Qiachip Smart Switch - BK7231N / CB2S - interior, programming

p.kaczmarek2 33777 266

This content has been translated

View the original version here.

Reply Cool? Ranking DIY | New topic

Notify about new articles

» | Positive voted Helpful post? (+33)

#1 21 Feb 2022 01:07

Here I will present the short teardown and OpenBK7231 programming procedure for another Tuya relay, which this time turned out to have a rather unusual CB2S module inside, based on the BK7231N chip (not to be confused with the BK7231T). The programming procedure will be presented in a very beginner-friendly way, step for step. I will describe what tools can be useful for this and what problems I had to solve to add BK7231N support to my firmware. The goal, as usual, will be to pair with Home Assistant and become independent from the manufacturer's servers.

Related Topics.
OpenBK7231 is my alternative open source firwmare for BK7231T, BK7231T and XR809 chips. It's like a Tasmota replacement for those families. It supports MQTT and Home Assistant integration. You can read more about it here:
WB2S / BK7231 Tutorial - creating our own firmware - UDP / TCP / HTTP / MQTT
[BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
I also described the manufacturer's applications (Tuya / eWeLink / Blitzwolf / SmartLife) in previous topics from the series. I will not touch on its subject here.
Additionally: my Home Assistant tutorial

Qiachip Smart Switch
Qiachip is simply another smart transmitter controlled by WiFi through the manufacturer's mobile application. There is a button on the housing, which also allows you to manually control it. This time the set with it is quite poor:

The manufacturer recommends the SmartLife application for it, which I described in the previous topics in the series.

The interior of the Qiachip Smart Switch
The housing is only held on the catches:

The circuit inside is classic - a transformerless power supply based on the BP2525:

AMS1117 LDO regulator (5V input, 3.3V output for WiFi module):

WiFi module - here CB2S - and a transistor to control the relay:

CB2S is a WiFi / Bluetooth module based on a 32-bit BK7231N microcontroller.
Leads of CB2S:

The circuit looks very similar to the WB2S implemented on the BK7231T:

These PWMs are compatible with the CB2S pins - let's take a look at the list:

PWM0 to P8 - that's right.

Programming of the BK7321N
I have already solved the problem of programming very similiar chip, BK7231T. I am running a project of a universal open source firmware dedicated to this chip, details in these topics:
WB2S / BK7231 Tutorial - we create our own firmware - UDP / TCP / HTTP / MQTT
[BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
Unfortunately, the BK7231T is not the BK7231N - the architecture is somewhat different. This is evidenced, for example, by the presence of two different versions of the SDK for these systems:
https://github.com/tuya/tuya-iotos-embeded-sdk-wifi-ble-bk7231n
https://github.com/tuya/tuya-iotos-embeded-sdk-wifi-ble-bk7231t
I already know the T version, I tried to run N analogously, but I quickly encountered a strange problem.
During the compilation from the Cygwin level, I received such an error:

I figured it was because Cygwin should use Windows Toolchain files.
Here is the fix:
https://github.com/openshwprojects/OpenBK7231...mmit/61b4204aa0677a8fc886f4e6bd4e235337eb1e85

The next changes I made were adding the SDK to the repository (as it was in the T version, because here I had to copy them from the T version).
My modified N version SDK is published here::
https://github.com/openshwprojects/OpenBK7231N/
The SDK is prepared in such a way that is compatible with my application (Tasmota's equivalent) for the T version, which is available here:
https://github.com/openshwprojects/OpenBK7231T_App
On the application side I had to make a few corrections (eg the name and location of several files changed, additionally Tuya corrected the typos - it used to be "tuya_hal_storge.h" and now it is "tuya_hal_storage.h", but most of them have been similar).
Another difference between the SDK of versions N and T is the presence of tuya source code - in version N it is only in lib (libtuya.a), and in version T we have c sources. I mean, for example, functions such as tuya_hal_flash_read or tuya_hal_wifi_all_ap_scan.
The addresses of the memory sections also differ between the N and T versions:
https://github.com/tuya/tuya-iotos-embeded-sd...k7231n_os/beken378/func/user_driver/Bk.Driver
https://github.com/tuya/tuya-iotos-embeded-sd...37cuser_driver/Bken37cuser_driver/Bken37cuser

Another absurdity that I had to fix was a configuration problem - something was overwriting the BK_PARTITION_NET_PARAM sections. It turned out that the RL_SUPPORT_FAST_CONNECT setting is to blame, which is rigidly given the same address, where the configuration is supposed to be. Well, Tuya has a mess in the SDK:

Ultimately, the application compiles:

Connecting the programmer
Everything is as in the previously described WB2S or WB3S (BK7231T). USB to UART converter and only connect TX1 and RX1:

Same photo, but with description:

In addition, also CEN to be able to reset the module (but you can without CEN and reset by cutting off the power, as long as it does not reset the USB port due to too high power consumption after connecting the relay). Of course, also the mass and power supply (5V, connected to the 3.3V LDO regulator input).

Attempt to upload the firmware to BKwriter 1.60
First, I tried to use the same program that I uploaded the firmware to BK7231T - BKwriter 1.60. I checked two modes there, one marked as BK7231:

In BK7231 mode, there is always an error with CRC during firmware verification.
And the other BK7231N:

There is a bug with "unprotect" flash on BK7231N. Was it a blocked system?

Attempted to upload a firmware by the Python tool
BKwriter did not work - but there is also a second option. Tool written in Python by Tuya, available, among others. here:
https://github.com/OpenBekenIOT/hid_download_py
The above repo already contains our modifications.
In the readme of this tool, the N version of the layout is mentioned:

Quote:

For BK7231N, set download address to 0x0, and set -u option.

Will it work? Let's try. I developed such a .bat file (you can also enter it from the cmd level):

Code: text Expand Select all Copy to clipboard
python uartprogram W:\GIT\OpenBK7231N\apps\OpenBK7231N_App\output\1.0.0\OpenBK7231N_app_QIO_1.0.0.bin --unprotect -d com10 -w --startaddr 0x0

I started it with the module already connected:

Then (at the "Getting bus" stage) I reset the module (you can connect and disconnect the power supply, but I shorted the CEN pin to ground for a while. If it does not work, you can try to give a pull up resistor to CEN and then try to reset shorting to ground) and programming started:

Ready:

Uploaded without errors. I can see that the configuration AP appears - the firmware works!

What does my firmware offer?
My firmware is basically very similar to Tasmota. Creates its own AP after startup:

The configuration page is available there on IP 192.168.4.1.
It can be connected to our router there:

You can freely configure the module (its pins, their roles):

You can connect it with Home Assistant via MQTT:

You can also directly control the module:

There is also an automatic configurator for the smart devices I reviewed:

And let's not forget the configuration generator for Home Assistant, here:

My firmware already supports three platforms - BK7231T, BK7231N and XR809. But details another time ...

PS: And if we connect our device with OpenBK to our WiFi and we want to know the IP address assigned to it by DHCP, it is best to look at the configuration page of our router and find BK by the host name:

Summary
Ultimately, however, I managed to run my open firmware on this relay based on the CB2S module (BK7231N). There was a bit of porting the source code from the SDK, but fortunately it was only me that had to do. There was also a bit of guesswork with uploading the firmware , but I can already say that in the end the procedure comes down to:
1. we solder the wires to RX, TX, CEN and power supply. RX and TX are connected to the USB UART converter
2. we run hid_download_py from the command line, more precisely python uartprogram W: \ GIT \ OpenBK7231N \ apps \ OpenBK7231N_App \ output \ 1.0.0 \ OpenBK7231N_app_QIO_1.0.0.bin --unprotect -d com10 -w --startaddr 0x0 . Yes, we are uploading the QIO version
3.The program will wait for the module reset - we short the CEN to ground (preferably also having a pull up there, i.e. a resistor for power supply) to reset the module
The 4th program will detect the RESET itself and load the firmware
5. done! We configure the rest via the WiFi access point (IP is 192.168.4.1, if the page does not open, it means that DHCP has not started - we can just set our machine ourselves, e.g. IP 192.168.4.10 and reconnect to the BK network)
The question is what firmware - the latest versions of the binary are available here:
https://github.com/openshwprojects/OpenBK7231T_App/releases
For more details, please visit my repositories (README will be updated):
https://github.com/openshwprojects/OpenBK7231T_App
PS: I know from one of the users that Qiachip Smart Switch is also available with WB2S - so there may be different modules inside. Fortunately, WB2S is also supported by my firmware.

Cool? Ranking DIY
About Author
p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Offline

Joined: 26 Dec 2014

Posts: 4836

Help: 235

Posts rating: 5167

Points: 41064
p.kaczmarek2 wrote 4836 posts with rating 5167, helped 235 times. Been with us since 2014 year.
#2 29 Jun 2022 16:47

ncore432 ncore432

Level 5

Helpful post? (0)

#2 29 Jun 2022 16:47

Well hello, I'm glad that I found your work , because I've got this beautiful switch and its the CB2S version , but the plate is soldered i guess in that way that i cannot reach the RX TX side ,any suggestions how to remove it ? Thx
#3 29 Jun 2022 16:55

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#3 29 Jun 2022 16:55

Can you post a photo?

Well, maybe a solder wick, soldering iron and some flux? First put flux on joints, then use solder wick and soldering iron to remove the solder, and when you're done (all solder is removed) then you can pull out CB2S module out....

You can program CB2S outside of relay board, just provide 3.3V, GND and TX/RX (no CEN needed, I think)

Of course, you have to solder it later.
#4 29 Jun 2022 17:07

ncore432 ncore432

Level 5

Helpful post? (0)

#4 29 Jun 2022 17:07

I did post a photo but the moderator needs to approve it, I just wanted to ask you that how on earth they are managed to solder it like this, with hotplate I guess, or with some dark magic. Soon the picture will be approved and you'll see this horrid technique.

Added after 5 [minutes]:

this is the tiny switch that goes into the wall socket behind the switch, and almost no testpoints are exposed on the PCB.I would say it's 20mmx20mmx10mm

Added after 1 [minutes]:

ncore432 wrote:
I did post a photo but the moderator needs to approve it, I just wanted to ask you that how on earth they are managed to solder it like this, with hotplate I guess, or with some dark magic. Soon the picture will be approved and you'll see this horrid technique.

Added after 5 [minutes]:

this is the tiny switch that goes into the wall socket behind the switch, and almost no testpoints are exposed on the PCB.I would say it's 20mmx20mmx10mm

And it's a pain in the butt with localTuya in Homaeaasitant, so thats why your work is far superior to the original firmware
#5 29 Jun 2022 17:54

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#5 29 Jun 2022 17:54

Ah, you are asking for the soldering technique? Well, maybe I could make a short video clip, but for now text description should do it

1. if board is dirty from your previous experiments, clear it with PCB cleaner, might be IPA or something
2. also make sure that soldering iron tip is clean
3. add flux to the joints/pads
4. add some extra Pb solder (Pb has lower melting temperature and it's easier to use than pb-free solder) on the joints/pads (with the help of soldering iron, obviously)
5. strip the wire, add some flux on the wire
6. add some solder on the wire tip (without soldering it, just to make sure that solder penetrates the wire)
7. then, finally, solder the wire (already coated with solder) to the PCB joint (both PCB joint and wire should be already pre-covered with solder on this step)

This methods lets you to solder wires to test pads reliably, even with the cheapest aliexpress soldering irons

Have you read the other guides?
https://www.elektroda.com/rtvforum/topic3875654.html

PS: when you get wires connected, can you do a full flash read of your CB2S (2MB of flash?)? Tuya-cloudcutter projects needs flash dumps so people can program devices without soldering wires
#6 29 Jun 2022 18:18

ncore432 ncore432

Level 5

Helpful post? (+1)

#6 29 Jun 2022 18:18

the funny thing is that no soldered surface is exposed, it's like a sandwich
#7 29 Jun 2022 18:31

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#7 29 Jun 2022 18:31

Send me a photo on private message or something

in a meantime, maybe you'd be able to use this: https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues/62 ? I'm not sure if it matches your devices, but maybe...
#8 29 Jun 2022 18:56

ncore432 ncore432

Level 5

Helpful post? (0)

#8 29 Jun 2022 18:56

I ve manged to take it off but I ripped some pads, it is worse than a BGA job, will send the pictures on PM
#9 29 Jun 2022 19:20

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#9 29 Jun 2022 19:20

So it seems that you have a very different relay than the one here and pads really are not accessible, because they are totally covered by PCB.
ncore432 wrote:

I would have try with hot air, but now you already have module off...

You can program it now and try soldering it back. Since one of the pads might ripped of, maybe you should try using some small wires and let the WiFi module dangle in the air (or better secure it with glue later)
#10 29 Jun 2022 19:49

ncore432 ncore432

Level 5

Helpful post? (0)

#10 29 Jun 2022 19:49

yeah, but first I gonna flash it with your software, the FTDI will do ?

Added after 1 [minutes]:

so we need, 3.3V, GND, RX TX , right ?

Added after 34 [seconds]:

no clue what p26 did that I've smoked

I've no clue what part is under the shield,that shield is also from one piece, no top and bottom shield, unbelievable....
#11 29 Jun 2022 19:53

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#11 29 Jun 2022 19:53

Ah, so P26 from the module is also lost?

Don't worry, with OpenBeken you can control relay with any other pin.

Only 3.3V, GND RX and TX are needed. Some people also like to use CEN, but you can reset module (or, the correct way to say is 'reboot') just by powering it off and on

And again, remember to do a backup flash dump and send it here, or to me, to to tuya-cloudcutter guys.
#12 29 Jun 2022 20:08

ncore432 ncore432

Level 5

Helpful post? (+1)

#12 29 Jun 2022 20:08

Ok, if you point me to the dump procedure direction, I would appreciate it
#13 29 Jun 2022 20:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#13 29 Jun 2022 20:18

Well, check the guides linked here:

https://github.com/openshwprojects/OpenBK7231T_App
but the procedure is
1. connect gnd, tx, and rx (use 3.3V voltage levels for uart converter)
2. set read memory size to 2mb (or anything large, it will be clamped) in bkwriter 1.60
3. press "read"
4. now, while the bkwriter is waiting for device to reply, power on the device by connceting VCC to 3.3V from some 3.3V LDO maybe ams1117 or something
5. now bkwriter will read the memory
6. to make sure, repeat
#14 29 Jun 2022 20:28

ncore432 ncore432

Level 5

Helpful post? (0)

#14 29 Jun 2022 20:28

will do, but first I have to measure my FTDI signal output level, I think it's 3v, but I never know
#15 29 Jun 2022 20:56

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#15 29 Jun 2022 20:56

There was some reports from users saying that certain USB to UART converters are problematic, so maybe you can try buying the one I have, it's one of the cheapest one, widely available
#16 29 Jun 2022 21:44

ncore432 ncore432

Level 5

Helpful post? (0)

#16 29 Jun 2022 21:44

ok it says it read it but where is the outputted dump?
#17 29 Jun 2022 22:05

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#17 29 Jun 2022 22:05

in the same directory that you run .exe from

Have you ensured to read whole flash, not just the first partitions?
#18 30 Jun 2022 01:23

ncore432 ncore432

Level 5

Helpful post? (0)

#18 30 Jun 2022 01:23

it puts put nothing

Added after 2 [minutes]:

under a Browse button , is another with weird charachters, what is it for ?

Added after 55 [minutes]:

kaczmarek, my friend thank you for your guidance, I will proceed now with the flashing, hope it al gonna be OK !

Added after 2 [hours] 9 [minutes]:

ok flashed, the AP appears , but I'm too tired, trying to assemble the whole thing tomorrow
#19 30 Jun 2022 05:59

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#19 30 Jun 2022 05:59

Thanks, altough I am not sure if you included the whole 2MB. It's just 956KB. At least such flash is still usefull for Tuya-cloudcutter, but it's harder to analyze.

Weird characters buttons is "Write", I think
#20 30 Jun 2022 12:18

ncore432 ncore432

Level 5

Helpful post? (0)

#20 30 Jun 2022 12:18

I'm really upset that they are phasing out the ESP line. It was a good allrounder, maybe it had problems with the wifi stability but still...
#21 16 Jul 2022 00:28

babelhoo babelhoo

Level 2

Helpful post? (0)

#21 16 Jul 2022 00:28

Great information. I’m glad I found this.
I have a couple of Tuya wall switches with a CUB chip, which based on what I found on Tuya’s documents, it’s based on the BK7231N, although I see it has more pins.
Any idea if this firmware would work? (I’ll probably will give it a shot anyway, worst case scenario I ‘ll brick one of the switches. )
#22 16 Jul 2022 00:37

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#22 16 Jul 2022 00:37

BK7231N is well supported, so give it a shot. I will help you to get it up and running.

Still, can you provide us a little more information, which devices you have and where did you buy them? We're creating a documentation for Tuya devices, so any new information is welcome.
#23 16 Jul 2022 02:01

babelhoo babelhoo

Level 2

Helpful post? (0)

#23 16 Jul 2022 02:01

I’ll try it this weekend (dump the current FW before), I’ll get more details when I do and get back to you. I’m from Argentina and bought these locally on a very popular website. (in Latin America that is), it seems the guys importing these over here have the switches branded to their own brand, but these look like the typical wall switch with round touch sensitive buttons. I’ll attach images when I try to flash it during the weekend. Thanks for your quick reply!
#24 16 Jul 2022 10:30

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#24 16 Jul 2022 10:30

Dumping FW before flashing is very important, because if you do a full 2 MB dump (and paired with preferrably dummy network because it could leak your SSID), and send full 2 MB dump to tuya-cloudcutter guys (google for their github, put a zip file attachment as new Issue), they can add OTA programming support for all the same devices, so you can flash them with OpenBeken without opening them.

Remember to check after doing read that your file is full 2MB and not just 965KB or something like that.
#25 18 Jul 2022 16:29

babelhoo babelhoo

Level 2

Helpful post? (0)

#25 18 Jul 2022 16:29

Unfortunately I couldn't do much this past weekend, as the crappy USB to TTL adaptor I had decided to quit on me... I just ordered a few different ones, just in case, and I'll retry as soon as I get them.
#26 27 Jul 2022 03:44

babelhoo babelhoo

Level 2

Helpful post? (0)

#26 27 Jul 2022 03:44

The link to releases with the latest compiled mentioned above bin is not available anymore?
#27 27 Jul 2022 07:52

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#27 27 Jul 2022 07:52

Correct link:
https://github.com/openshwprojects/OpenBK7231T_App/releases
#28 31 Jul 2022 00:06

jony4t jony4t

Level 5

Helpful post? (0)

#28 31 Jul 2022 00:06

Hello Goodnight. I am a newbie in this forum, I have searched the whole forum looking for a solution before writing, but I can't find a solution

I've been trying to flash a CB2s Bk7231N, at first I used a pl230 ttl converter, I couldn't flash it. Then I bought a C340G ttl converter and I couldn't flash either. Has anyone had a similar problem?

when executing uartprogrma it appears (cannot get bus)

Greetings. translated from spanish to english
#29 31 Jul 2022 00:56

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

#29 31 Jul 2022 00:56

Hello, I will try my best to help you, but you need to provide more information. There can be multiple reasons for your flashing issues.
1. Are you doing a proper reboot while the programmer tool is waiting to get bus? You can do this by:
a) power off and power on the device (NOTE: too large capacitors will overload usb port so it's better to power from external 5V source or remove temporarily said capacitor from board)
b) use CEN pin to RESET (NOTE: this is tricky because it works only if you ground CEN for a certain amount of time, you have to do this for a short while, it always takes me several tries to get right)
2. Are you connecting to correct RX and TX? Are you connecting RX of USB converter to TX of Beken, and TX of USB to RX of Beken?
3. Are you sure that RX and TX lines used for programming are not "busy"? By "busy" I mean, they could:
a) be used for TuyaMCU communication. They could have be connected to MCU. In this case you might need to temporary disconnect them, but not always
b) be used for something like a button with external pull up resistor, and it's the same in this case, you might need to disconnect them temporarily (cut the trace)
4. Have you tried the second flashing tool? We have bkWriter 1.60 for Windows and the python uartprogram for hid_download_py repository.

Please post some photos of your setup. Show how your device look like, how is connected, how you do a reset.
#30 01 Aug 2022 05:35

00svd00 00svd00

Level 8

Helpful post? (0)

#30 01 Aug 2022 05:35

Hello! Is there any possibility to erase all settings? After playng with configs my wifi relay is not connecting to my wifi and also is not creating Wifi AP. FW reflash doesn't help
Seems that some config prevents it to boot(and same in safe mod - after several fast reboots)
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Log in with Google

Reply Cool? Ranking DIY | New topic

Notify about new articles