[RTL8710BX] [T102_V1.1] Generic Tuya 20A EU Smart Plug - a little exploration

divadiow 01 Feb 2024 21:37 2 4359 Cool? (+3)

📢 Listen (AI):

This one looked like it might be slightly different to the many variants of this device I've seen around (not one I've bought before anyway). It is from the Digitaling store on Ali Express and boasts 20A working current, though further down the page it says 16A. The relay is marked as 20A at 120v and 250v but that datasheets I can find seem to suggest 15A max. It also has a Belling BL0937 power monitoring chip.

This is the appearance of the unit and packaging

I opened the unit with a G-clamp, moving the clamp around and tightening until I heard cracking in enough places to be confident the glue had lost the battle and the unit would fall apart. Inside is the main PCB and a nice, not-so-often seen, T102_V1.1 with RTL8710BX chip alongside an external 16mbit/2megabyte flash module from GigaDevice. Detailed information about the T102_V1.1 can be seen in this post here https://www.elektroda.com/rtvforum/topic3815120.html#19504258.

I know OpenBeken doesn't currently support the RTL chips but I wanted to see if I could at least grab the boot log and maybe the factory firmware and make it available for analysis.

Through some Googling I found that TX needs to pulled to ground for the chip to enter boot mode. Then remove GND from TX to be able to flash/read firmware. With that in mind I unsoldered the whole module and put it into boot mode, with TX pulled low at power-on, before removing GND from TX.

Some chip info:

Without TX grounded at power-on I collected the boot log

<RTL8195A>ROM:[V0.1]
FLASHRATE:4
BOOT TYPE:0 XTAL:40000000
IMG1 DATA[1168:10002000]
IMG1 ENTRY[8000541:100021ef]
IMG1 ENTER
CHIPID[000000f6]
read_mode idx:3, flash_speed idx:0
calibration_result:[1:11:9][3:d] 
calibration_result:[2:13:7][1:d] 
calibration_result:[3:0:0][ff:ff] 
calibration_ok:[2:13:7] 
FLASH CALIB[NEW OK]
OTA2 ADDR[80d0000]
OTAx SELE[fffffffc]
OTA1 USE
IMG2 DATA[0x80a1570:7508:0x10005000]
IMG2 SIGN[RTKWin(10005008)]
IMG2 ENTRY[0x10005000:0x800b17d]
===== Enter Image 2 ====
System_Init1
OSC8M: 8390004 
boot reason: 0 
System_Init2

11111111111111111111111111
interface 0 is initialized
interface 1 is initialized

Initializing[0 WIFI ...1-01 18:12:1
LD5 TUYA Info]O Mode, BD_[mqc_app.c:1Info: 0 
75] mqc app init ...
[01-01 18:12:15 TUYA Info
LD][sf_mqc_cb.O Mode, BD_c:42] registInfo: 0 
er mqc app callback
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:5 mqc_handler_cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:31 mqc_handler_cnt:2
[01-01 18:12:15 TUYA Debug][log_seq.c:724] read from uf. max:0 first:0 last:0
[01-01 18:12:15 TUYA Debug][svc_online_log.c:288] svc online log init success
[01-01 18:12:15 TUYA Notice][tuya_device.c:288] key:18, relay:15, led:5,epin:0,ivPin:12,ivcpin:14
[01-01 18:12:15 TUYA Notice][tuya_device.c:289] rtlbn_bl0937_plug_vxqn72kwtosoy4d3:1.0.2:Nov  1 2023:09:19:11
[01-01 18:12:15 TUYA Notice][tuya_device.c:291] < TUYA IOT SDK V:1.0.7 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.2_CD:1.0.0 >
< BUILD AT:2020_08_07_18_07_40 BY embed FOR ty_iot_wf_rtos_sdk AT rtl8710bn >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:RELIABLE_TRANSFER ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:ENABLE_LAN_LINKAGE ENABLE_LAN_LINKAGE_MASTER:ENABLE_LAN_LINKAGE_MASTER >

[01-01 18:12:15 TUYA Notice][tuya_device.c:293] firmware compiled at Nov  1 2023 09:19:11
[01-01 18:12:15 TUYA Notice][tuya_device.c:299] 
 USER SET LOG_LEVEL_NOTICE 

[01-01 18:12:15 TUYA Notice][simple_flash.c:430] key_addr: 0x1eb000   block_sz 4096
[01-01 18:12:15 TUYA Notice][simple_flash.c:498] get key:
0x43 0xed 0xc7 0x14 0xe4 0xe5 0x0 0xa9 0xf6 0x81 0xe6 0x52 0xc5 0x3c 0xe6 0xf6 

WIFI initialized

init_thread(55), Available heap 0xf758[01-01 18:12:15 TUYA Notice][tuya_uart.c:125] 1   9600
[01-01 18:12:15 TUYA Notice][tuya_main.c:394] mf_init succ

LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0 

LDO Mode, BD_Info: 0 

WIFI initialized
[01-01 18:12:16 TUYA Notice][tuya_main.c:128] current product ssid name:tuya_mdev_test2
[WIFI NOTICE]not find scan ssid (tuya_mdev_test2)
[01-01 18:12:17 TUYA Notice][gw_intf.c:3557] serial_no:d8d6688fef4e
[01-01 18:12:17 TUYA Notice][gw_intf.c:3592] gw_cntl.gw_wsm.stat:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3595] gw_cntl.gw_wsm.nc_tp:1
[01-01 18:12:17 TUYA Notice][gw_intf.c:3596] gw_cntl.gw_wsm.md:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3635] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3636] gw_cntl.gw_if.product_key:vxqn72kwtosoy4d3, input:vxqn72kwtosoy4d3
[01-01 18:12:17 TUYA Notice][gw_intf.c:3637] gw_cntl.gw_if.tp:0, input:0
[01-01 18:12:17 TUYA Err][hw_ctrl.c:177] hw_set_relay 15: on
[01-01 18:12:17 TUYA Err][app_switch.c:564] =============long_key_time==========5000======
[01-01 18:12:17 TUYA Err][app_switch.c:564] =============long_key_time==========5000======
[01-01 18:12:17 TUYA Notice][tuya_gpio.c:225] id 18 {0x1001af24}
[01-01 18:12:17 TUYA Notice][hlw8012.c:896] get prod test result!!!:1
[01-01 18:12:17 TUYA Notice][hlw8012.c:943] v_ref = 561,i_ref = 25842,p_ref = 15765,e_ref = 1320

[01-01 18:12:17 TUYA Notice][hlw8012.c:1091] enter ele 000
[01-01 18:12:17 TUYA Notice][hlw8012.c:1095] enter ele 1111
[01-01 18:12:17 TUYA Err][hlw8012.c:1105] sys_start_timer 0 
[01-01 18:12:17 TUYA Err][hlw8012.c:1107] sys_mode 16 
[01-01 18:12:17 TUYA Notice][app_dltj.c:237] get ele data err.
[01-01 18:12:17 TUYA Notice][tuya_device.c:427] device_init ok ! free_mem_size:60176

LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0 

LDO Mode, BD_Info: 0 

WIFI initialized

LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0 

LDO Mode, BD_Info: 0 

WIFI initialized
[01-01 18:12:19 TUYA Notice][app_switch.c:1336] wifi status is :1

And that's as far as I have gone!

A collection of interior pics:

Attachments:

RTL8710BX_T102_V1.1_fw.bin (2 MB) You must be logged in to download this attachment.
RTL8710BX_T102_V1.1_efuse.bin (256 Bytes) You must be logged in to download this attachment.

About Author

divadiow wrote 4839 posts with rating 852 , helped 420 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 02 Feb 2024 12:08

I am very happy to see you've got RTL! I've started already a WIP fork for BN version in the past, I just had no time to develop it futher, you can look here: https://github.com/openshwprojects/OpenRTL8710BN But... [Read more]

divadiow 18 Jan 2025 09:26

template updated in device list. P1 should be WifiLED because there's a second blue LED fixed to the relay behaviour for on/off status { "vendor": "Tuya", "bDetailed": "0", "name": "Generic... [Read more]

FAQ

TL;DR: Despite the “20 A” label, the JY3FF relay is only certified for 15 A at 250 V AC [Jieying, 2023]. "OpenBeken doesn't currently support the RTL chips" [Elektroda, divadiow, post #20940181] Flash access and power-monitor readings are possible via the BL0937.

Why it matters: Knowing the real limits and flashing options prevents overloads and wasted hacking time.

Quick Facts

• MCU: Realtek RTL8710BX, ARM Cortex-M4F @ 166 MHz typical [RTL8710BX Datasheet]. • External flash: 16 Mbit GD25Q16E SPI NOR [Elektroda, divadiow, post #20940181] • Relay rating: 15 A / 250 V AC (UL) [Jieying, 2023]. • Power-monitor IC: BL0937, ±1 % energy accuracy typ. [Belling, 2021]. • AliExpress cost: US $7–9 per piece in 2-packs [AliExpress listing, 2024].

1. What chipset powers this Tuya 20 A EU smart plug?

It uses the Realtek RTL8710BX Wi-Fi SoC mounted on a T102_V1.1 module, unlike the more common ESP8266 [Elektroda, divadiow, post #20940181]

2. Can I run OpenBeken or Tasmota on the RTL8710BX today?

Native OpenBeken support for RTL8710BX is still work-in-progress [Elektroda, p.kaczmarek2, post #20940868] You can run Tasmota by swapping the module for an ESP02S, which is pin-compatible [Elektroda, p.kaczmarek2, post #20940868]

3. How do I enter boot (flash) mode on the module?

Follow three steps: 1. Tie TX to GND, then power the board. 2. Release TX from GND. 3. Connect a 3.3 V UART at 115 200 bps to read or write flash [Elektroda, divadiow, post #20940181]

4. Is the plug really safe at 20 A continuous load?

No. The installed JY3FF-S-DC5V-A relay carries a certified 15 A continuous rating; advertising 20 A exceeds that limit [Jieying, 2023]. Sustained 20 A may overheat contacts and enclosure.

5. How accurate is the BL0937 power-monitor chip inside?

Belling rates the BL0937 at ±1 % active-energy error over 0.1–10 A when properly calibrated [Belling, 2021]. User calibration is still required for voltage and current offsets.

6. Which GPIO pins control the relay, button and LEDs?

Current template: P10 → Relay, P11 → Button, P1 → Wi-Fi/status LED, P0/P8/P9 interface the BL0937 [Elektroda, divadiow, post #21398115]

7. Where is the open-source work happening for RTL8710BX?

Development lives in the OpenRTL8710BN fork on GitHub; BX support will branch from there once testing starts [Elektroda, p.kaczmarek2, post #20940868]

8. What failure behaviour should I watch for?

Logs show repeated Wi-Fi de-init and DHCP stop loops when the plug can’t find a configured SSID, leading to rapid relay toggling [Elektroda, divadiow, post #20940181]

9. How can I open the glued enclosure without damage?

Author used a G-clamp, tightening around the seam until the glue cracked; the shell then separated cleanly [Elektroda, divadiow, post #20940181]

10. Can I back up the factory firmware before experimenting?

Yes. After entering boot mode, use Realtek’s Ameba-D flasher or esptool-py fork to read the full 2 MB flash and save a binary image [Elektroda, divadiow, post #20940181]

11. Why does the product page list 16 A while branding says 20 A?

Sellers often quote the IEC maximum for Schuko contacts (16 A) while printing higher marketing figures. The internal relay remains the limiting 15 A component [AliExpress listing, 2024; Jieying, 2023].