife and a small screwdriver. The original teardown described the case as quite easy to split this way. Work around the seam slowly instead of forcing one side, because the goal is to preserve the enclosure before you remove the PCB for flashing access.
[#20946292]
What is the CB2S module in this Elworks dual smart socket, and why is it important for flashing OpenBK?
"CB2S is a board module that hosts the BK7231N Wi-Fi chip, exposes the serial flashing connections, and identifies the hardware platform used by the socket." It matters because the shared device template names the board as CB2S, and the flashing points to reach are on that module, not just anywhere on the main PCB.
[#20946292]
Which pads or pins on the BK7231N/CB2S board need to be accessed to flash this dual socket with a BK flasher?
You need access to 3V3, GND, RX1, TX1, and CEN on the CB2S module. The teardown author separated the plug section from the PCB specifically to reach those five points. Without those connections, the BK flasher cannot reliably talk to the BK7231N during read or write operations.
[#20946292]
What is the BL0937 chip, and how is it used for power metering in Tuya-based dual smart plugs?
"BL0937 is a metering chip that supports power measurement, using dedicated signal lines such as CF, CF1, and SEL to report consumption-related data." In this socket, the template maps BL0937CF to pin 7, BL0937CF1 to pin 8, and BL0937SEL to pin 23, which is why the device is tagged for power metering.
[#20946292]
What steps are involved in separating the PCB from the mains plug section on the Elworks or Nedis dual smart plug?
Use a simple 3-step process. 1. Open the enclosure with a hobby knife and small screwdriver. 2. Free the mains input pins from the PCB by desoldering them. 3. Lift the plug section away so you can reach 3V3, GND, RX1, TX1, and CEN on CB2S. A later Nedis owner saw the same locked-in mains pins and followed the same general method.
[#21368780]
Which tools worked for desoldering the input mains pins from the PCB, and how was solder wick used in this teardown?
A 100 W Weller solder gun and solder wick worked. The user said he used the solder gun to heat the large mains-pin joints and solder wick to remove solder until the PCB came free. That approach directly addressed the two big solder spots that were holding the board onto the 230 V power legs.
[#21368780]
Why does BK7231GUIFlashTool start reading and then hang with a 'Reading failed' message on a BK7231N device?
The thread points to unstable communication, not a confirmed firmware lock. The read started after a short CEN trigger, then stopped at a seemingly random point, and later improved after better wire soldering and a much lower baud rate. That pattern fits marginal serial links, especially when the user called his first direct soldering work questionable.
[#21391121]
How does lowering the baud rate from 1500000 or 921600 to 115200 affect BK7231N firmware read reliability?
Lowering the baud rate to 115200 made the read reliable enough to complete. At 921600, the dump still stopped halfway, but at 115200 the user reported, “115200, and bingo everything read out nicely.” In this thread, slower UART speed clearly traded peak transfer rate for a full, stable firmware backup.
[#21391121]
What is CEN on the CB2S module, and how is it used to trigger flashing or firmware readout?
"CEN is a control pin that helps start communication with the BK7231N during flashing, because briefly toggling it can trigger the chip to begin a read session." The user said BK7231GUIFlashTool started reading as soon as he triggered CEN for a short period, which confirms it was part of the entry sequence on this board.
[#21389717]
Why might a CH340G USB TTL adapter work unreliably at high baud rates when reading a BK7231N smart plug?
The thread shows that the CH340G setup could work, but not reliably at very high speed on this plug. The user used a CH340G 3.3 V/5 V USB TTL adapter, yet reads at 1500000 and 921600 stalled, while 115200 completed. That result suggests the weak point was the high-speed serial link, especially before the wiring was resoldered cleanly.
[#21391121]
What differences were found between the Elworks CLY809M-GE template and the Nedis WIFIP141FWT template, especially the relay pin mapping?
The key difference was the relay order. Elworks mapped pin 24 to Rel;1 and pin 26 to Rel;2, while the Nedis web-app template showed pin 24 as Rel;2 and pin 26 as Rel;1. The BL0937 lines, Wi-Fi LED, and button positions otherwise matched the same general CB2S-based layout.
[#21391319]
How do you extract Tuya device parameters and generate a JSON template from the original firmware using the BK flasher web application?
Read the original firmware first, then use the BK flasher’s web flow to export the detected settings. The teardown says the flash program extracted Tuya parameters from the stock firmware, and the “Launch Web application” page produced a JSON script containing vendor, model, chip, board, keywords, pins, image, and wiki fields.
[#20946292]
What should be checked before writing OpenBK to a BK7231N smart socket if firmware readout only works intermittently?
Check wiring quality and confirm you can complete a full read at a stable baud rate before writing anything. In this case, the user first suspected missing setup details, then improved the soldering with help from a colleague, reduced speed from 921600 to 115200, and only after a clean dump said he would try writing next.
[#21391121]
How do BK7231GUIFlashTool and Tasmotizer compare for working with a CH340G USB TTL adapter on Tuya-based plugs?
The thread only confirms different roles, not equal results. The CH340G adapter was said to work with Tasmotizer, while BK7231GUIFlashTool was the tool actually used to read the BK7231N plug and expose the read failures. So, in this discussion, Tasmotizer verified the adapter generally worked, but BK7231GUIFlashTool exposed speed and wiring sensitivity on this hardware.
[#21389717]
When flashing a BK7231N device powered through an AMS1117 regulator, what role does supplying 5V to AMS1117 play, and when is it needed?
The thread does not confirm that 5 V to AMS1117 was needed on this socket. One user asked whether missing that step caused failed reads because some guides mention it, but the later fix came from better soldering and reducing the baud rate to 115200. In this specific case, the successful outcome did not depend on a confirmed AMS1117 5 V feed.
[#21389717]
Generated by the language model.
Comments
Thank you for submitting the template. It seems you've forget about the device model - CLY809M-GE - but I've added it for you. Device should be soon live at: https://openbekeniot.github.io/webapp/de... [Read more]
@snusken I have a Nedis WIFIP141FWT double smart plug, which looks identical to yours when opened, so I'm thinking your work applies, and would like to test it out. Thanks for your write-up. Did you have... [Read more]
Hello Chris, As far as I remember, I used my old 100 W Weller solder gun and some solder wick to free the input mains pins from the PCB. best regards, Erik ( living place Sønderborg :) ) [Read more]
Thanks. I won't have time today, but hopefully after new years eve :) [Read more]
Hi again. When trying to just read out the firmware, using BK7231GUIFlashTool, it starts reading as soon as I trigger CEN for a short perioed, but then, at what seems as a random time later, it hangs,... [Read more]
Are you sure about that high speed baud setting? Such high speeds never worked reliably for me. [Read more]
Thank you for taking your time to answer. I tried lowering it to 912600, but then got nothing, and from snuskens image of the flasher, he also had 1500000 set. But it might as well be bad soldering on... [Read more]
Took the PCB with me to work, and had a friendly colleague solder some wires on. Lowered the baud rate to 921600, but it still stopped half way, but at least it got something. Lowered it to 115200, and... [Read more]
Good job! Sure, can you share Nedis template in JSON format, as copied from Web App? [Read more]
This is from the web-app's Config menu, when accessing the device through: IP/app { "vendor": "Tuya", "bDetailed": "0", "name":... [Read more]