Elektroda.com
Elektroda.com
X
Elektroda.com

Qiachip Smart Switch - BK7231N / CB2S - interior, programming

p.kaczmarek2 12048 175
This content has been translated flag-pl » flag-en View the original version here.
  • Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Here I will present the short teardown and OpenBK7231 programming procedure for another Tuya relay, which this time turned out to have a rather unusual CB2S module inside, based on the BK7231N chip (not to be confused with the BK7231T). The programming procedure will be presented in a very beginner-friendly way, step for step. I will describe what tools can be useful for this and what problems I had to solve to add BK7231N support to my firmware. The goal, as usual, will be to pair with Home Assistant and become independent from the manufacturer's servers.

    Related Topics.
    OpenBK7231 is my alternative open source firwmare for BK7231T, BK7231T and XR809 chips. It's like a Tasmota replacement for those families. It supports MQTT and Home Assistant integration. You can read more about it here:
    WB2S / BK7231 Tutorial - creating our own firmware - UDP / TCP / HTTP / MQTT
    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
    I also described the manufacturer's applications (Tuya / eWeLink / Blitzwolf / SmartLife) in previous topics from the series. I will not touch on its subject here.
    Additionally: my Home Assistant tutorial

    Qiachip Smart Switch
    Qiachip is simply another smart transmitter controlled by WiFi through the manufacturer's mobile application. There is a button on the housing, which also allows you to manually control it. This time the set with it is quite poor:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    The manufacturer recommends the SmartLife application for it, which I described in the previous topics in the series.

    The interior of the Qiachip Smart Switch
    The housing is only held on the catches:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    The circuit inside is classic - a transformerless power supply based on the BP2525:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    AMS1117 LDO regulator (5V input, 3.3V output for WiFi module):
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    WiFi module - here CB2S - and a transistor to control the relay:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    CB2S is a WiFi / Bluetooth module based on a 32-bit BK7231N microcontroller.
    Leads of CB2S:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    The circuit looks very similar to the WB2S implemented on the BK7231T:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    These PWMs are compatible with the CB2S pins - let's take a look at the list:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    PWM0 to P8 - that's right.

    Programming of the BK7321N
    I have already solved the problem of programming very similiar chip, BK7231T. I am running a project of a universal open source firmware dedicated to this chip, details in these topics:
    WB2S / BK7231 Tutorial - we create our own firmware - UDP / TCP / HTTP / MQTT
    [BK7231T] My HTTP server, configurator, MQTT support from Home Assistant
    Unfortunately, the BK7231T is not the BK7231N - the architecture is somewhat different. This is evidenced, for example, by the presence of two different versions of the SDK for these systems:
    https://github.com/tuya/tuya-iotos-embeded-sdk-wifi-ble-bk7231n
    https://github.com/tuya/tuya-iotos-embeded-sdk-wifi-ble-bk7231t
    I already know the T version, I tried to run N analogously, but I quickly encountered a strange problem.
    During the compilation from the Cygwin level, I received such an error:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    I figured it was because Cygwin should use Windows Toolchain files.
    Here is the fix:
    https://github.com/openshwprojects/OpenBK7231...mmit/61b4204aa0677a8fc886f4e6bd4e235337eb1e85
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    The next changes I made were adding the SDK to the repository (as it was in the T version, because here I had to copy them from the T version).
    My modified N version SDK is published here::
    https://github.com/openshwprojects/OpenBK7231N/
    The SDK is prepared in such a way that is compatible with my application (Tasmota's equivalent) for the T version, which is available here:
    https://github.com/openshwprojects/OpenBK7231T_App
    On the application side I had to make a few corrections (eg the name and location of several files changed, additionally Tuya corrected the typos - it used to be "tuya_hal_storge.h" and now it is "tuya_hal_storage.h", but most of them have been similar).
    Another difference between the SDK of versions N and T is the presence of tuya source code - in version N it is only in lib (libtuya.a), and in version T we have c sources. I mean, for example, functions such as tuya_hal_flash_read or tuya_hal_wifi_all_ap_scan.
    The addresses of the memory sections also differ between the N and T versions:
    https://github.com/tuya/tuya-iotos-embeded-sd...k7231n_os/beken378/func/user_driver/Bk.Driver
    https://github.com/tuya/tuya-iotos-embeded-sd...37cuser_driver/Bken37cuser_driver/Bken37cuser
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Another absurdity that I had to fix was a configuration problem - something was overwriting the BK_PARTITION_NET_PARAM sections. It turned out that the RL_SUPPORT_FAST_CONNECT setting is to blame, which is rigidly given the same address, where the configuration is supposed to be. Well, Tuya has a mess in the SDK:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Ultimately, the application compiles:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming



    Connecting the programmer
    Everything is as in the previously described WB2S or WB3S (BK7231T). USB to UART converter and only connect TX1 and RX1:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Same photo, but with description:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    In addition, also CEN to be able to reset the module (but you can without CEN and reset by cutting off the power, as long as it does not reset the USB port due to too high power consumption after connecting the relay). Of course, also the mass and power supply (5V, connected to the 3.3V LDO regulator input).


    Attempt to upload the firmware to BKwriter 1.60
    First, I tried to use the same program that I uploaded the firmware to BK7231T - BKwriter 1.60. I checked two modes there, one marked as BK7231:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    In BK7231 mode, there is always an error with CRC during firmware verification.
    And the other BK7231N:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    There is a bug with "unprotect" flash on BK7231N. Was it a blocked system?

    Attempted to upload a firmware by the Python tool
    BKwriter did not work - but there is also a second option. Tool written in Python by Tuya, available, among others. here:
    https://github.com/OpenBekenIOT/hid_download_py
    The above repo already contains our modifications.
    In the readme of this tool, the N version of the layout is mentioned:
    Quote:

    For BK7231N, set download address to 0x0, and set -u option.

    Will it work? Let's try. I developed such a .bat file (you can also enter it from the cmd level):
    Code:

    python uartprogram W:\GIT\OpenBK7231N\apps\OpenBK7231N_App\output\1.0.0\OpenBK7231N_app_QIO_1.0.0.bin --unprotect -d com10 -w --startaddr 0x0

    I started it with the module already connected:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Then (at the "Getting bus" stage) I reset the module (you can connect and disconnect the power supply, but I shorted the CEN pin to ground for a while. If it does not work, you can try to give a pull up resistor to CEN and then try to reset shorting to ground) and programming started:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Ready:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Uploaded without errors. I can see that the configuration AP appears - the firmware works!

    What does my load offer?
    My load is basically the equivalent of Tasmota. Creates its own AP after startup:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    The configuration page is available there on IP 192.168.4.1.
    It can be connected to our router there:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    You can freely configure the module (its pins, their roles):
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    You can connect it with Home Assistant via MQTT:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    You can also directly control the module:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    There is also an automatic configurator for the smart devices I reviewed:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    And let's not forget the configuration generator for Home Assistant, here:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming
    My firmware already supports three platforms - BK7231T, BK7231N and XR809. But details another time ...

    PS: And if we connect our device with OpenBK to our WiFi and we want to know the IP address assigned to it by DHCP, it is best to look at the configuration page of our router and find BK by the host name:
    Qiachip Smart Switch - BK7231N / CB2S - interior, programming

    Summary
    Ultimately, however, I managed to run my open firmware on this relay based on the CB2S module (BK7231N). There was a bit of porting the source code from the SDK, but fortunately it was only me that had to do. There was also a bit of guesswork with uploading the firmware , but I can already say that in the end the procedure comes down to:
    1. we solder the wires to RX, TX, CEN and power supply. RX and TX are connected to the USB UART converter
    2. we run hid_download_py from the command line, more precisely python uartprogram W: \ GIT \ OpenBK7231N \ apps \ OpenBK7231N_App \ output \ 1.0.0 \ OpenBK7231N_app_QIO_1.0.0.bin --unprotect -d com10 -w --startaddr 0x0 . Yes, we are uploading the QIO version
    3.The program will wait for the module reset - we short the CEN to ground (preferably also having a pull up there, i.e. a resistor for power supply) to reset the module
    The 4th program will detect the RESET itself and load the firmware
    5. done! We configure the rest via the WiFi access point (IP is 192.168.4.1, if the page does not open, it means that DHCP has not started - we can just set our machine ourselves, e.g. IP 192.168.4.10 and reconnect to the BK network)
    The question is what firmware - the latest versions of the binary are available here:
    https://github.com/openshwprojects/OpenBK7231T_App/releases
    For more details, please visit my repositories (README will be updated):
    https://github.com/openshwprojects/OpenBK7231T_App
    PS: I know from one of the users that Qiachip Smart Switch is also available with WB2S - so there may be different modules inside. Fortunately, WB2S is also supported by my firmware.

    Cool? Ranking DIY
    About Author
    p.kaczmarek2
    Level 27  
    Offline 
    p.kaczmarek2 wrote 2159 posts with rating 3937, helped 94 times. Been with us since 2014 year.
  • #2
    ncore432
    Level 5  
    Well hello, I'm glad that I found your work , because I've got this beautiful switch and its the CB2S version , but the plate is soldered i guess in that way that i cannot reach the RX TX side ,any suggestions how to remove it ? Thx
  • #3
    p.kaczmarek2
    Level 27  
    Can you post a photo?

    Well, maybe a solder wick, soldering iron and some flux? First put flux on joints, then use solder wick and soldering iron to remove the solder, and when you're done (all solder is removed) then you can pull out CB2S module out....

    You can program CB2S outside of relay board, just provide 3.3V, GND and TX/RX (no CEN needed, I think)

    Of course, you have to solder it later.
  • #4
    ncore432
    Level 5  
    I did post a photo but the moderator needs to approve it, I just wanted to ask you that how on earth they are managed to solder it like this, with hotplate I guess, or with some dark magic. Soon the picture will be approved and you'll see this horrid technique.

    Added after 5 [minutes]:

    this is the tiny switch that goes into the wall socket behind the switch, and almost no testpoints are exposed on the PCB.I would say it's 20mmx20mmx10mm

    Added after 1 [minutes]:

    ncore432 wrote:
    I did post a photo but the moderator needs to approve it, I just wanted to ask you that how on earth they are managed to solder it like this, with hotplate I guess, or with some dark magic. Soon the picture will be approved and you'll see this horrid technique.

    Added after 5 [minutes]:

    this is the tiny switch that goes into the wall socket behind the switch, and almost no testpoints are exposed on the PCB.I would say it's 20mmx20mmx10mm


    And it's a pain in the butt with localTuya in Homaeaasitant, so thats why your work is far superior to the original firmware
  • #5
    p.kaczmarek2
    Level 27  
    Ah, you are asking for the soldering technique? Well, maybe I could make a short video clip, but for now text description should do it

    1. if board is dirty from your previous experiments, clear it with PCB cleaner, might be IPA or something
    2. also make sure that soldering iron tip is clean
    3. add flux to the joints/pads
    4. add some extra Pb solder (Pb has lower melting temperature and it's easier to use than pb-free solder) on the joints/pads (with the help of soldering iron, obviously)
    5. strip the wire, add some flux on the wire
    6. add some solder on the wire tip (without soldering it, just to make sure that solder penetrates the wire)
    7. then, finally, solder the wire (already coated with solder) to the PCB joint (both PCB joint and wire should be already pre-covered with solder on this step)

    This methods lets you to solder wires to test pads reliably, even with the cheapest aliexpress soldering irons

    Have you read the other guides?
    https://www.elektroda.com/rtvforum/topic3875654.html


    PS: when you get wires connected, can you do a full flash read of your CB2S (2MB of flash?)? Tuya-cloudcutter projects needs flash dumps so people can program devices without soldering wires
  • #6
    ncore432
    Level 5  
    the funny thing is that no soldered surface is exposed, it's like a sandwich
  • #7
    p.kaczmarek2
    Level 27  
    Send me a photo on private message or something

    in a meantime, maybe you'd be able to use this: https://github.com/tuya-cloudcutter/tuya-cloudcutter/issues/62 ? I'm not sure if it matches your devices, but maybe...
  • #8
    ncore432
    Level 5  
    I ve manged to take it off but I ripped some pads, it is worse than a BGA job, will send the pictures on PM
  • #9
    p.kaczmarek2
    Level 27  
    So it seems that you have a very different relay than the one here and pads really are not accessible, because they are totally covered by PCB.
    ncore432 wrote:

    Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming Qiachip Smart Switch - BK7231N / CB2S - interior, programming

    I would have try with hot air, but now you already have module off...

    You can program it now and try soldering it back. Since one of the pads might ripped of, maybe you should try using some small wires and let the WiFi module dangle in the air (or better secure it with glue later)
  • #10
    ncore432
    Level 5  
    yeah, but first I gonna flash it with your software, the FTDI will do ?

    Added after 1 [minutes]:

    so we need, 3.3V, GND, RX TX , right ?

    Added after 34 [seconds]:

    no clue what p26 did that I've smoked

    I've no clue what part is under the shield,that shield is also from one piece, no top and bottom shield, unbelievable....
  • #11
    p.kaczmarek2
    Level 27  
    Ah, so P26 from the module is also lost?

    Don't worry, with OpenBeken you can control relay with any other pin.

    Only 3.3V, GND RX and TX are needed. Some people also like to use CEN, but you can reset module (or, the correct way to say is 'reboot') just by powering it off and on

    And again, remember to do a backup flash dump and send it here, or to me, to to tuya-cloudcutter guys.
  • #12
    ncore432
    Level 5  
    Ok, if you point me to the dump procedure direction, I would appreciate it
  • #13
    p.kaczmarek2
    Level 27  
    Well, check the guides linked here:

    https://github.com/openshwprojects/OpenBK7231T_App
    but the procedure is
    1. connect gnd, tx, and rx (use 3.3V voltage levels for uart converter)
    2. set read memory size to 2mb (or anything large, it will be clamped) in bkwriter 1.60
    3. press "read"
    4. now, while the bkwriter is waiting for device to reply, power on the device by connceting VCC to 3.3V from some 3.3V LDO maybe ams1117 or something
    5. now bkwriter will read the memory
    6. to make sure, repeat
  • #14
    ncore432
    Level 5  
    will do, but first I have to measure my FTDI signal output level, I think it's 3v, but I never know
  • #15
    p.kaczmarek2
    Level 27  
    There was some reports from users saying that certain USB to UART converters are problematic, so maybe you can try buying the one I have, it's one of the cheapest one, widely available
  • #16
    ncore432
    Level 5  
    ok it says it read it but where is the outputted dump?
  • #17
    p.kaczmarek2
    Level 27  
    in the same directory that you run .exe from

    Have you ensured to read whole flash, not just the first partitions?
  • #18
    ncore432
    Level 5  
    it puts put nothing

    Added after 2 [minutes]:

    under a Browse button , is another with weird charachters, what is it for ?

    Added after 55 [minutes]:

    kaczmarek, my friend thank you for your guidance, I will proceed now with the flashing, hope it al gonna be OK !

    Added after 2 [hours] 9 [minutes]:

    ok flashed, the AP appears , but I'm too tired, trying to assemble the whole thing tomorrow
  • #19
    p.kaczmarek2
    Level 27  
    Thanks, altough I am not sure if you included the whole 2MB. It's just 956KB. At least such flash is still usefull for Tuya-cloudcutter, but it's harder to analyze.

    Weird characters buttons is "Write", I think
  • #20
    ncore432
    Level 5  
    I'm really upset that they are phasing out the ESP line. It was a good allrounder, maybe it had problems with the wifi stability but still...
  • #21
    babelhoo
    Level 2  
    Great information. I’m glad I found this.
    I have a couple of Tuya wall switches with a CUB chip, which based on what I found on Tuya’s documents, it’s based on the BK7231N, although I see it has more pins.
    Any idea if this firmware would work? (I’ll probably will give it a shot anyway, worst case scenario I ‘ll brick one of the switches. )
  • #22
    p.kaczmarek2
    Level 27  
    BK7231N is well supported, so give it a shot. I will help you to get it up and running.

    Still, can you provide us a little more information, which devices you have and where did you buy them? We're creating a documentation for Tuya devices, so any new information is welcome.
  • #23
    babelhoo
    Level 2  
    I’ll try it this weekend (dump the current FW before), I’ll get more details when I do and get back to you. I’m from Argentina and bought these locally on a very popular website. (in Latin America that is), it seems the guys importing these over here have the switches branded to their own brand, but these look like the typical wall switch with round touch sensitive buttons. I’ll attach images when I try to flash it during the weekend. Thanks for your quick reply!
  • #24
    p.kaczmarek2
    Level 27  
    Dumping FW before flashing is very important, because if you do a full 2 MB dump (and paired with preferrably dummy network because it could leak your SSID), and send full 2 MB dump to tuya-cloudcutter guys (google for their github, put a zip file attachment as new Issue), they can add OTA programming support for all the same devices, so you can flash them with OpenBeken without opening them.

    Remember to check after doing read that your file is full 2MB and not just 965KB or something like that.
  • #25
    babelhoo
    Level 2  
    Unfortunately I couldn't do much this past weekend, as the crappy USB to TTL adaptor I had decided to quit on me... I just ordered a few different ones, just in case, and I'll retry as soon as I get them.
  • #26
    babelhoo
    Level 2  
    The link to releases with the latest compiled mentioned above bin is not available anymore?
  • #28
    jony4t
    Level 4  
    Hello Goodnight. I am a newbie in this forum, I have searched the whole forum looking for a solution before writing, but I can't find a solution

    I've been trying to flash a CB2s Bk7231N, at first I used a pl230 ttl converter, I couldn't flash it. Then I bought a C340G ttl converter and I couldn't flash either. Has anyone had a similar problem?

    when executing uartprogrma it appears (cannot get bus)

    Greetings. translated from spanish to english
  • #29
    p.kaczmarek2
    Level 27  
    Hello, I will try my best to help you, but you need to provide more information. There can be multiple reasons for your flashing issues.
    1. Are you doing a proper reboot while the programmer tool is waiting to get bus? You can do this by:
    a) power off and power on the device (NOTE: too large capacitors will overload usb port so it's better to power from external 5V source or remove temporarily said capacitor from board)
    b) use CEN pin to RESET (NOTE: this is tricky because it works only if you ground CEN for a certain amount of time, you have to do this for a short while, it always takes me several tries to get right)
    2. Are you connecting to correct RX and TX? Are you connecting RX of USB converter to TX of Beken, and TX of USB to RX of Beken?
    3. Are you sure that RX and TX lines used for programming are not "busy"? By "busy" I mean, they could:
    a) be used for TuyaMCU communication. They could have be connected to MCU. In this case you might need to temporary disconnect them, but not always
    b) be used for something like a button with external pull up resistor, and it's the same in this case, you might need to disconnect them temporarily (cut the trace)
    4. Have you tried the second flashing tool? We have bkWriter 1.60 for Windows and the python uartprogram for hid_download_py repository.

    Please post some photos of your setup. Show how your device look like, how is connected, how you do a reset.
  • #30
    00svd00
    Level 7  
    Hello! Is there any possibility to erase all settings? After playng with configs my wifi relay is not connecting to my wifi and also is not creating Wifi AP. FW reflash doesn't help
    Seems that some config prevents it to boot(and same in safe mod - after several fast reboots)