logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Sonoff S60TPG iPlug UK Smart Plug Investigation [ESP32-C3] [CSE7759B] [SM-049]

divadiow 
A product page for the Sonoff S60 UK Plug TPG 13A smart plug, showing the plug, its box, and promotional pricing details.
Here are my experiences with a Sonoff S60TPG iPlug UK smart plug, along with teardown, flashing information and OpenESP32 experiments (OBK port).


Gray box of Sonoff S60TPG iPlug Type G smart plug on a beige carpet. Box of Sonoff S60TPG iPlug UK smart plug with product label and barcode. Box of Sonoff Type G Wi-Fi Smart Plug on a beige carpet. Gray box of Sonoff iPlug S60TPG Type G placed on a beige carpet. Sonoff S60TPG iPlug smart plug, manual, and Type G box on a carpet. Close-up of the label on the Sonoff S60TPG smart plug with three UK metal prongs visible.
The plug was bought from Ali Express
https://nl.aliexpress.com/item/1005006764953793.html

Glue seemed to be too strong and I didn't have the right width tools to contort it in a vice to crack it open. I resorted to drilling a hole at the chassis join from which it could be pried apart. Main PCB removed from power pins and then module de-soldered.

Close-up of a UK smart plug with a drilled hole at the seam and visible crack along the plastic enclosure. Disassembled Sonoff S60TPG UK smart plug with exposed PCB and electronic components. Top view of the inside of a Sonoff S60TPG iPlug UK smart plug, showing electronic components on the PCB. Close-up of the internal PCB of a Sonoff S60TPG plug, showing the SM-049 ESP32-C3 module and electronic components. Close-up of a FANHAR relay and electronic components on a smart plug’s PCB. Close-up of the interior of a Sonoff S60TPG iPlug UK smart plug showing electronic components and connectors. Close-up of the inside of a Sonoff S60TPG smart plug, showing the PCB, power contacts, and electronic components. The inside of an empty Sonoff S60TPG iPlug UK plug case with visible partitions, no electronics inside. Close-up of a smart plug interior showing a PCB, two LEDs, and a Chipsea CSE7759B chip. Close-up of the Sonoff S60TPG smart plug PCB with visible electronic components, capacitors, and a relay. Close-up of a smart plug PCB with a FANHAR FH17-1A2TE relay and visible electronic components.
Fragment of a round PCB from Sonoff S60TPG plug, with labeled pins and electronic components visible. A fragment of the Sonoff S60TPG PCB showing pin labels, electronic components, and solder pads. A PCB module with a black CSE7759B chip and markings ROHS and E506706. Top view of the SM-049 ESP32-C3 V1.3 PCB module, showing component layout and pin labels. ESP32-C3 SM-049 V1.3 module on a green PCB with pin labels, top view. Electronic module with CHIPSEA CSE7759B chip mounted on a green PCB with ROHS marking and several connectors.

A module I've not seen before. A Coolkit SM-049 V1.3 - an ESP32-C3 with 4mb flash integrated. On the reverse of the module is a Chipsea Technologies CSE7759B energy metering chip. Module takes 5V from main PCB but then 3.3v supplied to ESP32 thanks to a MicrOne (Nanjing Micro One Elec) ME6211A33PG-N 6211A 2438/33 LDO.

Close-up of ME6211A33PG-N 6211A voltage regulator IC on a green PCB, with visible 5V, KEY, and RST labels.

from IO21/TX at 115200 baud, factory boot log

Code: Text
Log in, to see the code



eWeLink app experience. fw ver 1.1.1 with update to 1.2.0 offered

Screenshot of a mobile app showing the SONOFF S60TPG device detected during the add device process.Screenshot of eWeLink app with S60TPG smart plug turned on, showing zero power usage. Mobile app screen for the Sonoff S60TPG smart plug in eWeLink, showing firmware update notification and device stats. Mobile app screen showing energy summary with current 0.25 A, voltage 5.43 V, power 7.26 W, and 0 kWh energy usage today, yesterday, and this month. Screenshot of Sonoff S60TPG device settings in a mobile app, showing current firmware version and various configuration options. Firmware update notification explaining daylight saving time handling and update steps for the eWeLink app.


IO9/Key grounded gets ESP into download mode

Code: Text
Log in, to see the code


info gathering with esptool

esptool.exe --port com73 get_security_info
Code: Text
Log in, to see the code


good, no secure boot or flash encryption.

espefuse.exe --chip esp32c3 --port COM73 summary
Code: Text
Log in, to see the code


dump to file
esptool.exe --chip esp32c3 --port COM73 --baud 921600 read_flash 0x000000 0x400000 flash_dump.bin

Flashed OpenESP32C3 factory image with esp-flasher.exe from https://github.com/Jason2866/ESP_Flasher/releases

Module contact tracing and labels

ESP32-C3 SM-049 V1.3 board with labeled pins and a pinout diagram in the corner.
Photo of an electronic module with a CHIPEA CSE7759B chip, labeled pins GPIO10, GPIO9 (KEY/BTN), and TX/C3-GPIO7, plus ESP32-C3 and CSE7759B diagrams.

Fragment of a Sonoff smart plug PCB with labeled pins and signal names visible.

Meaning the assignments are

Code: JSON
Log in, to see the code


The blue wifi LED is controllable but the second red LED is linked to the relay. On=relay closed, Off=relay open.

ESP builds are missing the CSE7766 driver (compatible with CSE7759B), so I enabled it with this PR https://github.com/openshwprojects/OpenBK7231T_App/pull/1642 but @insmod warned me in the comments that it may not work. This is my first CSE7759B - from what I've seen in other posts it seems only the driver needs starting and perhaps flag 26 ([UART] Use alternate UART for BL0942, CSE, TuyaMCU, etc) needs enabling in some situations. Unfortunately no readings on ESP32 with or without flag. IO7 is connected to TX on the CSE7759B.

Diagram of the CSE7759B chip with the TI pin highlighted and labeled TX/C3-GPIO7.

Screenshot of OpenESP32C3 web interface showing relay switched off and all sensor readings at zero.

and that's the current state of play.
About Author
divadiow
divadiow wrote 2731 posts with rating 469 , helped 245 times. Live in city Bristol. Been with us since 2023 year.

Comments

Add a comment
p.kaczmarek2 21 May 2025 00:48

Interesting, which brings us the question how we can futher test and improve the CSE and UART drivers.... maybe try to get a valid CSE packet and then do remaining operations on the ESP dev board, while... [Read more]

divadiow 21 May 2025 23:29

I'll try to set up some kind of CSE simulation. Hopefully it'll be more reliable and indicative of a real CSE than the BL0937 simulator attempts with PWM and Arduino sketch. No idea about how good the... [Read more]

p.kaczmarek2 22 May 2025 13:29

I've also got Sonoff but the one with CSE7761, which has different UART protocol. I will have few spare hours today and I will try porting some driver, but I'm not sure if it will work with unstable UART.... [Read more]

divadiow 22 May 2025 14:06

cool. ESP Sonoff I assume? Added after 22 [minutes]: yes :) https://github.com/openshwprojects/OpenBK7231T_App/commit/e64ccf49abd3adc078753feffe893ca2587ce424 [Read more]

p.kaczmarek2 22 May 2025 14:08

Is PROTA working for you on ESP?" I get: 2025-05-22 14:02:40: [Found matching file: OpenESP32C2_1645_merge_1d63268bd632.img] 2025-05-22 14:02:40: [Sending... [Read more]

divadiow 22 May 2025 14:28

yikes. a lot of artefacts now. worked though https://obrazki.elektroda.pl/1523743000_1747916891_bigthumb.jpg 025-05-22 13:26:17: [Checking zip file: C:\Users\divad\Downloads\PROTATool (1)\1645/97086a1b8ac6e01527a6a726f6260bf5af25c7e1\OpenBK7231T_App_cse_97086a1b8ac6_OpenESP32C2.zip] 2025-05-22... [Read more]

p.kaczmarek2 22 May 2025 14:36

2025-05-22 14:32:23: [Found matching file: OpenESP32C2_cse_97086a1b8ac6.img] 2025-05-22 14:32:23: [Sending OTA data to http://192.168.0.162/api/ota attempt... [Read more]

divadiow 22 May 2025 14:39

Not sure what you mean. I was testing on C3 SuperMini and that was matched OK. Is your Sonoff not C2? [Read more]

p.kaczmarek2 22 May 2025 14:40

No, it's ESP32 but code in PROTA uses Contains and it tries first binary with ESP32 in name - obviously a bug [Read more]

divadiow 22 May 2025 14:54

oh i get you. yes my ESP32 gets sent C2 ota too 2025-05-22 13:51:16: [Found matching file: OpenESP32C2_cse_97086a1b8ac6.img] 2025-05-22 13:51:16: 2025-05-22 13:51:29: [Error sending OTA update:... [Read more]

p.kaczmarek2 22 May 2025 18:36

I've added a fix, the substring approach was treating ESP32S2 as ESP32. [Read more]

divadiow 23 May 2025 06:23

How's it going with the CSE7761 experience on ESP? [Read more]

p.kaczmarek2 23 May 2025 09:17

I've did some tests but I couldn't get receiving to work. I've also realized that we need HAL to choose custom UART pins on ESP32 (@insmod but I also may do it soon). My current plan is to just take an... [Read more]

insmod 23 May 2025 09:25

I thought about playing with UART again and adding ESP pin selection after w800/berry and then bk7231u/7252 is merged. Initial idea is to add something like HAL_AddPlatformSpecificCommands() and executing... [Read more]

divadiow 23 May 2025 09:57

this would be good. I'm just flashing new BK7252U device with same tests as in doorbell thread. [Read more]

p.kaczmarek2 23 May 2025 13:01

So w800 + berry is ready to merge? [Read more]

insmod 23 May 2025 13:41

Yes. The only recommendation for BL602 is to use partition layout toml from here: https://github.com/openshwprojects/OpenBK7231T_App/pull/1629#issuecomment-2876874850 You can even try to enable berry... [Read more]

p.kaczmarek2 23 May 2025 14:02

Permanent or recoverable via UART? Would it possible to add a safe check for that? [Read more]

insmod 23 May 2025 14:07

Recoverable. I don't know how OTA is performed on BL602, but if there is a header with unpacked size, then perhaps it's possible. [Read more]