BK7231N Flashes Successfully but No AP, Dim Blue LED, No Function After Firmware Restore

philip3 480 11

#1 21718054 12 Oct 2025 17:03

philip3 philip3

Level 2

Post #1

21718054 12 Oct 2025 17:03

Hi,
I tried following this guide https://www.elektroda.com/rtvforum/topic4113539.html
It looked like everything went fine, the flasher reports "success" at every step. However now the unit powers up, the led glows blue, but quite dim, no AP, no function. I tried flashing the original firmware back, unfortunately, same behaviour. I tried with 3.3V directly to the BK7231N, also with external 5V to the regulator of the board, tried different USB-UART adapters, two different PCs, I also tried the older flashing software. Tried multiple times in every combination I could think of.
Any idea what else I can try?
Flasher produced this data when I made a copy of the original firmware.


Device configuration, as extracted from Tuya: 
- Pair/Toggle All Button on P24
- WiFi LED on P8
- TglChannelToggle (channel 1) on P6
- Relay (channel 1) on P26
Device seems to be using CB2S module, which is using BK7231N.
And the Tuya section starts, as usual, at 2023424


{
	"rl1_lv":"1",
	"on_off_cnt":"10",
	"onoff_rst_m":"1",
	"onoff_clear_t":"10",
	"rand_dpid":"42",
	"net_trig":"4",
	"onoff_n":"3",
	"netled1_lv":"0",
	"jv":"102",
	"onoff_rst_type":"2",
	"total_bt_pin":"24",
	"nety_led":"2",
	"total_stat":"2",
	"reset_t":"5",
	"netled1_pin":"8",
	"remote_add_dp":"49",
	"remote_list_dp":"50",
	"net_type":"0",
	"inch_dp":"44",
	"module":"CB2S",
	"ch_cddpid1":"9",
	"onoff1":"6",
	"clean_t":"5",
	"init_conf":"38",
	"zero_select":"0",
	"onoff_type":"0",
	"series_ctrl":"0",
	"total_bt_lv":"0",
	"cyc_dpid":"43",
	"remote_select":"0",
	"ch_num":"1",
	"rl1_pin":"26",
	"netn_led":"2",
	"ch_dpid1":"1",
	"crc":"20"
}

ADVERTISEMENT
#2 21718123 12 Oct 2025 18:01

DeDaMrAz DeDaMrAz

Level 22

Helpful post? (0)

Post #2
21718123 12 Oct 2025 18:01

Plug the device from power, wait couple of seconds and power it back on. Provide more info like a log from flasher maybe.

Confirm CEN pin is not shorted to ground maybe if even your backup is not working.

How are you determining there is no AP?

If you like my work, support me at: https://paypal.me/openshwprojects
ADVERTISEMENT
#3 21718139 12 Oct 2025 18:07

philip3 philip3

Level 2

Topic author Helpful post? (0)

Post #3
21718139 12 Oct 2025 18:07

>>21718054 Hi,
I see that there is no AP by checking on my phone and on my computer for the AP from the firmware, I left the device powered for >30 minutes, still no AP visible in the list of Wi-Fis. I tried powering on/off in various ways (much like you suggest). I will post some logs tomorrow when I am back at the computer, even though it shows "success" at every step, there may be something in it that I did not notice. I will check the CEN pin, that is a good idea, thanks.

#4 21718685 13 Oct 2025 08:22

philip3 philip3

Level 2

Post #4

21718685 13 Oct 2025 08:22

Hi
This is how the Flasher software was setup:

Here are the logs of the firmware flashing:


Starting flash new (no backup)!
Now is: Montag, 13. Oktober 2025 08:17:30.
Flasher mode: BK7231N
Going to open port: COM5.
Serial port open!
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (1500000)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to read encryption key...
Encryption key read done!
Encryption key: 510fb093 a3cbeadc 5993a17e c7adeb03
Reading file firmwares/OpenBK7231N_QIO_1.18.189.bin...
Loaded 1220464 bytes from firmwares/OpenBK7231N_QIO_1.18.189.bin...
Using hack to write QIO - just skip bootloader...
... so bootloader will not be overwritten!
Preparing to write data file to chip - resetting bus and baud...
Getting bus... (now, please do reboot by CEN or by power off/on)
Getting bus success!
Going to set baud rate setting (1500000)!
Will try to read device flash MID (for unprotect N):
Flash MID loaded: 1560EB
Will now search for Flash def in out database...
Flash def found! For: 1560EB
Flash information: mid: 1560EB, icName: TH25Q16HB, manufacturer: TH, szMem: 200000, szSR: 2, cwUnp: 0, cwEnp: 7, cwMsk: 407C, sb: 2, lb: 5, cwdRd: 05-35-FF-FF, cwdWr: 01-FF-FF-FF
Flash size is 2MB
Entering SetProtectState(True)...
sr: 0
sr: 0
final sr: 0
msk: 407c
cw: 0, sb: 2, lb: 5
bfd: 0
SetProtectState(True) success!
Going to do erase, start 69632, sec count 281!
Erasing sector 69632... ok! Erasing sector 73728... ok! Erasing sector 1216512... ok!....<removed>
All selected sectors erased!
Writing sector 0x11000... ok! Writing sector 0x12000... ok! Writing sector 0x13000...<removed>
Starting CRC check for 281 sectors, starting at offset 0x11000
CRC matches 0xBE5EF02C!

NOTE: the OBK config writing is disabled, so not writing anything extra.
Writing file data to chip successs.

ADVERTISEMENT
#5 21719334 13 Oct 2025 19:23

DeDaMrAz DeDaMrAz

Level 22

Helpful post? (0)

Post #5
21719334 13 Oct 2025 19:23

Are you able to get a log from Tx2 pin?

There is 101 ways you can make this operation wrong and there is no way for us to figure out how to help without more information, pictures of the setup, something....

Try to get the log from log port on the back of the module, see TX2 on the picture, be extremely careful and power the device on the bench not from mains power supply for testing!!!

If you like my work, support me at: https://paypal.me/openshwprojects
#6 21720025 14 Oct 2025 14:28

philip3 philip3

Level 2

Topic author Helpful post? (0)

Post #6
21720025 14 Oct 2025 14:28

>>21719334 Thanks for the help! Here are some images of the setup I used:

The adapter I used is this one: https://www.compel.ru/item-pdf/cb37a42a4d51a0ea78da7d18c05d219f/pn/chip45~littleusb.pdf
It uses CP2102, 3.3V RX/TX, and the 5V is coming from VBUS (direct 5V from PC) on the adapter to the 5V on the unit, given 3.3V to the BK chip.
I tried also one other USB/serial converter with FTDI232 chip (being careful with 3.3V/5V).
I have checked CEN, it is not shorted to earth, I tried to read from TX2 when I reset with CEN, but I only get garbage, I tried at 115200 baud (tried other speeds as well).
I can read from the device, and what I read looks plausible, so it seems I can read/write, but it will not start. The blue device in the image is to measure USB power draw, never above 200mA, usually 100mA or less.
#7 21720037 14 Oct 2025 14:48

DeDaMrAz DeDaMrAz

Level 22

Helpful post? (0)

Post #7
21720037 14 Oct 2025 14:48

Normal operating current for that module in AP mode is about 50-80mA (no relay, just module).

Log on TX2 should be @ 115200.

Something is wrong as your backup should work after flashing, do you mind sharing your backup? Be warned if you paired it before it will have some of your data in there!

If you like my work, support me at: https://paypal.me/openshwprojects
#8 21720042 14 Oct 2025 14:58

philip3 philip3

Level 2
Topic author Helpful post? (0)

Post #8
21720042 14 Oct 2025 14:58

>>21720037 This should be it.

Attachments:

readResult_BK7231N_QIO_xxxx_2025-07-10-10-22-36.bin (2 MB) You must be logged in to download this attachment.
ADVERTISEMENT
#9 21720055 14 Oct 2025 15:15

DeDaMrAz DeDaMrAz

Level 22

Helpful post? (0)

Post #9
21720055 14 Oct 2025 15:15

Your backup is working fine for me om my test module

There is something you are missing and I can't figure out what it is.

If you like my work, support me at: https://paypal.me/openshwprojects
#10 21720075 14 Oct 2025 15:30

philip3 philip3

Level 2

Topic author Helpful post? (0)

Post #10
21720075 14 Oct 2025 15:30

>>21720055 OK, that is good to know that I got that part right at least, thanks! If I flash the backup, save it again, it should be identical to the 1st backup, right? I am wondering if I can read OK, but somehow my writing is incorrect for some bytes, just a few bytes incorrectly written would be enough to stop it working.
#11 21720082 14 Oct 2025 15:36

DeDaMrAz DeDaMrAz

Level 22

Helpful post? (0)

Post #11
21720082 14 Oct 2025 15:36

In theory yes, but I believe we are using the same GUITool and if I can writhe your backup and it works on my end.... something on your end is problematic and it's hard to pinpoint what.

Maybe try shorter wires, remove cables after flashing, desolder the module out and try that way....

Still weird that you can't get TX2 log.

If you like my work, support me at: https://paypal.me/openshwprojects
#12 21720157 14 Oct 2025 16:46

philip3 philip3

Level 2

Topic author Helpful post? (0)

Post #12
21720157 14 Oct 2025 16:46

>>21720082 I tried desoldering the module and repeating everything, including your suggestions (check TX2, shorter wires, etc). No change. Looks like I might have fried it after the backup. I will order a few blanks from AliExpress and try my luck again. Tnx!
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply | New topic

Report a violation of the law

Topic summary

✨ A BK7231N-based device using a CB2S module was flashed following a guide, with the flasher reporting success at every step. After flashing, the device powers on with a dim blue LED but does not create a Wi-Fi access point (AP) or function properly. Attempts to restore the original firmware yielded the same issue. Various troubleshooting steps were taken, including powering the device with 3.3V directly to the BK7231N, supplying 5V to the board regulator, using different USB-UART adapters and PCs, and trying older flashing software versions. The user confirmed no AP is visible on multiple devices after extended power-on time. Suggestions include checking the CEN pin for shorts to ground and providing flasher logs for further diagnosis.
Generated by the language model.

FAQ

TL;DR: After flashing a BK7231N/CB2S, no AP plus a dim blue LED often means a boot or wiring issue; AP current is typically 50–80 mA, and “Log on TX2 should be @ 115200.” [Elektroda, DeDaMrAz, post #21720037]

Why it matters: This FAQ helps makers fix "flashes OK but no AP" on BK7231N smart modules, fast.

Typical AP-mode current draw: 50–80 mA (module only, no relay). [Elektroda, DeDaMrAz, post #21720037]
CB2S module uses the BK7231N SoC; Wi‑Fi LED often on P8 by default. [Elektroda, philip3, post #21718054]
UART debug: TX2 at 115200 baud; capture on bench power only. [Elektroda, DeDaMrAz, post #21720037]
Boot enable (CEN) must not be tied to GND; check before troubleshooting. [Elektroda, DeDaMrAz, post #21718123]
Flash device seen in logs: TH25Q16HB, 2 MB, MID 0x1560EB. [Elektroda, philip3, post #21718685]

Quick Facts

Typical AP-mode current draw: 50–80 mA (module only, no relay). [Elektroda, DeDaMrAz, post #21720037]
CB2S module uses the BK7231N SoC; Wi‑Fi LED often on P8 by default. [Elektroda, philip3, post #21718054]
UART debug: TX2 at 115200 baud; capture on bench power only. [Elektroda, DeDaMrAz, post #21720037]
Boot enable (CEN) must not be tied to GND; check before troubleshooting. [Elektroda, DeDaMrAz, post #21718123]
Flash device seen in logs: TH25Q16HB, 2 MB, MID 0x1560EB. [Elektroda, philip3, post #21718685]

Why does my BK7231N flash “success” but show no AP and a dim blue LED?

A successful write can still fail to boot if wiring, power, boot pins, or config are wrong. Check CEN is not grounded, use short UART leads, remove programming wires after flashing, and power the module on the bench. If still no AP after minutes, capture TX2 logs at 115200. [Elektroda, DeDaMrAz, post #21718123]

What current draw should I expect when the module creates its AP?

Expect about 50–80 mA for the module alone in AP mode. Higher current may indicate peripherals; much lower current with a dim LED can indicate a stalled boot. “Log on TX2 should be @ 115200.” [Elektroda, DeDaMrAz, post #21720037]

How do I capture a boot log from TX2 on CB2S/BK7231N?

Use a 3.3 V USB‑UART. Connect GND‑to‑GND, adapter RX‑to‑TX2 pad, and power the module from a bench 3.3–5 V supply (per board). Open your terminal at 115200 8N1 and reset with CEN. “Be extremely careful” and avoid mains during testing. [Elektroda, DeDaMrAz, post #21719334]

Could a bad write corrupt only a few bytes and kill the AP?

Yes. Even a few wrong bytes in firmware or parameters can stop boot. Reflash the backup, then read back and compare files byte‑for‑byte to confirm integrity. Shorter wires and clean power improve reliability during writes. [Elektroda, DeDaMrAz, post #21720082]

My backup works on another module but not mine. What does that imply?

If your backup image boots on a known‑good module, your target hardware is suspect. Damage during handling, ESD, or power mistakes can leave the module unreadable at runtime even if flashing verifies. Consider replacing the module. [Elektroda, DeDaMrAz, post #21720055]

What is the CB2S module and which chip does it use?

CB2S is a Tuya Wi‑Fi module built around the BK7231N SoC. In the shared config, the relay is on P26, button on P24, and Wi‑Fi LED on P8. [Elektroda, philip3, post #21718054]

What flash chip and size does BK7231N report in the logs?

The flasher identified a TH25Q16HB SPI NOR with 2 MB capacity and MID 0x1560EB. Size mismatches or protection bits can block proper writes, so confirm this matches your unit. [Elektroda, philip3, post #21718685]

How long should I wait for the AP SSID to appear after power‑up?

AP SSID should appear shortly after a clean boot. If you waited 30 minutes with no SSID, the device likely failed to boot or remains in a reset state. Check CEN, power, and capture TX2 logs. [Elektroda, philip3, post #21718139]

What is “CEN” and why does it matter here?

CEN is the chip enable/reset pin. If it’s shorted to ground, the SoC stays held in reset and never boots, so no AP appears. Confirm CEN is free and only pulsed for reset during flashing. [Elektroda, DeDaMrAz, post #21718123]

How should I power the board safely while debugging?

Power on the bench using a known, isolated supply. Do not power from mains during serial logging. Keep leads short and remove UART wires after flashing to avoid pin conflicts. “Power the device on the bench.” [Elektroda, DeDaMrAz, post #21719334]

What is “Tuya” in this context?

Here, “Tuya” refers to the original vendor firmware/config that shipped with the device. The user extracted mapping data and backed up this image before flashing. [Elektroda, philip3, post #21718054]

What is OpenBK/OpenBeken in the flasher log?

The image name shows “OpenBK7231N_QIO_1.18.189.bin.” Users commonly replace the stock Tuya firmware with this image on BK7231N modules. It was written while skipping the bootloader area. [Elektroda, philip3, post #21718685]

How do I verify my write actually matched the file? (3‑step check)

Flash the backup image.
Read the entire flash back to a file.
Compare hashes or bytes against the original file; they should match exactly. [Elektroda, philip3, post #21720075]

What UART and power levels should I use with CP2102 or FT232 adapters?

Use 3.3 V for RX/TX. If you feed 5 V, route it only to the board’s 5 V regulator input, not to the SoC. Confirm grounds are common. Avoid long leads and noisy USB ports. [Elektroda, philip3, post #21720025]

My TX2 output looks like garbage characters. What now?

Garbage often means wrong baud or ground issues. Set 115200 baud, verify GND is solid, and shorten leads. If still unreadable, the SoC may not execute code due to damage or bad flash. [Elektroda, philip3, post #21720025]

When should I give up and replace the module?

If CEN checks out, 115200 TX2 shows no readable log, readbacks verify, and your backup boots elsewhere, the module is likely damaged. Replacing the module saves time. [Elektroda, philip3, post #21720157]

Generated by the language model.