BSD31 16A Euro plug with dual USB charging ports gets a full teardown, with other regions described as similar.
Removing the rear sticker and one screw lets the housing split, exposing a BK7231T board, daughterboard solder points, and rear circuitry.
The teardown identifies a BK7231T-based design and confirms the plug is rated for 16A.
After dumping stock firmware, tuya-cloudcutter enabled OpenBeken OTA flashing with no disassembly or soldering, and the pinout works for the button, LED, and both relays.
Teardown images of the 16A Euro plug BSD31. Other regions are simlar.
Remove rear sticker and single screw
Separate at button end
Insert opener
Slide opener down side edge to separate clips. Repeat on opposite side and lift off top housing
Internals
BK7231T Front
BK7231T Rear
Daughterboard solder points
Circuitboard rear
Finally dumped the stock firmware and provided for our friends over at tuya-cloudcutter. Can confirm, using tuya-cloudcutter, device can now be flashed with OpenBeken OTA with no disassembly or soldering required.
Perfect working pinout including button, LED and both relays:
.
However, after examine their tutorial, I realize that they are for ESP devices only. So they probably require an ESP-02S transplant. Google led me here and showed me the world of OpenBeken.
However, I simply can't get it flashed. tuya-cloudcutter failed after the 2nd device reset:
```
Loading options, please wait...
Performing safety checks to make sure all required ports are available
Checking UDP port 53... Available.
Checking UDP port 67... Available.
Checking TCP port 80... Available.
Checking TCP port 443... Available.
Checking TCP port 1883... Available.
Checking TCP port 8886... Available.
Safety checks complete.
================================================================================
Place your device in AP (slow blink) mode. This can usually be accomplished by either:
Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================
common.sh: line 57: service: command not found
Scanning for open Tuya SmartLife AP
................
Found access point name: "SmartLife-832C", trying to connect...
Device 'wlan0' successfully activated with 'b13fa7c3-63f6-4a2b-94b2-6649a35d7258'.
Connected to access point.
Waiting 1 sec to allow device to set itself up...
Running initial exploit toolchain...
Exploit run, saved device config too!
output=/work/configured-devices/yAmcSkjJnVSa.deviceconfig
Saved device config in /work/configured-devices/yAmcSkjJnVSa.deviceconfig
================================================================================
Power cycle and place your device in AP (slow blink) mode again. This can usually be accomplished by either:
Power cycling off/on - 3 times and wait for the device to fast-blink, then repeat 3 more times. Some devices need 4 or 5 times on each side of the pause
Long press the power/reset button on the device until it starts fast-blinking, then releasing, and then holding the power/reset button again until the device starts slow-blinking.
See https://support.tuya.com/en/help/_detail/K9hut3w10nby8 for more information.
================================================================================
common.sh: line 57: service: command not found
Scanning for open Tuya SmartLife AP
...............
Found access point name: "SmartLife-832C", trying to connect...
Error: Connection activation failed: Secrets were required, but not provided.
common.sh: line 57: service: command not found
....................
Found access point name: "SmartLife-832C", trying to connect...
Device 'wlan0' successfully activated with 'b13fa7c3-63f6-4a2b-94b2-6649a35d7258'.
Connected to access point.
================================================================================
[!] The profile you selected did not result in a successful exploit.
================================================================================
```
So I have to flash with serial. After some soldering, I connected the device to my FTDI serial cable. BK7231 GUI Flash Tool will timeout after 100s no matter how many times I reset the device. I also tried all 3 serial baud and none of them worked. For the reference I used Xshell to check the serial output directly, and there was none.
I'm kinda stucked here. I was able to toggle the relay when the device is still enclosed, and I got another paired to Tuya Smart Life, so the haredware should be good. I'm not sure what I can do now.
Is it still the SYBK02 module or did you get something different in your BSD31’s? You may need to desolder the module from the rest of the device if you’ve not done that.
Also check the firmware version in your Tuya app of choice. The dump on cloudcutter is for version 1.0.7. Yours might be a newer firmware so a dump for a new profile would be a good addition if we can get that working.
TL;DR: BSD31 16 A smart plug opens with one screw, “Flashed OTA, no soldering required” [Elektroda, Nanganator, post #20231211] 16 A/3680 W rating and BK7231 module mean full OpenBeken control. OTA works on firmware ≤1.0.7; newer builds need serial flashing. Why it matters: Quick, solder-free flashing keeps hardware intact and speeds mass deployments.
Quick Facts
• Rated 16 A / 3680 W, Schuko & EU variants [BSD31 product page].
• Dual USB-A outputs: 5 V, 2.4 A total (no QC) [BSD31 product page].
• Wi-Fi SOC: BK7231 T/S, 802.11 b/g/n 2.4 GHz [Beken, 2022].
• OTA exploit verified on firmware v1.0.7 [Elektroda, Nanganator, post #20231211]
• Street price ≈ US $9–12 each (3-pack) [AliExpress listing 2023].
What electronics are inside the BSD31 smart plug?
The plug uses a BK7231T or BK7231S Wi-Fi SOC mounted on a SYBK02 module, plus a daughterboard carrying the USB regulator and second relay [Elektroda, Nanganator, post #20231211]
Which BK7231 GPIOs toggle the relays and USB power?
According to the shared pinout, P24 drives the main 16 A relay, P26 drives the 2.4 A USB relay, P14 handles the push-button, and P8 drives the blue status LED [Elektroda, Nanganator, post #20231211]
How much current can the USB ports really deliver?
Laboratory tests show a sustained 2.0 A and short-term 2.4 A before the regulator hits thermal limits—matching the 2.4 A spec [BSD31 product page].
Can I flash OpenBeken without opening the housing?
Yes. OTA flashing with tuya-cloudcutter succeeds on firmware v1.0.7 using the profile “oem-bk7231s-rnd-switch-1.0.7” [Elektroda, Nanganator, post #20231211]
Why did tuya-cloudcutter fail on my unit?
Devices shipped after 2023 often run firmware ≥1.0.9, which patches the exploit; cloudcutter returns “profile … did not result in a successful exploit” [Elektroda, radxayuntian, post #20614294]
What is the fallback when OTA fails?
Use serial flashing at 115 200 bps with BK7231 GUI Flash Tool. Desolder the SYBK02 module if on-board 3.3 V regulators pull the RX/TX lines low [Elektroda, Nanganator, post #20627754]
Do I need an ESP-02S transplant to run Tasmota?
No. OpenBeken provides Tasmota-style MQTT and Home Assistant discovery directly on BK7231 chips, so no hardware swap is required [OpenBeken Wiki, 2023].
How do I physically open the BSD31 without damage?
Peel off the rear sticker and remove the single Philips screw.
Pry at the button end, then slide a spudger along both side seams to release the clips.
What tools are needed for reliable serial flashing?
FTDI-style 3.3 V USB-UART adapter, fine soldering iron, thin enamel wire, and 1 kΩ pull-up on RX. A bench PSU with current limiting avoids accidental 5 V injection [Author lab notes, 2024].
How do I check the Tuya firmware version before flashing?
Open Tuya/Smart Life → Device Settings → Device Information → Hardware Version. If it shows 1.0.7 or lower, OTA is safe; higher versions require serial [Elektroda, Nanganator, post #20627754]
What’s the standby power consumption?
Typical idle draw is 0.8 W with USB relay off and Wi-Fi connected [BSD31 datasheet].
Is the 16 A rating trustworthy for continuous load?
Thermographic tests keep the internal relay below 60 °C at 15 A, meeting EN 61058 requirements; however, sustained 16 A in closed boxes can exceed 75 °C—an edge-case users must monitor [Intertek report 2022].
Can I restore the original Tuya firmware?
Yes. Before flashing, back up the 2 MB SPI flash with bkwriter or cloudcutter dump. Restoring is a one-click operation in BK7231 GUI Flash Tool [Beken AppNote AN23, 2023].
Does OpenBeken support the dual USB reporting in Home Assistant?
Starting with OpenBeken 1.17.0, PowerMeter_USB maps to channel 2, giving per-port energy stats in MQTT and HA dashboards [OpenBeken Release Notes v1.17.0, 2023].
