Mini Smart Switch - CB2S BK7231N Based

jkwim 7089 12

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+2)

Post #1
20359513 30 Dec 2022 14:52

There has been many versions of Mini Smart Switch.
1. Aubess 2gang Mini Smart Switch BK7231N /CB2S
2. mini smart switch - Belon BL2028N-
3. ZN268131 WB2S BK7231T WiFi Smart Switch that allows you to connect a bistable button

4. Cheapest Wi-Fi Switch You Can Buy For Your Smart Home

I came across another product which has diferrent internals but with CB2S/BK7321N.

Software version was V1.3.8

I tried tuya-cloudcutter with many different profiles for BK7321N but was not successful.

Manual Flashing was the only way forward.

1. Opening the device was very easy. I used several guitar picks to release the tabs on the four corners.

2. There were two daughter boards with CB2S module connected to a shorter daughter board (very similar to attaching the WB2S module in link 3 above)

3. Instead of soldering wires I have decided to try out a different method to secure jumper wires to the soldering pads mechanically using custom made clips like these

I made these by removing the pins from a female header connector and then crimping the fork like metal pin to a female jumper wire connector as shown.

4. Plan of the connections

5. Since the CB2S module has pins on both sides which are arranged as alternate slots, my attachments can be secured so that only one side is touching a pin. However one has to be careful not to let the pin touch adjacent solder pads on either side.

The leftmost pin touches the solder pad on the top side of the PCB while the rightmost 4 pins touches TX1, RX1, GND and 3V3 solder pads on the bottom side.

BTW, the TX1, RX1 pins have no connections to the daughter board. So no worry about removing the CB2S module for flashing.

6. Used python uartprogram for flashing

During dumping the existing firmware use of default high speed baudrate was successful. I used
Code: text Expand Select all Copy to clipboard
-b 9600
option to lower the baudrate to a very very low value and it was successful but took a way long time.

Flashing new firmware at default baudrate was successful.

Cool? Ranking DIY
About Author
jkwim jkwim

Level 13
Offline

Joined: 05 Nov 2022

Posts: 186

Help: 4

Posts rating: 25

Points: 863
jkwim wrote 186 posts with rating 25, helped 4 times. Been with us since 2022 year.

ADVERTISEMENT
#2 20359572 30 Dec 2022 15:30

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (+1)

Post #2
20359572 30 Dec 2022 15:30

Very good presentation, but it's important to add one more note here.
Those cheapest box switches have a very weak power supplies with low quality electrolytic capacitors. I even covered replacement of such capacitor here:
https://www.elektroda.pl/rtvforum/topic3898805.html
There is one way to increase the life of power supply and also the stability of WiFi module.
To your autoexec.bat (or to short startup command) add PowerSave command.
This will enable extra low power consumption mode for BK7231T/BK7231N and reduce the current consumption and heating.

NOTE: in the future it may be enabled by default, but it's still at testing phrase

Also note: some of similar devices are using RX/TX pin of CB2S/WB2S to control button or a relay, so it might be easier to just desolder whole WiFi module and program it outside of the board.

The image above shows WB2L_M1 but it's similar for WB2S and CB2S

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#3 20853216 09 Dec 2023 11:14

divadiow divadiow

Level 38

Helpful post? (0)

Post #3
20853216 09 Dec 2023 11:14

I've a similar mini switch with CB2S but not a riser/daughterboard. I've confirmed continuity between usb-serial pins and the end of my pogo pins, and the unit is powering so ground and vcc are fine.

I just cannot get touching CEN to begin acknowledgment in BK Easyflasher, however long I hold CEN connected. Did you have any difficulty with yours @jkwim ?

also, with the power off/on method - how do you do this without interrupting the com port? mine drops out of device manager and BKflasher just stops with no com port error.
ADVERTISEMENT
#4 20853221 09 Dec 2023 11:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #4
20853221 09 Dec 2023 11:18

COM port should never drop, how do you power that? COM may drop if there is a large capacitance on the device and you power it via 5V to the 3.3V LDO on the device board, that's why I usually just desolder the WiFi module. I don't even use CEN, I just do power off/on cycle.
Also, your wires seem long, this may cause flashing problems.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#5 20853248 09 Dec 2023 11:42

divadiow divadiow

Level 38

Helpful post? (0)

Post #5
20853248 09 Dec 2023 11:42

>>20853216

hello! thanks for replying so quickly.

it's just 3.3v from the usb-serial adaptor, not via 5v or anything. I was trying to avoid desoldering because I'm not convinced I'll get it back in again!

it's possible the wires are too long, I've had to join two jumper wires for each pogo pin to the usb device. I need more male-female. I could try shorter with what I have.

not sure why the com port is dropping. I am only disconnecting the power pin from the usb adaptor end when I do power cycle

I don't have a breadboard, but surely removing and reinserting into a breadboard is the same as disconnecting from usb-serial...
#6 20853276 09 Dec 2023 12:03

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #6
20853276 09 Dec 2023 12:03

Have you watched our tutorials?
https://www.youtube.com/@elektrodacom
It's been stated many times that USB to UART adapter will not provide enough current and it's recommended to use external one. Or at least a better one, like a 3.3V from Arduino, which can be used also as USB to UART converter as long as you put Atmega in RESET state

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#7 20853320 09 Dec 2023 12:37

divadiow divadiow

Level 38

Helpful post? (0)

Post #7
20853320 09 Dec 2023 12:37

I've seen a few vids now yes, and I do recall that being stated. I need more equipment! I was just hopeful that if the device is powering and I can pair with Tuya that that would be enough current to flash. I'll go shopping and try again.
#8 20853328 09 Dec 2023 12:41

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #8
20853328 09 Dec 2023 12:41

Maybe that's not needed. Is there an AMS1117-3.3V visible on your board?

It is possible to connect 5V from USB to the input of that AMS1117-3.3V LDO and reset via disconnecting that 5V connection.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#9 20853335 09 Dec 2023 12:46

divadiow divadiow

Level 38

Helpful post? (0)

Post #9
20853335 09 Dec 2023 12:46

Yes, there is an AMS and a BP
ADVERTISEMENT
#10 20853381 09 Dec 2023 13:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #10
20853381 09 Dec 2023 13:18

Here is AMS pinout:

You can flash your device by soldering GND, 5V from USB, RX and TX . Then you power off/on by disconnecting 5V.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#11 20855897 11 Dec 2023 07:27

divadiow divadiow

Level 38

Helpful post? (0)

Post #11
20855897 11 Dec 2023 07:27

thank you. I got this yesterday so could have a separate 3.3v and some more male-female wires (and a 10k resistor for BL602 in the future). Yes my external 3.3 and usb-ttl are connected for common ground.

https://www.amazon.co.uk/dp/B01ERP6WL4

curiously, there is still no flashing it seems. My wires are now single length between each leg. I've tried 3 different USB-TTL adaptors (CH340 and 2x (probably fake) FTDI). Nothing after CEN or powering on/off 3.3v (COM port no longer drops when external 3.3v is switched).

I saw in this thread https://www.elektroda.com/rtvforum/topic3977701.html from @erlipan2001 that they updated the original post to warn of RX being grounded, but I do not have continuity to ground with the RX on this device, so don't think it's that (assuming there would be continuity if it was this issue?). There is no power monitoring chip.

I've tried 115200 and 9600 baud. I'm guessing my next step can only be unsoldering the board. Or trying hid_download_py
#12 20855927 11 Dec 2023 08:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #12
20855927 11 Dec 2023 08:10

Unsoldering WiFi board is a very reliable method and it's more easier than it seems. Just make sure to use some flux and solder wick.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#13 20857170 11 Dec 2023 21:46

divadiow divadiow

Level 38

Post #13

20857170 11 Dec 2023 21:46

woohoo. finally did it. it was actually the RX in the end. unsoldered it with wick and flux and it flashed straight away to OpenBeken.


{
	"nc_tp":"1",
	"ssid":"null",
	"passwd":"null",
	"md":"0",
	"random":"0",
	"wfb64":"1",
	"stat":"0",
	"token":"null",
	"region":"null",
	"reg_key":"null",
	"dns_prio":"0 }{nc_tp",
	"psk_key":"vJP0jKnMmU4d6lwLNfLylG1oSPqnuHq3etjmf",
	"auth_key":"nr4RxVwLp8HPDSbmojIw5bLIpizkytEE",
	"ap_ssid":"SmartLife",
	"ap_passwd":"null",
	"country_code":"CN",
	"bt_mac":"null",
	"bt_hid":"null",
	"prod_test":"false",
	"fac_pin":"vs4ksbpax2dwwm6a }-B000004re0c[{type",
	"mode":"rw",
	"property":"{type",
	"id":"1}",
	"{type":"obj",
	"max":"86400",
	"scale":"0",
	"step":"1",
	"type":"value}",
	"maxlen":"255}",
	"{mode":"rw",
	"lckey":"3]bmXI;?9@Xl7.a1",
	"h_url":"http",
	"h_ip":"3.123.188.102",
	"hs_url":"null",
	"hs_ip":"null",
	"hs_psk":"https",
	"hs_psk_ip":"18.195.249.137",
	"mqs_url":"null",
	"mqs_ip":"null",
	"mq_url":"m2.tuyaeu.com",
	"mq_ip":"35.156.42.116",
	"ai_sp":"null",
	"ai_sp_ip":"null",
	"mq_psk":"m2.tuyaeu.com",
	"mq_psk_ip":"35.156.42.116",
	"lp_url":"baal.tuyaeu.com",
	"lp_ip":"18.193.97.90",
	"time_z":"+00",
	"s_time_z":"[[1711846800",
	"wx_app_id":"null",
	"wx_uuid":"null",
	"dy_tls_m":"0",
	"cloud_cap":"1025",
	"psk21_key":"null }{nc_tp",
	"on_off_cnt":"10",
	"onoff_rst_m":"1",
	"onoff_clear_t":"10",
	"rand_dpid":"42",
	"net_trig":"4",
	"onoff_n":"5",
	"netled1_lv":"0",
	"jv":"102",
	"onoff_rst_type":"2",
	"total_bt_pin":"10",
	"nety_led":"2",
	"total_stat":"2",
	"reset_t":"5",
	"netled1_pin":"8",
	"remote_add_dp":"49",
	"remote_list_dp":"50",
	"net_type":"0",
	"inch_dp":"44",
	"module":"CB2S",
	"ch_cddpid1":"9",
	"onoff1":"23",
	"clean_t":"5",
	"init_conf":"38",
	"zero_select":"0",
	"onoff_type":"0",
	"series_ctrl":"0",
	"total_bt_lv":"0",
	"cyc_dpid":"43",
	"remote_select":"0",
	"ch_num":"1",
	"rl1_pin":"26",
	"netn_led":"0",
	"ch_dpid1":"1",
	"crc":"94",
	"}#FBble_beaconkeyAADBFDB6AB2A9B5D01FFEA91EB8728B9{abi":"0",
	"swv":"1.3.10",
	"bv":"40.00",
	"pv":"2.2",
	"lpv":"3.4",
	"pk":"keyjnuy4s3kre7m7",
	"firmk":"keyjnuy4s3kre7m7",
	"cadv":"1.0.5",
	"cdv":"1.0.0",
	"dev_swv":"1.3.10",
	"s_id":"000004re0c",
	"dtp":"0",
	"sync":"0",
	"attr_num":"1",
	"mst_tp_0":"100",
	"mst_ver_0":"102",
	"mst_md5_0":"f314a40ea88403776ca006c24647bb7b",
	"mst_tp_1":"0",
	"mst_ver_1":"null",
	"mst_md5_1":"null",
	"mst_tp_2":"0",
	"mst_ver_2":"null",
	"mst_md5_2":"null",
	"mst_tp_3":"0",
	"mst_ver_3":"null",
	"mst_md5_3":"null }{key",
	"index":"0}{ch0",
	"cnt":"0}0$6Bis_stride0{abi",
	"ap_s{nc_tp":"1",
	"mst_md5_0{ch0":"0}1",
	"mst_3ch0":"0}1"
}


Device configuration, as extracted from Tuya: 
- Pair/Toggle All Button on P10
- WiFi LED on P8
- TglChannelToggle (channel 1) on P23
- Relay (channel 1) on P26
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424

not the tidiest, but hey.

Attachments:

CB2S_TUYA_10a_mini_switch_readResult_BK7231N_QIO_2023-11-12-19-34-54.bin (2 MB) You must be logged in to download this attachment.

Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

✨ The discussion revolves around various models of Mini Smart Switches based on the BK7231N/CB2S chipset, including the Aubess 2gang Mini Smart Switch, Belon BL2028N, and ZN268131 WB2S. Users share experiences with flashing firmware, troubleshooting connectivity issues, and the importance of using quality power supplies to enhance device stability. Manual flashing is often necessary due to difficulties with tools like Tuya-cloudcutter. Participants discuss the significance of proper wiring, the use of external power sources, and the potential need to desolder components for successful firmware updates. A successful flashing to OpenBeken firmware was achieved after addressing RX pin issues.

FAQ

TL;DR: Four jumper-wire pins and a stable 3.3 V let you flash a CB2S mini switch in under 2 minutes; “enable extra low power consumption” for longer life [Elektroda, p.kaczmarek2, post #20359572]

Why it matters: Fast, repeatable flashing replaces Tuya firmware with local control and reduces heat.

Quick Facts

• CB2S uses a 32-bit BK7231N @ 120 MHz with 2 MB flash [Tuya CB2S Datasheet]. • Peak Wi-Fi TX current ≈ 80 mA; idle drops to <20 mA with PowerSave [Tuya Datasheet; Elektroda #20359572]. • Minimum pins to flash: 4 (3V3, GND, RX, TX) [Elektroda, jkwim, post #20359513] • Default dump at 115 200 baud is ≈12× faster than 9 600 baud [Elektroda #20359513]. • Typical factory capacitor: 5 µF/400 V budget electrolytic; swap for 10 µF low-ESR to double lifespan [Elektroda #20359572].

What hardware sits inside the Mini Smart Switch discussed in the thread?

The board carries a Tuya CB2S module based on a BK7231N SoC, an AMS1117-3.3 V LDO, a 10 A relay and cheap 400 V electrolytic capacitors [Elektroda, jkwim, post #20359513]

Why did Tuya-cloudcutter fail on firmware V1.3.8?

Cloudcutter profiles supported older CB2S builds only. Firmware V1.3.8 blocks OTA exploits, so manual UART flashing stayed the sole option [Elektroda #20359513].

How do I open the enclosure without cracking it?

Slide four thin guitar picks into the corner clips, then twist gently. No screws hold the shell, so the lid lifts straight up [Elektroda #20359513].

Which pins must I connect to flash the CB2S module?

Connect 3V3, GND, RX, and TX on the underside pads. Leave CEN floating; a power-cycle also enters bootloader [Elektroda, p.kaczmarek2, post #20853221]

Can I avoid soldering jumper wires?

Yes. Crimp forked header pins onto female jumpers and clamp them against the pad—mechanical tension holds contact during flashing [Elektroda #20359513].

Why does my COM port disappear when I toggle power?

The USB-UART chip resets if you feed the switch through its 3.3 V pin and the load exceeds ~100 mA. Use an external 3.3 V source or inject 5 V before the AMS1117 instead [Elektroda #20853221].

What current-capable supply should I use?

Provide at least 300 mA at 3.3 V. An Arduino board in RESET delivers ≈500 mA and serves as a reliable UART bridge [Elektroda #20853276].

What does the PowerSave command do?

Add PowerSave to autoexec.bat to cut BK7231 idle current by roughly 50 %, reducing heat and extending capacitor life [Elektroda #20359572].

My flash still fails—could RX be grounded?

Yes. Some boards link RX to ground or buttons. Remove the solder blob or desolder the module; users reported instant success after lifting RX [Elektroda #20857170].

How do I safely desolder the CB2S module?

Flood the pads with flux.
Heat the row with a wide-tip iron while pulling gently with tweezers.
Wick excess solder, then reflow to reinstall. A full removal takes <60 s with 350 °C heat [Elektroda #20855927].

Are the stock capacitors trustworthy long term?

No. They are low-grade and run hot; failure can kill Wi-Fi. Replacing with a 105 °C 10 µF capacitor doubles service life [Elektroda #20359572].

Which baud rate is optimal for uartprogram?

Stick to the default 115 200 baud. Dumping at 9 600 baud is 12× slower and risks timeouts [Elektroda #20359513].

How can I enter the bootloader without using CEN?

Disconnect 3.3 V for one second, reconnect while keeping TX/RX wired. The chip auto-detects UART and starts the boot ROM [Elektroda #20853221].

What OpenBeken GPIO map works for this one-gang switch?

Configure: P26 Relay1, P23 Channel1 button, P10 Pair button, P8 Wi-Fi LED. This matches the Tuya JSON dump [Elektroda #20857170].

How much does a bare CB2S module cost?

Singles retail for €2–€3 on AliExpress as of 2024 [AliExpress listing, 2024].

Can I brick the module during flashing?

Bricking is rare. The BK7231 boot ROM is in mask ROM; as long as 3V3 stays below 3.6 V you can always re-flash via UART [Tuya CB2S Datasheet].