[BK7231N / CB3S] Aubess Tuya Wifi Smart Touch Switch 4 Gang W/ Neutral

I've bought a wall switch from Aubess for my home, with 4 capacitive (touch) buttons.

I ordered it from AliExpress: https://www.aliexpress.com/item/1005005009473461.html







With the device in hands, it was time to begin the fun part - disassembly and converting it to OpenBK!





Regarding functionality, when a button is touched/pressed, the corresponding relay is triggered. The button has a light that shows whether the relay is open or closed - it will show up as blue when the relay is ON and red when the relay is OFF.

As you can see, the device is powered by a CB3S chip, although not all of its pins are soldered on the PCB. Upon checking the datasheet for the MCU, we can determine the required pins to flash the device:

Datasheet: https://developer.tuya.com/en/docs/iot/cb3s?id=Kai94mec0s076



I've connected a push button to drive the CEN pin to low level to put the device into bootloader mode in order to flash a new firmware.

Pin Name	Pin Number
CEN	3
VCC	8
GND	9
RX1	15
TX1	16

NOTE: these devices are 3.3v, so the VCC pin is connected to the 3V3 pin on the USB UART programmer.

Flashing:


At first, it wasn't possible to flash and I thought it could be that the CEN is connected to the wrong ping - according to the datasheet, the RST pin corresponds to the CEN pin of the IC, so I tried changing the CEN to that pin, but it didn't work. Every time I pressed the button before flashing, the device would simply reboot and the flash would fail because it couldn't communicate with the UART bus.

Then I found out looking at other teardowns that some devices have an extra chip (highlighted in pink) that connects to either the TX/RX lines of the wifi module, so you need to find a way to cut the communication between the wifi module and this IC. For me, the easiest way was to completely remove the IC using an air reflow station and resoldering it back with flux.

So I reconnected the push button to the CEN pin (pin 3) and this time, without the extra IC, I was able to flash OpenBK. I used the command line tool, hid_download, as I run Linux on my PCs, but you should be able to flash it using the new BK7231GuiFlashTool.

- BK7231GuiFlashTool: https://github.com/openshwprojects/BK7231GUIFlashTool
- hid_download: https://github.com/OpenBekenIOT/hid_download_py

Flashing command:

I have configured it after flashing by using the web app and selecting Tuya Smart Wifi Switch 4 Gang from the pre-configured devices list. Some pins were wrong, but luckily the relays were mapped correctly.

Pin	Type	Channel
P6	Rel	4
P7	Btn	1
P8	Rel	3
P9	Rel	1
P10	Btn	3
P14	Btn	2
P23	WifiLED_n	-
P24	Btn	4
P26	Rel	2

I could setup the relays, but unfortunately I couldn't map the physical buttons on OpenBK. I found out that pins P7, P14, P20 and P24 might be connected to the touch buttons; the way I tested it was by trial and error and set those pins as digital inputs. By doing so, the light of the corresponding touch button would turn red but nothing happened if I touched the button. When I change the state via the web interface, the lights change accordingly and the relays get triggered, but when touching the capacitive buttons nothing happens. I even tried setting those pins as actual buttons, but nothing worked.

EDIT: turns out when resoldering the button controller IC I messed up and the IC wasn't properly soldered. After soldering it once again the buttons started working.

As for the extra IC that I removed to flash OpenBK, I suspect it's a driver for the relays, as I tested with a multimeter and found out some of its pins are connected to the CB3S pins that drive the relays.