logo elektroda
logo elektroda
X
logo elektroda

[BK7231N/CB2S/BL0942] LSPA7 Tuya Smart Plug teardown and flashing OpenBeken via UART procedure

electrikphone 2385 4
ADVERTISEMENT
  • Tare down of LSPA7 tuya smart plug.

    I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
    i've gathered all the info i can see the images of various steps along the way.
    I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
    I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
    The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.

    Here is a portion of the flashing process
    Spoiler:

    Device configuration, as extracted from Tuya: 
    - Button (channel 1) on P6
    - WiFi LED on P8
    - Relay (channel 1) on P26
    Device seems to be using CB2S module, which is using BK7231N.
    And the Tuya section starts, as usual, at 2023424
    
    
    json format
    {
    	"rl1_lv":"1",
    	"bt1_pin":"6",
    	"net_trig":"2",
    	"jv":"1.0.3",
    	"netled1_lv":"0",
    	"netled_reuse":"0",
    	"bt1_type":"0",
    	"ffc_select":"0",
    	"nety_led":"1",
    	"over_cur":"16000",
    	"bt1_lv":"0",
    	"reset_t":"5",
    	"netled1_pin":"8",
    	"chip_type":"3",
    	"lose_vol":"70",
    	"over_vol":"300",
    	"module":"CB2S",
    	"ch_cddpid1":"9",
    	"ch1_stat":"2",
    	"rl1_type":"0",
    	"ch_num":"1",
    	"ele_fun_en":"1",
    	"rl1_pin":"26",
    	"netn_led":"0",
    	"vol_def":"0",
    	"ch_dpid1":"1",
    	"crc":"29",
    	"}hfX^Agw_dieAmf_test_close":"40.00",
    	"pv":"2.2",
    	"lpv":"3.3",
    	"pk":"<secret>",
    	"firmk":"<secret>",
    	"cadv":"true",
    	"cdv":"1.0.0",
    	"dev_swv":"1.1.7",
    	"s_id":"null",
    	"dtp":"0",
    	"sync":"0",
    	"attr_num":"0",
    	"mst_tp_0":"0",
    	"mst_ver_0":"null",
    	"mst_tp_1":"0",
    	"mst0dAtls_ca_cntpasswd":"<secret>",
    	"md":"0",
    	"random":"0",
    	"wfb64":"1",
    	"stat":"2",
    	"token":"<secret>",
    	"region":"null",
    	"reg_key":"null",
    	"dns_prio":"0^Atimer_arr08Atls_ca_cnt0fBastro_timer{abi",
    	"id":"<secret>",
    	"swv":"1.1.7",
    	"bv":"40.00",
    	"mst_ver_1":"null",
    	"mst_tp_2":"0",
    	"mst_ver_2":"null",
    	"mst_tp_3":"0",
    	"mst_ver_3":"null }<secret>",
    	"mode":"rw",
    	"property":"{type"
    }
    
    (True) success!
    Going to do erase, start 1904640, sec count 1!
    Erasing sector 1904640... ok! 
    All selected sectors erased!
    
    Now will also write OBK config...
    Long name from CFG: OpenBK_E2D100031
    Short name from CFG: obk_E2D100031
    Web Root from CFG: https://openbekeniot.github.io/webapp/
    Writing config sector 0x1D1000...Writing file data to chip successs.


    I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
    I hope the all the pictures are good enough ?

    Cool? Ranking DIY
    About Author
    electrikphone
    Level 3  
    Offline 
    electrikphone wrote 8 posts with. Been with us since 2024 year.
  • ADVERTISEMENT
  • #2 20934177
    p.kaczmarek2
    Moderator Smart Home
    Which pad of CB2S is broken, maybe we can fix it?

    Judging by the voltage of the relay, I would guess it's using 5V power supply, then it uses LDO to get 3.3V for WiFi module

    Here is OBK template:
    Code: JSON
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 20935758
    electrikphone
    Level 3  

    I broke p26 pad off :-( the one for the relay.
    The OBK template is missing the details for the BL0942, isn't it?
    I did think I could just move the relay in software to p7 as it doesn't look like it gets used, then put it back with a link wire.
  • ADVERTISEMENT
  • #4 20936155
    p.kaczmarek2
    Moderator Smart Home
    All required BL0942 details are in the template. BL0942 is always on UART1, so there is no need to select GPIO for that. You just need to start the driver.

    Yes, you can route relay to P7, it's a good solution.
    Helpful post? Buy me a coffee.
  • #5 20936819
    electrikphone
    Level 3  

    I used P7 for my relay pin assignment and it worked just fine.
    What are the minimum values the BL chip can read?
    I am currently running the whole thing from a 5vdc source and I see the 5v on the index page. However, how do I get it to display the current usage?
    The load is a 5v water pump running at 0.300 Amps.
    What command do I issue as this didn't work?

    VoltageSet 0.1, CurrentSet 0.1, PowerSet 0.01

    Screenshot of a user interface displaying electrical parameters such as frequency, voltage, current, power, and energy data.
ADVERTISEMENT