[Youtube] How to flash BK7231T smart 2gang switch and free it from the cloud - video guide

p.kaczmarek2 2217 25

This content has been translated

View the original version here.

Reply | New topic

Notify about new articles

» | Helpful post? (+3)

#1 14 Nov 2022 04:47

The video presents a summary of the firmware change in the Tuya switch for WiFi 2.4GHz based on BK7231T (here WB3S). This particular switch, in order to change the firmware, required desoldering the touch button controller chip in the SOIC housing, because it occupied the UART line needed for programming. This problem does not always occur, sometimes the manufacturer will leave the UART port free, and sometimes even lead it to marked pads, but there was no such comfort here.
Fortunately, the problematic circuit can be desoldered with the cheapest Chinese soldering iron, all you need is the right method, flux, additional binder and attention not to overheat the path:

The video was prepared with the help of my assistant (thank you for helping me with the film) and sped up accordingly.

Even products on ESP sometimes encounter similar problems. Another solution would be to cut the paths or (if possible) to put the problematic system (e.g. the second microcontroller, from TuyaMCU) into the RESET state.

The purpose of the firmware change is to free the product from the cloud and from the manufacturer's servers, as well as to enable free control and connection to Home Assistant (and not only, OpenBeken even supports SSDP and even Windows devices "see" such programmed switches).

The video contains English subtitles, because it is also aimed at our English-speaking users (ultimately, the thumbnail and perhaps the lector will be changed and it will also be placed on elektroda.com).

The firmware used, OpenBeken, supports the BK7231T, BK7231N, XR809, BL602, W600 and W800 (and similar) platforms, on all the operations are quite similar, although the tools for uploading the batch differ to some extent. Details in the project readme.
https://github.com/openshwprojects/OpenBK7231T_App

Used firmware - OpenBeken - ready binaries for supported platforms:
https://github.com/openshwprojects/OpenBK7231T_App/releases

A simple Windows program for uploading/reading a batch - bkWriter 1.60:
https://github.com/openshwprojects/OpenBK7231T/blob/master/bk_writer1.60.zip

A more complex batch upload/download program written in Python - hid_download_py:
https://github.com/OpenBekenIOT/hid_download_py/issues

Previous video about the relay:
[Youtube] Firmware change in Tuya relay with busy UART lines
Previous video about the LED "bulb":
[Youtube] Removing the SMD module and changing the BK7231 firmware in the RGBCW LED lamp

And the contest:
Present your own construction or send an article and receive a 64GB SD card
It also applies to topics placed in " Equipment indoors ", i.e. descriptions of e.g. IoT gadgets, but not only.

Side news/organizational matters:
1. The BK7231N platform in OpenBeken received a patch last month that significantly improved stability with a large number of MQTT events (problems were reported by several users, they are now fixed)
2. OpenBeken recently supports Home Assistant Discovery, so you don't have to manually copy the configuration. Config->Generate Home Assistant CFG and there you need to click the new button:

3. OpenBeken already supports the W600 and W601 WinnerMicro platform (thanks to the help of one of the contributors).
4. OpenBeken has recently supported an online device database (Launch Web Application->Config):

The database contains photos of devices, their templates, settings and scripts as well as links to Elektroda. Do you have any new device? Anyone can add them via pull request to:
https://github.com/OpenBekenIOT/webapp/blob/gh-pages/devices.json
Here you can see the database of devices in an accessible form:
https://openbekeniot.github.io/webapp/devicesList.html
About Author
p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Offline

Joined: 26 Dec 2014

Posts: 5843

Help: 279

Posts rating: 5827

Points: 52838
p.kaczmarek2 wrote 5843 posts with rating 5827, helped 279 times. Been with us since 2014 year.
#2 14 Nov 2022 10:40

Mateusz_konstruktor Mateusz_konstruktor

Level 33

» | Helpful post? (0)

#2 14 Nov 2022 10:40

Is this device available for sale in Poland and does it have a distributor, or does it have to be individually imported from abroad?
#3 14 Nov 2022 10:53

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (+1)

#3 14 Nov 2022 10:53

Your question can be answered in two ways. This particular switch was bought on eBay, but this type of products floods various types of shops also in Poland and on our Polish auction portal you can also buy them with shipping in the Smart package - you get them after 2 days by courier to your hands (or on Parcel locker). And the interiors are more or less similar and the programming procedure is analogous.

If you buy a switch of this type, then generally or you can get one on ESP8266, e.g. described here:
https://www.elektroda.pl/rtvforum/topic3749207.html
or rather on BK7231T/BK7231N. I haven't come across switches on other modules yet, though someone from the USA mentioned that he got a W600 switch, but my OpenBeken supports it anyway . In both cases, you upload the batch via UART (you need to locate the appropriate pins) and possibly, when these pins are "occupied", you have to cut the paths or remove the problematic system as in the video.

Both ESP and BK are programmed via UART. Tuya-convert (programming without opening the housing) can also work with ESP, if you're lucky. Newer ESP products no longer work with Tuya-convert.

Some time ago I posted a short topic about similar switches, but on ESP - then there is the plus that you can upload Tasmota:
https://www.elektroda.pl/rtvforum/topic3933329.html

So you have a wide choice.

I will only add that it is also worth considering the WiFi + RF433 option, at least one to buy in Poland - e.g. the QTouch series (but still produced, of course ... you know where). QTouch I described, among others. here:
https://www.elektroda.pl/rtvforum/topic3793509.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#4 14 Nov 2022 12:55

Mateusz_konstruktor Mateusz_konstruktor

Level 33

» | Helpful post? (+1)

#4 14 Nov 2022 12:55

Lots of unknowns.
In addition, the manufacturer himself may want to start blocking the possibility of changing the software to other than "company" at some point. I am thinking here of changes in electronic design, especially in the circuits located on the printed circuit board.

You would have to make lists: which versions should not be bought and which ones are already proven and the whole project has a chance of success.
How to keep up to date and know what is hidden under the casing of the latest releases of externally identical devices?
#5 14 Nov 2022 13:32

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

#5 14 Nov 2022 13:32

I do not know a single case of "blocking by the manufacturer" ESP8266 or BK7231T or BK7231N. Even if you break the bootloader in BK, you can get to the system via SPI. The only thing "blocked" is tuya-convert - so newer products with ESP cannot be programmed without opening the housing.
Physically it is also rather hard, there is always some access to the RX / TX pads. Even in these smallest modules:

Someone could write "what if there will be modules without RX / TX at all" - well, that would be a problem, but somehow I don't expect it and I haven't encountered it at the moment.

Mateusz_konstruktor wrote:

You would have to make lists: which versions should not be bought and which ones are already proven and the whole project has a chance of success.
How to keep up to date and know what is hidden under the casing of the latest releases of externally identical devices?

Generally, it's something like this with my users from the USA and from around the world we already do (well, we try to do) - hence the flood of topics in "Device interiors":
https://openbekeniot.github.io/webapp/devicesList.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#6 14 Nov 2022 14:53

Mateusz_konstruktor Mateusz_konstruktor

Level 33

» | Helpful post? (0)

#6 14 Nov 2022 14:53

I wrote about one or another manufacturer of the entire device.

However, it is obvious to change the software of the module itself, which is designed with the intention of freely uploading new software to it.

What could this look like in practice? Currently, we have one version of the internal plate, and in some time we can expect another version that no longer cooperates. Buying and persuading after unpacking?
#7 14 Nov 2022 15:25

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

#7 14 Nov 2022 15:25

There are a few "internal boards" of WiFi modules, but they all have pads that are also probably used in the factory for testing. Rather, it would not be profitable for them to make a version absolutely without these pads. I have not yet met a board from Tuya that would not have been derived in any form of programming interface.

If they change to something "non-cooperative" then someone will stumble upon it sooner or later and report it. And just in case, there is always a chance that the new module will have a compatible footprint, eg with the easy-to-buy ESP12E, and then it can be replaced at a low cost. Some people do that too.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#8 14 Nov 2022 15:35

Mateusz_konstruktor Mateusz_konstruktor

Level 33

» | Helpful post? (0)

#8 14 Nov 2022 15:35

Entire device = switch.
I did not and I do not mean the component itself, which is the Wi-Fi module.
#9 14 Nov 2022 16:12

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

#9 14 Nov 2022 16:12

If by "internal board" you mean the PCB of the switch and not the WiFi module, this is the smallest problem. After all, the paths to the touch buttons and relays, and possibly the WiFi LED, can be traced anew or, as a last resort, guessed. There is even a tool in OpenBeken that shows input states.

In general, the interiors of devices evolve over time (e.g. LSPA9 is older on BK7231T + BL0937 and newer on BK7231N + BL0942) but you have to come to terms with it and we try to include it in the list linked above.

We create templates and ready-made pinout descriptions to help users, but we know that generally you can find a device with a different "pinology" and this is not a problem.

If you mean something else, please elaborate. I'm not sure if I understand correctly what you're referring to.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#10 14 Nov 2022 23:00

Anonymous Anonymous

Level 1

» |

#10 14 Nov 2022 23:00

Mateusz_konstruktor wrote:
In addition, the manufacturer himself may want to start blocking the possibility of changing the software to other than "company" at some point. I am thinking here of changes in electronic design, especially in the circuits located on the printed circuit board.

There is no need for any design changes on the PCB.
It is enough for the manufacturer to make the same number as Makita;

That is, it will block access to the processor's memory with a password, or the so-called. a virtual password that does not exist. So once you program the processor and you have cut off access to the flash memory in both directions ...
In the case of Makita, the entire BMS module is replaced, while in the case of Tuya, I do not know if it will be profitable ... Well, unless someone orders 1000 pcs. those US on ali, and he will program and replace ...
#11 15 Nov 2022 07:24

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

#11 15 Nov 2022 07:24

It's quite possible, but nothing suggests it yet. They may introduce a new WiFi chip soon, either completely "unavailable" or simply without SDK.
It was similar when no one knew that Beken could be programmed, then people also exchanged modules. For example, here someone bought 30 lamps and soldered 30 times:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#12 15 Nov 2022 10:38

Mateusz_konstruktor Mateusz_konstruktor

Level 33

» | Helpful post? (0)

#12 15 Nov 2022 10:38

Which items to choose from the store shelf?
#13 15 Nov 2022 11:50

Anonymous Anonymous

Level 1

» |

#13 15 Nov 2022 11:50

p.kaczmarek2 wrote:
For example, here someone bought 30 lamps and soldered 30 times:

That's how I read this article. But generally I meant something like this;

Personally, in the place of the manufacturer, if I would go into a specific modification of these bulbs, plugs, relays, etc. I would issue an order for the production of one board with a microcontroller, RGBI power driver and power supply converter driver. I would put the transistor keying on the primary side outside the converter for obvious reasons. And basically this transistor would be the only element + some semiconductor diodes outside ... Of course, the order would be issued for some universal US for potting, which, depending on the boding, could handle all Tuya mini gadgets. Such integration would bring savings and effectively block the possibility of fiddling with the firmware. Of course, the system itself for one-time programming (I know they are so cheap)

Who knows what will happen next year?
Such a flooded integration means you would practically have to insert your processor, LED driver and inverter driver, because everything would be integrated on one tiny silicon plate, which after boding and programming, would be flooded with epoxy resin ...
This would probably be the end of cheap and quick modifications of Tuya products.

I would like to add that, for example, Makita knows about BMS counterfeits, that's why he is constantly messing with housings, so that something still doesn't fit, and another hour in the back before you polish it all up so that it fits professionally. Well, unless you buy BMS + housing with welding plates on ali, but then you will earn 4 tenners less and you will be literally 0, because you will not offer less than the competition. So below PLN 200 for a regenerated 3Ah 18V battery...
#14 15 Nov 2022 12:09

Mlody_Zdolny Mlody_Zdolny

Level 25

» | Helpful post? (0)

#14 15 Nov 2022 12:09

spec220 wrote:
Makita knows about BMS counterfeits, that's why they constantly mess with the housings, so that something still doesn't fit, and another hour in the back before you polish it all up so that it fits professionally.

May this practice end as soon as possible, just like standardization to USB-C in the case of chargers for smartphones and laptops in the EU.
So far, you can come across 3D models of adapters between different mounting systems.
#15 15 Nov 2022 12:45

Anonymous Anonymous

Level 1

» |

#15 15 Nov 2022 12:45

Mlody_Zdolny wrote:
May this process end as soon as possible

Let me tell you that Makita is one of the few brands that exaggerates so much with these locks, because security is an obvious thing. In other brands, even Bosch does not block. Yes, there is a balancer, PCM, NTC, but the US does not have a counter, and it does not block after cell replacement or loss of balance ... Anyway, why the counter, what are these battery charge indicators? ... Someone who does construction, it knows how much it can use on a given battery...
Makita simply generates e-waste. If it wasn't for this blockade, what I showed in post #10 would be for "re-consumption", i.e. in other leading brands ...

I wonder how it will be with this Tuya? Because what I wrote about in post #13 would probably reduce production costs a lot...
#16 15 Nov 2022 18:06

Mateusz_konstruktor Mateusz_konstruktor

Level 33

» | Helpful post? (0)

#16 15 Nov 2022 18:06

There doesn't have to be any extreme activity.
It is enough, for example, considering this particular model, to change the button controller to a different type.
#17 15 Nov 2022 18:10

Spanner Spanner

Level 14

» | Helpful post? (0)

#17 15 Nov 2022 18:10

Interesting way of desoldering. I usually sucked as much binder as possible from the pads with a braid and then removed the chip after heating it with hot-air. Of course, this method is not always possible. When desoldering from a system in which you do not know the BOM or the schematic, it is good to glue the surrounding small elements with kapton, because it may happen that when the board is accidentally moved, small elements may change their place and this may cause problems.

A preheater is useful if the board allows its use.

An interesting fun was once when desoldering a module in the form of a PCB soldered on another PCB - it had to be done in such a way as not to damage either the board or the module. The problem was that the module had pads (I don't know what it's called exactly, it's figuratively a semicircle - as if a metallized THT pad was cut in half) on both sides, and I don't know if there were even any on the third edge.

The three of us desoldered it - one of us heated a copper wire of about 1mm soldered on one side of the pads with one soldering iron, I heated the other side in the same way and had tweezers at the ready, the third of us heated the whole thing with hot air. In addition, the whole thing on the heater ?

The whole thing was finally completed successfully.
#18 15 Nov 2022 18:39

Anonymous Anonymous

Level 1

» |

#18 15 Nov 2022 18:39

Spanner wrote:
Interesting way of desoldering.

A colleague, the author, presented this method for the first time in a different topic ... I will say that in this way it is normal to drive virtually any SMD chips, only I have to buy a high-lead binder and a good flux, because Sn60Pb40 stiffens quickly, and you have to go to two soldering irons with a lot of thermal inertia... But it works. Pads are intact. And after desoldering, the tin is splashed from the PCB, and the remains from the pads are removed with a braid soaked in flux ...
#19 15 Nov 2022 19:00

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

#19 15 Nov 2022 19:00

If indeed IoT devices are on the "black dots", it is known that it will be difficult to do anything sensible. Fortunately, that's not likely to happen yet.

The desoldering method was also presented here:
https://www.elektroda.pl/rtvforum/topic3918655.html

Some people go a step further and buy a special desoldering binder - ChipQuik - but I haven't tried it and I'm not going to. I feel like that would be overpaying.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#20 15 Nov 2022 19:06

Anonymous Anonymous

Level 1

» |

#20 15 Nov 2022 19:06

p.kaczmarek2 wrote:
Some people go a step further and buy a special desoldering binder - ChipQuik

And what binder do you use for SMD desoldering? What is your Sn to Pb ratio?
#21 15 Nov 2022 19:09

Mlody_Zdolny Mlody_Zdolny

Level 25

» | Helpful post? (0)

#21 15 Nov 2022 19:09

Spanner wrote:
Interesting way of desoldering.

The key to success is the flux. Practice shows that flux or even an ordinary, not very advanced solder paste perfectly retains heat and allows you to solder SMD components with a simple soldering iron.
#22 15 Nov 2022 19:12

Anonymous Anonymous

Level 1

» |

#22 15 Nov 2022 19:12

Mlody_Zdolny wrote:
The key to success is the flux. Practice shows that flux or even an ordinary, not very advanced solder paste perfectly retains heat and allows you to solder SMD components with a simple soldering iron.

Well, if you have more lead, it should take a little longer to cool down? And then he'll be able to desolder bigger bones...
#23 15 Nov 2022 22:22

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

» | Topic author Helpful post? (0)

#23 15 Nov 2022 22:22

spec220 wrote:

And what binder do you use for SMD desoldering? What is your Sn to Pb ratio?

I do not use any special binder, the most ordinary Sn60Pb40 sold often in small violets with a characteristic blue plug, although I bought a spool of it some time ago because it is so convenient. And the pasta...

EDIT: In this topic you have a photo of what I soldered some time ago:
https://www.elektroda.pl/rtvforum/viewtopic.php?p=19752804#19752804
I also have two slightly better soldering irons (already adjustable; actually one is a soldering iron station + hot air) but I think that basically it is not ... absolutely necessary, as you have a feeling.

EDIT2: Ah, just for the sake of clarity, I'm writing here, of course, about situations such as the one in the video from the topic, and not about e.g. removing the MOSFET from the motherboard of the laptop. There you have to really heat it up and the spouts of the mass are large and have high heat capacities. This is completely different than the one small SOIC out of a board such as in a smart switch.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600 and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects
#24 15 Nov 2022 22:40

Anonymous Anonymous

Level 1

» |

#24 15 Nov 2022 22:40

p.kaczmarek2 wrote:
the most common Sn60Pb40

That's what I have too.

what do you think about LC40 >> Pb60Sn40 ?
and such a flux with ali?
https://pl.aliexpress.com/item/32948598235.html?spm=a2g0o.cart.0.0.512e452cfl9Ppy&mp=1&gatewayAdapt=glo2pol
in total for PLN 17 you get 2 syringes, 2 pistons + 2 needles.

You can buy 2 syringes for PLN 13 for less, or 100g in a container for about PLN 30.

Is it worth playing in the LC40? + this flux from ali, is it rather crap?
#25 15 Nov 2022 22:47

Mlody_Zdolny Mlody_Zdolny

Level 25

» | Helpful post? (0)

#25 15 Nov 2022 22:47

spec220 wrote:
Well, if you have more lead, it should take a little longer to cool down? And then he'll be able to desolder bigger bones...

It depends on what you want to do and what you care about. If it is hardware repair and SMD components, I do not go without hot-air and pre-heating.
In the case of THT - the Hakko desoldering gun comes into action.
If it is the recovery of elements and I don't care about the board, then a soldering iron with a triangular tip with an elongated edge and mainly flux in the form of flux paste or gel.
I deliberately do not use binders with Pb in the composition at all.
#26 15 Nov 2022 23:02

Anonymous Anonymous

Level 1

» |

#26 15 Nov 2022 23:02

Mlody_Zdolny wrote:
In the case of THT - a desoldering gun comes into action

When it comes to THT, the braid is also good for desoldering, especially when the print comes off easily...

Mlody_Zdolny wrote:
It depends on what you want to do and what you care about. If it is hardware repair and SMD components, I do not go without hot-air and pre-heating

You can pre-heat a larger IC, but this patent with this tin pouring of all pads is cool ... Only when using ordinary rosin, my tin quickly cools down, and you have to do it quickly ...

Added after 7 [minutes]:

I made my first attempts on a charger that I accidentally ... well ... I dropped it ...

Such things go smoothly when pouring LC60 and ordinary rosin
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Log in with Google

Reply | New topic

Notify about new articles