Disassembling and Flashing Tuya BSD29 UK Smart Plug + DS18B20 Sensor Mod [WL2S] [LN882H] [BL0937]

divadiow 04 Nov 2024 23:02 3 2103 Cool? (+2)

📢 Listen (AI):

TL;DR

Opened a generic 20A Tuya BSD29 UK smart plug with energy metering, revealing a Lightning Semiconductor LN882H-based WL2S module and BL0937 circuitry.
Removed the live and neutral pins, then used UART download mode and a Python tool to back up the 2 MB factory firmware.
Added a DS18B20 temperature sensor on GPIOA1 with a 4.7k pull-up resistor, powered from the module’s 3.3V and ground pads.
Flashing OpenBeken succeeded, the plug booted and broadcast an access point, and the BSD34 template matched this hardware.
The case was heavily glued and required vice pressure, scalpel work, and care around the button to open.

Generated by the language model.

Here is a look inside a generic 20A Tuya BSD29 UK smart plug with energy metering capabilities. I will unsolder the main PCB, the module and then flash it to run OpenBeken, cutting it off from all Tuya cloud services. I'll also add a DS18B20 temperature sensor so the temperature inside the casing can be measured.

This black BSD29 was purchased from the Cerhot Smart Store on Ali Express https://www.aliexpress.com/item/1005006573066580.html

Like many plugs, this was welded/glued together very well, meaning some brute force and pressure is required to open. In my vice I clamped the device several millimetres just below the circular rim of the bottom of the plug. This should allow the vice to squash the side wall of the case in very slightly, opening up some small gaps along the glue gap.

I did not film this process (next time!), but the vice was pretty tight. As small gaps opened I used a scalpel to dig down into those gaps, the glue audibly cracking apart as this is done. Rotated the unit around repeatedly until it was more broken apart than not. Be prepared to give it some force. Be careful crushing the button in.

Once inside we can see its guts, including a Lightning Semiconductor LN882H based WL2S module.

And to reach the bottom of the module the live and neutral pins need to be desoldered. This can be achieved with plenty of flux, solder braid and some patience. Heating and lifting each side of the PCB fractionally, in turn, until the legs are freed.

Then the same with flux and braid to remove the WL2S. After which the module can be soldered ready for power and UART flash/backup.

(Those convenient GND and 3.3V test pads have given me an idea.)

I have not been able to obtain a datasheet for the WL2S yet. It is not a Tuya module. I made this to add missing detail for me and others in the future:

And with connections soldered as follows

WL2S TXD1 -> USB-TTL RX
WL2S 3V3 -> 3.3V external PSU
WL2S GND - > PSU GND/USB-TTL GND

we get the following boot log captured at 921600 baud

switching to TXD0/RXD0 to the USB-TTL adaptor and grounding A9 we put the LN882H into UART download mode when powered. Which means the attached zipped Python script and exe file can be run to download the 2mb factory firmware to a file. This process takes about 40 minutes.

As detailed in this thread I flashed OpenLN to the module using the separate GUI program.

I have a bag of 10 Dallas/Maxim fake DS18B20 sensors and those nicely placed 3v3 and ground pads seemed like they could be put to good use. There are also the unused GPIOs A1 and A5 on the back of the module.

With a 4.7k resistor between the data and VCC legs I tested the sensor working on GPIOA1 on an LN882H test device.

With some heatshrink protection, hot glue gun blobs and some careful routing of some wires, the sensor seems to sit fairly happily in this gap in the plug

At this point I've soldered the WL2S back into the PCB and tested OpenBeken boots and broadcasts an access point as expected. As luck would have it, the BSD34 template is identical for this device, so that was easy. With the DS18B20 this means:

which looks like

But for the basic BSD29 OBK template is:

And finally, some more pics of the packaging, manual and device

https://github.com/OpenBekenIOT/webapp/pull/158

Attachments:

LN882H_CMD_TOOL.zip (51.37 KB) You must be logged in to download this attachment.
BSD29_flash.bin (2 MB) You must be logged in to download this attachment.

About Author

divadiow wrote 4832 posts with rating 851 , helped 420 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment

p.kaczmarek2 15 Nov 2024 11:40

Very nice mod, but aren't the internals of the plug heating up the sensor? Maybe it would make sense to let the DS18B20's head peak out a little bit out of the device case. Still, take care, it seems the... [Read more]

divadiow 15 Nov 2024 11:59

yes, but I was only after an idea of the temps inside rather than the environment outside. But mostly so I have a DS18B10 always paired with LN882H ready for immediate testing. [Read more]

divadiow 08 Apr 2025 08:29

in the unlikely event anyone swaps the WL2S for a WB2S, the pin assignments would then be the following for this device "6": "LED_n;1", "7": "BL0937CF;0", "8": "BL0937CF1;0", "10":... [Read more]

FAQ

TL;DR: For tinkerers modifying a 20A UK Tuya BSD29 plug, the WL2S/LN882H board can be backed up as a full 2 MB image and reflashed; as the author notes, "the BSD34 template is identical," so OpenBeken setup is straightforward. This FAQ solves safe opening, UART flashing, BL0937 mapping, and an internal DS18B20 sensor add-on for local control without Tuya cloud reliance. [#21289818]

Why it matters: This thread turns a hard-to-open mains smart plug into a documented, reusable workflow for backup, reflashing, energy metering, and internal temperature monitoring.

Option	Module / chip	Best use	Key mapping note
Original hardware	WL2S / LN882H	OpenLN or OpenBeken on the stock board	BSD34 template matches the device mapping
Swapped module	WB2S	Only if you replace WL2S physically	Pins change completely, including relay and BL0937 lines

Key insight: The most valuable takeaway is not just that the BSD29 can run custom firmware, but that its stock WL2S board exposes enough pads and unused GPIOs to support both a full UART backup and a DS18B20 sensor mod with clean reassembly.

Quick Facts

The captured Tuya boot log identifies TuyaOS V3.5.4 on LN882H, reports firmware ln_elec_plug:1.0.4, and shows the relay on pin 6, button on pin 10, and Wi-Fi LED on pin 7 in the stock firmware context. [#21289818]
The WL2S boot log was read at 921600 baud, while the full factory dump used a Python tool and produced a 2 MB backup that took about 40 minutes. [#21289818]
The DS18B20 test used a 4.7 kΩ pull-up resistor between data and VCC and worked on GPIOA1 before final installation inside the plug. [#21289818]
The SoftAP shown in the log used IP 192.168.176.1 with DHCP leasing from 192.168.176.2 to 192.168.176.2, confirming a single-client setup during provisioning. [#21289818]
A later update dated 2025-04-08 gives a separate WB2S replacement map, with relay on pin 26 and BL0937SEL on pin 24, so module swaps are not pin-compatible. [#21511246]

1. How do you safely open a glued or welded Tuya BSD29 UK smart plug without destroying the case or crushing the button?

Open it by compressing the lower side wall, not by prying the face apart first. 1. Clamp the plug in a vice a few millimetres below the circular bottom rim. 2. Tighten until small gaps appear along the glue seam. 3. Work a scalpel into those gaps while rotating the plug and avoid crushing the button area. The author says the case was glued very well and needed noticeable force, so slow, even pressure matters more than a single hard pry. [#21289818]

2. What is the WL2S module in the Tuya BSD29 smart plug, and how is it related to the LN882H chip?

The WL2S is the plug’s Wi-Fi module, and it is built around the Lightning Semiconductor LN882H. "WL2S is a Wi-Fi module that hosts the LN882H SoC, provides the radio and GPIO interface, and is the removable board flashed during this mod." In this BSD29, the module is visibly marked WL2S, while the internal boot log identifies LN882H libraries and TuyaOS components running on that chip. [#21289818]

3. How do you desolder the main PCB and remove the WL2S module from a BSD29 plug for flashing?

Desolder the mains pins first, then lift off the WL2S separately. The thread recommends plenty of flux, solder braid, and patience. Heat and lift each side of the PCB in small increments until the live and neutral legs release, then repeat the same braid-and-flux process on the WL2S module itself. That staged approach reduces pad damage and gives access to the underside for power and UART wiring. [#21289818]

4. What UART wiring and baud rate are needed to read the boot log from a WL2S / LN882H module?

Use WL2S TXD1 to USB-TTL RX, WL2S 3V3 to an external 3.3 V supply, and WL2S GND to shared ground. Capture the boot log at 921600 baud. The post explicitly lists those three connections and shows a long successful boot capture at that speed, confirming the module was powered and talking over UART before any firmware dump or reflash work began. [#21289818]

5. How do you put an LN882H into UART download mode and back up the full 2 MB factory firmware from a BSD29 smart plug?

Switch to TXD0/RXD0, ground A9 during power-up, and then run the provided dump tool. The thread says grounding A9 forces the LN882H into UART download mode. The author then ran python LN882H_Flash_Dumper.py COM10 BSD29_flash and saved the complete 2 MB factory image. That backup took about 40 minutes, so plan for a long uninterrupted serial session. [#21289818]

6. What is the BL0937 energy metering chip, and which pins does OpenBeken use for BL0937CF, BL0937CF1, and BL0937SEL on the BSD29?

OpenBeken uses pin 12 for BL0937CF, pin 7 for BL0937CF1, and pin 19 for BL0937SEL on the BSD29. "BL0937 is an energy-metering IC that outputs measurement pulses for power data, using separate CF and CF1 lines plus a selection line to switch measurement context." Those exact mappings appear in the BSD29 template and in the DS18B20-modified pin block shown in the thread. [#21289818]

7. Which OpenBeken or OpenLN template works for the Tuya BSD29 smart plug with WL2S, and why is the BSD34 template compatible?

The BSD34 template works for this WL2S-based BSD29 because its pin layout is identical. The author says OpenBeken booted correctly after reassembly and that using the BSD34 template made setup easy. For the plain BSD29 OpenBeken template, the published map includes LED on 0, button on 3, relay on 11, and BL0937 lines on 7, 12, and 19. The compatibility matters because it avoids manual pin discovery after flashing. [#21289818]

8. How do you add a DS18B20 temperature sensor to a WL2S-based BSD29 plug, including the pull-up resistor and GPIO choice?

Use GPIOA1 for the data line and add a 4.7 kΩ resistor between data and VCC. The thread first verifies the sensor on an LN882H test device, then installs it inside the plug using the WL2S test pads for 3.3 V and ground. In the final OpenBeken pin map, the sensor becomes DS1820_IO;1, which lets the reflashed plug report internal temperature after the module is soldered back in. [#21289818]

9. Why would a DS18B20 mounted inside the BSD29 plug read higher temperatures, and what does it actually measure inside the case?

It reads higher because it measures the air and heat buildup inside the plug, not the room outside. A follow-up comment specifically notes that the internals may warm the sensor, and the reply confirms that this was intentional. The goal was to get an idea of temperatures inside the casing and to keep a DS18B20 paired with LN882H hardware for immediate testing, not to measure ambient temperature. [#21304077]

10. What safety issues should you consider when adding a DS18B20 to this plug if the internal power supply is not isolated?

Treat the entire internal sensor wiring as potentially unsafe to touch, because the power supply appears non-isolated. A reply warns that the sensor head should never be exposed outside the enclosure for that reason. If you add a DS18B20, keep it fully inside the case, insulate all leads, and avoid routing it where reassembly could pinch the cable against live sections. That warning is the clearest safety limit in the thread. [#21304053]

11. WL2S vs WB2S in a Tuya BSD29 smart plug — how do the pin assignments differ after a module swap?

They differ completely enough that you must use a new map after the swap. The 2025 update says a WB2S replacement changes core functions to relay on 26, button on 10, LED on 23, inverted LED on 6, BL0937CF on 7, BL0937CF1 on 8, and BL0937SEL on 24. That means a WL2S/OpenBeken template cannot be reused blindly after replacing the module. [#21511246]

12. What are the correct pin mappings for a WB2S replacement in the BSD29 if the original WL2S module is swapped out?

Use this WB2S map: 6 = LED_n;1, 7 = BL0937CF;0, 8 = BL0937CF1;0, 10 = Btn;1, 23 = LED;1, 24 = BL0937SEL;0, and 26 = Rel;1. The update presents those assignments as the correct replacement mapping for this specific BSD29 if someone swaps out the original WL2S. It is a device-specific correction, not a generic WB2S template. [#21511246]

13. Why does the LN882H boot log report the module as CB2S even though the board inside the plug is marked WL2S?

The log reports module: is CB2S because that is how the stock firmware identifies its configured module profile, even though the physical board is marked WL2S. The same post shows both facts side by side: photos of the WL2S hardware and a Tuya boot log that names CB2S. The thread does not claim a hardware mismatch; it only documents that the software identifier and silkscreen label differ. [#21289818]

14. What’s the best way to route and insulate DS18B20 wires inside a smart plug using heatshrink and hot glue without interfering with reassembly?

Use short runs, heatshrink on exposed joints, and small hot-glue anchors to hold the cable in a side gap. The author shows the sensor sitting in an internal cavity after adding heatshrink protection, glue blobs, and careful wire routing. That approach keeps the DS18B20 stable during reassembly and reduces the chance of a wire crossing the PCB edge or getting trapped when the case closes. [#21289818]

15. Where can I find the OpenBeken webapp template or pull request for the Tuya BSD29 UK smart plug with LN882H, WL2S, and BL0937?

You can find it at the GitHub pull request referenced at the end of the main post for the OpenBeken webapp. The thread links directly to a pull request for adding or documenting this BSD29 template, after showing the full JSON with chip: "LN882H", board: "WL2S", and BL0937-related pins. That link is the thread’s primary pointer to the reusable template entry. [#21289818]

Generated by the language model.