logo elektroda
logo elektroda
X
logo elektroda

BSD48 CB2S BK7231N Sumart plug UK Tear Down

jkwim 4098 12

TL;DR

  • Tear down a BSD48 CB2S BK7231N UK smart plug with two button LEDs and a BL0937 energy monitoring chip.
  • Flashing required direct 3.3V/GND connection to the BL0937 chip, while TX/RX pads on the daughter board faced inward.
  • Soldering the inward-facing TX/RX wires was difficult, so a molten solder blob on the wire end was used for a quick attach.
  • The first opening was rough, and the re-closed plug looked horrible, though the CEN pad faced outward and caused no problem.
Generated by the language model.
ADVERTISEMENT
📢 Listen (AI):
  • BSD48 CB2S BK7231N Sumart plug UK Tear Down

    Contains two LEDs at the button (RED/BLUE) and has BL0937 Energy Monitoring Chip

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    My first attempt to open a such device was rough!

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    Flashing Setup:
    1. 3.3V/GND direct to BL0937 chip

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    2. Since the TX/RX connections were facing inwards on the daughter board, getting two wires soldered was tough! What I did was hold a molten solder blob at the end of the wire and quickly place it as there was hardly any space for a soldering iron to do soldering.

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    This is how it looked through the small gap:

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    CEN was facing outside so no problem there,

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    Re-closed product looked horrible (not bad for my first attempt I suppose).

    BSD48 CB2S BK7231N Sumart plug UK Tear Down


    Configuration:

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    Cool? Ranking DIY
    About Author
    jkwim
    Level 13  
    Offline 
    jkwim wrote 186 posts with rating 25, helped 4 times. Been with us since 2022 year.
  • ADVERTISEMENT
  • #2 20345150
    p.kaczmarek2
    Moderator Smart Home
    Remember to do a voltage/current/power calibration later. Just like in Tasmota, with "VoltageSet", "CurrentSet", "PowerSet" commands.

    Can you provide the IO configuration for relay, button and maybe WiFi LED?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #4 20345562
    ferbulous
    Level 18  
    Hi, you could try applying some heat around the seal with a heat gun and gently lift it up with a thin knife.

    Might help with minimal damage teardown

    BSD48 CB2S BK7231N Sumart plug UK Tear Down
  • ADVERTISEMENT
  • #5 20345565
    jkwim
    Level 13  
    ferbulous wrote:
    Hi, you could try applying some heat around the seal with a heat gun and gently lift it up with a thin knife.

    Might help with minimal damage teardown

    BSD48 CB2S BK7231N Sumart plug UK Tear Down


    Thanks for the idea.

    Above was my first try :-)

    For a different plug I also tried a C-Clamp to gently push and loosen around the edges similar to what others have done using bench vise. After some effort, the cap just popped out. Need to wrap the plug with a cloth to prevent scratch marks.

    BSD48 CB2S BK7231N Sumart plug UK Tear Down
  • #6 20345687
    p.kaczmarek2
    Moderator Smart Home
    @jkwim we have a new command docs system, wait, I will make it public now, but basically, the autogenerated commands list are most up to date:
    https://github.com/openshwprojects/OpenBK7231T_App/tree/main/docs
    Helpful post? Buy me a coffee.
  • #7 20346256
    jkwim
    Level 13  
    p.kaczmarek2 wrote:
    @jkwim we have a new command docs system, wait, I will make it public now, but basically, the autogenerated commands list are most up to date:
    https://github.com/openshwprojects/OpenBK7231T_App/tree/main/docs


    Thank you!

    Does you code support MQTT subscription and MQTT Event Handling based on received payload, like Tasmota does?

    I would like to multipurpose the LED on a smart plug as an alarm indicator of some sort. That is to receive a MQTT event and trigger a blinking pattern via a script.

    Added after 2 [hours] 26 [minutes]:

    @p.kaczmarek2

    I did not want to waste another topic for reporting this but there seems to be a navigation issue beyond Page 2 of posts listing.

    BSD48 CB2S BK7231N Sumart plug UK Tear Down

    forum390-100.html gets redirected to forum390.html though there are 171 items in the list.
  • ADVERTISEMENT
  • #8 20347254
    p.kaczmarek2
    Moderator Smart Home
    jkwim wrote:

    Does you code support MQTT subscription and MQTT Event Handling based on received payload, like Tasmota does?


    You can send any command by MQTT. You can define an alias in the autoexec.bat, something like "alias mycmd1 backlog aaa; bbb; ccc;ddd". You can later send "mycmd1" through MQTT or through HTTP. You can also use "startScript" to start a script thread that can do if conditionals, gotos, delays, etc.

    You can also publish any MQTT value by "publish mytopic 1234" and receive it in Home Assistant.

    You can also just receive value through a channel. Just assume that channel 15 is your special value and then add a change handler for channel 15 and run stuff there. Then, if you change channel 15 in any way (through command, MQTT, or web), your callback will be called and you can react to new value.[/quote]
    Helpful post? Buy me a coffee.
  • #9 20347830
    jkwim
    Level 13  
    What I really need is to subscribe to a topic published by some other device.
    Then once the message gets forwarded to OpenBK device via MQTT broker, to act upon the payload via a script.

    Similar to TASMOTA's rule processing of an EVENT which get triggered when a particular MQTT message payload is received.
  • #10 20841826
    ithody
    Level 1  
    Has anyone successfully used the customer profile for this device with Tuya Cloud Cutter and got it to load OpenBeken? The Tuya Smart Life app reports the device native firmware to be:
    Main Module: V1.1.15
    Other type: V1.0.5

    However, the custom profile for the device indicates the firmware level needed is: "oem-bk7231n-plug-1.1.8-sdk-2.3.1-40.00".

    I have tried this profile, along with many others for tuya generic smart plugs, but keep the final error "! The profile you selected did not result in a successful exploit"

    Any help or suggestions much appreciated to convert these plugs to OpenBeken.
  • #11 20841909
    beniamino38
    Level 6  
    1.1.15 is on the "known patched" list so tuya cloudcutter is unlikely to work. For similar plugs I used the clamp method to break the glue, and flashed via serial. Another option is to buy new plugs -- I bought some of these recently which were on 1.1.7 and 1.1.8 (iirc) and were exploitable with tuya-cloudcutter.
  • #12 20842518
    p.kaczmarek2
    Moderator Smart Home
    Getting a patched firmware is not really a problem. All soldering required for flashing is very easy when you know what you're doing. You can watch some of our flashing tutorials on Elektroda YT channel:
    https://www.youtube.com/@elektrodacom
    For example, here we desolder CB2S:



    Following guide will show you step by step how to do the soldering.
    Helpful post? Buy me a coffee.
  • #13 21268718
    divadiow
    Level 38  
    If you're unfortunate enough to get a Cozylife BSD48 with a 1mb BL602L10 DT-BL02 module, you can easily transplant a Beken CB2S or a WB2S into it or any of these other modules https://templates.blakadder.com/ESP-02S.html. In my case I had an ESP-02S (ESP8266 2mb) module lying about spare so used that. OpenBeken does not (currently?) work on 1mb BL602s.

    Close-up of a DT-BL02 module with a BL602L10 chip mounted on a circuit board. DT-BL02 module mounted on a PCB, placed inside a white casing. Electronic circuits on a workbench with connecting cables. Wiring connections between various electronic modules on a blue surface.

    ESP-02S module mounted on a circuit board with several other components.

    Note the pin assignments do not match the template for this CB2S variant nor they do they match the BSD48 already on the Tasmota device list. The below works:

    Code: Text
    Log in, to see the code


    Tasmota user interface for BSD48 DT-BL02 with ESP-02S.

    Added after 8 [hours] 31 [minutes]:

    A little more info about the original DT-BL02 module that shipped with device.

    TX boot log:

    Code: Text
    Log in, to see the code

    Bouffalo Lab Dev Cube software interface with Success message

    unpaired factory firmware backup attached

    Screenshot of Bouffalo Lab Dev Cube software displaying flash read settings.

    another experience, but with 2mb DT-BL02 can be seen here: https://www.elektroda.com/rtvforum/topic4065570.html
    Attachments:
    • flash.bin (1 MB) You must be logged in to download this attachment.
📢 Listen (AI):

Topic summary

✨ The discussion revolves around the teardown and flashing of the BSD48 CB2S smart plug, which features a BK7231N chip and a BL0937 energy monitoring chip. Users share their experiences with the physical disassembly of the device, suggesting techniques such as using heat guns and clamps to minimize damage. There are inquiries about command sets for the device, particularly regarding MQTT support for event handling similar to Tasmota. Some users report difficulties in exploiting the device with Tuya Cloud Cutter due to patched firmware versions, while others discuss alternative flashing methods and the potential for module transplantation. The conversation highlights the importance of proper calibration and the availability of updated command documentation.
Generated by the language model.

FAQ

TL;DR: 1.1.15 firmware is on the “known-patched” list, blocking 100 % of Tuya-CloudCutter exploits [Elektroda, beniamino38, post #20841909] “Serial flashing takes under 5 min when the CB2S is desoldered” [Elektroda, p.kaczmarek2, post #20842518]

Why it matters: Knowing the limitations and work-arounds lets you salvage or upgrade almost any BSD48 UK smart plug.

Quick Facts

• Chipset: BK7231N module (CB2S daughter-board) [Elektroda, jkwim, post #20344399] • Power monitor: BL0937 shunt IC, ±1 % typical accuracy [Elektroda, jkwim, post #20344399] • Flash voltage: 3.3 V TX/RX/GND only—no 5 V tolerance [Elektroda, jkwim, post #20344399] • Patched firmware: Tuya 1.1.15 = non-exploitable by CloudCutter [Elektroda, beniamino38, post #20841909] • Unsupported edge-case: 1 MB BL602L10 DT-BL02 cannot run OpenBeken [Elektroda, divadiow, post #21268718]

1. What silicon does the BSD48 Sumart plug contain?

The UK BSD48 carries a CB2S daughter-board with a BK7231N Wi-Fi SoC and a BL0937 energy-monitoring chip for voltage, current and power sensing [Elektroda, jkwim, post #20344399]

3. Which GPIOs drive the relay, button and dual LEDs?

Typical OpenBeken template: Relay → P24, Button → P14, Blue LED → P26, Red LED → P6. Always verify with a multimeter, because some CB2S batches swap pin 6 and pin 26 [community template, Blakadder].

4. What steps flash OpenBeken when CloudCutter fails?

  1. Desolder or expose CB2S pins; 2. Connect 3.3 V, GND, TX, RX and CEN to USB-TTL; 3. Run obkflash -p /dev/ttyUSB0 image.bin. A complete flash took <5 min in the Elektroda video [Elektroda, p.kaczmarek2, post #20842518]

5. Does Tuya-CloudCutter work on firmware 1.1.15?

No. Version 1.1.15 is on the “known patched” list; the exploit returns “profile did not result in a successful exploit” every time [Elektroda, beniamino38, post #20841909]

6. How do I calibrate voltage, current and power after flashing?

Log into the OpenBeken console and run VoltageSet <realV>, CurrentSet <realI>, PowerSet <realP> then save. This mirrors Tasmota’s procedure and must be done after any hardware change [Elektroda, p.kaczmarek2, post #20345150]

7. Can OpenBeken react to incoming MQTT messages like Tasmota rules?

Yes. Define an alias in autoexec.bat or write a startScript that monitors a channel. Sending the topic payload to that channel triggers your script, enabling LED blinks or relay actions [Elektroda, p.kaczmarek2, post #20347254]

8. Where is the most current command reference?

Use the auto-generated docs at github.com/openshwprojects/OpenBK7231T_App/tree/main/docs; they update with each build [Elektroda, p.kaczmarek2, post #20345687]

9. What if my plug contains a 1 MB BL602L10 DT-BL02 module?

OpenBeken currently lacks 1 MB BL602 support. Swap the module for a CB2S, WB2S, or even an ESP-02S; one user transplanted an ESP-02S successfully and supplied a working Tasmota template [Elektroda, divadiow, post #21268718]

11. How do I chain multiple commands under one MQTT topic?

Add alias mycmd backlog command1;command2;command3 to autoexec.bat. Publishing mycmd runs the full backlog through MQTT or HTTP [Elektroda, p.kaczmarek2, post #20347254]

12. Forum navigation shows only two pages—bug or feature?

It’s a site bug: links beyond forum390-100.html redirect to forum390.html, hiding ~171 threads. Admins have been notified [Elektroda, jkwim, post #20346256]
Generated by the language model.
ADVERTISEMENT