[Solved] Flashing Tuya WB3S in Window Controller with BekinWriterV1.60 - Fail & 16-Pin Chip Removal

Using the BekinWriterV1.60 to flash a Tuya WB3S board is not working - it just doesn't get going and reports Failed after the 15 seconds or so. I am disconnecting/reconnecting power, then grounding the CEN briefly (loose orange wire in pic) all within the 15 seconds. I have my USB to UART board set to 3v3 and all wires are directly soldered to the WB3S pads. I note your video on a similar board you desolder a 8 pin chip. In my case I have a 16 pin chip in that position and I'm not skilled enough to remove that! Is that the problem do you think? Is there anything else I could try? I have worked out the Button x3, LED x3 and Relay x2 outputs and was intending to add the device to your knowledge base, but little point if it cannot be flashed. Pictures below:- Any help would be great.

Hello, can you check the RXD1/TXD1 pads of WB3S with multimeter and check if they are connected anywhere, maybe to SOIC chip?

How do you power that device? Getting 3.3V from USB to UART converter may not work, you need good, reliable, 3.3V LDO with good current capability.

From what I can tell having probed it with an oscilloscope, the RXD1 is used as the input from one of the buttons, and the TXD1 is an output that drives a blue LED under one of the buttons. I'll try again with a proper 3v3 power supply on the VCC pad. Edit: - I've tried it now with a 3v3 lab supply to the VCC pad with a common ground and no difference regarding flashing. I also put a scope on the RXD1 pad and can see a repeating square ish wave while the 15s thing is going on. But the wave form is only going between 3v3 and about 2v8 (nowhere near ground). So my guess is there's some other circuitry keeping the voltage up and stopping the device receiving any input. I couldn't see a signal on the Tx but that's not surprising.

richardsg307 wrote:

the RXD1 is used as the input from one of the buttons, and the TXD1 is an output that drives a blue LED under one of the buttons.

We had a similar situation on video:
https://youtu.be/Yb3zXtBdSnE?list=PLzbXEc2ebpH0CZDbczAXT94BuSGrd_GoM
You must disconnect those devices from UART lines somehow. Cut the trace (and then fix it) or desolder the chip, etc...

OK Understood and thanks for helping. I've cut the 2 tracks in the positions indicated on the pictures. Checked with a multimeter. Now when I try to flash, when I power back on, the 15 second timer stops immediately and I get a failed message. On 1 occasion it said something about setting baud rate but still failed. Oscilloscope is now showing a signal on the Rx pin going 3v3 to ground. Here's my settings and the failed message: I also tried the python program OpenBKT uartprogram but that fails too with the message 'Unprotect failed'. Also fyi, the board uses PWM3 and 0 for the 2 relays, PWM2 and 4 and RDX1 for the 3 buttons, and TXD1, PWM5 and PI4 for the blue LEDs under the buttons. does another of those prevent flashing?

how do you power that device? Where do you get 3.3V from?

I'm getting the 3v3 from a lab switching mode power supply.

Do you do power cycle by disconnecting power?
TX should connect to RX, and RX to TX.

I can confirm Tx - Rx and vice versa.
I power cycle by switching off/on the 3v3 to the VCC pad. I have a common ground between the USB/UART and power supply.
I've changed the power supply to an AZDelivery breadboard power header device.

Further, I just tried running at 115200 baud and it started to erase and got 2 blocks up on the progress bar before it failed. Tried it several times and always fails at 2 blocks. It now starts the erase without a power cycle. I think that has bricked the device as far as Tuya is concerned. I then did a 'Read Flash' at 115200 and it all went successfully taking around 90 seconds and creating a file the same size as the Open Beken firmware file. Looking at the file in Hex Edit shows the first few pages as solid FFs, probably from the erase getting somewhere before failing.

Some progress I feel, but still need help figuring what next to try.

Erasing first blocks will brick Tuya firmware, but device can be still flashed with OBK.

Please shorten your wires for RX and TX in order to reduce the interference.

Still no joy. 2 blocks progress on erase when at 115200 then fail. Can still read the existing at 115200.
Same when powered by USB/UART board.
Thanks for helping.

I had some reports saying that trying another USB to UART converter helped in the past.

Success using the python loader. Changed the command from what I saw on the web a bit. The command that worked for me was:


With the response:

The Erase was quick and the Write over a minute I guess.

I'm now in the App first through the phone and then the PC after doing the Configure WiFi thing. Time to restore the tracks and then get configuring. I will submit my work on the forum when complete.

Thanks for your help. Hopefully I won't need to bother you again...

Feel free to ask any futher questions. So, basically, bkWriter 1.60 didn't work but hid_download_py was successful?

Yes, BekenWriterV1.60 didn't work - it never got past the 2 blocks progress when erasing.

With hid_download_py I started with the command I saw online:

That just returned 'Unprotect Failed'.
But then took out the '-s 0x0' as I read that the default was '0x11000' and that matched what BekenWriter defaulted to. Then I took out the '-u' as I read that Unprotect was needed for the N (ie not the T), and finally added the '-b 115200' as that got me a little further using BekenWriter. Bingo!
I note that the '-l' (which I didn't use) defaults to 0x1000. I don't know if that's the same variable used in BekenWriter labelled 'Operate Length' that has 0x000ef000; a very different value!

Well, no wonder that command with -u and -s 0x0 returns unprotect fail. It's for BK7231N, not BK7231T. As you can see, it's good to check readme before using command. You can also try our newer flasher, that has most of things automatic:
https://github.com/openshwprojects/BK7231GUIFlashTool

I don't think that l is set 0x1000, it should be taken automatically from source file length. The 0x1000 you saw may be a sector size in flash memory.

Reading stuff is not my strong point!

One track repaired easily with a blob of solder but the other... phew, needed a sliver of wire and I just hope it stays put. It's all working.

I've started configuring and have got the 3 buttons going, the 3 LEDs and the 2 relays. I see by default they are all grouped/linked by their channel number, which is fine. But I now need to create an interlock between the relays (on Ch 1 and Ch 3) so that they are never both on at the same time. I'll read more on OpenBeken but if I hit a brick wall I'll open another thread for help.

Thanks.

I had to disconnect the RXD1 and TXD1 pins from the onboard devices they were connected to, to stop them messing with the flashing signaling. I did it by cutting the tracks leading away from the pins. Reconnecting them afterwards was tricky!

Also the GUI tool Beken Writer kept failing on the flash so in the end I found 'hid_download_py' worked. See thread for details of the command I had to use.