In this post, I will share teardown of Tuya Smart switch for boiler water heater and flashing it with OpenBK7231N.
The switch was bought on Aliexpress, the major reason to buy this device is it’s advertised high power, 20A 4400W !! (I have very bad experience with cheap Sonoff 16A switches that nearly burned my entire house after few weeks of operation).
after discovering this forum... i had to give Tuya a try
I was really hoping to get an old device with either ESP chip or at least WB2S, however the switch came with CB3S and BK2731N, which made the process a bit more educational (aka complicated).
The front glass cover is easily removed, and the 1st PCB layer with the LED and CB3S module are exposed.
This PCB is connected with 4 pins socket to a 2nd PCB which contains the relay and power circuit. In between there is a thin film layer (like in other switches from Tuya).
For the firmware upgrade there is no need to disassemble the 2nd PCB. Just remove the 1st PCB from its housing.
Prepare to flash hardware: 1. Breadboard with few cables
2. A 3.3v power supply
3. USB to serial adapter FT232RL FTDI 4. FIMO clay or soldering iron...
To avoid soldering, I’ve used some FIMO clay to hold breadboard cable pins right on the chip. This method requires some practice to make sure the pins actually touch the board at the correct position, and make sure that the cables don’t move while flashing.
Flashing: so, after wiring everything, and double checking that all connections are correct, it's time to run the flashing!
when running the flashing command, you need to reset the chip by grounding pin 1 (that's the 'free' orange wire in the picture). if all goes well, you will get a successful msg!
OpenBK7231N config: by now you should see a new wifi AP from the switch, something like OpenBK7231N_#######.
connect to this wifi, and setup access to your home wifi.
in the configuration menu, setup:
That's a very interesting device. Thank you for posting the teardown.
I am especially intrigued by that WB3S/CB3S switch. I have looked at the Tuya documentation to check the difference:
It seems that the jumper allows you to select between RXD2 and PWM3.
For CB3S, those are pins 12 and 13:
12 CSN I/O Production test control pin. If it is used as a common I/O pin, it must be connected to the VCC externally. Do not connect it to the ground before the module is powered on.
13 P8 I/O GPIOP_8, which corresponds to P8 of the IC, PWM 2
It looks like they are trying to avoid using CSN pin in case of CB3S.
Regarding 20A relay - it seems there is indeed such a relay inside, but I don't know how it will work in practise.
Anything else you need to do find the pin for button?
I have a similar tuya 20a switch (UK size standard) with wb3s, found the relay and led, tested remaining pins but still couldn’t get button working
Well, there are two approaches for finding the button. First is to try each pin one by one (set it to btn role In config and try pressing button and see if relays switches) and second option is to follow the PCB tracks with multimeter.
Remember to set the channel index for button to the same value that relay has. Channel index is used to link relays, buttons and LEDs together.