Beken BK3431Q Program Mode Entry, SPI Pinout, and Flash Dumping Tools

User question

Hi everyone,

I'm currently working with a Beken BK3431Q chip and I'm having some trouble entering Program Mode to dump the flash memory.

On the standard BK3431, there is usually a specific pin to trigger the bootloader/program mode, but I cannot find an equivalent hardware trigger for the Q variant.

Current Status:

UART: I can successfully connect to the UART console, but it seems to be locked in Debug Mode. I can see logs, but I cannot execute commands to dump flash or interact with the bootloader.

SPI: I’ve attempted to access the chip via SPI using pins P00 (SCK), P01 (CSN), P02 (MOSI), and P03 (MISO) [Note: Verify if you meant these or the P04-P07 you mentioned], but as a beginner in SPI interfacing, I haven't had any luck getting a response.

My Questions:

Does the BK3431Q require a specific high/low voltage on a certain pin during power-on to enter Program Mode (similar to the ESP32's GPIO0)?

Is there a specific "magic key" or command sent via UART at boot time to interrupt the boot process?

For SPI access, is there a recommended tool or script (like flashrom or a specific Beken Programmer tool) that works specifically for this revision?

Any guidance, datasheets, or pinout tips would be greatly appreciated!

Thanks in advance!

Artificial Intelligence Response

Direct answer to the question

• Yes, BK3431-family parts use a strap (“Mode Selecting/Prog_Mode”) sampled at reset to enter Program Mode. On BK3431 it is a dedicated pin named Prog_Mode (pin 27). When asserted at reset, P0.4–P0.7 become the SPI programming bus. The BK3431Q follows the same concept (mode selected at startup), though the exact package pin mapping depends on the Q variant/board. (datasheet4u.com)
• No interactive “magic key” on the debug UART is documented to interrupt boot. BK3431Q platforms typically use UART0 (P00/P01) for firmware download with vendor tools, while UART2 (P16/P17) prints logs; your log-only console is normal application/debug output. Entering a ROM download path is usually done by the mode strap, not by a typed sequence. (scribd.com)
• For SPI access, use the SPI pins P0.4–P0.7 in Program Mode. Practical tools include Beken’s own “BekenHIDTool” (SPI) and “bk_writer” (UART) from Tuya/Beken SDKs; for generic SPI programmers (e.g., CH341A, FT232H, RP2040), use software that can send raw SPI commands because the internal flash may not present a JEDEC ID. Read-out can be blocked by the chip’s protection flag. (scribd.com)

Detailed problem analysis

• Boot/Program mode selection
  • BK3431 (baseline) explicitly exposes a pin named Prog_Mode (pin 27). Sampling this pin high at reset places the chip in Program Mode; leaving it low boots normally. In Program Mode, P0.4 = MOSI, P0.5 = MISO, P0.6 = SCK, P0.7 = CS (“SPI Enable”). A second strap JTAG_Mode (pin 24) selects JTAG if asserted. (datasheet4u.com)
  • BK3431Q: Beken’s and Tuya’s public collateral for Q parts states that at startup the device enters programming/JTAG/normal “according to the received command from Mode Selecting Pin.” This mirrors the BK3431 behavior (strap-based mode selection). While the Q datasheet with pin numbers is not broadly published, Tuya’s BK3431Q platform docs confirm UART0 on P00/P01 is used for flashing/licensing and SPI default pins are P04–P07, matching BK3431’s mapping in Program Mode. Board vendors often break these to a 6-pin “P07–P04 + 3V3/GND” header and a separate Reset pad. (airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com)
• Your UART observations
  • Seeing logs but no command prompt is expected when you’re connected to the log UART (often UART2 on P16/P17). The ROM/programmer UART is typically UART0 on P00 (TX) / P01 (RX). To use a UART downloader (bk_writer), move your USB‑UART to P00/P01 and assert the appropriate mode strap at reset. (scribd.com)
• Your SPI attempt (P00–P03)
  • That pin group is not the SPI programming bus. In Program Mode, the SPI wiring is P04–P07 only: P04 MOSI, P05 MISO, P06 SCK, P07 CS. This matches BK3431’s datasheet and Tuya’s BK34xx programming guides. (datasheet4u.com)
• Read-out protection
  • BK3431 allows permanently forbidding flash readout by writing a pattern at the top of flash. If set, SPI dumps will return all 0xFF/0x00 or fail regardless of wiring/tools. Expect the Q variant to have a similar mechanism. (datasheet4u.com)

Current information and trends

• Public, vendor-side collateral for BK3431Q emphasizes two host tools in current SDKs: “BekenHIDTool” (SPI-based) and “bk_writer” (UART-based). The platform sheet maps UART0 (P00/P01) for flashing and SPI default pins P04–P07. (scribd.com)
• Community experience on related Beken BLE parts (BK3431/BK3432/BK3231) shows successful SPI dumps via P04–P07 in Program Mode, sometimes requiring raw SPI transactions because the internal flash does not advertise a JEDEC ID. (datasheetcafe.com)

Supporting explanations and details

• Safe, reproducible entry to Program Mode (BK3431 reference, applies to Q with board-specific pinout):
  • Identify the mode-select (Prog_Mode/“Mode Selecting Pin”) and reset (RSTN) on your PCB. On BK3431, Prog_Mode is pin 27 and RSTN pin 5; many boards expose these as test pads or through zero-ohm links. (datasheet4u.com)
  • Strap sequence:
  • Power off.
  • Pull Mode Selecting/Prog_Mode high with a resistor (10 kΩ to 3.3 V).
  • Keep JTAG_Mode low.
  • Assert RSTN low, then release high; the chip samples the strap and enters Program Mode; P04–P07 switch to the SPI peripheral role. (datasheet4u.com)
• SPI wiring to a generic programmer
  • 3.3 V only on VCC and all IOs.
  • Programmer CS → P07, SCK → P06, MOSI → P04, MISO → P05, common GND and 3V3.
  • Start at low SCK (≤1 MHz), use SPI Mode 0, and issue raw 0x03 reads with a 24‑bit address. If 0x9F (JEDEC ID) returns 0x00/0xFF, proceed with blind reads; some SoC-internal flashes do not identify. (datasheet4u.com)
• UART route
  • If you prefer the ROM UART downloader, move to UART0 pins (P00 TX, P01 RX), use bk_writer from the BK3431Q toolset, and toggle reset while the tool is attempting to connect. The mode strap must select the UART download path on Q parts (vendor tools handle timing). (scribd.com)

Ethical and legal aspects

• Firmware may contain copyrighted code, device IDs, and keys. Ensure you have the right to read it and comply with local anti‑circumvention and IP laws. If read‑out protection is set, bypassing it may be unlawful. (datasheet4u.com)

Practical guidelines

• Pinout and jig
  • Locate P04–P07, RSTN, and the mode-select pad on your board (often silkscreened TEST/PROG/BOOT). If unavailable, scrape solder mask and micro‑wire to the QFN pins; verify with continuity and a microscope. (datasheet4u.com)
• Minimal SPI dump procedure (internal flash)
  • Strap Program Mode; wire SPI as above; power at 3.3 V; reset; then:
  • Try 0x9F; if no ID, immediately try 0x03 reads from 0x000000 upward; dump the full expected size (BK3431: 128 KB; BK3431Q typical is larger—product page lists 512 KB typical, so plan for up to 512 KB). (datasheet4u.com)
• Tools that work
  • Vendor: BekenHIDTool (SPI) and bk_writer (UART). (scribd.com)
  • Generic: CH341A/FT232H/RP2040 as SPI masters with scriptable stacks; use software enabling raw command sequences (e.g., flashrom with serprog or custom Python). Expect to disable auto‑probe and specify geometry manually. (datasheetcafe.com)
• What to try if you still only see logs
  • Move from UART2 (P16/P17) to UART0 (P00/P01) and use the vendor UART downloader or assert the mode strap to SPI Program Mode instead of relying on terminal input. (scribd.com)

Possible disclaimers or additional notes

• The exact BK3431Q pin number for the “Mode Selecting Pin” may differ from BK3431’s pin 27; some Tuya/Beken PDFs are distribution‑restricted. The strap concept and P04–P07 mapping are consistent across BK34xx family documents. Treat BK3432/Q documentation as guidance when the Q datasheet is not publicly accessible and verify on your PCB. (airtake-public-data-1254153901.cos.ap-shanghai.myqcloud.com)
• Some boards replace the internal flash path with an external SPI NOR; if you find an 8‑pin 25‑series device, clip it directly and dump it conventionally. (datasheetcafe.com)

Suggestions for further research

• Request the “BK3431Q Flash Programming Specification/User Manual” from your module vendor or Beken/Tuya support; it clarifies strap polarity and addresses for Q variants. (bekencorp.com)
• Review BK3432 programming notes (procedurally similar) and Tuya production tutorials for their SPI flasher pinouts and reset timing. (manuals.plus)
• If you share clear PCB photos around the SoC and test pads, I can help identify the mode-select pad and propose exact wiring.

Brief summary

• Entering Program Mode on BK3431Q is done with a hardware mode strap sampled at reset (same principle as BK3431). In that mode, P04–P07 form the SPI programming bus; UART logs on P16/P17 won’t help you dump flash. Use BekenHIDTool (SPI) or bk_writer (UART on P00/P01) or a generic 3.3 V SPI programmer that can issue raw reads. Be prepared for read‑out protection to block access. (datasheet4u.com)

If you want, I can draft a pin‑by‑pin wiring diagram and a small Python script (spidev/pyftdi) once you confirm which pads you have access to and whether your board exposes a PROG/BOOT pad.

Disclaimer: The responses provided by artificial intelligence (language model) may be inaccurate and misleading. Elektroda is not responsible for the accuracy, reliability, or completeness of the presented information. All responses should be verified by the user.