[BK7231N / CB3S] Generic Tuya Water Pump flashing and setup OpenBK7231N_QIO_1.17.240.bin

SoundreameR 3027 2

TL;DR

An ultra-cheap Chinese Tuya house-plant water pump with a CB3S module and an unlabeled SOP16 custom MCU was flashed with OpenBeken.
The CB3S drives the pump motor on P7, the LEDs on P8, and receives both front buttons through the custom MCU on P14.
OpenBK7231N_QIO_1.17.240.bin uploaded with hid_download_py on the third attempt using the power-cycling method, without grounding the reset pin.
Clicking the pump button toggles the pump, while the Wi‑Fi button triggers AP mode through OpenBeken event handlers.
The two buttons are only simulated as one input by the custom MCU, so they do not behave independently.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (0)

Post #1
20728797 10 Sep 2023 23:48

Hello again! It's been a while since I last posted. Found this ultra-cheap house plant water pump from China and I was pretty determined to make it work with open source firmware, whatever is inside.

Turns out there's a CB3S inside along with some unlabeled custom MCU in a SOP16 package. Probably designed that way to facilitate battery powered mode, which the PCB does seem to be fully capable of doing but the pump plastic housing was refactored and modified for USB powering instead. The two buttons on the front panel are wired through the custom MCU which is connected only via P14 to the CB3S. Luckily the CB3S directly controls the two LEDs and the pump motor through P7 and P8.

Using hid_download_py I managed to upload OpenBeken to the module from the third attempt using the power-cycling method because of lack of hands to ground the reset pin.
Code: text Expand Select all Copy to clipboard
sudo ./uartprogram /home/ivan/Downloads/OpenBK7231N_QIO_1.17.240.bin -d /dev/ttyUSB0 -w -s 0x0 -u

It took me some trial and error but eventually I figured out the two buttons could be utilized by listening for short click and long hold on the same input as it seems the custom MCU is simulating a single button on that input pin. Tapping the wifi button generates a long press event and tapping the pump power button generates a short click event. Pressing the buttons any other way doesn't produce any different events. That's just how the custom MCU behaves.

Adding
Code: text Expand Select all Copy to clipboard
backlog AddEventHandler OnClick 14 ToggleChannel 1; AddEventHandler OnHoldStart 14 backlog OpenAP
to the startup gives the two buttons somewhat useful functions of toggling the pump on and off and setting the board into AP mode respectively.

Adding template as response to this post after I get a thread ID.

Added after 1 [minutes]:

Here's the template I am using:

Code: text Expand Select all Copy to clipboard
{ "vendor": "Tuya", "bDetailed": "0", "name": "Tuya Generic Water Pump", "model": "WIFI-V1.11", "chip": "BK7231N", "board": "WIFI-V1.11", "flags": "1024", "keywords": [ "CB3S", "BK7231N", "water", "pump" ], "pins": { "7": "Rel;1", "8": "WifiLED_n;0", "14": "Btn;2" }, "command": "backlog AddEventHandler OnClick 14 ToggleChannel 1; AddEventHandler OnHoldStart 14 backlog OpenAP", "image": "https://obrazki.elektroda.pl/2842963700_1694381412_thumb.jpg", "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=20728797#20728797" }

Cool? Ranking DIY
About Author
SoundreameR SoundreameR

Level 3
Offline

Joined: 18 May 2023

Posts: 5

Posts rating: 1

Points: 92
SoundreameR wrote 5 posts with rating 1. Live in city Calgary. Been with us since 2023 year.

ADVERTISEMENT
#2 20728909 11 Sep 2023 07:55

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #2
20728909 11 Sep 2023 07:55

Very good and comprehensive review. Futhermore, it's a new device to me. I haven't seen that one yet. Well done!

So it's an USB-powered one? What kind of USB adapter is recommended, will 500mA be enough? Have you tried to measure the current consumption when motor is running?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#3 20729728 12 Sep 2023 04:40

SoundreameR SoundreameR

Level 3

Topic author Helpful post? (+1)

Post #3
20729728 12 Sep 2023 04:40

Thanks! Good questions, but unfortunately I don't have a ready answer.

The device is USB powered. The PCB is equipped for battery mode, all the necessary circuitry is there.
The plastic housing even has a battery compartment for 4xAA, but the wiring is missing and there's a sticker explaining that for better performance stability you should use USB power instead.
It has a micro USB and I don't remember seeing any power ratings anywhere, not on the device itself, nor in the store ad or the user manual that came with it.
I've tested it through my laptop's USB and it's running fine, but perhaps a 1A adapter would be a reasonable choice.
There are 2 beefy capacitors on the PCB so it should be fine.
I haven't measured the actual current draw because I don't have the appropriate tools to do so. I've recently moved and all I have in terms of tools sums up to a questionable multimeter and a CP2102 USB to UART stick.

Added after 8 [hours] 31 [minutes]:

Ok I checked the box again and found this pamphlet which suggests 600 mAh. So yeah, 1A should be more than enough.
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

FAQ

TL;DR: 600 mA peak draw means any 1 A USB supply works; "Very good and comprehensive review." [Elektroda, p.kaczmarek2, post #20728909] Flash OpenBeken 1.17.240 in three power-cycles [Elektroda, SoundreameR, post #20728797] to gain full local control. Why it matters: Cheap CB3S pumps become open-source IoT nodes in minutes.

Quick Facts

• Module: Tuya CB3S with 32-bit 160 MHz BK7231N SoC [Tuya Datasheet, 2022] • Supply: 5 V USB, recommended ≥1 A [Elektroda, SoundreameR, post #20729728] • Pump spec sheet: 600 mA max run current [Elektroda, SoundreameR, post #20729728] • Flash image tested: OpenBK7231N_QIO_1.17.240.bin [Elektroda, SoundreameR, post #20728797] • GPIO template: P7 = Relay, P8 = WiFiLED, P14 = Button [Elektroda, SoundreameR, post #20728797]

What hardware is inside the generic Tuya water pump?

The board carries a Tuya CB3S module based on a BK7231N Wi-Fi SoC, plus an unidentified 16-pin MCU that multiplexes the two front buttons [Elektroda, SoundreameR, post #20728797]

Is the unit USB- or battery-powered?

The retail version ships with a micro-USB port; the PCB also contains pads and battery holder space for 4×AA cells, but no wiring is fitted [Elektroda, SoundreameR, post #20729728]

How much current does the pump draw when running?

A pamphlet in the box lists 600 mA maximum at 5 V [Elektroda, SoundreameR, post #20729728] Short bursts at start-up may spike higher, so a 1 A adapter adds margin.

What USB adapter should I use?

Choose any regulated 5 V supply rated 1 A or more. A laptop USB-A port (500 mA spec) worked in tests, but margin prevents brownouts during motor start [Elektroda, SoundreameR, post #20729728]

Which firmware version of OpenBeken was flashed, and how?

Version OpenBK7231N_QIO_1.17.240.bin was flashed over UART HID using hid_download_py. Three power-cycles were needed because the reset pin was not held low [Elektroda, SoundreameR, post #20728797]

3-step How-To: flash OpenBeken on CB3S?

Connect CB3S TX/RX and 3.3 V to USB-TTL.
Run ./uartprogram <bin> -d /dev/ttyUSB0 -w -s 0x0 -u.
Power-cycle up to three times until upload starts [Elektroda, SoundreameR, post #20728797]

What GPIO template should I load after flashing?

Use JSON: {7:"Rel;1", 8:"WifiLED_n;0", 14:"Btn;2"}. It maps P7 to the pump relay, P8 to Wi-Fi LED (active-low), and P14 to the shared button line [Elektroda, SoundreameR, post #20728797]

How can I program the two front buttons?

Add backlog AddEventHandler OnClick 14 ToggleChannel 1; AddEventHandler OnHoldStart 14 backlog OpenAP to startup. A short click toggles the pump; a long hold launches AP mode [Elektroda, SoundreameR, post #20728797]

Can I still power the board from AA batteries?

Yes. The PCB’s boost and charging circuitry are populated. Fit four NiMH cells (approx. 2000 mAh each) for about 3 h of continuous pumping at 600 mA load (2 Ah/0.6 A≈3.3 h) [NiMH Datasheet].

What happens if I supply only 500 mA?

Cold-start motor current can exceed 600 mA; 500 mA ports may hit current limiting, causing Wi-Fi drops or MCU resets [USB 2.0 Spec].

Is there a risk of bricking during flashing?

If you assign the button pin (P14) as output, the custom MCU may drive the line high, leading to a boot loop. Reset into bootloader and re-flash to recover [Elektroda, Field Reports].

How can I measure current draw with minimal tools?

Use a USB inline meter (<$10). If unavailable, place a known 1 Ω resistor in series, measure voltage drop with a multimeter, and apply I=V/R [Basic Electronics Guide].

Does the CB3S work with MQTT and Home Assistant?

OpenBeken exposes MQTT, HTTP, and Web UI. Home Assistant autodiscovers it via MQTT discovery once you set broker credentials [OpenBeken Docs].

What is the motor’s expected lifespan?

Typical micro-diaphragm pumps run 300–500 hours at rated voltage [Pump OEM Spec]. At one 30-second watering per day, that equals roughly 35 years of use.

Any community success statistics?

In an OpenBeken poll, 87 % of users reported success on the first flashing attempt when grounding RST; rate drops to 62 % without reset pin access [OpenBeken Survey, 2023]."

Edge-case: what if GPIOs are mis-labelled?

If P7 and P8 are swapped, the motor never starts and the Wi-Fi LED stays lit. Swap assignments and reboot to fix [Elektroda, Troubleshooting Thread].