logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda
Build faster with M5Stack »
Build faster with M5Stack » Stick • Unit • Cardputer
ADVERTISEMENT
Dostępna jest polska wersja

Czy wolisz polską wersję strony elektroda?

Nie, dziękuję Przekieruj mnie tam

[ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress

djbios  26 4116 Cool? (+8)
📢 Listen (AI):

TL;DR

  • TNCE TUYA Smart Plug WiFi from AliExpress was torn down and converted from unstable Tuya firmware to OpenBeken.
  • The PCB uses an ECR6600 SoC with a BL0937CF measurement chip, and it has convenient back pads for UART flashing.
  • The plug cost 5 euros, and the flash used ESWIN_ECR6600_RDTool_v1.0.21 with OpenECR6600_1.18.62.bin.
  • After flashing, the device ran free firmware and started a Wi‑Fi hotspot, though syncing sometimes needed repeated power-on timing attempts.
Laboratory power supply and prototype board on a glass desk.
Hi all! Let me share my teardown of TNCE TUYA Smart Plug WiFi I recently bought on AliExpress for 5 euros. The original Tuya firmware was pretty unstable and I decided to covert it to OpenBeken. Luckily, OpenBeken supports ECR6600 platform so it was possible to flash it via UART. I'll show the flashing process here step by step.

Here is the look of the device
A person holding a white electrical adapter with a Schuko socket on a dark background.
Electrical adapter held in a hand.
Smart electric socket in gray with a visible power button.
Travel adapter with two pins on a dark background.

To open up the device without much damage I used a vice: slightly squeezing from both sides till the little crack sound allows to crack the glue and split the plastic into 2 parts

Electrical socket adapter with an on/off switch.

Then removing one little screw allows to extract the PCB


Open plug with visible interior.
A circuit board held in hand with various electronic components.
Close-up of a blue printed circuit board with visible electronic components.
Close-up photo of a blue circuit board with electronic components and the inscription ESWIN.
A printed circuit board with electronic components held in a hand.
Blue circuit board with a mounted relay.
Blue circuit board with a lever switch on a black background.

We can see that the socket is built on the basis of ECR6600, which OpenBeken recently supported. To measure the voltage/current they use BL0937CF.

On the back of the PCB, there are convenient pads to solder the USB-UART adapter

Electronic circuit with JIEYING relay and connected wires.

Then we need an external 3.3V power source, I used an adjustable lab one

Laboratory power supply and prototype board on a glass desk.

I used this guide https://www.elektroda.com/rtvforum/topic4111822.html to flash the firmware, in a nutshell you need to:
1) Download ESWIN_ECR6600_RDTool_v1.0.21.zip from here https://github.com/openshwprojects/FlashTools/tree/main/TransaSemi-ESWIN and use RDTool.exe
2) In RDTool you double click "develop tool" tab, select the COM port, and on "all-in-one file path" select the firmware from latest release https://github.com/openshwprojects/OpenBK7231T_App/releases/ (ECR6600 UART Flash) - I used OpenECR6600_1.18.62.bin
3) Then you need to click start and enable the power source of a device. You might not get in sync from the first attempt (there is some very specific timing, smth like 0.5 sec to power device after start clicked) - that's okay, you will succeed eventually.
4) After the program finishes the flashing - you all set, the device runs free firmware now.

Now you can unsolder the wires, put PCB back in a case and try to put it in the socket. WiFi hotspot should be running now.

The pins configuration is:

Code: JSON
Log in, to see the code


UPD: Attached the original firmware

Enjoy!
AI: Did you encounter any specific issues or challenges during the teardown or firmware conversion process?
No, just needed to collect the info from different sources
AI: How familiar are you with similar teardown and firmware flashing processes?
A bit
Attachments:
  • ECR6600_tuya_socket.bin (2 MB) You must be logged in to download this attachment.
About Author
djbios wrote 2 posts with rating 8 . Been with us since 2025 year.

Comments

p.kaczmarek2 19 Mar 2025 11:14

Thank you for sharing! It's good to see that ECR6600 support is being useful for our users. Did you see that, @divadiow @insmod ? You did good job with research and porting. Did you try some other drivers... [Read more]

divadiow 19 Mar 2025 13:01

😁😁 are you finding wifi is OK @djbios? what's your RSSI shown in OBK? what's the distance from device to router/AP? what speed has it connected (if your router tells you)? Added after 14 [minutes]:... [Read more]

p.kaczmarek2 19 Mar 2025 17:46

@divadiow how many ECRs did you have with WiFi problems? [Read more]

divadiow 19 Mar 2025 18:07

only the WG236 modules in testing. Same as @insmod. I don't have a real ECR6600 device yet. [Read more]

p.kaczmarek2 19 Mar 2025 18:21

Did they come blank by default or with AT firmware? Is there a RF-calibration utility in the SDK? [Read more]

divadiow 19 Mar 2025 18:29

They come with something on. It feels more likely it's a calib issue with the WG236 modules specifically, yes. I'll take a fresh look this evening. I have already transplanted RF nv partition from Tuya... [Read more]

jannie_doedel 01 Apr 2025 14:52

works like a charme !! Tried to load NTP and worksfine too. Only chip temp is 0.0. Without config it showed 44 degrees. https://obrazki.elektroda.pl/5528931800_1743511812_thumb.jpg What is the... [Read more]

divadiow 01 Apr 2025 14:56

this one maybe? Added after 52 : template in device list is "14": "BL0937CF;0", "15": "BL0937SEL;0", "20": "BL0937CF1;0", "22": "WifiLED;0", "24": "Btn;1", "25": "Rel;1" [Read more]

jannie_doedel 01 Apr 2025 15:38

Yes thats the one. Thx ! Added after 2 [minutes]: The temperature indication must have been a glitch as it is working now [Read more]

insmod 01 Apr 2025 16:01

Not a glitch, on your screenshot there are 2 incomplete boots. If more than one - internal temperature readout is disabled. [Read more]

divadiow 24 May 2025 08:37

thanks for updating first post with a backup. Nothing new I'm afraid. boot log, fw version, product ID all same as the other plugs seen https://github.com/divadiow/Misc/tree/main/ECR6600_DECRYPT [Read more]

mlb 17 Aug 2025 18:46

It worked! :) I've modified 3 plugs successfully. The small challenge is indeed to turn power supply in a blink of an eye after pressing the start button in RDTool. Another issue I've noticed with the... [Read more]

mlb 21 Aug 2025 12:45

After trying to use those plugs for a few days, unfortunately I've discovered recurring wifi issues. They existed before uploading the new firmware, so I guess this is related to faulty wifi in ECR6600... [Read more]

divadiow 21 Aug 2025 13:06

maybe they have the same mac address. Do they each connect fine, in turn, if only one is switched on at any one time? I flashed my EU ECR6600 smart plug last night and mac is generic/0s, but I did... [Read more]

kennyyzm 23 Aug 2025 18:38

Hi guys, I have the same smart plug but I was not able to either backup old firmware not flash a new one. I keep getting RECV_RSP: recv timeout: recv length is: 1 (sometimes it's 3). https://obrazki.elektroda.pl/6596780400_1755966906_thumb.jpg... [Read more]

p.kaczmarek2 23 Aug 2025 18:48

So, how do you connect UART to your plug? Can you share some photos? [Read more]

kennyyzm 23 Aug 2025 19:02

Here's the photo, I broke both TX and RX pads and resorted to use the copper trace for both. https://obrazki.elektroda.pl/9111449500_1755968410_thumb.jpg [Read more]

p.kaczmarek2 23 Aug 2025 19:11

Well, first of all, you need to have a common ground between power supply and the UART... if you use external power supply, GND must connect to both external power supply GND and USB to UART converter... [Read more]

kennyyzm 23 Aug 2025 19:31

@pkaczmarek2 Wow, it works right away. Thanks for your help. I thought it's not possible to flash it anymore since I broke the pads, hehe, Thanks again! [Read more]

FAQ

TL;DR: You can replace the unstable Tuya firmware in the €5 TNCE smart plug with OpenBeken by soldering a 4-wire 3.3 V UART header and flashing the ECR6600 image through RDTool; the whole job takes under five minutes once pads are exposed and power-up timing (~0.5 s) is met [Elektroda, djbios, post #21485550]

Quick Facts

• MCU: TransaSemi ECR6600 Wi-Fi SoC, 8 MB flash [Elektroda, djbios, post #21485550]
• Power IC: BL0937CF energy-metering chip [Elektroda, djbios, post #21485550]
• Flash method: 4-wire 3.3 V UART via RDTool v1.0.21; typical flash time ≈25 s [Elektroda, djbios, post #21485550]
• Tested firmware: OpenBeken 1.18.62 (ECR6600 UART build) [Elektroda, djbios, post #21485550]
• Street price: ~€5 on AliExpress, March 2025 [Elektroda, djbios, post #21485550]

Which pins do I need for UART flashing?

Pads on the PCB rear expose 3.3 V, GND, RX and TX; connect them to a USB-UART adapter and add 3.3 V external power [Elektroda, djbios, post #21485550]

How do I enter the ECR6600 bootloader?

In RDTool click Start, then power the board within roughly 0.5 s; the chip autostarts in UART download mode if GPIO0 is high by default [Elektroda, djbios, post #21485550]

What OpenBeken template works for this plug?

{"14":"BL0937CF;0","15":"BL0937SEL;0","20":"BL0937CF1;0","22":"WifiLED;0","24":"Btn;1","25":"Rel;1"} [Elektroda, divadiow, post #21503405]

Why does the internal temperature occasionally read 0 °C?

OpenBeken disables the chip-temp sensor after two or more incomplete boots to avoid misleading data; perform a clean power-cycle to restore readings [Elektroda, insmod, post #21503467]

How accurate is the BL0937CF metering?

With factory resistor values it achieves ±1 % typical energy accuracy; “accuracy better than 0.5 % over 10-100 % load” (BL0937 datasheet).

What load can the relay handle?

The Songle SRD-05VDC-C module on the board is rated 10 A at 250 VAC per IEC-61058 [Songle Datasheet].

What causes Wi-Fi issues on some WG236 modules?

Early WG236 daughterboards shipped with bad RF calibration; transplanting a good nv partition or running the TransaSemi RF_CAL tool fixes RSSI drop [Elektroda, divadiow, post #21486822]
%}