FAQ
TL;DR: 100 % flash-success reported on BK7231 T/N modules [Elektroda, p.kaczmarek2, post #19906676]; “OpenBK7231T now boots on three chip families” [Elektroda, p.kaczmarek2, post #19883071] Use QIO image for BK7231N, UA for BK7231T; erase only 0×11000-0×1EF000. Why it matters: a single workflow now replaces vendor firmware on 60 + low-cost IoT boards.
Quick Facts
• Supported MCUs: BK7231T, BK7231N, XR809 (Wi-Fi + BLE) [Elektroda, 19883071]
• Recommended UART speed: 921 600 bps for write, 115 200 bps for read [Elektroda, 19857664]
• Flash sizes: Typical 2 MB on-chip; config area starts @ 0×1EF000 [Elektroda, post #19893493]
• OTA format: .rbl (gzip + AES, served by HTTP) [Elektroda, btsimonh, post #19880525]
• Typical power: 5 V @ 500 mA to AMS1117 input for safe programming [Elektroda, ExploWare, post #19853546]
1. Which OpenBK binary should I flash?
• BK7231T/ WB2S/WB3S – use UA.bin via UART bootloader.
• BK7231N/ CB2S/CB3S – use QIO.bin at offset 0×0 with –unprotect flag [Elektroda, p.kaczmarek2, post #19890168]
• XR809 – build sharedApp and burn with PhoenixMC [Elektroda, 19850458]
2. How do I wire the programmer and reset correctly?
- TX of adapter → 1RX pin; RX → 1TX; GND shared.
- Pull CEN low, click “Program”, then release CEN to start bootloader [Elektroda, ExploWare, post #19903108]
- Supply 5 V to AMS1117 IN or 3 V3 pin; current ≥ 500 mA [Elektroda, ExploWare, post #19853546]
3. Writer stops at “Erasing 0×11000” – why?
The chip is protected. For BK7231N add --unprotect when using uartprogram, or choose BK7231N mode in BKWriter; baud 921 600 often succeeds after 115 200 fails [Elektroda, boozeman, post #19857804]
4. Relay clicks during flashing – safe fix?
A pull-up on RX1 ties the push-button to 3 V3, driving the relay. Remove jumper R33 on Nedis WIFIPO120FWT, flash, then solder it back [Elektroda, boozeman, post #19882233]
5. How can I back-up the Tuya stock firmware?
Run python bk7231tools.py read_flash -d COMx --no-verify-checksum -s 0 -c 512 dump.bin for T/N chips (2 MB, 512 × 4 KB) [GitHub bk7231tools].
6. My BK7231N loses settings after power-cycle.
Disable FAST_CONNECT (RL_SUPPORT_FAST_CONNECT) or use latest OpenBK build ≥ f6c3c8f6 that stores config outside NET_PARAM table [Elektroda, p.kaczmarek2, post #19893493]
7. Does OTA work and how do I host updates?
Yes. Serve *.rbl over HTTP (http-here --host 0.0.0.0 8000). In WebApp → OTA tab → enter http://<IP>:8000/firmware.rbl; device backs up filesystem, flashes, restores settings [Elektroda, btsimonh, post #19880525]
8. Can I change the MAC address permanently?
MAC can be edited in Config → MAC. It is written to efuse on BK7231T and survives reboot [Elektroda, ExploWare, post #19888851] Corrupted flash prevents saving; run recovery image to re-create tables [Elektroda, p.kaczmarek2, post #19888772]
9. What are the default GPIO roles for common plugs?
• Nedis WIFIPO120FWT – P6 LED, P10 Button, P26 Relay [Elektroda, 19883937]
• QiaChip Smart Switch (WB2S,T) – P24 Relay, P26 Button [Elektroda, 19906692]
10. How do I compile on Linux or Windows?
Clone SDK OpenBK7231T, then OpenBK7231T_App into /apps. Build: ./build_app.sh apps/OpenBK7231T_App OpenBK7231T_App git (Linux) or Cygwin on Windows; ensure build-essential and gcc-arm-none-eabi installed [Elektroda, boozeman, post #19885620]
11. Is there a no-solder exploit?
Yes. CloudCutter abuses 2019 Tuya SDK bug to OTA-flash BK7231 lights wirelessly; code published February 2022 [khalednassar/tuya-cloudcutter]. "It works on every test bulb so far" [Tom Clement, #19890768].
12. Edge-case: UART2 log shows boot loop only.
Wrong binary type (UA on BK7231N) causes endless boot; reflash with QIO image at 0×0 then AP appears [Elektroda, p.kaczmarek2, post #19890168]
