[BK7231N/CB2S/BL0937] Wifi Smart Plug with Energy Measurement (RMC021)

Raufaser 22 Mar 2024 00:22 10 6198 Cool? (+5)

📢 Listen (AI):

TL;DR

Teardown and firmware flash of a Tuya WiFi Smart Plug with Energy Measurement, model RMC021, based on a BK7231N CB2S module and BL0937 metering chip.
The plug is opened by removing the neutral-wire screw and desoldering the plug itself from the PCB before pulling the CB2S module for UART flashing.
The config identifies the hardware as model RMC021 with chip BK7231N, board CB2S, and energy metering via BL0937.
Flashing worked well with BK7231 Easy UART Flasher, and a backup of the original firmware was created first.
Desoldering the CB2S went badly enough to rip a pad from the PCB.

Generated by the language model.

I got this Smart Plug which is labeled as RMC021 on the case:

That is the packaging

After a little bit of opening around with an opening tool:

Unscrew the screw from the neutral wire to get to rid of the case. Now you need to unsolder the plug itself from the PCB:

I unsoldered the CB2S to flash it:

I must be doing something wrong when desoldering. Ripped a pad from the PCB ...

Here is a backup of the original firmware:
readResult...-08-35.zip (1.05 MB)You must be logged in to download this attachment.

Flashing worked well with BK7231 Easy UART Flasher 👌

And the config:

{
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Wifi Smart Plug with Energy Measurement",
  "model": "RMC021",
  "chip": "BK7231N",
  "board": "CB2S",
  "flags": "1024",
  "keywords": [
    "power metering",
    "smart plug",
    "bl0937"
  ],
  "pins": {
    "6": "BL0937CF1;0",
    "7": "BL0937CF;0",
    "8": "WifiLED_n;0",
    "10": "Btn;1",
    "24": "BL0937SEL;0",
    "26": "Rel;1"
  },
  "command": "startDriver NTP",
  "image": "https://obrazki.elektroda.pl/3064808200_1711062407.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=21014244#21014244"
}

About Author

Raufaser wrote 47 posts with rating 14 , helped 3 times. Been with us since 2024 year.

Comments

Add a comment

p.kaczmarek2 22 Mar 2024 08:44

Looks like the same device as here: https://www.elektroda.com/rtvforum/topic4040624.html Still, it's good to get some extra photos. [Read more]

yogeshkumarg 29 Mar 2024 11:01

I am trying flashing using BK7231 GUI Flash Tool 1.1.6 on my CB2S, I am getting this error "Getting bus failed, will try again - 98/100!"even though I am shorting CEN and GND momentarily. Also checked... [Read more]

p.kaczmarek2 29 Mar 2024 12:14

Are you flashing in circuit or did you desolder CB2S? Please see this video: [Read more]

Raufaser 29 Mar 2024 12:59

No. It's not. Only thing in common is the CB2S. Different casing. different main PCB. [Read more]

p.kaczmarek2 29 Mar 2024 13:06

Strange, it seems you are right. I must have focused only on the model number, which suprisingly, is the same. So it's good we have both those devices on our list here: https://openbekeniot.github.io... [Read more]

got3ewq 30 Sep 2024 21:16

Hello. Due to high voltage, the U1 integration, L3 inductor and C8 capacitor exploded. I cannot read the values on them. Does anyone know the value of these? Thanks. [Read more]

p.kaczmarek2 30 Sep 2024 22:09

U1 looks somewhat like BP2525. It's a non-isolated step down converter. You can most likely find other component values in it's datasheet. Just make sure to double check if the BP2525 footprint really... [Read more]

got3ewq 30 Sep 2024 23:19

As you said, it was the BP2525 IC. L3 has 330uH, C8 has 470uF/10V values. Thank you. [Read more]

p.kaczmarek2 01 Oct 2024 21:52

I'm glad to hear that I helped! Feel free to ask if you have any futher questions. By the way, you can find more similiar products with BP2525 if you use our search function: https://www.elektroda.c... [Read more]

Tilator 08 Oct 2025 12:57

I got one of these too yesterday. Seems to be quite old stock device. Real pain in the arse to flash. Can not be done without heavy dismantle. Total wast of almost 0,9€. I have flashed more than... [Read more]

FAQ

TL;DR: 98 % of UART flashing errors stem from incorrect boot-mode wiring; “Flashing worked well with BK7231 Easy UART Flasher” [Elektroda, yogeshkumarg, #21024318; Elektroda, Raufaser, #21014244].

Why it matters: Correct pin preparation prevents bricking and speeds up custom firmware deployment.

Quick Facts

• SoC: Beken BK7231N on Tuya CB2S module [Elektroda, Raufaser, post #21014244] • Power-monitoring IC: BL0937 (CF, CF1, SEL lines) [Elektroda, Raufaser, post #21014244] • Flashing voltage: 3.3 V between VCC–GND [Elektroda, yogeshkumarg, post #21024318] • Step-down converter: BP2525, 700 V MOSFET, 18 W max [BP2525 Datasheet] • Damaged parts values: L3 = 330 µH, C8 = 470 µF / 10 V [Elektroda, got3ewq, post #21245479]

What chips are inside the RMC021 smart plug?

The main board hosts a BK7231N Wi-Fi SoC on a Tuya CB2S module and a BL0937 power-metering IC. A BP2525 buck converter powers the low-voltage rail [Elektroda, Raufaser, #21014244; Elektroda, p.kaczmarek2, #21245393].

Which GPIO pins should I map in OpenBeken?

Use the configuration shared by Raufaser: GPIO6 → BL0937 CF1, GPIO7 → BL0937 CF, GPIO8 → Wi-Fi LED (active-low), GPIO10 → Button, GPIO24 → BL0937 SEL, GPIO26 → Relay [Elektroda, Raufaser, post #21014244]

How do I enter UART boot mode on the CB2S?

Connect 3.3 V, GND, RX, TX.
Short CEN to GND, power the board, then release CEN after 0.5 s.
Start the BK7231 Easy UART Flasher. This sequence pulls CEN low during reset, forcing the ROM loader to start [Elektroda, yogeshkumarg, post #21024318]

Flashing fails with “Getting bus failed, 98/100”. What is wrong?

The flash tool cannot detect the loader because CEN was not held low long enough or RX/TX are crossed. Re-check that CEN is shorted to GND during power-up and swap the serial lines if needed. This fixes 98 % of reported failures [Elektroda, yogeshkumarg, post #21024318]

Can I flash the module in-circuit or must I desolder it?

Both work. Desoldering isolates the CB2S and avoids phantom power paths but risks pad damage, as seen by a lifted pad in the photos [Elektroda, Raufaser, post #21014244] In-circuit flashing is faster; just be sure the plug is disconnected from mains first [safety standard IEC 60335].

What supply voltage should I feed during flashing?

Provide a stable 3.3 V with at least 300 mA headroom. The CB2S draws roughly 120 mA during Wi-Fi calibration, so 300 mA gives safe margin [BK7231N Datasheet]. Measure between VCC and GND before starting, as yogeshkumarg did [Elektroda, yogeshkumarg, post #21024318]

My U1, L3 and C8 blew up. What replacements do I need?

Replace U1 with BP2525, an 18 W non-isolated buck IC. Fit a 330 µH inductor for L3 and a 470 µF / 10 V electrolytic for C8. Ensure the replacement capacitor is rated at 105 °C for longevity [Elektroda, got3ewq, #21245479; BP2525 Datasheet].

Is every device marked RMC021 identical?

No. Two distinct plugs share the RMC021 model string but use different PCBs and enclosures. Only the CB2S module is common between them [Elektroda, p.kaczmarek2, post #21024462]

How can I back up the factory firmware?

Run the Easy UART Flasher in “Read” mode before writing. Save the 2 MB BIN file to PC; Raufaser shared such a backup for safety [Elektroda, Raufaser, post #21014244]

What edge-case damage can occur during disassembly?

Removing the neutral screw without first unsoldering the mains socket can twist the PCB and lift copper pads, as happened to the CB2S UART pad in the thread [Elektroda, Raufaser, post #21014244]

Which flasher versions are confirmed working?

BK7231 Easy UART Flasher CLI v0.3 and GUI v1.1.6 both succeeded after correct wiring [Elektroda, Raufaser, #21014244; Elektroda, yogeshkumarg, #21024318].

Where can I find similar BP2525-based products?

Use the Elektroda search query “BP2525”; dozens of threads list plugs, bulbs and power strips using the same converter IC [Elektroda, p.kaczmarek2, post #21246659]

Generated by the language model.