logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Flashing Smartlive DS-121 with ltchiptool: Stuck After Firmware Update?

basdelouw78 2037 24
Best answers

Why does my Smartlive DS-121 with a CB3S/BK7231N chip flash successfully with ltchiptool but then not boot or create an access point, and what firmware/flash method should I use instead?

You likely flashed the wrong file: `ltchiptool_bk72xx_2024-11-07_11-42-46_efuse.bin` is an efuse backup, not the main firmware. The CB3S module uses a BK7231N, so the recommended path is to write a full, known-working BK7231N Tuya factory firmware from offset `0x0` to clear whatever state is on the chip, then flash OpenBeken with Easy Flasher / the BK7231GUIFlashTool using the N variant firmware [#21293217][#21293822] Your log shows flashing started at `0x11000`, so the bootloader was probably left intact at that point, but later attempts suggest it may have been overwritten; writing a full firmware from `0x0` is the suggested recovery step [#21293453][#21293530][#21294069] Easy Flasher is the tool meant for BK7231N/T chips and will offer the latest firmware for the selected chip if needed [#21293501] Use a decent external 3.3 V power supply for the module during flashing and avoid relying on the USB programmer’s 3.3 V line, which may brown out when Wi‑Fi starts [#21293609][#21293822] After restoring a working firmware, you should then be able to flash OpenBeken normally and see the device/AP come up [#21293822]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21292970
    basdelouw78
    Level 5  
    Posts: 13
    Hello,

    Not sure how this forum works but hopefully someone can put me in the right direction.

    I've a smartlive DS-121 wifi 4 touch glass touch switch with a cb3s chip on it.

    try to flash firmware ltchiptool_bk72xx_2024-11-07_11-42-46_efuse.bin (think this is the right one?)

    When i try to flash it with ltchiptool v4.11.2 i get:
    D [ 4602.494] ( 0.066s) Connecting
    W [ 4602.583] ( 0.090s) Unknown bootloader CRC - 0xCBC3D235 - please report this on GitHub issues!
    D [ 4602.592] ( 0.009s) Reading 4k page at 0x011000 (0.00%)
    D [ 4602.953] ( 0.361s) BK72xx connected - protocol: FULL, chip: BK7231N, bootloader: None, chip ID: 0x7231c, boot version: None
    D [ 4602.987] ( 0.034s) Trying to unprotect flash memory...
    D [ 4603.003] ( 0.016s) Erasing and writing at 0x11000 (0.00%)
    D [ 4603.003] ( 0.000s) - Checking block pre-erase @ 0x11000
    D [ 4603.019] ( 0.016s) - Trying to erase block @ 0x11000
    D [ 4603.033] ( 0.014s) - Checking block post-erase @ 0x11000
    D [ 4603.049] ( 0.016s) - Erase succeeded @ 0x11000
    D [ 4603.437] ( 0.388s) Erasing and writing at 0x12000 (0.45%)
    D [ 4603.833] ( 0.396s) Erasing and writing at 0x13000 (0.91%)
    D [ 4604.237] ( 0.405s) Erasing and writing at 0x14000 (1.36%)
    D [ 4604.635] ( 0.398s) Erasing and writing at 0x15000 (1.81%)
    D [ 4605.032] ( 0.397s) Erasing and writing at 0x16000 (2.27%)
    D [ 4605.431] ( 0.399s) Erasing and writing at 0x17000 (2.72%)
    D [ 4605.830] ( 0.399s) Erasing and writing at 0x18000 (3.17%)
    D [ 4606.228] ( 0.398s) Erasing and writing at 0x19000 (3.63%)
    D [ 4606.627] ( 0.399s) Erasing and writing at 0x1A000 (4.08%)
    D [ 4607.025] ( 0.398s) Erasing and writing at 0x1B000 (4.53%)
    D [ 4607.427] ( 0.402s) Erasing and writing at 0x1C000 (4.98%)
    D [ 4607.825] ( 0.398s) Erasing and writing at 0x1D000 (5.44%)
    D [ 4608.222] ( 0.396s) Erasing and writing at 0x1E000 (5.89%)
    D [ 4608.621] ( 0.399s) Erasing and writing at 0x1F000 (6.34%)
    D [ 4609.019] ( 0.398s) Erasing and writing at 0x20000 (6.80%)
    D [ 4609.419] ( 0.401s) Erasing and writing at 0x21000 (7.25%)

    and counting

    D [ 4689.817] ( 0.398s) Erasing and writing at 0xEB000 (98.79%)
    D [ 4690.214] ( 0.398s) Erasing and writing at 0xEC000 (99.24%)
    D [ 4690.612] ( 0.397s) Erasing and writing at 0xED000 (99.70%)
    D [ 4691.010] ( 0.399s) Verifying CRC
    W [ 4691.010] ( 0.000s) The current command timeout of 1.0 second(s) is too low for reading 905216 bytes CRC. Increasing to 3 second(s).
    D [ 4693.074] ( 2.064s) OK!
    D [ 4693.082] ( 0.008s) Trying to unprotect flash memory...
    D [ 4693.098] ( 0.016s) Writing unaligned data...
    D [ 4693.149] ( 0.051s) Stopped FlashThread
    D [ 4693.228] ( 0.078s) Started TerminalThread
    D [ 4693.228] ( 0.000s) Terminal opened


    And this is all.

    Not restarting or giving an access point. Only the led of the wifi burns when on power.

    anyone who can put me in the right direction?



    AI: Can you confirm if the firmware file you used is specifically compatible with the Smartlive DS-121 and the CB3S chip?
    not sure

    AI: After the flashing process, did you perform any specific steps to try and restart the device or set up the access point? If so, what were they?
    Yes making a restart and do a power down multiple times
  • ADVERTISEMENT
  • #2 21293217
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    basdelouw78 wrote:
    ltchiptool_bk72xx_2024-11-07_11-42-46_efuse.bin


    This is a backup of the efuse not the main firmware.

    What is your end goal? To be running OpenBeken?
  • #3 21293229
    basdelouw78
    Level 5  
    Posts: 13
    Hello Divadiow,

    Thanks for your reply. I want it to function locally on home assistant.

    Regards Bas
  • ADVERTISEMENT
  • #4 21293338
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    Did you take a full read of the factory firmware to file before writing anything to flash?
  • #5 21293341
    basdelouw78
    Level 5  
    Posts: 13
    >>21293338 nope I don't think so

    Added after 1 [hours] 9 [minutes]:

    divadiow wrote:
    Did you take a full read of the factory firmware to file before writing anything to flash?


    No, i've look again and i cannot find a backup. Is this a problem?
  • Helpful post
    #6 21293453
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    Not necessarily. It looks like your logs show you flashed from 0x11000 so your bootloader is hopefully ok, unless you did other flashing to different addresses.

    Maybe go straight to using Easy Flasher to burn the latest Beken N QIO firmware. See if OpenBeken comes up after that?

    https://github.com/openshwprojects/BK7231GUIFlashTool
  • ADVERTISEMENT
  • #7 21293464
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    Not necessarily. It looks like your logs show you flashed from 0x11000 so your bootloader is hopefully ok, unless you did other flashing to different addresses.

    Maybe go straight to using Easy Flasher to burn the latest Beken N QIO firmware. See if OpenBeken comes up after that?

    https://github.com/openshwprojects/BK7231GUIFlashTool


    ok, can you tell me the firmware to burn with easyflasher?
  • #8 21293481
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    It'll be the N variant of the Beken firmware. Have you seen any of the guides and videos? Starting from the Introduction on Github https://github.com/openshwprojects/OpenBK7231T_App?tab=readme-ov-file#introduction





    Added after 2 [minutes]:

    https://www.elektroda.com/rtvforum/topic4036050.html

    Added after 1 [minutes]:

    divadiow wrote:
    It'll be the N variant of the Beken firmware

    User interface of the BK7231 Easy UART Flasher tool for updating firmware.
  • ADVERTISEMENT
  • #9 21293491
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    It'll be the N variant of the Beken firmware. Have you seen any of the guides and videos? Starting from the Introduction on Github https://github.com/openshwprojects/OpenBK7231T_App?tab=readme-ov-file#introduction





    Added after 2 [minutes]:

    https://www.elektroda.com/rtvforum/topic4036050.html

    Added after 1 [minutes]:

    divadiow wrote:
    It'll be the N variant of the Beken firmware

    User interface of the BK7231 Easy UART Flasher tool for updating firmware.


    Yes I see a lot of videos but not all the chips are the same. I need the n series. That's the version I've burned on the chip as far as I know.

    But do I now need this version burned with espeasyflaser?
  • #10 21293501
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    Your CB3S module will have BK7231N chip on it. Easy Flasher is for Beken N and T chips. Easy Flasher will offer to download the latest firmware for your selected chip if there is not one already downloaded.

    Screenshot of BK7231 Easy UART Flasher program with an open firmware download window.
  • #11 21293511
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    Your CB3S module will have BK7231N chip on it. Easy Flasher is for Beken N and T chips. Easy Flasher will offer to download the latest firmware for your selected chip if there is not one already downloaded.

    Screenshot of BK7231 Easy UART Flasher program with an open firmware download window.


    Ok, sorry wrong reading. I was now looking at espeasy but that isn't working.

    I try again to burn the chip the way you are telling me. I now also have a backup bin. I think it's all burn ok but still no app or any live but the wifi led.

    i attach the backup bin file
    Attachments:
    • readResult_BK7231N_QIO_old_2024-07-11-19-13-51.bin (2 MB) You must be logged in to download this attachment.
  • #12 21293530
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    hmm. that backup doesn't even boot so I guess the bootloader was overwritten with something in previous efforts.
    You could use this to write a new one
    Screenshot of the BK7231 Easy UART Flasher program showing flash configuration options for a chip.
  • #13 21293553
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    hmm. that backup doesn't even boot so I guess the bootloader was overwritten with something in previous efforts.
    You could use this to write a new one
    Screenshot of the BK7231 Easy UART Flasher program showing flash configuration options for a chip.


    Ok, Software says write success with these options but still no live in it.

    I have made a new backup attach
    Attachments:
    • readResult_BK7231N_QIO_last_2024-07-11-19-40-40.bin (2 MB) You must be logged in to download this attachment.
  • #14 21293570
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    that boots into OpenBeken and I see it's got a network it's trying to join. It also goes into safe mode and broadcasts an AP as expected.

    Assuming it has the correct credentials is it not now appearing as a device on your network with an IP address you can browse to?
  • #15 21293585
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    that boots into OpenBeken and I see it's got a network it's trying to join. It also goes into safe mode and broadcasts an AP as expected.

    Assuming it has the correct credentials is it not now appearing as a device on your network with an IP address you can browse to?



    Still no activity. I have desoldered a 16pin ic to get a free tx/rx. is this needed to solder back before its working?
  • #16 21293597
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    I see. That sounds like you've removed the TuyaMCU.

    I guess tho if the module was powered ok then it should boot and broadcast. What if you power-cycle (off, on, off, on etc) 5 times, any OpenBeken access point broadcast?
  • #17 21293604
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    I see. That sounds like you've removed the TuyaMCU.

    I guess tho if the module was powered ok then it should boot and broadcast. What if you power-cycle (off, on, off, on etc) 5 times, any OpenBeken access point broadcast?


    No broadcast at all. I assume that if I can program the device it's also capable to startup without extra power but only the 3.3 volt of the programmer.
  • #18 21293609
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    Ah. Power from the USB programmer is often not enough, especially when the WiFi initialises. It may be browning out and boot looping. This would be seen in the TX2 boot log output.
  • #19 21293617
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    Ah. Power from the USB programmer is often not enough, especially when the WiFi initialises. It may be browning out and boot looping. This would be seen in the TX2 boot log output.


    Now put it back together but no difference.
  • #20 21293618
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    no safe mode AP after power cycling it 5 times?
  • #21 21293619
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    no safe mode AP after power cycling it 5 times?


    Nothing.
  • #22 21293822
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    OK. I think it it was me I'd want to blow away whatever state the firmware is in on the module by writing another (because you do not have the original backed-up) full known-working BK7231N Tuya factory firmware to the device from 0x0 (eg https://www.elektroda.com/rtvforum/topic4028222.html#21293815) then just use Easy Flasher to flash OpenBeken as normal. The module should not be powered from the mains through any of this but a decent external 3.3v PSU - ie not the USB programmer 3v line
  • #23 21293963
    basdelouw78
    Level 5  
    Posts: 13
    divadiow wrote:
    OK. I think it it was me I'd want to blow away whatever state the firmware is in on the module by writing another (because you do not have the original backed-up) full known-working BK7231N Tuya factory firmware to the device from 0x0 (eg https://www.elektroda.com/rtvforum/topic4028222.html#21293815) then just use Easy Flasher to flash OpenBeken as normal. The module should not be powered from the mains through any of this but a decent external 3.3v PSU - ie not the USB programmer 3v line


    Ok so burn your backup on the device must wake it up again. Do i need to change settings in the programmer or just select bk7231n chip and burn the bin file?

    I make a power connection with a external power supply.
  • #24 21294069
    divadiow
    Level 38  
    Posts: 4921
    Help: 430
    Rate: 875
    yes, burn backup from 0x0, no offset and nothing in write length in LT like this
    Screenshot displaying backup settings.
  • #25 21294071
    basdelouw78
    Level 5  
    Posts: 13
    Ok, can you tell me how to write from offset 0x0? Where in the settings do I make that change?
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion revolves around flashing the Smartlive DS-121 touch switch, which utilizes a CB3S chip, using the ltchiptool. The user encountered issues while attempting to flash the firmware, receiving warnings about an unknown bootloader CRC. Responses suggest that the user should first back up the factory firmware before flashing, and if that wasn't done, they should use Easy Flasher to install the latest Beken N QIO firmware. The conversation highlights troubleshooting steps, including ensuring adequate power supply during flashing and the importance of using the correct firmware version for the BK7231N chip. The user is advised to write a known-working factory firmware to restore functionality before attempting to flash OpenBeken again.
Generated by the language model.
Today's popular

FAQ

TL;DR: If your Smartlive DS-121 writes to 99.70% and then only shows the WiFi LED, “this is a backup of the efuse not the main firmware” is the key clue. This FAQ helps BK7231N/CB3S owners recover a switch that flashes in ltchiptool but never boots OpenBeken or exposes an AP. [#21293217]

Why it matters: Using the wrong file, the wrong write start, or weak 3.3V power can leave a BK7231N switch apparently flashed but still unusable on Home Assistant.

Option Best use in this thread Key detail
*_efuse.bin in ltchiptool Backup only Not the main firmware
Easy Flasher / BK7231GUIFlashTool Flashing OpenBeken Choose the BK7231N variant
Full backup or known-working Tuya firmware from 0x0 Recovery Write from 0x0, no offset
USB programmer 3.3V Risky for booting Wi-Fi May brown out during Wi-Fi start
External 3.3V PSU Preferred for recovery More reliable during flash and boot

Key insight: The thread points to a recovery path, not a dead module. First restore a full BK7231N image from 0x0 with stable external 3.3V power, then flash OpenBeken again with Easy Flasher. [#21293822]

Quick Facts

  • The failed ltchiptool session wrote from address 0x11000 to 0xED000, reached 99.70%, then verified CRC over 905216 bytes and raised the timeout from 1.0 s to 3 s before reporting OK!. [#21292970]
  • The CB3S module in this switch uses a BK7231N chip, and the recommended OpenBeken target in Easy Flasher is the N variant, not a T build. [#21293501]
  • The removed interface chip was described as a 16-pin IC and identified as the TuyaMCU, which can free TX/RX access but also changes how the assembled switch behaves. [#21293597]
  • OpenBeken safe mode should appear after power-cycling the device 5 times; in the thread, no AP appeared even after repeated cycling, which pushed the diagnosis toward power or image state. [#21293618]
  • Recovery guidance was specific: use a known-working full BK7231N Tuya image, write it from 0x0, leave write length empty, and power the module from a dedicated external 3.3V PSU instead of the programmer rail. [#21294069]

Why does a Smartlive DS-121 with a CB3S/BK7231N chip get stuck after flashing with ltchiptool and only leave the WiFi LED on?

It usually gets stuck because the wrong file was written or the module is not booting reliably after flash. In this case, the first file used was an efuse.bin, not the main firmware, and later the module still showed no AP or IP. The thread also identified a second failure path: USB programmer power at 3.3V can be too weak when Wi-Fi starts, causing brownout and boot looping while the WiFi LED stays on. [#21293609]

What is the ltchiptool_bk72xx_*_efuse.bin file, and why is it not the main firmware for a BK7231N device?

It is an efuse backup, not the runnable firmware image for the BK7231N application space. The clearest diagnosis in the thread was: “this is a backup of the efuse not the main firmware.” Writing that file does not give a Smartlive DS-121 the code it needs to boot OpenBeken or expose an access point after reset. [#21293217]

How do I flash OpenBeken correctly on a Smartlive DS-121 using Easy Flasher and the BK7231N N variant firmware?

Use Easy Flasher with the BK7231N N variant and let it fetch the latest matching firmware if needed. Do it in 3 steps:
  1. Select the BK7231N chip for the CB3S module.
  2. Let Easy Flasher download the latest firmware if none is present.
  3. Flash OpenBeken normally and then check for the AP or network join. The thread states Easy Flasher supports Beken N and T chips, and CB3S in this switch is BK7231N. [#21293501]

What should I do if I forgot to make a full factory firmware backup before writing to a CB3S module?

Recover with a known-working full BK7231N Tuya firmware, then reflash OpenBeken. The thread says missing the original backup is “not necessarily” fatal, but it removes the easiest restore path. The suggested fix was to write a full BK7231N Tuya factory image from 0x0, because the original factory image for this specific device was no longer available. [#21293822]

How can I tell from ltchiptool logs whether the bootloader on a BK7231N device is still intact?

You infer it from the write start address and later boot behavior. One reply noted that flashing began at 0x11000, so the bootloader was “hopefully ok” unless earlier attempts wrote to other addresses. Later, a backup review suggested the bootloader had in fact been overwritten in previous efforts, which changed the recovery strategy. [#21293453]

Which firmware should be selected in Easy Flasher for a CB3S module based on the BK7231N chip?

Select the BK7231N, or “N,” firmware variant. The thread explicitly says the CB3S module uses a BK7231N chip and that Easy Flasher supports both Beken N and T families. Choosing the N variant matches the hardware in the Smartlive DS-121 and avoids using the wrong image family. [#21293501]

What is TuyaMCU, and how does removing the 16-pin IC affect a Smartlive DS-121 switch during flashing and booting?

“TuyaMCU” is a companion control IC that handles device-side logic and talks to the Wi-Fi module over serial, often through TX/RX lines. In this thread, the removed part was described as a 16-pin IC, and removing it likely freed TX/RX access. The responder still expected the Wi-Fi module to boot and broadcast if it had proper power, so removing TuyaMCU did not fully explain the missing AP. [#21293597]

Why might a BK7231N device flash successfully but fail to create an OpenBeken access point afterward?

Because a successful write does not guarantee a successful boot. In the thread, one backup was later confirmed to boot OpenBeken, try joining a network, and enter safe mode, yet the user still saw no AP. The strongest explanation given was unstable power on the module’s 3.3V rail during Wi-Fi initialization, which can cause repeated resets before the AP becomes visible. [#21293570]

How does USB programmer 3.3V power compare with a dedicated external 3.3V PSU when booting or flashing a CB3S WiFi module?

A dedicated external 3.3V PSU is the safer choice for booting and recovery. The thread warns that USB programmer 3.3V is often not enough, especially when Wi-Fi initializes, and that can trigger brownout and boot looping. The final recovery advice explicitly said not to rely on the programmer 3V line and to use a decent external 3.3V supply instead. [#21293822]

What is OpenBeken safe mode AP, and how is it supposed to appear after power-cycling the device five times?

“OpenBeken safe mode AP” is a fallback wireless access point that the firmware broadcasts after repeated failed boots or forced recovery entry, giving you a direct setup path even when normal Wi-Fi join fails. In this thread, it was expected to appear after 5 off/on cycles. When no AP appeared after those five cycles, the fault was treated as power instability or corrupted firmware state. [#21293618]

How can I use a known-working BK7231N Tuya factory firmware from 0x0 to recover a device before reflashing OpenBeken?

Write the full known-working BK7231N Tuya image from address 0x0, then flash OpenBeken again. Do it in 3 steps:
  1. Load the full backup or known-good factory .bin.
  2. Set the write start to 0x0 with no offset.
  3. After recovery boots, use Easy Flasher for OpenBeken. The thread recommended this because the original factory backup was missing and the module needed a clean full image first. [#21293822]

Where in ltchiptool do I set the write offset to 0x0 and leave write length empty when restoring a full backup bin?

Set the restore to start at 0x0, leave write length blank, and do not add any offset. The thread’s final instruction was explicit: “burn backup from 0x0, no offset and nothing in write length in LT.” That is the exact restore setup the responder recommended for recovering the BK7231N image state. [#21294069]

What does the 'Unknown bootloader CRC' warning in ltchiptool mean on a BK7231N, and when is it a real problem?

It means ltchiptool did not recognize the bootloader CRC, not that flashing automatically failed. In the shown log, the tool still connected in FULL protocol, identified the chip as BK7231N, completed writes to 99.70%, and finished CRC verification with OK!. It becomes a real problem only if later evidence shows the bootloader was overwritten or the device never boots from a valid image. [#21292970]

ltchiptool vs BK7231GUIFlashTool Easy Flasher: which is better for recovering and flashing OpenBeken on BK7231N devices?

Easy Flasher was the preferred tool in this thread for getting OpenBeken onto the BK7231N. ltchiptool was used for raw writing and backup work, but the advice for a stuck Smartlive DS-121 was to “go straight” to Easy Flasher and burn the latest Beken N QIO firmware. That makes Easy Flasher the simpler recovery path after image confusion or bootloader uncertainty. [#21293453]

What troubleshooting steps should I follow when a flashed Smartlive DS-121 does not join Wi-Fi, does not show an IP address, and does not broadcast an AP?

Start with power, then image state, then recovery mode. Do it in 3 steps:
  1. Power the module from a stable external 3.3V PSU, not the USB programmer rail.
  2. Power-cycle it 5 times and check for the OpenBeken safe mode AP.
  3. If nothing appears, restore a full BK7231N image from 0x0 and reflash OpenBeken. The thread also notes an edge case: even when OpenBeken booted in analysis, the device still showed no visible AP locally. [#21293822]
Generated by the language model.
ADVERTISEMENT