[BK7231N - CB3S] Generic Tuya Wall Switch Push Button Type 1-3 Gang No Neutral

ferbulous 4158 55

Reply Cool? Ranking DIY | New topic

Notify about new articles

Helpful post? (+3)

#1 16 Nov 2022 05:33

This is a short teardown of Generic Tuya Wall Switch Push Button Type (No Neutral) with CB3S module.

Basic information:
Brand: Tuya
Model: LSPS5
Chip: BK7231N [CB3S]
Local Vendor: https://www.aliexpress.com/item/1005003379628923.html
There are other stores selling similar switches, the original store i bought from had increased their prices.

Teardown Photos:

Flashing Method:
Using serial method with hid_download tool. Start flashing and do a power cycle or ground the CEN pin.
UART TX --> PCB RX
UART RX --> PCB RX
UART GND --> PCB GND
UART 3.3V --> PCB 3.3V

Pinout:

1 Gang
Pin Role
P6 WIFILED_N
P8 Relay 1
P26 Btn 1

2 Gang
Pin Role
P6 WIFILED_N
p7 Relay 1
p14 Btn 1
p9 Relay 2
p24 Btn 2

3 Gang
Pin Role
P6 WIFILED_N
P7 Relay 1
P8 Relay 2
P9 Relay 3
P14 Btn 1
P24 Btn 3
P26 Btn 2

Cool? Ranking DIY
About Author
ferbulous ferbulous

Level 15
Offline

Joined: 29 Jan 2022

Posts: 261

Help: 4

Posts rating: 36

Points: 1150
ferbulous wrote 261 posts with rating 36, helped 4 times. Been with us since 2022 year.
#2 17 Nov 2022 09:49

caubergjef57 caubergjef57

Level 3

Helpful post? (0)

#2 17 Nov 2022 09:49

Hi, have a Smart Lite Wifi 3gang switch type DS-101. I flashing the BK7231N with version 1.15.38. Can somebody telling me how to configurated, try many but can't find the right configuration for the device. Any help are welcome.
#3 17 Nov 2022 10:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#3 17 Nov 2022 10:18

DS-101? Someone has submitted such configuration some time ago:
https://openbekeniot.github.io/webapp/devicesList.html

but idk if it's correct.
Also isn't it this device, in our not-yet-translated video?
https://www.youtube.com/watch?v=JCqq-gn-X2c&ab_channel=elektroda.pl

By the way, the no-neutral devices are also interesting from a technical standpoint. I've been drawing a schematic of such device once:
https://www.elektroda.pl/rtvforum/topic3793509.html
#4 18 Nov 2022 01:26

ferbulous ferbulous

Level 15

Topic author Helpful post? (0)

#4 18 Nov 2022 01:26

caubergjef57 wrote:
Hi, have a Smart Lite Wifi 3gang switch type DS-101. I flashing the BK7231N with version 1.15.38. Can somebody telling me how to configurated, try many but can't find the right configuration for the device. Any help are welcome.

Can you share more pictures of the device pcb?
When you said you can’t find the right configuration, what does it mean?
Can you still toggle the relays or buttons
#5 29 Nov 2022 08:59

caubergjef57 caubergjef57

Level 3

Helpful post? (0)

#5 29 Nov 2022 08:59

ferbulous wrote:

caubergjef57 wrote:
Hi, have a Smart Lite Wifi 3gang switch type DS-101. I flashing the BK7231N with version 1.15.38. Can somebody telling me how to configurated, try many but can't find the right configuration for the device. Any help are welcome.

Can you share more pictures of the device pcb?
When you said you can’t find the right configuration, what does it mean?
Can you still toggle the relays or buttons

Hi, i changed the module with a esp 12F and flashing tasmota.
Works great now.
Any way thanks
#6 05 Dec 2022 21:31

jkwim jkwim

Level 7

Helpful post? (0)

#6 05 Dec 2022 21:31

p.kaczmarek2 wrote:
DS-101? Someone has submitted such configuration some time ago:
https://openbekeniot.github.io/webapp/devicesList.html

I am also looking for these but the from the above page the links do not end up in actual posts. The link points to the page itself.

Can you please check?
#7 05 Dec 2022 22:09

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#7 05 Dec 2022 22:09

@jkwim this must be the rare case where someone submitted the pinout without adding a forum post. This is not recommended. Can you post some photos how your DS-101 looks inside?

Maybe it's this device:
#8 06 Dec 2022 12:47

jkwim jkwim

Level 7

Helpful post? (0)

#8 06 Dec 2022 12:47

What I have is Model DS-101JL :

Programming Setup (what I plan to do):

1. VCC (3.3V) & GND from the pin header at the back of the PCB

2. TX and RX
Pulled out the metal pins from a Female 2.54mm Dupont header.
The fork like arrangement of the end of the pin can be secured against the soldering pad of the WB3S Module. Other end will fit nicely on to a female Dupont jumper wire.

3. CEN. A jumper connected to ground can be used to momentarily ground the CEN pad

However my initial attempt to use "uartprogram" few weeks back failed most probably due to one of the TX/RX pins being connected to button controller chip. I only learned that part after watching the video in the previous post.

Exploring a way to work around without having to desolder the button controller chip if possible (break track perhaps). It looks like a difficult job with this PCB.

Added after 13 [minutes]:

It looks like there are 3 x LEDs for each touch switch.

It would be great if anybody knows whether these can be controlled via the microcontoller, probably not.
#9 06 Dec 2022 14:11

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#9 06 Dec 2022 14:11

@jkwim very good job with describing the switch, I will add your work to our online devices database.

Regarding flashing - well, try to follow each track and see if there is a good place to cut it. In some rare cases the tracks might have resistors on them,so you can just desolder those resistors, but I don't think it's the case with this switch. I had such situation on a certain TuyaMCU ESP8285 dimmer.

Desoldering that SOIC16 is not THAT hard, I use that method for SOIC16 as well:

Regarding LEDs... well, in case of such 3gang switches, the LEDs are usually connected to relay signals.
I have just flashed this TYWE3S switch:

and in case of that switch, LEDs are connected to relay signals.

EDIT: but obviously you can cut the track from relay signal to the LED (but keep resistor!) and connect that LED to IO pin of WB3S and use it in OpenBeken anyhow you want. It's easy, that way you could free all 3 diodes.
#10 07 Dec 2022 03:30

jkwim jkwim

Level 7

Helpful post? (0)

#10 07 Dec 2022 03:30

RXD1 is connected as follows:
#11 07 Dec 2022 04:26

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#11 07 Dec 2022 04:26

Directly connected?

Is there any place where you can cut the trace easily? If not... well... you will have to desolder the chip. First try on some scrap boards. It's easy. Just like I did on the video. Just remember to use flux, pb solder and keep soldering iron tip clean...
#12 10 Dec 2022 09:59

caubergjef57 caubergjef57

Level 3

Helpful post? (0)

#12 10 Dec 2022 09:59

jkwim wrote:
RXD1 is connected as follows:

Is there a pinout for this Ic?
#13 10 Dec 2022 10:13

ferbulous ferbulous

Level 15

Topic author Helpful post? (0)

#13 10 Dec 2022 10:13

@jkwim can you get the tuya firmware version for your device?
you could still flash it ota with tuya-cloudcutter by selecting the profile that has the same firmware version as your device
#14 10 Dec 2022 10:36

caubergjef57 caubergjef57

Level 3

Helpful post? (0)

#14 10 Dec 2022 10:36

Have someone the pinouts from this Ic?
#15 10 Dec 2022 18:59

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#15 10 Dec 2022 18:59

Hello @caubergjef57 , why do you need a pinout for the buttons controller? You could theoretically figure out pins yourself, just check which pin connects where (vdd, power, output 1, 2, 3, input 1 2 3?), but I am not sure why.

If you at least identify where the VDD and GND is, we could look for something on web, but again, I don't think it's needed
#16 11 Dec 2022 04:58

caubergjef57 caubergjef57

Level 3

Helpful post? (0)

#16 11 Dec 2022 04:58

Hi,
I thinking my question is a normal question. Maybe someone have or find out the pins for this ic already.
So why a answer here i can find it out for myself. Off course in the end i can try find it for myself.
#17 11 Dec 2022 11:16

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#17 11 Dec 2022 11:16

Sorry @caubergjef57 , maybe the language barrier made it sound differently, but my point was not to say that you should do all yourself. I apologize if you feel that way, but despite that, let's try to keep discussion here relevant to the device.

My point was just that this information is not needed for flashing and won't help. We could try to find our more about that buttons controller chip if you want, but without any marking, it's a total guessing.

If you provide us at least the locations of GND and VCC, and maybe the pins that goes to WiFi module, we could try to filter the available chips on the market and find the fitting one.

If you have any other questions, feel free to ask. Again, it's just impossible to fully guess pinout without markings on that IC, you'd have to provide us some basic information first (where is GND, VDD)
#18 14 Dec 2022 17:17

jkwim jkwim

Level 7

Helpful post? (0)

#18 14 Dec 2022 17:17

p.kaczmarek2 wrote:
Directly connected?

Is there any place where you can cut the trace easily? If not... well... you will have to desolder the chip. First try on some scrap boards. It's easy. Just like I did on the video. Just remember to use flux, pb solder and keep soldering iron tip clean...

Well, I was silent for past few days because I got busier with something.

I found a 0 Ohm resistor between RX and Button Controller chip and was going Eureka!

However my attempt to remove it did not go well. The soldering pad also came off with the resistor. However this is not a show stopper as a wire can be soldered on to the remaining pad and the chip.

I attempted to flash using "python uartprogram" but it could not establish any communication with the device.

Also I found that the Tx pin of the module is connected to LED3. High = Red, Low= Blue

Wonder whether this was the reason for the failure. Since it is an output pin, should not matter right? the LED keeps flashing the moment the device is powered on.

Anyway these days I am busy to give it another try.
#19 14 Dec 2022 17:30

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#19 14 Dec 2022 17:30

jkwim wrote:

However my attempt to remove it did not go well. The soldering pad also came off with the resistor. However this is not a show stopper as a wire can be soldered on to the remaining pad and the chip.

How did you try to remove it? Can I somehow help with soldering?
Here our guide for switches, but with english audio:

jkwim wrote:

Also I found that the Tx pin of the module is connected to LED3. High = Red, Low= Blue

Wonder whether this was the reason for the failure. Since it is an output pin, should not matter right? the LED keeps flashing the moment the device is powered on.

Tx indeed may be an output pin, but on the other hand, it always mates with Rx which is an input.
I recently had an ESP8285 switch which refused to flash because of a diode on TX pin:
https://www.elektroda.pl/rtvforum/topic3941452.html
#20 14 Dec 2022 20:09

jkwim jkwim

Level 7

Helpful post? (0)

#20 14 Dec 2022 20:09

ferbulous wrote:
@jkwim can you get the tuya firmware version for your device?
you could still flash it ota with tuya-cloudcutter by selecting the profile that has the same firmware version as your device

Thanks for bringing up this point.

I am interested in knowing more as well.

So in a nutshell I should not be worrying about device model as far as I match the firmware version and the chip?

I will try to connect to Tuya and get it.

Added after 2 [hours] 37 [minutes]:

My switch firmware versions are:
Main Module V1.0.7
MCU Module V1.0.7

I have two identical devices, the above is from second device which has not been dismantled.

I can put the device in to AP mode by toggling power 6 x times.

So the device is ok for flasing.

I will prepare a RPi for the purpose.

What I am not clear about is findling
Quote:
custom_firmware_UG_file.bin
corresponding to V1.0.7

I can see the UG file for later versions of the OpenBk firmware at Releases
#21 14 Dec 2022 20:47

ferbulous ferbulous

Level 15

Topic author Helpful post? (0)

#21 14 Dec 2022 20:47

jkwim wrote:
corresponding to V1.0.7

I can see the UG file for later versions of the OpenBk firmware at Releases

That refers to tuya-cloudcutter firmware profile that you need to pick for the 'cloudcutting'
not openbk firmware

#22 14 Dec 2022 21:38

jkwim jkwim

Level 7

#22 14 Dec 2022 21:38

Found a profile :

{
	"manufacturer": "LSC",
	"name": "3004200 WiFi Outdoor Dual Socket",
	"key": "keya4gvchmtapm8n",
	"ap_ssid": "SmartLife",
	"github_issues": [],
	"image_urls": [],
	"profiles": [
		"oem-bk7231s-rnd-switch-1.0.7-sdk-2.0.0-30.06"
	],
	"schemas": {
		"000001zi1l": [

Can I just use this profile simply because it says 1.0.7?

#23 15 Dec 2022 01:54

ferbulous ferbulous

Level 15

Topic author Helpful post? (0)

#23 15 Dec 2022 01:54

@jkwim yes, select that profile and pick any device in the list
I’ve also included more info here

https://www.elektroda.com/rtvforum/topic3941318.html
#24 15 Dec 2022 06:41

jkwim jkwim

Level 7

Helpful post? (0)

#24 15 Dec 2022 06:41

Quote:

How did you try to remove it? Can I somehow help with soldering?

I did flood some solder on both sides, perhaps I did not apply enough heat to other side. When I grabbed it with a tweezer the pad has come off with it :-(

Added after 2 [minutes]:

ferbulous wrote:
@jkwim yes, select that profile and pick any device in the list
I’ve also included more info here

https://www.elektroda.com/rtvforum/topic3941318.html

OK the process is clear to me now except the way to determine whether it is 'T' or 'N'.

I read that bktools can do that but I could not figure out how.
#25 16 Dec 2022 01:00

ferbulous ferbulous

Level 15

Topic author Helpful post? (0)

#25 16 Dec 2022 01:00

@jkwim easiest way is just googling for the datasheets or remove the metal case
Wb3s is listed as BK7231T on tuya website
Cloudcutter profile is device specific, T profile for T, N for N
For example, if can’t do a teardown yet but using T profile works to cloudcut then it’s definitely T chip

Just to be safe, run ‘run_detach’ script first and see if you can get A-xx prefix for the AP.

#26 16 Dec 2022 07:45

jkwim jkwim

Level 7

#26 16 Dec 2022 07:45

Here is the summary of my attempt to use cloudcutter which was not successful (I wonder whether I should start a new discussion):

1. Device has a WB3S Module (BK7231T)

2. Tuya FW version is 1.0.7

3. Prepared a fresh RPi setup exactly as per instructions (no other software or configutaion)

4. Selected 1.0.7 Profile (1.0.7 - BK7231T / oem_bk7231s_rnd_switch) which was available:

[?] Select the firmware version and name: 1.0.7 - BK7231T / oem_bk7231s_rnd_switch 1.0.3 - BK7231T / oem_bk7231s_light_ty_oldDp
   1.0.4 - BK7231T / cuco_sl1_b_bk
   1.0.4 - BK7231T / oem_bk7231s_ty_ffc_newdp
   1.0.5 - BK7231N / oem_bk7231n_dctrl_switch
   1.0.5 - BK7231N / oem_bk7231n_light_atomi
   1.0.5 - BK7231T / oem_bk7231s_strip_ty
   1.0.6 - BK7231N / oem_bk7231n_strip_rgb_diwen
 > 1.0.7 - BK7231T / oem_bk7231s_rnd_switch
   1.0.8 - BK7231T / oem_bk7231s_light_ty
   1.0.8 - BK7231T / oem_bk7231s_rnd_switch
   1.0.8 - BK7231T / oem_bk7231s_ty_ffc_db_ldv
   1.0.9 - BK7231N / soc_bjg
   1.0.9 - BK7231T / oem_bk7231s_ty_ffc_db_ldv
   1.1.0 - BK7231T / HYS_03_018_bk7231t_tjsama0rocl95kdn

5. Progressed up to starting of 'cloudcutterflash' AP

Found access point name: "SmartLife-F7F1", trying to connect..
Device 'wlan0' successfully activated with '53e7c04f-0509-4e7b-9bab-bd51c0289097'.
Connected to access point.
Configured device to connect to 'cloudcutterflash'
Device is connecting to 'cloudcutterflash' access point. Passphrase for the AP is 'abcdabcd' (without ')
Cutting device off from cloud..
==> Wait for 20-30 seconds for the device to connect to 'cloudcutterflash'. This script will then show the activation requests sent by the device, and tell you whether local activation was successful.
Using WLAN adapter: wlan0
Dec 15 16:52:49 dnsmasq[15]: started, version 2.80 cachesize 150
Dec 15 16:52:49 dnsmasq[15]: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify dumpfile
Dec 15 16:52:49 dnsmasq-dhcp[15]: DHCP, IP range 10.42.42.10 -- 10.42.42.40, lease time 12h
Dec 15 16:52:49 dnsmasq-dhcp[15]: DHCP, sockets bound exclusively to interface wlan0
Dec 15 16:52:49 dnsmasq[15]: read /etc/hosts - 5 addresses
Configuration file: /dev/stdin
wlan0: Could not connect to kernel driver
Using interface wlan0 with hwaddr e4:5f:01:15:0e:09 and ssid "cloudcutterflash"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED

6. Device connected to cloudcutterflash AP

Dec 15 16:52:52 dnsmasq-dhcp[15]: 1449922824 available DHCP range: 10.42.42.10 -- 10.42.42.40
Dec 15 16:52:52 dnsmasq-dhcp[15]: 1449922824 client provides name: wlan0
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 DHCPDISCOVER(wlan0) 7c:f6:66:fb:f7:f1
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 tags: wlan0
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 DHCPOFFER(wlan0) 10.42.42.17 7c:f6:66:fb:f7:f1
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 requested options: 1:netmask, 3:router, 28:broadcast, 6:dns-server
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 next server: 10.42.42.1
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  1 option: 53 message-type  2
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option: 54 server-identifier  10.42.42.1
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option: 51 lease-time  12h
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option: 58 T1  6h
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option: 59 T2  10h30m
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option:  1 netmask  255.255.255.0
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option: 28 broadcast  10.42.42.255
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option:  3 router  10.42.42.1
Dec 15 16:52:55 dnsmasq-dhcp[15]: 1449922824 sent size:  4 option:  6 dns-server  10.42.42.1

7. Device sends DNS query:

Dec 15 16:52:56 dnsmasq[15]: query[A] h3.iot-dns.com from 10.42.42.17
Dec 15 16:52:56 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1
Dec 15 16:52:57 dnsmasq[15]: query[A] h3.iot-dns.com from 10.42.42.17
Dec 15 16:52:57 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1
Dec 15 16:52:59 dnsmasq[15]: query[A] h3.iot-dns.com from 10.42.42.17
Dec 15 16:52:59 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1

8. There is a SSL error

Using PSK v1 - Received PSK ID version 02

Dec 15 16:52:59 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1
Using PSK v1 - Received PSK ID version 02
[W 221215 16:52:59 iostream:1404] SSL Error on 12 ('10.42.42.17', 64538): [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1129)
Dec 15 16:53:00 dnsmasq[15]: query[A] h3.iot-dns.com from 10.42.42.17
Dec 15 16:53:00 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1
Using PSK v1 - Received PSK ID version 02
[W 221215 16:53:01 iostream:1404] SSL Error on 12 ('10.42.42.17', 64539): [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1129)
Dec 15 16:53:02 dnsmasq[15]: query[A] h3.iot-dns.com from 10.42.42.17
Dec 15 16:53:02 dnsmasq[15]: config h3.iot-dns.com is 10.42.42.1
Using PSK v1 - Received PSK ID version 02
[W 221215 16:53:02 iostream:1404] SSL Error on 12 ('10.42.42.17', 64540): [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1129)

I checked gitgub issues and others have encountered same SSL issue. Could not find a solution.

Any idea as to how to procees?

I even tried 1.0.6 and 1.0.8 profiles but same error.

#27 16 Dec 2022 08:48

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#27 16 Dec 2022 08:48

I never used cloudcutter much but I seem to remember that "DECRYPTION_FAILED_OR_BAD_RECORD_MAC" meant that the profile is wrong.
I had it once or twice:
#28 16 Dec 2022 09:03

ferbulous ferbulous

Level 15

Topic author Helpful post? (0)

#28 16 Dec 2022 09:03

@jkwim looks like you're gonna have to dump your firmware bin & request a profile
since there's not much progress with serial method

You can use lightleakapp to dump your firmware.
prepare esp8266 as a dummy AP; flash this firmwa..bin Download (275.02 kB) firmware. power it up and you should get 'lightleakidle' AP
install the lightleak app your phone (allow location permission etc)
1) select 'lightleak - bk7231t profile', choose unconfigured
2) if there's a error on the 1st attempt, don't quit the app yet
3) redo step 1 but choose 'configured to join custom ap'
4) once connected, select 'read flash'

This may require several attempts to succeed
#29 10 Jan 2023 11:36

jo_sef jo_sef

Level 2

Helpful post? (0)

#29 10 Jan 2023 11:36

Hi guys I bought 3 gang switch and I would like to ask you for an advice. The thing is that the live wire is connected on L1, L2, L3 contacts once it switches on but I need to disconnect live wire from all three contacts, because my gate motor uses low voltage only. If I cut the track as showing below, does it do the job for me?

Thank you.

Josef
#30 10 Jan 2023 15:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

#30 10 Jan 2023 15:58

Hello @jo_sef , it is certainly possible to detach those relays from live wire (then basically there is a separation between relay contacts and coil), but from the photo I am unable to determine if you located the correct place. It even feels like it's not the correct place to cut. I'm afraid that cutting there would cut off the power supply of the device. I would need to see the whole device, where are relays, etc.
Futhermore, I am confused - what are those two MOSFETs doing there? Those KND3403A...
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Log in with Google

Reply Cool? Ranking DIY | New topic

Notify about new articles

Pin	Role
P6	WIFILED_N
P7	Relay 1
P8	Relay 2
P9	Relay 3
P14	Btn 1
P24	Btn 3
P26	Btn 2