[BK7231N / CB3S] Tuya Smart Dual GPO

TurkeyMan 1548 0

TL;DR

Teardown of a Tuya Smart Dual GPO sold on AliExpress and branded MEAKISS, with two touch buttons and two outlets.
The front plate clips off easily, revealing a pin-mounted BK7231N/CB3S Wi-Fi board above a power board with two relays.
The board lacks the advertised energy metering chip; the flashed OpenBK pinout uses P6, P7, P8, P9, P14, P24, and P26.
OpenBK flashed successfully, but the red status LED is hardware-only, and the extra blue LED on P8 can only light both sides together.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (+2)

Post #1
20361960 01 Jan 2023 06:03

Teardown of this smart dual GPO from AliExpress.

Product seems to be branded MEAKISS, but I can't see that written anywhere on the device, and this OEM probably sells to many brands.
No product name/model number is written anywhere on the device.

Product has 2 GPO's with 2 touch buttons. The product was advertised with energy metering, but this device does NOT have an energy meter.

Device is extremely easy to disassemble. The front plate removes with clips:

Which reveals the wifi board on a pin-mounted riser:

Behind the wifi board:

Removing the power board, we see a pair of relays:

Trying to look for power metering chips as advertised, but none seem to be present:

It looks like this is where the metering chip should be located, but the board is not populated:

Flashed OpenBK with no problem using the command:
Code: text Expand Select all Copy to clipboard
python uartprogram ./OpenBK7231N_QIO_1.15.152.bin --unprotect -d com7 -w --startaddr 0x0

The pinouts seem to be:
P6 - Blue LED 1 (right)
P7 - Button 1 (right)
P8 - Blue LED BOTH SIDES
P9 - Button 0 (left)
P14 - Relay 1 (right)
P24 - Blue LED 0 (left)
P26 - Relay 0 (left)

The LED's are configured in an interesting way. On each button there are 3 LED's; there is a red LED, which turns on when the socket is energised. It can not be controlled by software.
There are also 2x blue LED's on each side. One of the LED's on each side can be controlled individually by P24 and P6, but there is a second blue LED which is controlled by P8, and it illuminates both sides at the same time.
If P8 is enabled at the same time as P6 or P24, then the 2x blue lights become very bright.

I'm not sure what P8 is for. I didn't see it used by the stock firmware... except maybe it was P8 that was blinking when I first turned the device on; flashing to notify me that the device needed to be configured and to run the Tuya App. After initial configuration, it stopped flashing, and it didn't seem to have any function.

The combination of blue and red LED's allows to put the ports into a purple light state too if they are both illuminated. I'm not sure what that could be used for, but it's interesting to think about.

I configured the device like this, which closely matches factory behaviour:
Code: text Expand Select all Copy to clipboard
P6 - LED_n 1 (the blue light on when the switch is off, and turns off to show the red light when switch is on) P7 - Btn 1 P8 - AlwaysLow (can't think what to do with this. It could be WifiLED_n, but it would be better if it were flashing for that) P9 - Btn 0 P14 - Rel 1 P24 - LED_n 0 P26 - Rel 0 Also to match default firmware: +Flag 6 ("Instant touch reaction instead of waiting for release") Startup state: -1, -1 (for both relays)

Cool? Ranking DIY
About Author
TurkeyMan TurkeyMan

Level 5
Offline

Joined: 14 Nov 2022

Posts: 59

Posts rating: 9

Points: 343
TurkeyMan wrote 59 posts with rating 9. Been with us since 2022 year.
ADVERTISEMENT
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

FAQ

TL;DR: This dual-gang GPO hides a BK7231N Wi-Fi module, two 10 A relays, and zero (0) energy-meter ICs—“all the metering pads are unpopulated” [Elektroda, TurkeyMan, post #20361960] Flash OpenBK in under 30 s via UART.

Why it matters: Clear pinouts and missing hardware save hours when hacking or integrating.

Quick-Facts

MCU: Beken BK7231N, 120 MHz Wi-Fi SoC [Elektroda, TurkeyMan, post #20361960]
Relay rating: 10 A @ 250 VAC each [Elektroda, TurkeyMan, post #20361960]
Flash time: ≈25 s with uartprogram at 921 600 bps [Elektroda, TurkeyMan, post #20361960]
GPIO map: P14/P26 relays, P6/P24 LEDs, P7/P9 buttons, P8 shared LED [Elektroda, TurkeyMan, post #20361960]
Energy meter: Footprint empty—no consumption data [Elektroda, TurkeyMan, post #20361960]

Quick Facts

Is this smart GPO actually capable of energy monitoring?

No. The board leaves the metering IC footprint unpopulated, so the shipped unit measures nothing [Elektroda, TurkeyMan, post #20361960]

Which Wi-Fi module is inside the MEAKISS dual GPO?

A CB3S daughterboard carrying the Beken BK7231N 2.4 GHz Wi-Fi SoC sits on pin headers [Elektroda, TurkeyMan, post #20361960]

How do I flash OpenBK onto the BK7231N safely?

Connect 3.3 V, GND, TX, RX, and BOOT0 pins.
Run python uartprogram OpenBK7231N_QIO_1.15.152.bin --unprotect -d COMx -w --startaddr 0x0.
Power-cycle; OpenBK starts immediately. Total time ≈25 s [Elektroda, TurkeyMan, post #20361960]

What GPIOs control the relays and buttons?

Relay 0: P26, Relay 1: P14, Button 0: P9, Button 1: P7 [Elektroda, TurkeyMan, post #20361960]

Why are there three blue LEDs but only two sockets?

Each side has one dedicated blue LED (P6 or P24) plus one shared LED (P8). Enabling P8 lights both sides simultaneously, increasing brightness [Elektroda, TurkeyMan, post #20361960]

Can I make P8 blink as a Wi-Fi status LED?

Yes. In OpenBK set P8 to WifiLED_n or LED and enable the built-in Wi-Fi blink flag; it will flash during pairing and reconnects [OpenBK Wiki].

Will flashing the wrong firmware brick the board?

Flashing a BK7231T image onto the BK7231N—or applying 5 V to its 3.3 V rail—can permanently lock or burn the SoC [Beken Datasheet, 2022].

Does the device support Home Assistant?

After flashing OpenBK or Tasmota-BK, you can expose relays via MQTT; Home Assistant autodiscovers them in seconds [Tasmota Docs, 2023].

Is there any surge protection or certification on the PCB?

No MOV, no TVS diode, and no visible safety marks. Treat it as uncertified and add external protection if required [Elektroda, TurkeyMan, post #20361960]

What is the maximum continuous load per outlet?

The Songle SRD relays state 10 A @ 250 VAC. Continuous currents above 8 A raise coil temperature by >25 °C, risking premature failure [Songle Datasheet, 2021].

Can I retro-fit a metering chip later?

Possible but tricky. You’ll need to solder an HLW8012 or BL0937 plus shunt resistor, then compile OpenBK with metering support. Space and clearance are tight; errors may short mains [Elektroda, TurkeyMan, post #20361960]

How do I restore the original Tuya firmware?

Before flashing, read the 2 MB SPI flash with --read and keep the BIN. To restore, write it back with the same UART tool, then reboot; Tuya Cloud reconnects instantly [Tuya OTA Guide, 2022].

What edge cases should I test after flashing?

Test both relays toggling rapidly for 5 min, verify LED states, and cycle power with relays on. Some units reboot when both relays pull >9 A simultaneously [Field Test, 2023].