[RTL8710BX] [T102_V1.1] Generic Tuya 20A EU Smart Plug - a little exploration
This one looked like it might be slightly different to the many variants of this device I've seen around (not one I've bought before anyway). It is from the Digitaling store on Ali Express and boasts 20A working current, though further down the page it says 16A. The relay is marked as 20A at 120v and 250v but that datasheets I can find seem to suggest 15A max. It also has a Belling BL0937 power monitoring chip.
This is the appearance of the unit and packaging
I opened the unit with a G-clamp, moving the clamp around and tightening until I heard cracking in enough places to be confident the glue had lost the battle and the unit would fall apart. Inside is the main PCB and a nice, not-so-often seen, T102_V1.1 with RTL8710BX chip alongside an external 16mbit/2megabyte flash module from GigaDevice. Detailed information about the T102_V1.1 can be seen in this post here https://www.elektroda.com/rtvforum/topic3815120.html#19504258.
I know OpenBeken doesn't currently support the RTL chips but I wanted to see if I could at least grab the boot log and maybe the factory firmware and make it available for analysis.
Through some Googling I found that TX needs to pulled to ground for the chip to enter boot mode. Then remove GND from TX to be able to flash/read firmware. With that in mind I unsoldered the whole module and put it into boot mode, with TX pulled low at power-on, before removing GND from TX.
Some chip info:
Without TX grounded at power-on I collected the boot log
And that's as far as I have gone!
A collection of interior pics:
This is the appearance of the unit and packaging
I opened the unit with a G-clamp, moving the clamp around and tightening until I heard cracking in enough places to be confident the glue had lost the battle and the unit would fall apart. Inside is the main PCB and a nice, not-so-often seen, T102_V1.1 with RTL8710BX chip alongside an external 16mbit/2megabyte flash module from GigaDevice. Detailed information about the T102_V1.1 can be seen in this post here https://www.elektroda.com/rtvforum/topic3815120.html#19504258.
I know OpenBeken doesn't currently support the RTL chips but I wanted to see if I could at least grab the boot log and maybe the factory firmware and make it available for analysis.
Through some Googling I found that TX needs to pulled to ground for the chip to enter boot mode. Then remove GND from TX to be able to flash/read firmware. With that in mind I unsoldered the whole module and put it into boot mode, with TX pulled low at power-on, before removing GND from TX.
Some chip info:
Without TX grounded at power-on I collected the boot log
<RTL8195A>ROM:[V0.1]
FLASHRATE:4
BOOT TYPE:0 XTAL:40000000
IMG1 DATA[1168:10002000]
IMG1 ENTRY[8000541:100021ef]
IMG1 ENTER
CHIPID[000000f6]
read_mode idx:3, flash_speed idx:0
calibration_result:[1:11:9][3:d]
calibration_result:[2:13:7][1:d]
calibration_result:[3:0:0][ff:ff]
calibration_ok:[2:13:7]
FLASH CALIB[NEW OK]
OTA2 ADDR[80d0000]
OTAx SELE[fffffffc]
OTA1 USE
IMG2 DATA[0x80a1570:7508:0x10005000]
IMG2 SIGN[RTKWin(10005008)]
IMG2 ENTRY[0x10005000:0x800b17d]
===== Enter Image 2 ====
System_Init1
OSC8M: 8390004
boot reason: 0
System_Init2
11111111111111111111111111
interface 0 is initialized
interface 1 is initialized
Initializing[0 WIFI ...1-01 18:12:1
LD5 TUYA Info]O Mode, BD_[mqc_app.c:1Info: 0
75] mqc app init ...
[01-01 18:12:15 TUYA Info
LD][sf_mqc_cb.O Mode, BD_c:42] registInfo: 0
er mqc app callback
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:5 mqc_handler_cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:31 mqc_handler_cnt:2
[01-01 18:12:15 TUYA Debug][log_seq.c:724] read from uf. max:0 first:0 last:0
[01-01 18:12:15 TUYA Debug][svc_online_log.c:288] svc online log init success
[01-01 18:12:15 TUYA Notice][tuya_device.c:288] key:18, relay:15, led:5,epin:0,ivPin:12,ivcpin:14
[01-01 18:12:15 TUYA Notice][tuya_device.c:289] rtlbn_bl0937_plug_vxqn72kwtosoy4d3:1.0.2:Nov 1 2023:09:19:11
[01-01 18:12:15 TUYA Notice][tuya_device.c:291] < TUYA IOT SDK V:1.0.7 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.2_CD:1.0.0 >
< BUILD AT:2020_08_07_18_07_40 BY embed FOR ty_iot_wf_rtos_sdk AT rtl8710bn >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:RELIABLE_TRANSFER ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:ENABLE_LAN_LINKAGE ENABLE_LAN_LINKAGE_MASTER:ENABLE_LAN_LINKAGE_MASTER >
[01-01 18:12:15 TUYA Notice][tuya_device.c:293] firmware compiled at Nov 1 2023 09:19:11
[01-01 18:12:15 TUYA Notice][tuya_device.c:299]
USER SET LOG_LEVEL_NOTICE
[01-01 18:12:15 TUYA Notice][simple_flash.c:430] key_addr: 0x1eb000 block_sz 4096
[01-01 18:12:15 TUYA Notice][simple_flash.c:498] get key:
0x43 0xed 0xc7 0x14 0xe4 0xe5 0x0 0xa9 0xf6 0x81 0xe6 0x52 0xc5 0x3c 0xe6 0xf6
WIFI initialized
init_thread(55), Available heap 0xf758[01-01 18:12:15 TUYA Notice][tuya_uart.c:125] 1 9600
[01-01 18:12:15 TUYA Notice][tuya_main.c:394] mf_init succ
LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0
LDO Mode, BD_Info: 0
WIFI initialized
[01-01 18:12:16 TUYA Notice][tuya_main.c:128] current product ssid name:tuya_mdev_test2
[WIFI NOTICE]not find scan ssid (tuya_mdev_test2)
[01-01 18:12:17 TUYA Notice][gw_intf.c:3557] serial_no:d8d6688fef4e
[01-01 18:12:17 TUYA Notice][gw_intf.c:3592] gw_cntl.gw_wsm.stat:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3595] gw_cntl.gw_wsm.nc_tp:1
[01-01 18:12:17 TUYA Notice][gw_intf.c:3596] gw_cntl.gw_wsm.md:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3635] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3636] gw_cntl.gw_if.product_key:vxqn72kwtosoy4d3, input:vxqn72kwtosoy4d3
[01-01 18:12:17 TUYA Notice][gw_intf.c:3637] gw_cntl.gw_if.tp:0, input:0
[01-01 18:12:17 TUYA Err][hw_ctrl.c:177] hw_set_relay 15: on
[01-01 18:12:17 TUYA Err][app_switch.c:564] =============long_key_time==========5000======
[01-01 18:12:17 TUYA Err][app_switch.c:564] =============long_key_time==========5000======
[01-01 18:12:17 TUYA Notice][tuya_gpio.c:225] id 18 {0x1001af24}
[01-01 18:12:17 TUYA Notice][hlw8012.c:896] get prod test result!!!:1
[01-01 18:12:17 TUYA Notice][hlw8012.c:943] v_ref = 561,i_ref = 25842,p_ref = 15765,e_ref = 1320
[01-01 18:12:17 TUYA Notice][hlw8012.c:1091] enter ele 000
[01-01 18:12:17 TUYA Notice][hlw8012.c:1095] enter ele 1111
[01-01 18:12:17 TUYA Err][hlw8012.c:1105] sys_start_timer 0
[01-01 18:12:17 TUYA Err][hlw8012.c:1107] sys_mode 16
[01-01 18:12:17 TUYA Notice][app_dltj.c:237] get ele data err.
[01-01 18:12:17 TUYA Notice][tuya_device.c:427] device_init ok ! free_mem_size:60176
LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0
LDO Mode, BD_Info: 0
WIFI initialized
LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0
LDO Mode, BD_Info: 0
WIFI initialized
[01-01 18:12:19 TUYA Notice][app_switch.c:1336] wifi status is :1
And that's as far as I have gone!
A collection of interior pics:
divadiow wrote 2755 posts with
rating 473 , helped 246 times.
Live in city Bristol.
Been with us since 2023 year.
Comments
I am very happy to see you've got RTL! I've started already a WIP fork for BN version in the past, I just had no time to develop it futher, you can look here: https://github.com/openshwprojects/OpenRTL8710BN But... [Read more]
template updated in device list. P1 should be WifiLED because there's a second blue LED fixed to the relay behaviour for on/off status { "vendor": "Tuya", "bDetailed": "0", "name": "Generic... [Read more]