[BK7231N/BK7231T/CB2S] Tuya LSPA2 Wi-Fi Smart Plug 16A ЕС AU UK + 2.1A Dual independent USB

AgranBox 3174 11

TL;DR

Tuya LSPA2 Wi‑Fi Smart Plug 16A ЕС AU UK with 2.1A dual USB, independently controlled USB ports, is converted to OpenBK7231N firmware on a BK7231N chip.
OpenBK7231N was installed with tuya-cloudcutter on a Raspberry Pi 3 using the '1.1.8 - BK7231N / oem_bk7231n_plug' exploit.
GPIO 6, 7, 10, 24, and 26 are assigned to two relays, a toggle button, a master relay channel, and the Wi‑Fi LED.
After flashing, the plug looks broken because LEDs and buttons stop responding, but it still works and can be configured at http://192.168.4.1/.

AI summary based on the discussion. May contain errors.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

Listen:

Topic author Helpful post? (+1)

OpenBK7231N flashing and GPIO mapping for LSPA2 plug
Post #1 20616227 13 Jun 2023 21:56

A new version of a similar BSD31 smart socket. It differs in that both USB ports are controlled independently and the BK7231N chip is used, not T.

When buying, the firmware version 1.1.8 is installed on the smart socket.

I installed the OpenBK7231N firmware using tuya-cloudcutter installed on Raspberry 3 with Raspberry PI OS.

I chose hack "By firmware version and name": "1.1.8 - BK7231N / oem_bk7231n_plug"

or download last firmware file OpenBK7231N_UG_1.17.135.bin to /tuya-cloudcutter/custom-firmware and run:
Code: text Expand Select all Copy to clipboard
sudo ./tuya-cloudcutter.sh -r -p "mirabella-genio-i004527-double-plug" -f "OpenBK7231N_UG_1.17.135.bin"

Hacking occurs according to the instructions, from the second pass. After that, the device gives the impression of being broken, the indicators are not lit, the buttons are not pressed, but it is working. You can connect to the OpenBK7231N_MAC Wi-Fi network and configure the device by URL http://192.168.4.1/.

Code: text Expand Select all Copy to clipboard
ClearIO // clear old GPIO/channels lfs_format // clear LFS StartupCommand "" // clear STARTUP stopDriver * // kill drivers backlog setPinRole 6 Rel; setPinChannel 6 1 backlog setPinRole 7 Rel; setPinChannel 7 2 backlog setPinRole 10 Btn_Tgl_All; setPinChannel 10 0 backlog setPinRole 24 Rel; setPinChannel 24 0 backlog setPinRole 26 WifiLED_n; setPinChannel 26 1 setChannelLabel 0 Plug setChannelLabel 1 USB1 setChannelLabel 2 USB2 Flags 1024

Code: text Expand Select all Copy to clipboard
{ "vendor": "Tuya", "bDetailed": "0", "name": "Wi-Fi Smart Plug 16A ЕС AU UK BRA + 2.1A Dual USB", "model": "LSPA2", "chip": "BK7231N", "board": "TODO", "flags": "1024", "keywords": [ "TODO", "TODO", "TODO" ], "pins": { "6": "Rel;1", "7": "Rel;2", "10": "Btn_Tgl_All;0", "24": "Rel;0", "26": "WifiLED_n;1" }, "command": "", "image": "https://obrazki.elektroda.pl/1114790300_1686685394.jpg", "wiki": "https://www.elektroda.com/rtvforum/topic3983684.html" }

Cool? Ranking DIY
Nowe złączki do PCB od WAGO [sponsorowany]
About Author
AgranBox AgranBox

Level 4
Offline

Joined: 13 Jun 2023

Posts: 5

Posts rating: 2

Points: 26
AgranBox wrote 5 posts with rating 2. Been with us since 2023 year.

ADVERTISEMENT
Requesting Tuya config and USB current test
#2 20616527 14 Jun 2023 09:01

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14755

Help: 659

Rate: 12880
Helpful post? (0)

Requesting Tuya config and USB current test
Post #2 20616527 14 Jun 2023 09:01

That's the first device with independent USB port control that I've ever seen. Have you considered using:
Code: text Expand Select all Copy to clipboard
setChannelLabel 1 USB1

to give them some better display names on UI? See our docs:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md

Also, have you checked USB current capability of the port?

Can you attach Tuya config partition binary, extracted as shown here:
https://www.youtube.com/watch?v=WunlqIMAdgw&ab_channel=Elektrodacom

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#3 20616566 14 Jun 2023 09:37

AgranBox AgranBox

Level 4

Posts: 5

Rate: 2
Topic author Helpful post? (0)

Post #3
20616566 14 Jun 2023 09:37

setChannelLabel 1 USB1
setChannelLabel 2 USB2
setChannelLabel 0 Plug

Added after 8 [minutes]:

BK7231N_TuyaConfig_obk51F8744A.bin https://disk.yandex.ru/d/a6UQGTLQOX6Yzg
ADVERTISEMENT
#4 20616594 14 Jun 2023 09:43

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14755

Help: 659

Rate: 12880
Helpful post? (0)

Post #4
20616594 14 Jun 2023 09:43

Here's what I extracted:
Code: text Expand Select all Copy to clipboard
Device configuration, as extracted from Tuya: - Relay (channel 3) on P7 - Pair/Toggle All Button on P10 - WiFi LED on P26 - Relay (channel 2) on P6 - Relay (channel 1) on P24 Device seems to be using CB2S module, which is using BK7231N. And the Tuya section starts at UNCOMMON POSITION 0

so it's CB2S module! Good to know.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
OpenBK7231N conversion via ltchiptool UF2 workaround
#5 20616609 14 Jun 2023 10:41

AgranBox AgranBox

Level 4

Posts: 5

Rate: 2
Topic author Helpful post? (0)

OpenBK7231N conversion via ltchiptool UF2 workaround
Post #5 20616609 14 Jun 2023 10:41

https://aliexpress.ru/item/1005002741792619.html

By the way, I bought here, but I came across similar models under other brands in local stores.

Added after 41 [minutes]:

First I installed the firmware ESPHome-Kickstart-v23.04.28_bk7231n_app.ota.ug.bin and there were problems with switching to OpenBK7231N.
No OpenBK7231N firmware was installed via the web interface. Then I converted the firmware with the ltchiptool utility
Code: text Expand Select all Copy to clipboard
python -m ltchiptool uf2 write -b cb2s -o openbkt.uf2 OpenBK7231N_1.17.135.rbl=device:download

The resulting file is openbkt.uf2 https://disk.yandex.ru/d/f0mC-pO2o4wSow
It worked!

Added after 9 [minutes]:

I also prepared an autoexec.bat file so that the device reboots every day at 7 am. And also when you press the button, it turns off the ports for 3 seconds and turns on again. This is necessary to reboot connected devices, which sometimes freeze.

autoexec.bat
Code: text Expand Select all Copy to clipboard
startDriver NTP ntp_timeZoneOfs 3:00 addClockEvent 07:00 0xff 1 reboot addChangeHandler Channel0 == 0 addRepeatingEvent 3 1 setChannel 0 1 addChangeHandler Channel1 == 0 addRepeatingEvent 3 1 setChannel 1 1 addChangeHandler Channel2 == 0 addRepeatingEvent 3 1 setChannel 2 1 setChannel 0 0 setChannel 1 0 setChannel 2 0 delay_s 3 setChannel 0 1 setChannel 1 1 setChannel 2 1
BK7231T and BK7231N pin mapping for dual USB outlets
#6 20618796 15 Jun 2023 22:49

AgranBox AgranBox

Level 4

Posts: 5

Rate: 2
Topic author Helpful post? (0)

BK7231T and BK7231N pin mapping for dual USB outlets
Post #6 20618796 15 Jun 2023 22:49

>>20616594

@pkaczmarek262 can you analyze this file for a very similar outlet, but it looks a little different?
I ordered this model from this link: https://aliexpress.ru/item/1005002741792619.html
BK7231N_TuyaConfig_obk5533F290.bin https://disk.yandex.ru/d/y33Z7WXCGRuwTg

I have another socket, this time on a different chip BK7231T. It had firmware 1.0.7.

For the firmware I used this command:
Code: text Expand Select all Copy to clipboard
sudo ./tuya-cloudcutter.sh -r -p "tuya-generic-bsd31-16a-smart-plug"

BK7231T_TuyaConfig_obk76B4542B.bin https://disk.yandex.ru/d/_m2-j_fxf9qeug

All these devices have independent control of each USB port. But the channel settings are slightly different, different from the first socket.

Code: text Expand Select all Copy to clipboard
ClearIO // clear old GPIO/channels lfs_format // clear LFS StartupCommand "" // clear STARTUP stopDriver * // kill drivers backlog setPinRole 7 Rel; setPinChannel 7 2 backlog setPinRole 8 WifiLED_n; setPinChannel 8 1 backlog setPinRole 10 Btn_Tgl_All; setPinChannel 10 0 backlog setPinRole 24 Rel; setPinChannel 24 1 backlog setPinRole 26 Rel; setPinChannel 26 0 setChannelLabel 0 Plug setChannelLabel 1 USB1 setChannelLabel 2 USB2 Flags 1024

These two smart sockets do not have LEDs showing the operation of each USB port, as in the socket from the first post.

Attachments:

BK7231N_TuyaConfig_obk5533F290.7z (8.04 KB) You must be logged in to download this attachment.

BK7231T_TuyaConfig_obk76B4542B.7z (5.39 KB) You must be logged in to download this attachment.
ADVERTISEMENT
CB2S/BK7231N pinout and Tuya offsets confirmed
#7 21006754 16 Mar 2024 18:49

divadiow divadiow

Level 38

Posts: 5212

Help: 446

Rate: 914
Helpful post? (0)

CB2S/BK7231N pinout and Tuya offsets confirmed
Post #7 21006754 16 Mar 2024 18:49

I got one too. It matches the second variant.

Code: Text
Log in, to see the code

Boot output
Code: Text
Log in, to see the code

JSON
Code: JSON
Log in, to see the code

Tuya API return

Code: JSON
Log in, to see the code

factory fw attached. UK version hardware. Firmware v1.1.15 is no good for Cloudcutter. Some piccies:

and I am using this in autoexec to label switches

Code: Text
Log in, to see the code

I propose two OBK templates are added to the device list.

Code: JSON
Log in, to see the code

Code: JSON
Log in, to see the code

Attachments:

LSPA2.bin (2 MB) You must be logged in to download this attachment.
BK7231N CB2S pin mapping and Tuya section offset
#8 21006763 16 Mar 2024 18:57

divadiow divadiow

Level 38

Posts: 5212

Help: 446

Rate: 914
Helpful post? (0)

BK7231N CB2S pin mapping and Tuya section offset
Post #8 21006763 16 Mar 2024 18:57

https://github.com/OpenBekenIOT/webapp/pull/85

Added after 3 [minutes]:

AgranBox wrote:
I have another socket, this time on a different chip BK7231T. It had firmware 1.0.7

sure it's a T @AgranBox ? CB2S should be N

AgranBox wrote:
can you analyze this file for a very similar outlet, but it looks a little different?
I ordered this model from this link: https://aliexpress.ru/item/1005002741792619.html
BK7231N_TuyaConfig_obk5533F290.bin https://disk.yandex.ru/d/y33Z7WXCGRuwTg

Code: Text
Log in, to see the code
#9 21006786 16 Mar 2024 19:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14755

Help: 659

Rate: 12880
Helpful post? (+1)

Post #9
21006786 16 Mar 2024 19:10

That's a lot of useful information. I have merged the PR, device should be soon live at:
https://openbekeniot.github.io/webapp/devicesList.html

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#10 21252057 05 Oct 2024 23:47

oelkanne oelkanne

Level 1

Posts: 1
Helpful post? (0)

Post #10
21252057 05 Oct 2024 23:47

Is there a solution for CloudCutter for firmware 1.1.15 in the meantime?
ADVERTISEMENT
#11 21252141 06 Oct 2024 07:07

divadiow divadiow

Level 38

Posts: 5212

Help: 446

Rate: 914
Helpful post? (0)

Post #11
21252141 06 Oct 2024 07:07

>>21252057

No. UART flashing is the only known option if the firmware is patched for Cloudcutter exploit.
#12 21252225 06 Oct 2024 09:14

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Posts: 14755

Help: 659

Rate: 12880
Helpful post? (0)

Post #12
21252225 06 Oct 2024 09:14

Flashing device with CB2S module is very easy via UART:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence (AI)

*I agree to send the question to OpenAI, Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

Listen:

Report a violation of the law

Topic summary

The discussion revolves around the Tuya LSPA2 Wi-Fi Smart Plug, which features independent control for its dual USB ports and utilizes the BK7231N chip. Users share their experiences with firmware installation, specifically OpenBK7231N, and provide insights on device configuration and capabilities. Key commands for setting channel labels for USB ports are discussed, along with the extraction of device configuration data from Tuya. Users also mention issues encountered when switching firmware and provide solutions, including the use of UART for flashing devices with the CB2S module. The conversation highlights the importance of firmware versions and the potential for device automation through scripts.
AI summary based on the discussion. May contain errors.

FAQ

TL;DR: 3 controllable outputs and “independent USB port control” make this Tuya LSPA2 FAQ for users flashing OpenBK7231N on BK7231N/CB2S smart plugs, fixing CloudCutter profile choice, GPIO templates, UF2 conversion, and firmware 1.1.15 UART fallback. [#20616227]

Why it matters: The same LSPA2-style 16A plug appears with different GPIO maps, firmware versions, and CloudCutter results, so the correct template prevents dead-looking outputs.

Alternative	Chip/module	Firmware noted	Flashing route	Key GPIO map
Config Type 1	BK7231N / CB2S	1.1.15	UART if CloudCutter is patched	P7 Rel3, P24 Rel2, P26 Rel1, P8 WiFiLED_n
Config Type 2	BK7231N / CB2S	1.1.8	CloudCutter profile or custom firmware	P6 Rel1, P7 Rel2, P24 Rel0, P26 WiFiLED_n
BSD31-style variant	BK7231T reported	1.0.7	CloudCutter BSD31 profile	Different chip target and firmware image

Key insight: Identify the module, firmware version, and GPIO map before flashing. Firmware 1.1.15 was reported as not suitable for CloudCutter, while CB2S remains straightforward to flash by UART. [#21252141]

Quick Facts

The LSPA2 has 3 controllable outputs in OpenBeken: main Plug, USB1, and USB2, with dual USB ports controlled independently. [#20616227]
Firmware 1.1.8 on BK7231N worked with CloudCutter using the 1.1.8 - BK7231N / oem_bk7231n_plug firmware-name path. [#20616227]
Firmware 1.1.15 on a UK CB2S/BK7231N unit was reported as “no good for Cloudcutter,” so UART was the practical route. [#21006754]
The Tuya schema exposed switch DP IDs 1, 2, and 3, plus countdown IDs 9, 10, and 11 with 0–86400 s ranges. [#21006754]
An example OpenBeken automation used NTP at UTC+3:00, rebooted daily at 07:00, and power-cycled all 3 outputs for 3 s. [#20616609]

How do I flash OpenBK7231N on a Tuya LSPA2 16A smart plug with dual independent USB using tuya-cloudcutter?

Use tuya-cloudcutter on a Raspberry Pi 3 running Raspberry Pi OS.

Put OpenBK7231N_UG_1.17.135.bin in /tuya-cloudcutter/custom-firmware.
Run sudo ./tuya-cloudcutter.sh -r -p "mirabella-genio-i004527-double-plug" -f "OpenBK7231N_UG_1.17.135.bin".
After flashing, join OpenBK7231N_MAC and configure http://192.168.4.1/.
The thread reports that the hack completed on the second pass. [#20616227]

Which tuya-cloudcutter profile should I use for a Tuya LSPA2 smart plug running BK7231N firmware 1.1.8?

Use the firmware-name option 1.1.8 - BK7231N / oem_bk7231n_plug for firmware 1.1.8. The same report also used the mirabella-genio-i004527-double-plug profile with a custom OpenBK7231N 1.17.135 binary. Match the profile to BK7231N, not BK7231T, because the LSPA2 unit used a CB2S module. [#20616227]

Why does the LSPA2 smart plug look dead after flashing OpenBK7231N, and how do I connect to its recovery Wi-Fi page?

It looks dead because the LEDs and buttons may not work before GPIO roles are configured. The device still runs OpenBK7231N after flashing. Connect to the OpenBK7231N_MAC Wi-Fi network, then open http://192.168.4.1/. Configure pins before judging the socket as failed. This failure state appeared immediately after the second CloudCutter pass. [#20616227]

What GPIO pin configuration should I use in OpenBeken for the Tuya LSPA2 BK7231N CB2S smart plug with independently controlled USB ports?

Use the Type 2 map for the first BK7231N/CB2S LSPA2 sample: P6 relay channel 1, P7 relay channel 2, P10 toggle-all button, P24 relay channel 0, and P26 inverted Wi-Fi LED channel 1. Set Flags 1024. The channel labels were Plug on 0, USB1 on 1, and USB2 on 2. [#20616227]

How do I label the Plug, USB1, and USB2 channels in OpenBeken for a Tuya LSPA2 smart plug?

Set OpenBeken channel labels with three commands: setChannelLabel 0 Plug, setChannelLabel 1 USB1, and setChannelLabel 2 USB2. A later UK Type 1 template used setChannelLabel 1 Plug, setChannelLabel 2 USB1, and setChannelLabel 3 USB2, matching relay channels 1–3. Choose labels that match your GPIO template. [#20616566]

What is the CB2S module, and how is it related to the BK7231N chip in Tuya smart plugs?

“CB2S is a Tuya Wi-Fi module that uses the BK7231N chip, providing the radio and MCU platform for these smart-plug firmwares and GPIO relay mappings.” The extracted Tuya configuration identified the LSPA2 device as CB2S, with relays on P7, P6, and P24 in one sample. [#20616594]

What is tuya-cloudcutter, and what does it do when flashing Tuya BK7231 smart devices?

“tuya-cloudcutter is a flashing tool that installs alternative firmware on supported Tuya BK7231 devices without opening the case, using selected device profiles or firmware-version exploits.” In this thread, it installed OpenBK7231N on a BK7231N plug from firmware 1.1.8 using Raspberry Pi OS. [#20616227]

What is OpenBeken or OpenBK7231N, and why would I install it on a Tuya smart plug?

“OpenBeken, also called OpenBK7231N for BK7231N builds, is open firmware that replaces Tuya firmware and exposes local GPIO, channel labels, scripts, Wi-Fi setup, and device templates.” Users installed it to control the 16A plug, USB1, and USB2 independently without relying on stock Tuya behavior. [#20616227]

BK7231N vs BK7231T: which chip is used in Tuya LSPA2 and BSD31-style smart plugs, and why does it matter for flashing?

The discussed LSPA2 samples use CB2S, which means BK7231N, while one BSD31-style socket was reported with BK7231T firmware 1.0.7. Chip type matters because OpenBK7231N and OpenBK7231T use different targets and CloudCutter profiles. One expert questioned the BK7231T report because “CB2S should be N.” [#21006763]

What are the differences between the two OpenBeken template configurations for the Tuya LSPA2 dual USB smart plug?

Type 1 maps relays to P7 channel 3, P24 channel 2, and P26 channel 1, with Wi-Fi LED on P8. Type 2 maps relays to P6 channel 1, P7 channel 2, and P24 channel 0, with Wi-Fi LED on P26. Both use CB2S, BK7231N, Btn_Tgl_All on P10, and Flags 1024. [#21006754]

How can I convert OpenBK7231N firmware to UF2 with ltchiptool for a CB2S-based smart plug?

Run python -m ltchiptool uf2 write -b cb2s -o openbkt.uf2 OpenBK7231N_1.17.135.rbl=device:download. This converts the OpenBK7231N 1.17.135 RBL image into a CB2S UF2 file named openbkt.uf2. The thread reports that the resulting UF2 worked after ESPHome Kickstart caused web-flashing problems. [#20616609]

What should I do when ESPHome Kickstart is installed on a BK7231N device but OpenBK7231N will not flash through the web interface?

Convert the OpenBK7231N RBL firmware to UF2 with ltchiptool, then flash the generated UF2. The reported command used board cb2s and output file openbkt.uf2. The failure case happened after installing ESPHome-Kickstart-v23.04.28_bk7231n_app.ota.ug.bin; no OpenBK7231N firmware installed through the web interface. [#20616609]

How can I create an autoexec.bat in OpenBeken to reboot a Tuya smart plug every day and power-cycle all outputs for 3 seconds?

Create autoexec.bat with NTP, timezone, clock event, and channel handlers. The example starts NTP, sets ntp_timeZoneOfs 3:00, and runs addClockEvent 07:00 0xff 1 reboot. It then turns channels 0, 1, and 2 off, waits delay_s 3, and turns all three back on. This reboots frozen connected devices by cycling power. [#20616609]

What is the current solution for flashing Tuya LSPA2 firmware 1.1.15 when CloudCutter does not work?

Use UART flashing when firmware 1.1.15 is patched against the CloudCutter exploit. A UK CB2S/BK7231N unit with firmware oem_bk7231n_plug:1.1.15 was reported as not working with CloudCutter. Another expert stated that UART flashing is the only known option for patched firmware. [#21252141]

What safety precautions should I take when opening and UART flashing a 16A Tuya LSPA2 mains smart plug with USB ports?

Disconnect the 16A mains plug before opening it, and never attach UART while it is powered from mains. The thread’s device combines a mains socket and 2.1A USB supply, so exposed boards can carry hazardous voltages. Use UART only on the low-voltage module side, identify CB2S pins carefully, and reassemble insulation before load testing. [#21252225]