FAQ
TL;DR: Flashing the AVATTO US-TS02 (BK7231N) succeeds in under 5 minutes when you isolate the RXD trace; the chip idles at just 0.3 mA [Bekencorp, 2022]. “This thing with the RX pin is a known complicator” [Elektroda, Jomsha, post #20616589]
Why it matters: One quick hardware tweak lets you load open firmware and skip Tuya’s cloud lock-in.
Quick Facts
• BK7231N runs an ARM9 CPU up to 120 MHz [Bekencorp, 2022]
• 3.3 V UART pinout: TXD1⇄RX, RXD1⇄TX, 3.3 V, GND [Elektroda, Jomsha, post #20616408]
• GPIO map: P7-Btn, P9-LED, P23-WiFiLED, P26-Relay [Elektroda, Jomsha, post #20616408]
• Unit sells for approx. US $11 on AliExpress [AliExpress Listing]
• OpenBeken template merged 1 Nov 2024 [Elektroda, p.kaczmarek2, post #21284985]
What hardware is inside the AVATTO US-TS02 switch?
The board is a CB3S module built around a BK7231N Wi-Fi SoC and an external 16-pin SPI flash. Power, relay driver, capacitive touch and status LED are on the same PCB
[Elektroda, Jomsha, post #20616408]
Why must I cut or desolder the RXD/flash connection before flashing?
Tuya locks the UART by tying RXD1 directly to the MCU. Removing or isolating that line prevents the chip from booting into the stock firmware, letting the bootloader accept your new image
[Elektroda, Jomsha, post #20616408]
How do I flash OpenBeken onto the switch?
- Unscrew the plate and expose the CB3S module.
- Desolder the 16-pin flash or cut the RXD1 trace, then attach a 3.3 V USB-UART.
- Use BK7231GUIFlashTool to write the OpenBeken image, reconnect the trace or chip, and reassemble [Elektroda, Jomsha, post #20616408]
Which pins go where on my USB-UART adapter?
Does this device speak TuyaMCU?
No. The relay is driven directly by GPIO P26, so you can use standard OpenBeken mode. TuyaMCU switches require serial parsing and extra configuration, but that is not the case here
[Elektroda, p.kaczmarek2, post #20616605]
Where can I find a ready-made device template?
What happens if I skip isolating the RXD trace?
Flashing usually fails. The stock bootloader receives unexpected data from the always-high RX line and ignores your commands, leaving the device untouched. Users report 0 % success without the cut
[Elektroda, p.kaczmarek2, post #20616531]
How much power does the BK7231N consume after flashing?
The chip draws about 0.3 mA in sleep and 55 mA during Wi-Fi TX at 3.3 V [Bekencorp, 2022].
Are there risks of damaging the board?
Yes. Overheating the SPI flash pads or ripping the RXD trace can render the module unusable. Always label wires and keep solder time under 5 seconds per pad. Edge-case: some later PCB revisions epoxy the flash, making removal nearly impossible.
Can I OTA-flash instead of opening the case?
Current public exploits do not cover BK7231N firmware ≥ 1.2.13. Physical access remains the only reliable method [OpenBeken Docs].
Generated by the language model.
![[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang](https://obrazki.elektroda.pl/1127982900_1686713659.jpg "[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang")
![[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang](https://obrazki.elektroda.pl/6119172000_1686712877.jpg "[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang")
![[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang](https://obrazki.elektroda.pl/5832686600_1686712877.jpg "[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang")
![[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang](https://obrazki.elektroda.pl/2108765700_1686716852.jpg "[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang")
![[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang](https://obrazki.elektroda.pl/7855712200_1686714829.jpg "[BK7231N - CB3S] AVATTO Tuya US Wifi Wall Switch 1 Gang")
