logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BK7231N/CB2S] Elworks smart dual socket - teardown, CB2S, BL0937

snusken 3009 10

TL;DR

  • A Tuya-based Elworks dual smart socket with BK7231N/CB2S and BL0937 hardware was opened and prepared for flashing.
  • Flashing the BK7231N required separating the plug part from the PCB to reach 3V3, GND, RX1, TX1, and CEN on the CB2S module.
  • The socket cost about 15 € in Denmark.
  • BK flasher extracted the Tuya parameters from the original firmware and generated a usable JSON script from the “Launch Web application” page.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Bought a Tuya based dual smart socket here in Denmark for approx. 15 €, somewhat the same price as on Aliexpress.

    Double smart socket with front and back views shown in the image.

    Quite easy to separate top and bottom parts with a hobby knife and a small screwdriver:

    Close-up of the interior of a Tuya smart socket with visible electronic circuit components.

    To flash the BK7231N I needed to separate the plug part from PCB in order to reach 3V3, GND, RX1, TX1 and CEN on the CB2S module:

    Connected PCB module of a dual smart socket.

    I used the BK flasher with the following setup:

    Screenshot of BK7231 Easy UART Flasher software during sector 0xD000 writing.

    The flash program was able to extract the Tuya parameters from the original firmware,
    and from the "Launch Web application" page, I got the nice {json} script:

    Code: JSON
    Log in, to see the code

    --.-.-.-.-.--

    Screenshot showing PWM connections configuration with assigned functions.

    Screenshot of the software interface for a dual smart socket.

    Cool? Ranking DIY
    About Author
    snusken
    Level 3  
    Offline 
    snusken wrote 3 posts with rating 5. Been with us since 2024 year.
  • ADVERTISEMENT
  • #2 20948347
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14451
    Help: 650
    Rate: 12431
    Thank you for submitting the template. It seems you've forget about the device model - CLY809M-GE - but I've added it for you.
    Device should be soon live at:
    https://openbekeniot.github.io/webapp/devicesList.html
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #3 21368754
    ChrCphDk
    Level 3  
    Posts: 6
    @snusken I have a Nedis WIFIP141FWT double smart plug, which looks identical to yours when opened, so I'm thinking your work applies, and would like to test it out. Thanks for your write-up.
    Did you have to unsolder the connection to the 230V power-legs? It looks like two big solder spots are locking the PCB onto the power-legs, and hindering the removal of the PCB, or did you just some force to break of the PCB?
    Interior of the Nedis dual smart plug with visible electronic components.
    Best regards
    Chris (a fellow Dane) :)
  • #4 21368780
    snusken
    Level 3  
    Posts: 3
    Rate: 5
    Hello Chris,

    As far as I remember, I used my old 100 W Weller solder gun

    and some solder wick to free the input mains pins from the PCB.

    best regards, Erik ( living place Sønderborg :) )
  • ADVERTISEMENT
  • #5 21369249
    ChrCphDk
    Level 3  
    Posts: 6
    >>21368780
    Thanks. I won't have time today, but hopefully after new years eve :)
  • ADVERTISEMENT
  • #6 21389717
    ChrCphDk
    Level 3  
    Posts: 6
    Hi again.

    When trying to just read out the firmware, using BK7231GUIFlashTool, it starts reading as soon as I trigger CEN for a short perioed, but then, at what seems as a random time later, it hangs, and after a while the tool displays: "Reading failed":

    Screenshot of BK7231 Easy UART Flasher software with Reading failed message visible.

    If I'm very fast to start reading as soon as 3V gets connected I can read more data before it hangs, or so it seems.

    I see some guides also mentioning adding 5V to AMS1117, maybe I missing that, or am I doing some other rookie mistake here?
    Or can anyone help me get a full read, to see everything is good, before attempting any write?

    My USB flasher is: USB TTL converter UART module CH340G 3.3V 5V switch: (aliexpress dot com/item/32668866076.html), and works with Tasmotizer.
  • #7 21389861
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14451
    Help: 650
    Rate: 12431
    Are you sure about that high speed baud setting? Such high speeds never worked reliably for me.
    Helpful post? Buy me a coffee.
  • #8 21389918
    ChrCphDk
    Level 3  
    Posts: 6
    >>21389861
    Thank you for taking your time to answer.
    I tried lowering it to 912600, but then got nothing, and from snuskens image of the flasher, he also had 1500000 set.
    But it might as well be bad soldering on my part.
    First I tried designing a 3D printable jig, but since that didn't work, I soldered directly to the CB2S module's legs, but I'm out of flux and the soldering is questionable. So I think I should fix that first, try at a lower baud rate, before taking up anymore of peoples time on here.
    Just got frustrated that it seemed to work, and then again not, and thought there may be something simple I was missing :)

    Best regards
    Chris
  • #9 21391121
    ChrCphDk
    Level 3  
    Posts: 6
    Took the PCB with me to work, and had a friendly colleague solder some wires on.
    Lowered the baud rate to 921600, but it still stopped half way, but at least it got something.
    Lowered it to 115200, and bingo everything read out nicely:

    Easy UART Flasher program interface displaying reading success messages.

    Will try to write next.

    Added after 1 [hours] 31 [minutes]:

    It's working. Thank you so much for your work @snusken and all involved with OpenBK.
    Another device freed from Tuya!

    @p.kaczmarek2 please add the Nedis WIFIP141FWT double smart plug to the list with a link to this guide
  • #10 21391309
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14451
    Help: 650
    Rate: 12431
    Good job!
    Sure, can you share Nedis template in JSON format, as copied from Web App?
    Helpful post? Buy me a coffee.
  • #11 21391319
    ChrCphDk
    Level 3  
    Posts: 6
    This is from the web-app's Config menu, when accessing the device through: IP/app
    Code: text Expand Select all Copy to clipboard
    {
  "vendor": "Tuya",
  "bDetailed": "0",
  "name": "Full Device Name Here",
  "model": "enter short model name here",
  "chip": "BK7231N",
  "board": "TODO",
  "flags": "0",
  "keywords": [
    "TODO",
    "TODO",
    "TODO"
  ],
  "pins": {
    "6": "Btn_Tgl_All;0",
    "7": "BL0937CF;0",
    "8": "BL0937CF1;0",
    "10": "WifiLED_n;0",
    "23": "BL0937SEL;0",
    "24": "Rel;2",
    "26": "Rel;1"
  },
  "command": "",
  "image": "https://obrazki.elektroda.pl/YOUR_IMAGE.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/topic_YOUR_TOPIC.html"
}


    I have a different JSON from the flashing tool, let me know if that is also of interest.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ A Tuya-based Elworks smart dual socket (model CLY809M-GE) using the BK7231N chip on a CB2S board was disassembled for firmware extraction and flashing. The device was opened by separating the top and bottom parts, and the plug was detached from the PCB to access 3.3V, GND, RX1, TX1, and CEN pins on the CB2S module. Flashing was performed using a BK flasher tool, successfully extracting Tuya parameters and JSON configuration. A similar device, the Nedis WIFIP141FWT double smart plug, shares identical hardware, and users discussed desoldering the 230V power legs to free the PCB. Firmware reading issues were encountered due to high baud rates; lowering the baud rate to 115200 enabled full firmware readout. The USB TTL converter CH340G module was used for flashing. The community confirmed the device's compatibility with OpenBK firmware, enabling freedom from Tuya cloud control. JSON templates for device configuration were shared for integration into the OpenBK web application.
Generated by the language model.
Today's popular

FAQ

TL;DR: At 15 €, this Tuya dual plug can be opened and flashed, and one user confirmed that "115200, and bingo" fixed unstable BK7231N readout. This FAQ helps OpenBK users access CB2S pads, separate the PCB safely, and avoid common CH340G flashing failures on Elworks CLY809M-GE and similar Nedis hardware. [#21391121]

Why it matters: The thread turns a vague teardown into a repeatable flashing path for a mains-powered dual socket with power metering.

Variant or setting What the thread found Practical result
Elworks CLY809M-GE BK7231N + CB2S + BL0937 Working template shared
Nedis WIFIP141FWT Internals looked identical when opened Same method worked
1500000 / 921600 baud Read often started, then hung Unreliable dump
115200 baud Full read completed cleanly Reliable firmware backup

Key insight: Mechanical access was only half the job. Stable wiring and a lower UART speed mattered more than the original 1500000 setting for getting a complete BK7231N readout. [#21391121]

Quick Facts

  • Approximate purchase price was 15 € in Denmark, described as similar to AliExpress pricing for a Tuya-based dual smart socket. [#20946292]
  • The shared Elworks template identified BK7231N as the chip and CB2S as the board, with 7 mapped signals including button, LED, two relays, and three BL0937 lines. [#20946292]
  • Required flashing access points were explicitly listed as 3V3, GND, RX1, TX1, and CEN on the CB2S module. [#20946292]
  • One successful desoldering method used an old 100 W Weller solder gun plus solder wick to free the mains input pins from the PCB. [#21368780]
  • A failing read at 1500000 or 921600 baud became stable at 115200 baud, after better soldering and wire attachment. [#21391121]

How do you open the Elworks Smart Dual Socket CLY809M-GE without damaging the enclosure?

Open it by carefully separating the top and bottom halves with a hobby knife and a small screwdriver. The original teardown described the case as quite easy to split this way. Work around the seam slowly instead of forcing one side, because the goal is to preserve the enclosure before you remove the PCB for flashing access. [#20946292]

What is the CB2S module in this Elworks dual smart socket, and why is it important for flashing OpenBK?

"CB2S is a board module that hosts the BK7231N Wi-Fi chip, exposes the serial flashing connections, and identifies the hardware platform used by the socket." It matters because the shared device template names the board as CB2S, and the flashing points to reach are on that module, not just anywhere on the main PCB. [#20946292]

Which pads or pins on the BK7231N/CB2S board need to be accessed to flash this dual socket with a BK flasher?

You need access to 3V3, GND, RX1, TX1, and CEN on the CB2S module. The teardown author separated the plug section from the PCB specifically to reach those five points. Without those connections, the BK flasher cannot reliably talk to the BK7231N during read or write operations. [#20946292]

What is the BL0937 chip, and how is it used for power metering in Tuya-based dual smart plugs?

"BL0937 is a metering chip that supports power measurement, using dedicated signal lines such as CF, CF1, and SEL to report consumption-related data." In this socket, the template maps BL0937CF to pin 7, BL0937CF1 to pin 8, and BL0937SEL to pin 23, which is why the device is tagged for power metering. [#20946292]

What steps are involved in separating the PCB from the mains plug section on the Elworks or Nedis dual smart plug?

Use a simple 3-step process. 1. Open the enclosure with a hobby knife and small screwdriver. 2. Free the mains input pins from the PCB by desoldering them. 3. Lift the plug section away so you can reach 3V3, GND, RX1, TX1, and CEN on CB2S. A later Nedis owner saw the same locked-in mains pins and followed the same general method. [#21368780]

Which tools worked for desoldering the input mains pins from the PCB, and how was solder wick used in this teardown?

A 100 W Weller solder gun and solder wick worked. The user said he used the solder gun to heat the large mains-pin joints and solder wick to remove solder until the PCB came free. That approach directly addressed the two big solder spots that were holding the board onto the 230 V power legs. [#21368780]

Why does BK7231GUIFlashTool start reading and then hang with a 'Reading failed' message on a BK7231N device?

The thread points to unstable communication, not a confirmed firmware lock. The read started after a short CEN trigger, then stopped at a seemingly random point, and later improved after better wire soldering and a much lower baud rate. That pattern fits marginal serial links, especially when the user called his first direct soldering work questionable. [#21391121]

How does lowering the baud rate from 1500000 or 921600 to 115200 affect BK7231N firmware read reliability?

Lowering the baud rate to 115200 made the read reliable enough to complete. At 921600, the dump still stopped halfway, but at 115200 the user reported, “115200, and bingo everything read out nicely.” In this thread, slower UART speed clearly traded peak transfer rate for a full, stable firmware backup. [#21391121]

What is CEN on the CB2S module, and how is it used to trigger flashing or firmware readout?

"CEN is a control pin that helps start communication with the BK7231N during flashing, because briefly toggling it can trigger the chip to begin a read session." The user said BK7231GUIFlashTool started reading as soon as he triggered CEN for a short period, which confirms it was part of the entry sequence on this board. [#21389717]

Why might a CH340G USB TTL adapter work unreliably at high baud rates when reading a BK7231N smart plug?

The thread shows that the CH340G setup could work, but not reliably at very high speed on this plug. The user used a CH340G 3.3 V/5 V USB TTL adapter, yet reads at 1500000 and 921600 stalled, while 115200 completed. That result suggests the weak point was the high-speed serial link, especially before the wiring was resoldered cleanly. [#21391121]

What differences were found between the Elworks CLY809M-GE template and the Nedis WIFIP141FWT template, especially the relay pin mapping?

The key difference was the relay order. Elworks mapped pin 24 to Rel;1 and pin 26 to Rel;2, while the Nedis web-app template showed pin 24 as Rel;2 and pin 26 as Rel;1. The BL0937 lines, Wi-Fi LED, and button positions otherwise matched the same general CB2S-based layout. [#21391319]

How do you extract Tuya device parameters and generate a JSON template from the original firmware using the BK flasher web application?

Read the original firmware first, then use the BK flasher’s web flow to export the detected settings. The teardown says the flash program extracted Tuya parameters from the stock firmware, and the “Launch Web application” page produced a JSON script containing vendor, model, chip, board, keywords, pins, image, and wiki fields. [#20946292]

What should be checked before writing OpenBK to a BK7231N smart socket if firmware readout only works intermittently?

Check wiring quality and confirm you can complete a full read at a stable baud rate before writing anything. In this case, the user first suspected missing setup details, then improved the soldering with help from a colleague, reduced speed from 921600 to 115200, and only after a clean dump said he would try writing next. [#21391121]

How do BK7231GUIFlashTool and Tasmotizer compare for working with a CH340G USB TTL adapter on Tuya-based plugs?

The thread only confirms different roles, not equal results. The CH340G adapter was said to work with Tasmotizer, while BK7231GUIFlashTool was the tool actually used to read the BK7231N plug and expose the read failures. So, in this discussion, Tasmotizer verified the adapter generally worked, but BK7231GUIFlashTool exposed speed and wiring sensitivity on this hardware. [#21389717]

When flashing a BK7231N device powered through an AMS1117 regulator, what role does supplying 5V to AMS1117 play, and when is it needed?

The thread does not confirm that 5 V to AMS1117 was needed on this socket. One user asked whether missing that step caused failed reads because some guides mention it, but the later fix came from better soldering and reducing the baud rate to 115200. In this specific case, the successful outcome did not depend on a confirmed AMS1117 5 V feed. [#21389717]
Generated by the language model.
ADVERTISEMENT