[BK7231N / T34 ] Teardown Tuya Generic Wifi Wall Light Switch 3 Gang

Thanks for this thread. I have been successful, too.
This is square 2-gang version.

Good job, but hey, is this Winbond memory chip? What's the purpose of that in the light switch?

WF480RA - 315/433MHz transceiver. It has its own antena on pcb opposite the T34s wifi antena. It seems to be connected to some of the T34 gpios. Haven't traced them. Looks like the device can be controlled by rf remote, but that wasn't mentioned in supplied manual.

Ah, it makes sense, especially with that oscillator nearby... I also had sometimes smart devices coming with RF support unannounced.

>>21111928

Mine did mention RF support on the box, but I have no idea how that was meant to be used.

We will need to add WF480RA support.,

I've had the misfortune of receiving one of these. A challenge for another day perhaps



maybe some traces can be exposed instead of removing the whole chip

Added after 1 [hours] 25 [minutes]:

Couldn't resist starting



Added after 2 [minutes]:

Known as W601 BLE


Added after 9 [minutes]:

divadiow wrote:

Known as W601 BLE

Tying it in nicely with the Bingoelec brand
https://templates.blakadder.com/bingoelec_W601.html
https://www.elektroda.com/rtvforum/topic3974861.html#20911947

Added after 7 [hours] 49 [minutes]:

an educated pin stab for 28 P0/UART2_TXD gives us this boot output





Added after 12 [minutes]:

interesting

At least I see no RT-Thread mentions, so the key should be as usual?

it all looks like standard Tuya. The zipped dump in the first post gives this in Easy Flasher



but the user stuff is still decipherable. maybe a little tweak to Easy Flasher is all that's needed.



I have not progressed to dump/flash my one yet

Added after 2 [hours] 27 [minutes]:

that was a mission. USB-TTL-> sewing needles to reach P11/P10.

dumped and flashed without desoldering.



position of needles from a few angles:





getting the right thickness of needle was key for me. It turned out one of mine was slightly thicker than the other and wasn't making contact. If you can feel the bumps of the legs then you're OK.

Do you have RF Remote? This device should still have RF working I guess. RF is connected to the SOIC chip.

I forgot to mention that I also lifted this pin on the MCU.



it either traces to P1 or P11, not entirely sure. I'll drop it again then see if I can still dump firmware, now I have needles the right thickness.



Added after 2 [minutes]:

p.kaczmarek2 wrote:

Do you have RF Remote? This device should still have RF working I guess. RF is connected to the SOIC chip.

I have 1 RF remote. Not sure of frequency or pulse or whatever. will try it

Added after 50 [minutes]:

sadly none of the remote buttons have an effect. it's one those 4CH Qiachip types



Bought it to try on this https://www.elektroda.com/rtvforum/topic4042000.html

Added after 1 [hours] 39 [minutes]:



The box pix shows 3 buttons, but mine is single gang. The user data json sets these pins on import. I think I'd prefer the red ring show the switch to be off, but in this setup red=on. The red LED seems to be controlled by the MCU, not the T34.



https://github.com/OpenBekenIOT/webapp/pull/125

Added after 1 [hours] 40 [minutes]:

oh look

Hi

just received 4pcs. of 1 Gang Switches and I expected CB2S to be inside but now there is T34



I have 858 hot air gun and used it for replacing damaged USB-C ports and figured out not easy to take care of swiming SMD components.

So far no special tape here to use.

Can you advise if it´s worth givin it a try just using the Air gun for <60 sec. with some flux to desolder T34 but not damaging or displacing other components?
T34 is looking very circled by other components in my case/ for this type of switch.
Thx!

those legs look nicely exposed, unlike some T34s. I'd go with the sewing needle method.

I've just somehow got that switch, nice. Someone must have ordered one for me, do you know anything, @divadiow ? Thank you. I've briefly tested it with my RF remote and it indeed works, procedure is to hold the button and then click RF remote button. There is no audio signal when pairing.

p.kaczmarek2 wrote:

do you know anything, @divadiow ?

I may do

thanks for testing RF.

Thanks again, this may be a good idea for a youtube video. Still, first I need to decide what kind of flashing method would be the best here? Probably just try soldering the tiny wires to the pads... or the needles. I don't think showing the hot air method is a good idea, not many people have access to that kind of equipment.

The T34 legs are so concealed though on these types for soldering, but I guess anything is possible.

divadiow wrote:

... but I guess anything is possible.

Even having a hot air solder station in place, makes me think about using it because many things can go wrong for an inexperienced user.

Don´t want to make any advertisement but I don´t have needle probe jig nor a 3d printer.

Can you say if for the T34 these needel/clamps can work?

https://de.aliexpress.com/item/10050059364367...pcDetailBottomMoreOtherSeller%7Cquery_from%3A

Because based on my picture I can see each pin and have access to it when it´s solderes at the pcb.

I've never used those before.

No particularly special equipment needed if doing Rx/tx with a steady hand with gnd and vcc soldered https://www.elektroda.com/rtvforum/topic4036975-60.html#21117908

Pete0815 wrote:

Can you say if for the T34 these needel/clamps can work?

There is no free part of the legs on a T34 to hook in with anything.
The needle technique from @divadiow would be the way to go.
With the heatgun I would desolder the relay, the big resistor and the two condensators with a soldering iron first. And the clamp bar maybe better as well. Otherwise you have to use a to hight temperature or heat up for a to long time. Results in risk of damage the chip or risk of melting the parts arround.

rufus4 wrote:

Pete0815 wrote:

Can you say if for the T34 these needel/clamps can work?

There is no free part of the legs on a T34 to hook in with anything.
The needle technique from @divadiow would be the way to go.

Thanks. Now also found this topic which is exactly my device.
https://www.elektroda.com/rtvforum/topic4051203.html
VCC and GND are soldered but as expected I´m struggeling to place the needels.
Just when I thought they are in place, I used some glue to hold them in place. So far this did not work and I got red messages in the flashing tool (1.1.6
) or it completly crashed. Guess the needles (RX/TX) are not well positioned but lost some glue on the pcb which is now similar to an isolation

Guess I´ll give the hot air station a try.

I received two of these Tuya 2 gang touch switches with a nasty T34 chip inside recently.
Thanks to the good information on this thread I have openbeken running on it.
Thanks to @johnypean for the template that works on my 2 gang switch even though the board layout is slightly different to his,my board looks exactly like @divadiow 3 gang.
Thanks also to the devs,without this firmware I would be forced to use Chinese servers !
Is there a way to point openbeken to a local NTP server on my network ?
None of my IOT devices have internet access but would like to sync their time with my private NTP server.

I bought a similar one from ali to replace an esp8285 variant and it came with a t34 but i was pretty lucky and the pcb got easy flashing points

flashed it and it works flawlessly , here is the template :

Dave_S wrote:

Is there a way to point openbeken to a local NTP server on my network ?

Of course, you can set any server with ntp_setServer command.
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/docs/commands.md

>>21117908 Hi, i have board most similar lake yours, but different component placement.
In my board the Rx from T34 connected to resistor, so 1 needle is less The 4 pads also have different positions. the 2 of them - VCC and GND, the 2 others come to "unmarked" MCU, that i think served RF encodings touch buttons, and maybe T34 programming.

I think it have be way to program T34 via these pads, at least for production. The chineese guys have to change at least their config for 1,2 or 3 gangs in the switch. I don't belive they program T34 for different configurations before assembly.

Edit:
My board seems exactlly as @dhanushkadx , the pads plased on the buttons side.
I found, that in both modules, my, @dhanushkadx , @CameronDev and @divadiow have pins, that in regular works connected to buttons via some MCU,
the 2 "special" pads, connected to same MCU's legs (in my case the pins 5 and 6 of MCU).
But in some "special" modes, the buttons used P22,P23 that is JTAG TDO and TDI of T34.

@p.kaczmarek2 maybe you know some way to program chip via JTAG? At least, it will be easier to connect to MCU's pins, instead with needles to T34.
And if found way to program via 4 PCB points (i think it JTAG via MCU) it will be exellent.

Other ways it seems Tuya go to produce more smaller and smaller modules with harder to connect to it..

Is any way to found how to use these pins for programming? Or impossible?

Thanks!

>>21135586 Hello

How did you shorten with CEN ? I got the module connected, 3.3 and GND ok, But I can t pass the "reboot device" step, when I disconnect 3.3 from uart the COM3 disappear/ flasher sends an error.

Any help appreciated

What do you mean by "3.3V from UART"? 3.3V pin from UART can't provide enough current, check out our flashing tutorials here:
https://www.youtube.com/@elektrodacom
for example, that one:

Here is a screen capture from this vid:

Thanks for the thread, it has been very helpful.

A few days ago I install tasmota on several wifi smart sockets bought in Aliexpress with ID T34 2132K9RQT X00LHC directly welding according to the information of this thread.



Here the photo of how I did:



It is a very simple device, these are the details to be able to use the relay and the external button:



Thank you very much for the information and for sharing it with everyone. <3

PD: I hope my post is not at the wrong place

Thank you and good job on flashing that!

I've also received this plug and decided to create a separate guide: https://www.elektroda.com/rtvforum/forum51.html

Thank you!!!!

I had not seen it before, everything is very well documented, awesome.

Mine has no consumption chip.