[TG7100C][BL602] Amysen YX-WS01 Smart Plug Teardown

davidcpurdy 31 Dec 2023 15:52 13 6027 Cool? (+4)

📢 Listen (AI):

TL;DR

Amysen YX-WS01 smart plug teardown, FCC ID 2AOT8-WS01, uses module YX-X3-T71C-VER03 with a TG7100C Wi‑Fi chip.
The TG7100C is identified as a BL602 clone, which explains why the plug was neither ESP8266- nor BK7321-based.
The plug was bought in Nov 2022 via Amazon.com, and the firmware dump shows AliOS Things with board tg7100cevb.
Attempting AP mode produced no joy, but removing the module and flashing over UART with Bouffalo Lab Dev Cube and FTDI worked.

Generated by the language model.

Amysen YX-WS01, FCC ID 2AOT8-WS01, module YX-X3-T71C-VER03, chip TG7100C (a clone of the BL602)

I purchased these in Nov 2022 via Amazon.com in the US, hoping that they'd be Cloud-Cuttable, but was quickly discouraged after opening one up - the chipset was neither ESP8266 nor BK7321... and I did try to get it to go into AP mode, but no joy there. Upon closer examination, I found the chip on the Wifi module was labeled "TG7100C".

(Note that at least five different vendors (Esicoo, Ecoey, Amysen, Tuya, Unbranded, etc.) have sold smart plugs labeled YX-WS01, but both the firmware and chipset has changed over the years. The original version was easily convertible to Tasmota and/or Tuya, then some lockdowns due to firmware changes, and then came chipset change(s).
Amysen YX-WS01 smart plug and its packaging

After some digging [ https://twitter.com/madushan1000/status/1367041198851035137 ] it seems that the TG7100C is just a clone of the BL602. Evidence is in the SDK [ https://github.com/Ai-Thinker-Open/Ai-Thinker...vice_tree/chip_factory_params_IoTKitA_24M.dts ], for instance.

/dts-v1/;
/include/ "bl602_base.dtsi";
// version: 17
// last_comp_version: 16
// boot_cpuid_phys: 0x0

/ {
    model = "bl bl602 IOT board";
    compatible = "bl,bl602-sample", "bl,bl602-common";
    #address-cells = <0x1>;
    #size-cells = <0x1>;
    gpio {
        #address-cells = <1>;
        #size-cells = <1>;
        max_num = <40>;
        gpio0 {                                  
            status = "okay";                     
            pin  = <5>;                          
            feature = "led";                     
            active = "Hi"; //Hi or Lo
            mode = "blink"; //blink or hearbeat
            time = <100>; //duration for this mode
        };
        gpio1 {                                  
            status = "disable";                     
            pin  = <6>;                          
            feature = "led";                     
            active = "Hi"; //Hi or Lo
            mode = "blink"; //blink or hearbeat
            time = <100>; //duration for this mode
        };
        gpio2 {
            status = "okay";
            pin = <2>;
            feature = "button";
            active = "Hi";
            mode = "multipress";
            button {
                debounce = <10>;
                short_press_ms {
                    start = <100>;
                    end = <3000>;
                    kevent = <2>;
                };
                long_press_ms {
                    start = <6000>;
                    end = <10000>;
                    kevent = <3>;
                };
                longlong_press_ms {
                    start = <15000>;
                    kevent = <4>;
                };
                trig_level = "Hi";
            };
            hbn_use = "disable";
        };
    };
    i2s {
        #address-cells = <1>;
        #size-cells = <1>;
        i2s@40017000 {
            status = "okay";
            compatible = "bl602_i2s";
            reg = <0x40017000 0x100>;
            mclk_only = "okay";
            pin {
                mclk = <11>;
            };
        };
        i2s@40017100 {
            status = "okay";
            compatible = "bl602_i2s";
            reg = <0x40017100 0x100>;
            mclk_only = "disable";
            pin {
                bclk = <12>;
                fs = <29>;
                do = <30>;
                di = <31>;
            };
        };
    };
    i2c {
        #address-cells = <1>;
        #size-cells = <1>;
        i2c@40011000 {
            status = "okay";
            compatible = "bl602_i2c";
            reg = <0x40011000 0x100>;
            pin {
                scl = <32>;
                sda = <13>;
            };
            devices {
                list_addr = <0x18 0x21>;
                list_driver = "i2c_es8311", "i2c_gc0308>";
            };
        };
        i2c@40011100 {
            status = "disable";
            compatible = "bl602_i2c";
            reg = <0x40011100 0x100>;
            pin {
                /*empty here*/
            };
        };
    };
    timer {
        #address-cells = <1>;
        #size-cells = <1>;
        timer@40014000 {
            status = "disable";
            compatible = "bl602_timer";
            reg = <0x40014000 0x100>;
        };
        timer@40014100 {
            status = "disable";
            compatible = "bl602_timer";
            reg = <0x40014100 0x100>;
        };
    };
    pwm {
        #address-cells = <1>;
        #size-cells = <1>;
        pwm@4000A420 {
            status = "okay";
            compatible = "bl602_pwm";
            reg = <0x4000A420 0x20>;
            path = "/dev/pwm0";
            id = <0>;
            pin = <0>;
            freq = <800000>;
            duty = <50>;
        };
        pwm@4000A440 {
            status = "disable";
            reg = <0x4000A440 0x20>;
            path = "/dev/pwm1";
            id = <1>;
            pin = <1>;
            freq = <5000>;
            duty = <50>;
        };
        pwm@4000A460 {
            status = "disable";
            reg = <0x4000A460 0x20>;
            path = "/dev/pwm2";
            id = <2>;
            pin = <2>;
            freq = <5000>;
            duty = <50>;
        };
        pwm@4000A480 {
            status = "disable";
            reg = <0x4000A480 0x20>;
            path = "/dev/pwm3";
            id = <3>;
            pin = <3>;
            freq = <5000>;
            duty = <50>;
        };
        pwm@4000A4A0 {
            status = "disable";
            reg = <0x4000A4A0 0x20>;
            path = "/dev/pwm4";
            id = <4>;
            pin = <4>;
            freq = <5000>;
            duty = <50>;
        };
    };
    ir {
        #address-cells = <1>;
        #size-cells = <1>;
        ctrltype = <0>;
        tx {
            status = "disable";
            pin = <11>;         // only support 11
            mode = "NEC";       // NEC,ExtenedNEC,RC5,SWM
            interval = <100>;   // ms
            active_mode = "Hi"; //Hi,Lo
        };
        rx {
            status = "okay";
            pin = <12>;         // only support 12 13
            mode = "NEC";       // NEC,ExtenedNEC,RC5,SWM
            active_mode = "Hi"; //Hi,Lo
            data_check = <2>;   //bit 0:check cmd, bit 1:check addr
        };
    };
    uart {
        #address-cells = <1>;
        #size-cells = <1>;
        uart@4000A000 {
            status = "okay";
            id = <0>;
            compatible = "bl602_uart";
            path = "/dev/ttyS0";
            baudrate = <2000000>;
            pin {
                rx = <7>;
                tx = <16>;
            };
            buf_size {
                rx_size = <512>;
                tx_size = <512>;
            };
            feature {
                tx = "okay";
                rx = "okay";
                cts = "disable";
                rts = "disable";
            };
        };
        uart@4000A100 {
            status = "okay";
            id = <1>;
            compatible = "bl602_uart";
            path = "/dev/ttyS1";
            baudrate = <115200>;
            pin {
                rx = <3>;
                tx = <4>;
            };
            buf_size {
                rx_size = <512>;
                tx_size = <512>;
            };
            feature {
                tx = "okay";
                rx = "okay";
                cts = "disable";
                rts = "disable";
            };
        };
    };
    spi {
        #address-cells = <1>;
        #size-cells = <1>;
        spi@4000F000 {
            status = "okay";         /* okay disable */
            mode = "master";
            reg = <0x4000F000 0x100>;   /* 4KB */
            path = "/dev/spi0";
            port = <0>;
            polar_phase = <1>;                 /* 0,1,2,3 */
            freq = <6000000>;
            pin {
                clk = <3>;
                cs = <2>;
                mosi = <1>;
                miso = <0>;
            };
            dma_cfg {
                tx_dma_ch = <2>;
                rx_dma_ch = <3>;
            };
        };
    };
    gpip {
        #address-cells = <1>;
        #size-cells = <1>;
        adc_key {
            status = "disable";
            pin = <9>;
            interrupt  = <3>;
            key_vol = <0 100 400 300 500>;
            key_pcb = "SW1", "SW2", "SW3", "SW4","SW5";
            key_event = "Usr1", "Usr2", "Start", "Up", "Down";
            key_raw = <1 2 3 4 5>;
        };
    };
    qspi {
        #address-cells = <1>;
        #size-cells = <1>;
        qspi@4000A000 {
            status = "disable";
            reg = <0x4000A000 0x1000>;/* 4KB */
        };
    };
    wifi {
        #address-cells = <1>;
        #size-cells = <1>;
        region {
            country_code = <86>;
        };
        mac {
            mode = "MBF";
            sta_mac_addr = [C8 43 57 82 73 40];
            ap_mac_addr = [C8 43 57 82 73 02];
        };
        sta {
            ssid = "yourssid";
            pwd = "yourapssword";
            auto_connect_enable = <0>;
        };
        ap {
            ssid = "bl_test_005";
            pwd = "12345678";
            ap_channel = <11>;
            auto_chan_detect = "disable";
        };
        brd_rf {
            xtal_mode = "MF";
            xtal = <36 36 0 60 60>;
            /*
            pwr_table = <   4 3 3 186
                            4 3 4 176
                            4 3 5 167
                            3 3 0 159
                            3 3 1 149
                            3 3 2 140
                            3 3 3 129
                            3 3 4 119
                            3 3 5 110
                            2 3 0 101
                            2 3 1 91
                            2 3 2 82
                            2 3 3 72
                            2 3 4 62
                            2 3 5 52
                            1 3 3 10>;
            */
            pwr_mode = "bf";//B: only use power offset in EFUSE; b: use power offset in EFUSE with incremental mode; F: only use power offset in Flash; f: use power offset in Flash with incremental mode
            pwr_table_11b = <20 20 20 18>;//1Mbps 2Mbps 5.5Mbps 11Mbps
            pwr_table_11g = <18 18 18 18 18 18 14 14>; //6Mbps 9Mbps 12Mbps 18MBps 24Mbps 36Mbps 48Mbps 54Mbps
            pwr_table_11n = <18 18 18 18 18 16 14 14>; //MCS0 MCS1 MCS2 MCS3 MCS4 MCS5 MCS6 MCS7
            pwr_offset = <10 10 10 10 10 10 10 10 10 10 10 10 10 10>;//due to the limit of current DTC, negative value is used. So we work around by adding all the poweroffset with 10. so 8 represents -2; 10 represents 0; 13 represents 3
        };
        rf_temp {
            en_tcal = <0>;
            linear_or_follow = <1>;
            Tchannels       = <2412 2427 2442 2457 2472>;
            Tchannel_os     = <180  168  163  160  157>;
            Tchannel_os_low = <199  186  170  165  160>;
            Troom_os        = <255>;
            //negative value is NOT supported. So we use '256' for 0, '255' for -1, '257' for 1,'511' for 256
        };
    };
    bluetooth {
        #address-cells = <1>;
        #size-cells = <1>;
        brd_rf {
            pwr_table_ble = <13>;  //range:-3~15dbm; if set -3, please set 253 here
        };
    };
};

In order to flash it, I had to do a teardown and solder/connect it via UART/serial, Bouffalo Labs flasher.

==========================================================

After removing module, connecting it via Bouffalo Lab Dev Cube w/ FTDI USB adapter:

[00:14:07.525] - serial type is general
[00:14:07.580] - Open COM3 Success
[00:14:14.238] - start-----------hal
[00:14:14.242] - [MTD] >>>>>> Hanlde info Dump >>>>>>
[00:14:14.245] -       name PARAM2
[00:14:14.247] -       id 0
[00:14:14.250] -       offset 001fc000(2080768)
[00:14:14.253] -       size 00002000(8Kbytes)
[00:14:14.256] -       xip_addr 00000000
[00:14:14.259] - [MTD] <<<<<< Hanlde info End <<<<<<
[00:14:14.261] - Read slot:0
[00:14:14.264] - No written slot found
[00:14:14.266] - [BL] [SEC] TRNG Handler
[00:14:14.310] - 1th channel,lo_vco_freq_cw=146
[00:14:14.312] - 2th channel,lo_vco_freq_cw=145
[00:14:14.315] - 3th channel,lo_vco_freq_cw=144
[00:14:14.319] - 4th channel,lo_vco_freq_cw=142
[00:14:14.322] - 5th channel,lo_vco_freq_cw=141
[00:14:14.324] - 6th channel,lo_vco_freq_cw=140
[00:14:14.327] - 7th channel,lo_vco_freq_cw=139
[00:14:14.330] - 8th channel,lo_vco_freq_cw=138
[00:14:14.333] - 9th channel,lo_vco_freq_cw=136
[00:14:14.336] - 10th channel,lo_vco_freq_cw=135
[00:14:14.338] - 11th channel,lo_vco_freq_cw=134
[00:14:14.345] - 12th channel,lo_vco_freq_cw=133
[00:14:14.347] - 13th channel,lo_vco_freq_cw=132
[00:14:14.352] - 14th channel,lo_vco_freq_cw=130
[00:14:14.355] - 15th channel,lo_vco_freq_cw=129
[00:14:14.359] - 16th channel,lo_vco_freq_cw=128
[00:14:14.363] - 17th channel,lo_vco_freq_cw=127
[00:14:14.366] - 18th channel,lo_vco_freq_cw=126
[00:14:14.369] - 19th channel,lo_vco_freq_cw=124
[00:14:14.374] - 20th channel,lo_vco_freq_cw=123
[00:14:14.377] - 21th channel,lo_vco_freq_cw=122
[00:14:14.381] - 0th channel,vco_idac_cw=10
[00:14:14.383] - 1th channel,vco_idac_cw=10
[00:14:14.386] - 2th channel,vco_idac_cw=10
[00:14:14.391] - 3th channel,vco_idac_cw=9
[00:14:14.393] - 4th channel,vco_idac_cw=9
[00:14:14.395] - 5th channel,vco_idac_cw=9
[00:14:14.399] - 6th channel,vco_idac_cw=9
[00:14:14.402] - 7th channel,vco_idac_cw=9
[00:14:14.404] - 8th channel,vco_idac_cw=9
[00:14:14.409] - 9th channel,vco_idac_cw=9
[00:14:14.411] - 10th channel,vco_idac_cw=9
[00:14:14.415] - 11th channel,vco_idac_cw=9
[00:14:14.417] - 12th channel,vco_idac_cw=9
[00:14:14.420] - 13th channel,vco_idac_cw=9
[00:14:14.425] - 14th channel,vco_idac_cw=9
[00:14:14.426] - 15th channel,vco_idac_cw=9
[00:14:14.430] - 16th channel,vco_idac_cw=7
[00:14:14.433] - 17th channel,vco_idac_cw=7
[00:14:14.435] - 18th channel,vco_idac_cw=9
[00:14:14.440] - 19th channel,vco_idac_cw=8
[00:14:14.442] - 20th channel,vco_idac_cw=8
[00:14:14.444] - LO locked 9 135
[00:14:14.447] - rosdac_i_gc3=25
[00:14:14.449] - rosdac_i_gc2=25
[00:14:14.451] - rosdac_i_gc1=25
[00:14:14.456] - rosdac_i_gc0=25
[00:14:14.457] - rosdac_q_gc3=36
[00:14:14.458] - rosdac_q_gc2=36
[00:14:14.460] - rosdac_q_gc1=36
[00:14:14.464] - rosdac_q_gc0=36
[00:14:14.468] - rbb_cap1_fc_i=26,rbb_cap2_fc_i=26,rbb_cap1_fc_q=26,rbb_cap2_fc_q=26
[00:14:14.475] - new rbb_cap1_fc_i=50,rbb_cap2_fc_i=50,rbb_cap1_fc_q=50,rbb_cap2_fc_q=50
[00:14:14.477] - LO locked 9 135
[00:14:14.481] - amp=128,step=32,adc_mean_i=40
[00:14:14.483] - amp=160,step=16,adc_mean_i=61
[00:14:14.485] - amp=176,step=8,adc_mean_i=72
[00:14:14.490] - amp=184,step=4,adc_mean_i=77
[00:14:14.492] - amp=188,step=2,adc_mean_i=80
[00:14:14.495] - amp=190,step=1,adc_mean_i=82
[00:14:14.500] - amp=191,step=0,adc_mean_i=82
[00:14:14.504] - tmx_cs=0, tmxcs_pwr_avg=27251, tmxcs_pwr_avg>>10=26
[00:14:14.509] - tmx_cs=1, tmxcs_pwr_avg=35585, tmxcs_pwr_avg>>10=34
[00:14:14.513] - tmx_cs=2, tmxcs_pwr_avg=46982, tmxcs_pwr_avg>>10=45
[00:14:14.519] - tmx_cs=3, tmxcs_pwr_avg=60930, tmxcs_pwr_avg>>10=59
[00:14:14.523] - tmx_cs=4, tmxcs_pwr_avg=76030, tmxcs_pwr_avg>>10=74
[00:14:14.527] - tmx_cs=5, tmxcs_pwr_avg=83497, tmxcs_pwr_avg>>10=81
[00:14:14.533] - tmx_cs=6, tmxcs_pwr_avg=78475, tmxcs_pwr_avg>>10=76
[00:14:14.536] - tmx_cs=7, tmxcs_pwr_avg=64380, tmxcs_pwr_avg>>10=62
[00:14:14.543] - tmx_cs_max=5, tmxcs_pwr_max=83497, tmxcs_pwr_max>>10=81
[00:14:14.546] - amp=256,step=64,adc_mean_i=-165
[00:14:14.550] - amp=320,step=32,adc_mean_i=-72
[00:14:14.553] - amp=352,step=16,adc_mean_i=-21
[00:14:14.555] - amp=368,step=8,adc_mean_i=2
[00:14:14.557] - amp=376,step=4,adc_mean_i=15
[00:14:14.563] - amp=380,step=2,adc_mean_i=22
[00:14:14.564] - amp=382,step=1,adc_mean_i=23
[00:14:14.566] - amp=383,step=0,adc_mean_i=27
[00:14:14.572] - tosdac_i=28,tosdac_q=38,tx_iq_gain_comp=1013,tx_iq_phase_comp=-6
[00:14:14.575] - amp=256,step=64,adc_mean_i=31
[00:14:14.578] - amp=320,step=32,adc_mean_i=91
[00:14:14.583] - amp=352,step=16,adc_mean_i=123
[00:14:14.586] - amp=368,step=8,adc_mean_i=141
[00:14:14.588] - amp=376,step=4,adc_mean_i=149
[00:14:14.591] - amp=380,step=2,adc_mean_i=153
[00:14:14.597] - amp=382,step=1,adc_mean_i=156
[00:14:14.599] - amp=383,step=0,adc_mean_i=156
[00:14:14.606] - tosdac_i=29,tosdac_q=39,tx_iq_gain_comp=1016,tx_iq_phase_comp=-2
[00:14:14.610] - amp=256,step=64,adc_mean_i=87
[00:14:14.614] - amp=320,step=32,adc_mean_i=130
[00:14:14.616] - amp=352,step=16,adc_mean_i=154
[00:14:14.621] - amp=368,step=8,adc_mean_i=166
[00:14:14.624] - amp=376,step=4,adc_mean_i=172
[00:14:14.626] - amp=380,step=2,adc_mean_i=176
[00:14:14.632] - amp=382,step=1,adc_mean_i=177
[00:14:14.635] - amp=383,step=0,adc_mean_i=178
[00:14:14.642] - tosdac_i=25,tosdac_q=44,tx_iq_gain_comp=1004,tx_iq_phase_comp=3
[00:14:14.645] - amp=272,step=68,adc_mean_i=40
[00:14:14.649] - amp=340,step=34,adc_mean_i=137
[00:14:14.651] - amp=374,step=17,adc_mean_i=190
[00:14:14.656] - amp=391,step=8,adc_mean_i=218
[00:14:14.661] - tosdac_i=24,tosdac_q=40,tx_iq_gain_comp=1004,tx_iq_phase_comp=-1
[00:14:14.665] - amp=224,step=56,adc_mean_i=132
[00:14:14.667] - amp=280,step=28,adc_mean_i=195
[00:14:14.672] - tosdac_i=23,tosdac_q=37,tx_iq_gain_comp=1000,tx_iq_phase_comp=6
[00:14:14.677] - amp=272,step=68,adc_mean_i=140
[00:14:14.679] - amp=340,step=34,adc_mean_i=205
[00:14:14.682] - tosdac_i=20,tosdac_q=37,tx_iq_gain_comp=990,tx_iq_phase_comp=4
[00:14:14.688] - amp=288,step=72,adc_mean_i=130
[00:14:14.692] - amp=360,step=36,adc_mean_i=191
[00:14:14.695] - amp=396,step=18,adc_mean_i=223
[00:14:14.699] - tosdac_i=28,tosdac_q=42,tx_iq_gain_comp=992,tx_iq_phase_comp=-1
[00:14:14.705] - amp=304,step=76,adc_mean_i=142
[00:14:14.708] - amp=380,step=38,adc_mean_i=208
[00:14:14.714] - tosdac_i=29,tosdac_q=40,tx_iq_gain_comp=994,tx_iq_phase_comp=5
[00:14:14.718] - [WF] [KEY] [CFG] nVAP is 2, endidx 10, startidx 8
[00:14:14.725] - ------ set default key 4201cf08, key ptr 00000000
[00:14:14.728] - ------ set default key 4201d2e0, key ptr 00000000
[00:14:14.729] - td_init
[00:14:14.733] - td_reset idx=0
[00:14:14.738] - td_reset idx=1
[00:14:14.742] - [WF] country code CN used, num of channel 13
[00:14:14.743] - Enable BMX IRQ
[00:14:14.751] - [WF] [KEY] [CFG] nVAP is 2, endidx 10, startidx 8
[00:14:14.756] - ------ set default key 4201cf08, key ptr 00000000
[00:14:14.759] - ------ set default key 4201d2e0, key ptr 00000000
[00:14:14.760] - td_init
[00:14:14.761] - td_reset idx=0
[00:14:14.762] - td_reset idx=1
[00:14:14.771] - [WF] country code CN used, num of channel 13
[00:14:14.772] - wifi init success!!
[00:14:14.773] - [000311] kv version:1.0
[00:14:14.779] - [000312] aos framework init.
[00:14:14.781] - -Welcome to AliOS Things-
[00:14:14.784] - [prt] log level set as: [ 3 ]
[00:14:14.791] - --------Firmware info--------
[00:14:14.794] - app: smart_outlet,  board: tg7100cevb
[00:14:14.795] - Host: feige
[00:14:14.796] - Branch:
[00:14:14.797] - Hash:
[00:14:14.805] - Date: Aug  5 2021 14:53:55
[00:14:14.807] - Kernel: AOS-R-1.3.4
[00:14:14.809] - LinkKit: 2.3.0_FY_1.6.6-8
[00:14:14.814] - APP: app-1.6.6-20210805.145355
[00:14:14.816] - Region env: SINGAPORE-ONLINE
[00:14:14.822] - [MTD] >>>>>> Hanlde info Dump >>>>>>
[00:14:14.824] -       name media
[00:14:14.825] -       id 0
[00:14:14.830] -       offset 001c5000(1855488)
[00:14:14.832] -       size 00002000(8Kbytes)
[00:14:14.835] -       xip_addr 231b4000
[00:14:14.840] - [MTD] <<<<<< Hanlde info End <<<<<<
[00:14:14.843] - version = ver0.0.1
[00:14:14.846] - KV = ProductKey:a1JG8An8ORa
[00:14:14.849] - KV = DeviceName:703e971ed91c
[00:14:14.852] - [000333] pk[a1JG8An8ORa]
[00:14:14.857] - [000333] dn[703e971ed91c]
[00:14:14.860] - [000338]<W> try secured ap config!
[00:14:14.865] - [000342]<E> no valied ap config found!

Flashing the removed module worked fine, and here is a template for it:

{
  "vendor": "Amysen",
  "bDetailed": "0",
  "name": "Amysen Wifi Smart Plug YX-WS01",
  "chip": "BL602",
  "board": "YX-X3-T71C-VER03",
  "pins": {
    "1": "LED_n;1",
    "12": "Rel;1",
    "16": "Btn;1"
  },
  "keywords": [
    "plug",
    "relay",
    "TG7100C"
  ],
  "image": "https://obrazki.elektroda.pl/9135692300_1704034050.jpg",
  "wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=20886589"
}

About Author

davidcpurdy wrote 22 posts with rating 4 . Been with us since 2022 year.

Comments

Add a comment

p.kaczmarek2 01 Jan 2024 09:49

That's a nice find, how does the boot log from this device looks like? Isn't IO8 a 'BOOT' pin on BL602? Have you watched BL602 guides? [Read more]

davidcpurdy 01 Jan 2024 16:32

Success finally! The problem was partly with the power supply. After sorting that out, I did get it to flash. Transcript below, showing first the tail end of an unsuccessful flash, then a successful... [Read more]

davidcpurdy 03 Jan 2024 20:23

@pkaczmarek2 Question: How much better is the CH340G over the older FTDI ttl-232r-3v3? With the CH340G, do I need separate PSU to supply the 3.3VDC to the board? If so, is it a high-quality... [Read more]

p.kaczmarek2 03 Jan 2024 20:48

I would say that you need to either use an external 3.3V LDO regulator or a board that has such LDO regulator, if there is no AMS1117-3.3-like LDO regulator on your board, then it will not work. This... [Read more]

davidcpurdy 04 Jan 2024 05:28

OK, I think I'm beginning to see a difference in the way these Amysen devices behave, versus the Sonoff S40. When I would power on the Sonoff S40 with a power supply, it gave a strong click, and the LEDs... [Read more]

p.kaczmarek2 04 Jan 2024 08:17

@davidcpurdy I am usually desoldering modules from the main board for flashing, it's always a good practice. Sometimes the capacitance on the main board is so high that connecting power directly from USB... [Read more]

davidcpurdy 04 Jan 2024 18:21

@pkaczmarek2 : 1. Is a buck converter generally enough to step down, say 6VDC to 3.3VDC? Is the LDO absolutely necessary to get ride of any variation in that voltage (ie. like spikes, ripples)? The... [Read more]

p.kaczmarek2 04 Jan 2024 18:41

The buck converter you mention supports 3A output current which is way more than any Tuya WiFi module may even require. This should work, altough I'd always make sure to put a decoupling capacitor at the... [Read more]

davidcpurdy 04 Jan 2024 21:04

OK, just checking my own sanity here... Desoldering/disassembling the plug leads from the board to get access to the solder joints for the Wifi Module is a pain, but the upside is that flashing the removed... [Read more]

p.kaczmarek2 05 Jan 2024 06:50

Good job, so why didn't it flash in circuit? Maybe RX/TX or boot was used for some other purpose on the board? [Read more]

davidcpurdy 09 Jan 2024 00:36

I may have figured out one piece of the puzzle as to why neither flashing nor even basic UART communication has been working on this plug while the Wifi board is attached before today. I got the CH340G... [Read more]

p.kaczmarek2 09 Jan 2024 04:12

So the previous USB to UART converter did not work? [Read more]

davidcpurdy 09 Jan 2024 04:41

I was not able to flash onboard w/ the FTDI adapter, but i was able to w the CH340g. I’m not sure what the reason is, but I had read years ago that the CH340g was somehow more stable. If I remember... [Read more]

FAQ

TL;DR: With 3.3V power, a 10kΩ BOOT pull-up, and a CH340G, the YX-WS01 can be flashed like a BL602 device; one expert conclusion was "essentially identical to regular BL602". This FAQ helps modders who hit UART handshake failures, unclear pin maps, or unreliable in-circuit flashing on TG7100C plugs. [#20886589]

Why it matters: This plug looks ordinary, but its TG7100C module changes the flashing method, power requirements, and adapter choice enough to determine whether the project succeeds.

Option	In-circuit UART access	Flashing outcome in thread	Power notes
FTDI TTL-232R-3V3	Often failed	Repeated handshake failures	Needed shared grounds; still unreliable onboard
CH340G	Worked onboard	Successful onboard flash confirmed	External 3.3V supply still used
Desoldered module + external PSU	Most reliable	Repeated successful flashes	Best when board loading causes issues

Key insight: The main blocker was not the firmware image. It was stable 3.3V power and a UART setup the installed main board would tolerate, especially during BOOT entry and handshake.

Quick Facts

The working OpenBeken/OpenBL602 pin map was GPIO1 = LED_n, GPIO12 = Rel, and GPIO16 = Btn on the YX-X3-T71C-VER03 module. [#20886589]
The stock firmware boot log identified app: smart_outlet, board: tg7100cevb, Kernel: AOS-R-1.3.4, and build date Aug 5 2021 14:53:55. [#20885158]
Bouffalo Lab Dev Cube flashed the module successfully at 1,000,000 and 2,000,000 baud, with full sessions taking about 10.3 s to 14.5 s. [#20899184]
The flashing checklist explicitly warned that BOOT uses GPIO8, UART uses GPIO7 RX and GPIO16 TX, and flashing-mode current was about 5–7 mA. [#20886589]
A 3A buck converter was considered sufficient for powering the module during flashing, and adding a decoupling capacitor at VDD was recommended. [#20891465]

What is the TG7100C chip, and how is it related to the BL602?

The TG7100C is a BL602-compatible Wi-Fi SoC used here on the YX-X3-T71C-VER03 module. The thread links it to BL602 because the TG7100C SDK references bl602_base.dtsi and identifies the board model as bl602. In practice, the module flashed with BL602 tools and behaved like a regular BL602 target once UART power and BOOT wiring were correct. [#20885158]

How can I flash an Amysen YX-WS01 smart plug with the YX-X3-T71C-VER03 module over UART using Bouffalo Lab Dev Cube?

You can flash it over UART with Bouffalo Lab Dev Cube using the BL602 flow. 1. Wire 3.3V, GND, TX, RX, and pull BOOT high through a 10kΩ resistor. 2. In Dev Cube, select the BL602 image set, partition_cfg_2M.toml, blsp_boot2.bin, and the OpenBL602 firmware. 3. Power the module, start Create & Download, and confirm you see ack is b'4f4b' and All Success. A successful onboard session used COM4 at 2,000,000 baud. [#20899184]

Which pin mapping works for the Amysen YX-WS01 smart plug on OpenBeken or OpenBL602?

The working map is GPIO1 for the inverted LED, GPIO12 for the relay, and GPIO16 for the button. The template posted for this device used "1": "LED_n;1", "12": "Rel;1", and "16": "Btn;1". That same mapping was later confirmed again as the working pin map after successful flashing. [#20886589]

Why does the Amysen YX-WS01 sometimes fail the BL602/TG7100C UART handshake with an FTDI TTL-232R-3V3 adapter?

It fails when the module does not enter a stable flashing state or the adapter cannot maintain clean signaling under board load. The thread showed repeated shake hand fail and BFLB LOAD HELP BIN FAIL errors with the FTDI adapter while the module was still on the main board. The same setup improved only after changing power arrangements or switching adapters, which points to power stability and in-circuit loading as the main causes. [#20890067]

What differences between a CH340G and an FTDI TTL-232R-3V3 matter when flashing TG7100C or BL602 devices?

The important difference in this thread was practical stability, not a claimed protocol difference. The FTDI TTL-232R-3V3 could not reliably flash the module onboard, while the CH340G gave working UART logs first and then a confirmed onboard flash. The author had also read that CH340G was considered more stable for ESP8266-era flashing, and the thread’s real result matched that experience on this plug. [#20899269]

Why would a TG7100C module flash reliably after desoldering it from the main board but fail while still installed in-circuit?

Desoldering removes the main board’s electrical load and makes power delivery cleaner. The thread reports that removed modules flashed on the first try, while installed modules often showed weak relay clicks, LED flicker, or UART handshake failure. An expert note in the thread added that high onboard capacitance and limited USB-fed power can disrupt flashing, so isolating the module is the safer method. [#20890688]

What wiring is needed for TX, RX, 3.3V, GND, and BOOT to put a TG7100C or BL602 module into flashing mode?

Use crossed UART plus a shared ground and a pulled-up BOOT line. The proven wiring was: TX to RX, RX to TX, PSU 3.3V to module VDD, TTL ground tied to PSU ground and module ground, and PSU 3.3V to BOOT through a 10kΩ resistor. Without the shared grounds, the module entered a boot loop instead of starting cleanly. [#20891736]

Why is GPIO8 treated as the BOOT pin on BL602-style devices, and how should it be pulled during flashing?

GPIO8 is treated as the BOOT strap because the flashing tool’s own diagnostic checklist explicitly names it that way. The tool asked whether GPIO8 was pulled up to the board’s own 3.3V before reset, and whether reset occurred while GPIO8 stayed high. In this thread, the working method matched that rule by pulling BOOT high through a 10kΩ resistor during flashing entry. [#20886589]

What is an LDO regulator, and why does it matter when powering a WiFi module like the TG7100C during flashing?

"LDO regulator" is a linear voltage regulator that provides a fixed low-noise output, with the key characteristic that it handles small input-to-output voltage drops without switching noise. It matters because some USB-UART boards expose a 3.3V pin only for logic-level selection, not as a strong current source. The thread warned that without an AMS1117-3.3-like regulator or another solid 3.3V source, flashing may fail. [#20890115]

Can a 3A buck converter safely replace an LDO for powering a BL602 or TG7100C module while flashing?

Yes, the thread says a 3A buck converter is enough for this use if the output is stable. The specific converter discussed was rated for 3A, and the reply said that was far more than a Tuya-class Wi-Fi module should require. The same reply still recommended adding a decoupling capacitor at the module VDD and following normal vendor power-layout practice. [#20891465]

What does 'Cloud-Cuttable' mean for smart plugs like the YX-WS01, and why did this model not cooperate in AP mode?

In this thread, “Cloud-Cuttable” meant a plug that could be locally converted without opening it by using its normal wireless setup behavior. The buyer expected that path because older YX-WS01 variants had been convertible, but this unit used a TG7100C instead of older ESP8266 or BK7231-family hardware. It also would not enter the expected AP mode, so the project moved to physical teardown and UART flashing. [#20885158]

Why does OpenBL602 on this plug come up at 192.168.169.1 instead of the more expected 192.168.4.1?

It came up at 192.168.169.1 because that was the AP address OpenBL602 actually configured on this device after flashing. The author expected 192.168.4.1, but later boot logs clearly showed the interface moving to IP: 192.168.169.1 with DHCP starting at 192.168.169.2. The thread does not give a root-cause explanation, only a confirmed observed address change on this plug. [#20899184]

How can I tell from the UART boot log whether the Amysen YX-WS01 is actually ready to flash successfully?

You can tell because a good setup shows readable stock boot output before flashing starts. A successful log included -Welcome to AliOS Things-, firmware details, and later the flasher returned ack is b'4f4b'. The author gave a clear rule: if you cannot see the initial AliOS boot info and diagnostics in the UART log, the flash attempt is not going to work. [#20891736]

What might cause an onboard-flashed YX-WS01 to fail about a day later even though the flash process reported success?

The thread suggests the likely cause was not the image file but unstable onboard conditions after flashing. One plug flashed successfully in-circuit with the CH340G, then failed about a day later, while two later plugs had to be removed from the main board and then worked well. That pattern points to board-level power, loading, or in-circuit electrical side effects rather than a repeatable firmware build problem. [#20899269]

How do I create and validate a correct OpenBeken device template for the Amysen YX-WS01, including the bDetailed flag?

Create the template with vendor, product name, chip, board, working pin map, keywords, image, and wiki link, then import it into the web tool. The posted working template used chip: BL602, board: YX-X3-T71C-VER03, and bDetailed: 0. The maintainer confirmed the template was correct, added it upstream, and explained that bDetailed marks a step-by-step teardown article, not core device functionality. [#20891465]

Generated by the language model.