[BK7231N/CB2S/BL0942] LSPA7 Tuya Smart Plug teardown and flashing OpenBeken via UART procedure

electrikphone 3075 4

TL;DR

LSPA7 Tuya smart plug teardown identifies a CB2S module with BK7231N, a BL0942 energy-metering chip, a relay, and a KP3210SG power-supply chip.
Tuya configuration exposes the wiring: button on P6, WiFi LED on P8, and relay on P26, which helps map the UART flashing setup.
Flashing used a CP2102 USB-to-UART adapter and BK7231 GUI Flash Tool, with the adapter powering the CB2S during the entire process.
OpenBeken configuration write succeeded after erasing sector 1904640, and the device now has an OBK config named OpenBK_E2D100031 / obk_E2D100031.
One CB2S pad was broken during disassembly, and the binary backup may still contain SmartLife-linked data that needs stripping.

Generated by the language model.

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Topic author Helpful post? (0)

Post #1
20934148 29 Jan 2024 00:58

Tare down of LSPA7 tuya smart plug.

I purchased 2 of these things, they both lasted about a year before the stopped working. so before knowing about this site i started taking things apart and unfortunately broke a pad off the CB2S (BN7231N) module.
i've gathered all the info i can see the images of various steps along the way.
I have included a few of the programer i used the 'USB to UART Convert and USB to TTL RS485 RS232 3.3v 5v Output 3 Multifunctional Functions USB Serial Adapter Module CP2102' its able to provide enough power for the CB2S through the entire flashing process.
I used BK7231 GUI Flash Tool very easy to use i just spun up a vm of windows to flash the CB2S.
The LSPA7 smart plugs reports current use via the (BL0942) and also had a relay. The only other chip on the board is KP3210SG chip as I think the power supply. maybe 10vdc.

Here is a portion of the flashing process
Spoiler:

Code: text Expand Select all Copy to clipboard
Device configuration, as extracted from Tuya: - Button (channel 1) on P6 - WiFi LED on P8 - Relay (channel 1) on P26 Device seems to be using CB2S module, which is using BK7231N. And the Tuya section starts, as usual, at 2023424 json format { "rl1_lv":"1", "bt1_pin":"6", "net_trig":"2", "jv":"1.0.3", "netled1_lv":"0", "netled_reuse":"0", "bt1_type":"0", "ffc_select":"0", "nety_led":"1", "over_cur":"16000", "bt1_lv":"0", "reset_t":"5", "netled1_pin":"8", "chip_type":"3", "lose_vol":"70", "over_vol":"300", "module":"CB2S", "ch_cddpid1":"9", "ch1_stat":"2", "rl1_type":"0", "ch_num":"1", "ele_fun_en":"1", "rl1_pin":"26", "netn_led":"0", "vol_def":"0", "ch_dpid1":"1", "crc":"29", "}hfX^Agw_dieAmf_test_close":"40.00", "pv":"2.2", "lpv":"3.3", "pk":"<secret>", "firmk":"<secret>", "cadv":"true", "cdv":"1.0.0", "dev_swv":"1.1.7", "s_id":"null", "dtp":"0", "sync":"0", "attr_num":"0", "mst_tp_0":"0", "mst_ver_0":"null", "mst_tp_1":"0", "mst0dAtls_ca_cntpasswd":"<secret>", "md":"0", "random":"0", "wfb64":"1", "stat":"2", "token":"<secret>", "region":"null", "reg_key":"null", "dns_prio":"0^Atimer_arr08Atls_ca_cnt0fBastro_timer{abi", "id":"<secret>", "swv":"1.1.7", "bv":"40.00", "mst_ver_1":"null", "mst_tp_2":"0", "mst_ver_2":"null", "mst_tp_3":"0", "mst_ver_3":"null }<secret>", "mode":"rw", "property":"{type" } (True) success! Going to do erase, start 1904640, sec count 1! Erasing sector 1904640... ok! All selected sectors erased! Now will also write OBK config... Long name from CFG: OpenBK_E2D100031 Short name from CFG: obk_E2D100031 Web Root from CFG: https://openbekeniot.github.io/webapp/ Writing config sector 0x1D1000...Writing file data to chip successs.

I also have the binary backup of the device from the flashing process if any one needs it i may have to strip out some sata as i think it was still linked to my smartlife app.
I hope the all the pictures are good enough ?

Attachments:

IMG_20230708_194053610_HDR.jpg (757.76 KB) You must be logged in to download this attachment.

IMG_20230708_194202743_HDR.jpg (963.21 KB) You must be logged in to download this attachment.

IMG_20230708_194228623_HDR.jpg (916.59 KB) You must be logged in to download this attachment.

IMG_20240108_183518997_HDR.jpg (732.52 KB) You must be logged in to download this attachment.

IMG_20240108_183531465_HDR.jpg (648.26 KB) You must be logged in to download this attachment.

IMG_20240111_014717270.jpg (503.04 KB) You must be logged in to download this attachment.

IMG_20240111_014818700_HDR.jpg (394.33 KB) You must be logged in to download this attachment.

IMG_20240111_014840332_HDR.jpg (470.25 KB) You must be logged in to download this attachment.

IMG_20240111_014858511_HDR.jpg (532.05 KB) You must be logged in to download this attachment.

IMG_20240112_175918551_HDR.jpg (1.38 MB) You must be logged in to download this attachment.

IMG_20240112_184731238_HDR.jpg (739.53 KB) You must be logged in to download this attachment.

IMG_20240112_184940475_HDR.jpg (1.3 MB) You must be logged in to download this attachment.

IMG_20240112_190257779_HDR.jpg (1.07 MB) You must be logged in to download this attachment.

IMG_20240112_185038163_HDR.jpg (1.04 MB) You must be logged in to download this attachment.

IMG_20240112_221135032_HDR.jpg (617.59 KB) You must be logged in to download this attachment.

Cool? Ranking DIY
About Author
electrikphone electrikphone

Level 3
Offline

Joined: 27 Jan 2024

Posts: 8

Points: 29
electrikphone wrote 8 posts with. Been with us since 2024 year.

ADVERTISEMENT
#2 20934177 29 Jan 2024 04:05

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #2
20934177 29 Jan 2024 04:05

Which pad of CB2S is broken, maybe we can fix it?

Judging by the voltage of the relay, I would guess it's using 5V power supply, then it uses LDO to get 3.3V for WiFi module

Here is OBK template:
Code: JSON
Log in, to see the code

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#3 20935758 30 Jan 2024 03:23

electrikphone electrikphone

Level 3

Topic author Helpful post? (0)

Post #3
20935758 30 Jan 2024 03:23

I broke p26 pad off the one for the relay.
The OBK template is missing the details for the BL0942, isn't it?
I did think I could just move the relay in software to p7 as it doesn't look like it gets used, then put it back with a link wire.
ADVERTISEMENT
#4 20936155 30 Jan 2024 12:11

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #4
20936155 30 Jan 2024 12:11

All required BL0942 details are in the template. BL0942 is always on UART1, so there is no need to select GPIO for that. You just need to start the driver.

Yes, you can route relay to P7, it's a good solution.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#5 20936819 30 Jan 2024 18:32

electrikphone electrikphone

Level 3

Topic author Helpful post? (0)

Post #5
20936819 30 Jan 2024 18:32

I used P7 for my relay pin assignment and it worked just fine.
What are the minimum values the BL chip can read?
I am currently running the whole thing from a 5vdc source and I see the 5v on the index page. However, how do I get it to display the current usage?
The load is a 5v water pump running at 0.300 Amps.
What command do I issue as this didn't work?

VoltageSet 0.1, CurrentSet 0.1, PowerSet 0.01
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

FAQ

TL;DR: BL0942 meters 0.5 mA–20 A and "route relay to P7" [Elektroda, p.kaczmarek2, post #20936155] rescues torn-pad plugs; flashing OpenBeken by UART finishes in ~18 s at 115 200 bps [Elektroda, electrikphone, post #20934148]

Why it matters: One USB adapter and two commands restore full local control and energy metering.

Quick Facts

• BK7231N (CB2S) SoC: 120 MHz, 2 MB flash, 256 KB SRAM [BK7231N Datasheet, 2023] • Relay coil: 5 V, ≈70 mA draw [Elektroda, electrikphone, post #20934148] • BL0942 accuracy: ±0.5 % from 0.02 A to 20 A [BL0942 Datasheet, 2021] • Flashing speed used: 115 200 bps UART [Elektroda, electrikphone, post #20934148] • OpenBeken config sector offset: 0x1D1000 (1.9 MB) [Elektroda, code, post #20934148]

1. What ICs are inside the LSPA7 smart plug?

The board carries a CB2S module with BK7231N Wi-Fi SoC, a BL0942 metering chip on UART1, a KP3210SG buck converter for 5 V, and a 5 V relay driver [Elektroda, electrikphone, post #20934148]

2. Which GPIOs control the button, LED and relay?

OpenBeken template maps P6 to Button1, P8 to active-low Wi-Fi LED, and P26 to Relay1 [Elektroda, p.kaczmarek2, post #20934177]

3. Can I flash OpenBeken with only a CP2102 USB-UART adapter?

Yes. The CP2102 supplies 3.3 V and TX/RX lines; the user flashed successfully with BK7231 GUI Flash Tool in a Windows VM using that adapter alone [Elektroda, electrikphone, post #20934148]

4. My P26 pad ripped—how do I still drive the relay?

Reassign Relay1 to an unused pin, e.g., P7, then solder a short wire from P7 to the relay transistor. p.kaczmarek2 confirmed: "route relay to P7" [Elektroda, p.kaczmarek2, post #20936155]

5. Does the template lack BL0942 GPIO settings?

No. BL0942 always talks over UART1, so no explicit GPIO appears. You only need the command startDriver BL0942 in the template [Elektroda, p.kaczmarek2, post #20936155]

6. How do I enable live voltage, current and power readings?

Run startDriver BL0942, then calibrate with VoltageSet , CurrentSet , PowerSet . Data updates on the WebApp automatically [OpenBeken Wiki].

7. What is the smallest load BL0942 can sense accurately?

Datasheet resolution is 0.5 mA; accuracy drops below 20 mA, so a 0.3 A pump is well above the minimum [BL0942 Datasheet, 2021].

8. Why did my VoltageSet 0.1 command fail at 5 V operation?

BL0942 expects line-level mains voltages. For 5 V DC testing, the voltage divider scaling is off by a factor ≈40, so readings saturate near zero. Calibrate with the actual high-side divider or test at 230 V AC [BL0942 Datasheet, 2021].

9. What power rails exist on the PCB?

KP3210SG creates 5 V for the relay; an onboard LDO steps 5 V to 3.3 V for BK7231N. Relay voltage confirms 5 V rail presence [Elektroda, p.kaczmarek2, post #20934177]

10. How long does flashing take?

At 115 200 bps the complete erase and write cycle finished in about 18 s, including one 1904640-byte sector [Elektroda, electrikphone, post #20934148]

11. What happens if I erase the wrong sector?

Erasing 0x0–0x30000 removes the bootloader; the module then boots to an empty ROM and appears dead until re-flashed via ROM-boot mode—pads P7/P8 enter that mode [BK7231N Datasheet, 2023].

12. Three-step relay-reroute How-To

run "setPinRole 7 1" and "setPinChannel 7 1"; reboot.
bridge CB2S pin 7 to relay base pad with 0.1 mm wire.
saveCfg 1. The relay now clicks on GUI command.

13. Can the CP2102 power the plug during calibration?

Yes. Its 5 V output feeds the KP3210SG, which then creates stable rails for tests under 100 mA total draw [Elektroda, electrikphone, post #20934148]

14. Where should I store the binary backup?

Remove unique tokens before sharing; the dump contains SmartLife cloud IDs and keys marked in the log [Elektroda, electrikphone, post #20934148]