BK7231 datasheet, pinout, programming, specification, wiki (BK7231T, BK7231N)

BK7231T/BK7231N is a popular WiFi & Bluetooth SoC used widely in Tuya Smart products. BK7231 can be found in smart sockets, smart LED bulbs, smart switches, etc. BK7231 usually comes in form of modules which are pin to pin compatible with ESP modules (TYWE2S, TYWE3S, ESP12, etc..). BK7231 devices can be easily programmed by UART and you can free them from the cloud by using open source firmware. Here I will provide some generic information about BK7231 SoC.

Please scroll to the bottom of the post to get the BK7231U, etc, datasheets, manuals, all that I've found

BK7231 features:
- 802.11 b/g/n 1x1 Compliant
- 20/40 MHz bandwidth and STBC
- Working mode Wi-Fi STA, AP, Direct and Repeater SGI、Green-Field Preamble and A-MPDU Support WPA, WPA2 and WAPI
- Support 802.11e and WMM-PS
- Up to 120 MHz for MCU
- In package 2Mbyte FLASH, support transparent download
- On chip 256 Kbyte data RAM
- 50 MHz SDIO interface and SPI
- Full speed USB host and device
- Dual high speed UART
- Dual high speed I2C
- Multi-channel 10bit ADC
- Six 16-bits timer with PWM mode
- Clock signal output

BK7231 QFN32 Pinout
Here's the pinout of BK7231 microcontroller:

BK7231 pin table:

Pin Index	Role
1	VCCRXFE
2	ANT
3	VCCPA
4	VCCPAD
5	VCCIF
6	VSYS
7	VDDIG
8	VDDAON
9	VBAT
10	P28/RX_EN/USBDN
11	P14/SD_CLK_SPI_SCK
12	P16/SD_CMD/SPI_MOSI
13	P15/SD_DATA3/SPI_CSN
14	P17/SD_DATA0/SPI_MISO
15	P26/IRDA/PWM5
16	P24/LPO_CLK/PWM4
17	P23/ADC3/TDO
18	P22/XHOUT/TDI
19	P21/I2C1_SDA/TMS
20	P20/I2C1_SCL/TCK
21	CEN
22	P6/CLK13M/PWM0
23	P7/WIFI_ACTIVE/PWM1
24	P8/BT_ACTIVE/PWM2
25	P9/BT_PRIORITY/PWM3
26	P10/UART1_RXD
27	P11/UART1_TXD
28	P1/UART2_RXD/I2C2_SDA
29	P0/UART2_TXD/I2C2_SCL
30	XO
31	XI
32	VCCPLL
33	GND (bottom pad)

Some of more important BK7231 IO features has been highlighted in the following table:

Feature	Description	Used pins
UART1	Programming/TuyaMCU/BL0942 interface port	UART1_RXD is P10, UART1_TXD is P11
UART2	Debugging/log output interface port	UART2_RXD is P1, UART2_TXD is P0
I2C1	First hardware I2C interface	I2C1_SDA is P21, I2C1_SCL is P20
I2C2	Second hardware I2C interface	I2C2_SDA is P28, I2C2_SCL is P29
SPI Memory	SPI port for flashing in SPI mode	SCK is P20, CSN is P21, SI is P22, SO is P23
SPI Interface	Hardware SPI for interfacing peripherals	MISO is P17, CSN is P15, MOSI is P16, SCK is P14

BK7231 PWMs are widely used in RGBCW smart lighting. Here' s the BK7231 PWM mapping:

PWM	IO
PWM0	P6
PWM1	P7
PWM2	P8
PWM3	P9
PWM4	P26
PWM5	P24

BK7231T/BK7231N UART Programming
BK7231 microcontroller comes with a preloaded UART bootloader in the 0x0 - 0x11000 flash memory section. Bootloader allows you to read and write the device flash memory by UART1 port.
Unlike in ESP8266/ESP8285 MCUs, there is no special pin used to enable bootloader mode. Bootloader is only enabled for a fraction of a second after device reboot.
To use TTL UART with your computer, you will need a USB to UART converter that supports 3.3V voltage levels. There are many converters like that on the market, but the one used frequently by us is CH340G:

The programming procedure is the following:
1. connect TXD1, RXD1, VDD and GND. Use UART to USB converter with 3.3V levels
NOTE: As always with UART, RX of one side should connect to TX of the other side, etc.
2. Start flash operation in the chosen tool
3. Reboot device, there are 3 ways to do it:
a) reboot by disconnecting power and reconnecting it
b) reboot by shorting CEN (RESET signal) to ground
c) reboot from firmware (for example, OpenBeken web panel has a 'restart' button
4. Wait for flashing procedure to finish.

The preferred simple GUI tool for flashing BK7231T and BK7231N is BK7231 GUI Simple Flasher:
https://github.com/openshwprojects/BK7231GUIFlashTool
Scroll down to see full BK7231 GUI Flasher Guide!
The old tool for Windows from Beken Corp is bkWriter 1.60:
https://github.com/openshwprojects/OpenBK7231T/blob/master/bk_writer1.60.zip
bkWriter 1.60 works well for BK7231T, but it may overwrite your bootloader if you try to write flash memory to address over 0x200000 because of address wrap. Still, it's safe to use it to write OpenBK7231T_UA_* file, as it's smaller than 2MB



The current bkWriter 1.60 usage is following: flash UA (User Area) firmware to offset 0x11000 with operation length no longer than 0x001EF000 (0x00200000-0x00011000).
The BK Python tools (hid_download_py, both UART and SPI):
https://github.com/OpenBekenIOT/hid_download_py
hid_download_py is an old tool for BK7231N operations.
hid_download_py command for BK7231N reading flash (doing firmware backup):

hid_download_py command for BK7231N writing flash (programming new firmware):


You can program BK7231 both inside the circuit and outside the circuit.
Programming BK7231 inside the circuit may not be a perfect method, because some of the devices are using BK7231 RXD1/TXD1 (UART1) for TuyaMCU communication and it interferes with programming.
Also you should never attempt to program device that is connected to mains.

Example flashing circuit (flashing outside the PCB)
CB2S/WB2S version:

WB2L/WB2L_M1 (BK7231N) version:

WB3S example:

Entire circuit is powered by 3.3V and 5V would damage it.
Shorting those two pins select 3.3V voltage levels:

WARNING: You can't use USB to UART converter 5V/3.3V pins to power circuit. They are used to select voltage levels and don't have enough current capability. That's why we're using external LDO (TC1264 3.3V or AMS1117 3.3V)
WARNING: If you don't have external USB cable, you can get 5V directly from USB to UART converter USB socket pin, more about that later.

If you want to see the flashing procedure of BK7231T that is directly on the PCB (also with existing onboard AMS1117 3.3V usage), please refer to this topic: Garden Tuya CCWFIO232PK Double Relay - BK7231T - Programming.
There is also a similar topic: Light switch from the USA - Gosund Smart Switch SW5-A-V2.1 - BK7231T

Reliable 5V from USB to UART converter trick
The common CH340G USB to UART (TTL) converter can be very useful for programming BK7231 devices, but it's not able to power to BK7231 from it's 3.3V/5V pins. The 5V/VDD/3.3V pins on the converter are used only to select voltage levels, they can't supply enough current to power the WiFi module.
That's why our common approach is to break out a 5V directly from USB port, by soldering an extra cable to USB connector 5V pin:

Later we can connect that cable to the input of 3.3V LDO regulator and get 3.3V for BK.


BK7231 GUI Simple Flasher Usage
BK7231 GUI Flasher is very simple to use, it can even download latest OBK build automatically. Here's a detailed step by step guide:
1. Download and unpack executable from Releases tab
2. Prepare programming circuit for BK7231 (both T and N)
- get a USB to UART bridge with 3.3V voltage signals
- connect the Bridge RX to Module TXD1, and Bridge TX to Module RXD1
- if you want to use CEN RESET method, solder wire to CEN
- power the device from either the bridge or an external power source. All Beken based modules require 3.3v.
⚠️ NEVER try hacking devices while connected to mains power!
3. Open our flasher:

4. Select proper platform - BK7231T or BK7231N
5. Select your COM port of USB to UART converter
6. Click "Download latest from Web" to get proper binary file
7. Wait for download to finish

8. Close download window
9. Click "Backup and flash new"
10. When the log window is waiting for "Getting bus", do a device reboot. You can do this in two ways, choose one:
- Option A: short CEN to GND for 0.25s (it is tricky to get this right, requires precise timing)
- Option B: power off and on device (of course, it should not be connected to mains, use your own safe 3.3V power supply that can supply enough current)

11. It will begin reading (it does first backup, then write)

12. After reading, it will start the new firmware erase

13. And then, automatically, write:

14. Done:

15. Firmware access point show appear now. Connect to it and enter 192.168.4.1 configuration page.
16. Remember that saved firmware backup is in the "backups" dir

NOTE: If you're getting CRC mismatch, then it means you've selected from platform (T instead or N, or vice versa):




BK7231T/BK7231N SPI Programming
It is also possible to program BK7231 via SPI interface. This will allow you to recover BK if you have accidentally overwrote the bootloader section. BK7231 is basically acting like a flash memory in this case and responds to common flash memory commands (read, erase, write, etc...)

Here's a simplest SPI flasher tool:
https://github.com/openshwprojects/BK7231_SPI_Flasher
Here's detailed SPI flashing guide:
BK7231 programming via SPI in flash memory mode - Python and Banana Pi
Here is a more advanced flasher by Beken Corps, but not maintained:
https://github.com/OpenBekenIOT/hid_download_py/blob/master/SPIFlash.md

BK7231 T & N binary files classification
Tuya/Beken toolset produces various binary files for a single BK build. Here are they respective meanings:
After the chip of this module model is compiled, the following types of .bin files are generated:
- OpenBK7231T_1.15.341.rbl - OTA update (useful for OpenBeken web panel)
- OpenBK7231T_UA_1.15.341.bin - user area firmware (no bootloader; flash it at 0x11000)
- OpenBK7231T_QIO_1.15.341.bin - bootloader + user area firmware (flash it at 0x0)
- OpenBK7231T_UG_1.15.341.bin - update area firmware (not used in OpenBeken, but useful for OTA hack)
The notation is similar for both T and N.
NOTE: OpenBeken flashing guide recommends using _UA_ for T platform at 0x11000 offset and _QIO_ for N platform at 0x0 offset.


BK7231 Memory Layout/Partitions
Here's the memory layout used by Tuya.
BK7231T:

Name	Code	Start	Length
Bootloader	BK_PARTITION_BOOTLOADER	0x00000000	0x11000 //68KB
Application	BK_PARTITION_APPLICATION	0x11000	0x121000//1156KB
ota	BK_PARTITION_OTA	0x132000	0x96000, //600KB
RF Firmware	BK_PARTITION_RF_FIRMWARE	0x1e0000	0x1000
NET info	BK_PARTITION_NET_PARAM	0x1e1000	0x1000

BK7231N:

Name	Code	Start	Length
Bootloader	BK_PARTITION_BOOTLOADER	0x00000000	0x11000 //68KB
Application	BK_PARTITION_APPLICATION	0x11000	0x121000//1156KB
ota	BK_PARTITION_OTA	0x12A000	0xA6000 //664KB
RF Firmware	BK_PARTITION_RF_FIRMWARE	0x1D0000	0x1000
NET info	BK_PARTITION_NET_PARAM	0x1D1000	0x1000

Bootloader and Application partitions should be self-explanatory; the UART programming will not work if bootloader partition is overwritten. The OTA partition is used to store pending update (RBL data) that will be unpacked and executed with next reboot (it will be unpacked into Application partition).
NET Info partition is a generic data partition with a key-value system used to store SSID, etc, it is overwritten in OpenBeken with our own structures. RF Firmware/calibration partition stores RF calibration data and MAC address.
NOTE: BK_PARTITION_NET_PARAM partition can be decoded and read on any BK device with a simple UART programmer, so your SSID and password may be leaked if you throw out used IoT device.
There are also some undocumented partitions in the code, for example a quick reconnect block data for WiFi were stored in N SDK at the hardcoded address.

BK7231N generic memory mapping:

Name/Access	Start	Length
flash (rx)	ORIGIN = 0x00010000	LENGTH = 2M - 64k
tcm (rw!x)	ORIGIN = 0x003F0000	LENGTH = 60k - 512
itcm (rwx)	ORIGIN = 0X003FEE00	LENGTH = 4608
ram (rw!x)	ORIGIN = 0x00400100	LENGTH = 192k - 0x100

NOTE: TCM=Tightly-Coupled Memory, ICTM = Instruction Tightly-Coupled Memory
The ITCM section is used for timing-critical functions which are executed from RAM memory. This means there is no extra random delays caused by fetching instructions from flash. Doing a precise bitbang drivers won't work when a function is stored in flash.


BK7231T/BK7231N Modules
BK7231 comes in form of various Tuya modules. Some of the modules have a generic usage, and some of them are dedicated for certain IoT applications, like WB2L/CB2L which is dedicated for LED driving (it has only PWM IOs available).
Tuya is using a standardized format of module names:
- WBXX modules (WB2L, WB2S, etc) are using BK7231T
- CBXX modules (CB2L, CB2S, etc) are using BK7231N.
Let's see the most common Beken modules:
- WB3S (BK7231T):

WB3S pinout is visible on the image.
- CB3S (BK7231N)

CB3S Pinout (click to show spoiler):

WB3S and CB3S have similar pinout to TYWE3S/ESP12
- WB2S (BK7231T):

- CB2S (BK7231N):

CB2S and WB2S have similar pinout to TYWE2S, etc
- WB2L (BK7231T):

NOTE: The UART1 is available only on the back of the module, which is often covered by the PCB. This can be problematic when you want to program new firmware, you might need to use method shown here.
NOTE: There is also a BK7231N version called WB2L_M1.
- CB2L (BK7231N):

CB2L and WB2L are used mostly in LED lighting, they have only PWM IOs available.
- WBLC9 (BK7231T):

- CBLC9 (BK7231N)

CBLC9 and WBLC9 are also often used in LED bulbs due to their small form factor.
- CBLC5 (BK7231N):

CBLC5 pinout:

Symbol	I/O type	Function
ANT	O	Pad pin for the external antenna
GND	P	Ground pin
M4	I/O	Support hardware PWM and correspond to PA 24 on the internal IC
M5	I/O	Support hardware PWM and correspond to PA 26 on the internal IC
M0	I/O	Support hardware PWM and correspond to PA 6 on the internal IC
3V3	P	Power supply pin

CBLC5 test pads:

Symbol	I/O type	Function
R2	I/O	UART2_RX, LOG RX, which corresponds to P1 on the internal IC
T2	I/O	UART2_TX, LOG TX, which corresponds to P0 on the internal IC
R1	I/O	UART1_RX, user serial interface RX, which corresponds to P10 on the internal IC
T1	I/O	UART1_TX, user serial interface TX, which corresponds to P11 on the internal IC
CSN	I	If connected to the ground before powered on, enter the RF test mode. If not connected or connected to VCC before powered on, enter the firmware application mode.
None	I	RST pin, which corresponds to CEN on the internal IC

- WBLC5 (BK7231T)


WBLC5 test pads are not described on the image above but you can look at the CBLC5 specs.
- WB8P (BK7231T), another one with only PWM pads accessible:



T34 integrated BK7231N module
T34 is basically a BK7231N SoC integrated with a crystal, an RF matching circuit and most of the peripheral devices within a single LGA 6x6 36-pin package. The T34 dimensions are 6±0.1 mm (W)×6±0.1 mm (L) ×0.85±0.1 mm (H).

T34 pin definitions:

T34 schematic diagram:

Here's a real photo of T34 SoC:


Replacing BK module with ESP
While it's not recommended, because there is already a mature open source firmware for this platform, it's still worth noting that WB/CB modules have usually pinout similar to the TYWE modules, etc. For example, WB3S can be replaced with TYWE3S (ESP12) and WB2S can be replaced by TYWE2S and similar.
Please consult this generic guide for more information on so-called "brain transplant" procedure:
Replacing the WiFi module with ESP12F (ESP8266) in a smart / tuya device
Article above refers to the XR809/XR3 IoT module, but the procedure would be similar for WB3S/CB3S, etc.

What is required to run BK7231 module in practice?
It's important to note that you can easily both flash and run BK7231 modules outside the boards with 0 external components.
To be precise, you will only need a 3.3V power supply with a preferably generic 100nF capacitor at the output. No external resistors, etc. are required.
Many test development stands can be constructed that way, for example:
- CB2S + DHT11 test circuit:

- WB2S + LCD 2x16 with I2C driver + MCP23017 port expander test circuit:

- WB2S + bistable switch and potentiometer test circuit:

- WB2S + IR receiver test circuit:

- WB2S + Software SPI test:

More about my test setups will be covered in dedicated OBK topic.

BK7231T/BK7231N Minimal system diagram
Here's a minimal BK7231 circuit diagram from Tuya docs. You will most likely not need it, as most of the times BK is available in a form of modules, but it might be useful for a generic reference.

NOTE: the parts from the circuit are already present in the BK7231 modules

BK7231 in LED lighting
BK7231 is used widely in LED lighting, including various types of bulbs (CW, RGB, RGBCW, etc), LED strip controllers, ceiling lamps, etc.
Usually a simple PWM-driven LED chips are used:

Example chips: SM2083, SM2123E, SM15133E
Sometimes, a custom communication protocol is employed (a variation of I2C) and LED channels are controlled by SDA/SCL bus:

Example chips: SM2135 (8 bit colour channel), SM2235 (10 bit version), BP1658CJ (10 bit), BP5758D (10 bit).
Important: there are two types of PWM-controller CW (CCT) drivers
CCT, Correlated Color Temperature, is a feature that allows you to customize the temperature of bulb white colour. CCT is defined in degrees Kelvin, so the warm light is around 2700K, neutral white at around 4000K, and cool white is at 5000K or more.
CCT control can be achieved in two ways:
- basic two PWM control - first PWM controls Cool White LEDs, second Warm White LEDs, and their respective fractions are calculated in firmware
- alternate PWM control - first PWM controls the brightness level, and second controls the temperature (then a dedicated CW/CCT driver drives LEDs appropriately)

BK7231 in power metering
BK7231 can be used in various smart sockets, where some of them also offer a power metering features, including the measurements of the voltage, current, power and more.
BK7231 can be seen often used with BL0942 power metering chip (they are most often using UART1 port for communication, in rare cases they use SPI mode):


There are few similar chips to BL0942, they can have a slightly different UART protocol, for example CSE7766:

BL0937 is also used, it can use any arbitrary IO of BK7231, but requires IO interrupts to count pulses on CF and CF1 pins (measurement results are encoded as pulses):



A good example of power-metering device can be a LSPA9 socket (BL0942):

Read more here:Tuya LSPA9 smart socket - teardown, OpenBeken flashing guide for CB2S, BL0942



BK7231 and TuyaMCU
TuyaMCU smart devices, unlike other devices, consists both a WiFi module and an external MCU that takes a certain part of WiFi module duties and communicates with the WiFi module via the UART protocol called TuyaMCU.

In this case often all buttons, relays, power metering features and sensors are connected to the MCU and WiFi module can only control them via dedicated UART protocol. Communication is two-way, so MCU can report a relay switch (caused by user pressing button) to the WiFi module, and WiFi module can also order a relay switch (when user toggles relay state in the mobile App).
Each TuyaMCU variable has an unique ID, called "dpID" and a type (integer, enum, raw bytes data, string....
The IDs (dpIDs) are unique per device model and must be captured or guessed.
There is usually no floating point data in TuyaMCU - values like 22.5 temperature are sent as integers (225).
TuyaMCU usually uses 9600 baud rate, but sometimes higher speeds are also used.
TuyaMCU communication is using UART1 port (RXD1/TXD1) of Beken WiFi modules, so it may interfere with programming.
For more information see Tuya Smart Serial Protocol Guide:
https://images.tuyacn.com/smart/aircondition/Guide-to-Interworking-with-the-Tuya-MCU.pdf
Here are few examples of TuyaMCU device.
Photo below shows the PCB of smart Dimmer with WB3S and TuyaMCU:

Read more: Dimmer EDM-01AA-EU 300W for BK7231 and TuyaMCU - configuration
Photo below shows the PCB of TuyaMCU Fan Controller:

Read more: Tuya 5 Speed Fan Controller by TEQOOZ - Home Assistant
Photo below shows the PCB of TuyaMCU Fan Controller:

Read more: QIACHIP Universal WIFI Ceiling Fan Light Remote Control Kit - BK7231N - CB2S
Photo below shows the PCB of TuyaMCU energy metering device:

Read more: [TAC2121C] Tuya smart DIN-rail relay/energy meter [BK7231N]
Photo below shows the PCB of TH06 Clock, Humidity meter and temperature meter:

Read more: [BK7231T] LCD calendar/thermometer/hygrometer TH06 WiFi for TuyaMCU - Home Assistant


BK7231 and battery powered devices
There are basically two kinds of BK7231 battery powered devices on the market.
First kind consists only a WiFi module and peripherals, it's using a deep sleep feature to prolong battery life. Deep sleep basically turns off BK for a given amount of time and then BK has to reboot from 0 (no RAM etc is preserved).

Image source: https://www.elektroda.com/rtvforum/viewtopic.php?p=20387992#20387992
Second kind is a TuyaMCU variation, where the MCU is able to control the WiFi power supply through a simple MOSFET, so basically MCU is in low power state all the time, WiFi module is powered off, and MCU only wakes up when it has to report the status, enables power for WiFi module, and reports the sensor states to WiFi module via UART which then later can report it through WiFi to the cloud.

Here's a detailed analysis and description of such device: Energy-saving (?) Battery-operated door / window sensor for WiFi DS06


BK7231 current consumption
BK7231 features both runtime sleep (keeps device active but saves energy) and deep sleep (basically turns off device, clears RAM, and reboots from scratch after given time), but it's still worth to note the standard current consumption during RX/TX operations at runtime:

Communications	Wi-Fi standard	Rate	Transmitted/received power	Typical value	Unit
Transmit	802.11b	11 Mbit/s	+17 dBm	220	mA
Transmit	802.11g	54 Mbit/s	+14 dBm	200	mA
Receive	802.11g	54 Mbit/s	-10 dBm	104	mA
Receive	802.11n	MCS 7	-10 dBm	124	mA

The recommended power supply maximum peak current is at least 400mA.

BK7231 custom devices
There is much more BK7231 devices on the marked. A good example of custom IoT device featuring RGB light, a motor, and a laser (projector) is the Genio Galaxy Lamp:

Read more about it here: Genio Galaxy Smart Lamp - BK7231T - Teardown + Guide

BK7231U dev board?
Now it's time for a small warning for all readers.
There is supposedly a BK7231U dev board sold on Aliexpress, the HLK-B30-V1.0:



I do not recommend buying this board. The SoC on the pictures is indeed BK7231 but item is shipped with CC8000!

There is also CB3S available on Aliexpress, but I haven't checked that offer. And I think that it would be cheaper to buy whol 5$ smart bulb than to buy a single module..

BK7231 Video Flashing Guides
Elektroda.com Youtube channel features teardowns and flashing guides of multiple BK7231 devices. Each firmware flashing guide is shown step by step, and often includes soldering/desoldering details presented in easily accessible form for beginners.
RGBCW Tuya bulb flashing guide - BK7231N (WB2L_M1)

BK7231T/WB3S flashing guide - 2g Tuya wall switch - with SOIC8 chip desoldering - Home Assistant

Tuya Relay CB2S/BK7231N control without Local Tuya - 100% free from cloud with Home Assistant guide


BK7231 Devices List
Here's a global list of BK7231 IoT devices, fully maintained by community (you can also add your device there):
https://openbekeniot.github.io/webapp/devicesList.html
The list contains also non-BK7231 IoT devices, so there is some ESP8266/ESP8285 devices, BL602 devices, W600/W601 devices, W800/W801 devices, XR809 devices, and much more.
Devices list screenshot:


BK7231 Programming Guides
Here are few selected topics from the devices list.
LED WiFi RGBCW Tuya - teardown, BK7231N, programming
Tuya LSPA9 smart socket - teardown, OpenBeken flashing guide for CB2S, BL0942
Garden Tuya CCWFIO232PK Double Relay - BK7231T - Programming
If you want to find a guide for specific device, just use search function on our list.

Futher reading/sources
This topic was based mostly on released Tuya docs and on my own research. Here are some links that I used as a reference:
docs.bekencorp.com
BK7231T COB Hardware Design Guideline
Flash and Authorize CB Modules
Flash Firmware to and Authorize WB Series Modules
Wi-Fi Low-Power Device Solution

Thank you for reading
Thank you for your attention. This topic will be updated regularly with new information. If you have any questions, please create a separate topic here. This post is a documentation only.
I am attaching related datasheets.