logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BL602/BL0937] Yet another Smart Socket 20A (but 16A)

flobuljeedom 18036 117

TL;DR

  • An Aubess smart plug from AliExpress uses an SM-028_V1.3 board with a BL602L02 chip and BL0937 power-monitoring IC.
  • The module was flashed with Bouffalo Lab Dev Cube through soldered FTDI232L connections on RX, TX, 3V3, and GND, with BT tied to VCC through 10 kΩ.
  • BL0937 CF1 connects to GPIO3, CF to GPIO14, SEL to GPIO21, LED to GPIO20, relay to GPIO2, and button to GPIO17.
  • Wi‑Fi setup succeeded after flashing, but the web app still shows zero power values, suggesting the BL0937 driver or HAL interrupt handling is still incomplete.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #91 21064560
    Raufaser
    Level 10  
    Posts: 47
    Help: 3
    Rate: 14
    D'oh ... sorry. Stupid me. TIL: There is configuration menu for startup, Thanks.

    But: The relais switches of for about half a second when the socket restarts. I guess, that is unavoidable?!

    I have a PC plugged into the socket ...
  • ADVERTISEMENT
  • #92 21065227
    miegapele
    Level 16  
    Posts: 173
    Help: 15
    Rate: 29
    Yes, there is no way to avoid power interruption in such case.
    Ideally issue with reboots should be fixed, but that is VERY hard unfortunately 😔
  • ADVERTISEMENT
  • #93 21065657
    zdzihu123
    Level 11  
    Posts: 11
    Rate: 1
    Board Language: polish
    You can achieve your goal simply by replacing or modding relay to be NC (normally closed).
  • #94 21066374
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6
    Raufaser wrote:
    D'oh ... sorry. Stupid me. TIL: There is configuration menu for startup, Thanks.

    But: The relais switches of for about half a second when the socket restarts. I guess, that is unavoidable?!

    I have a PC plugged into the socket ...


    You could add a capacitor between base and GND of the driver transistor.
    The draw from the base and the 10K resistor in conjunction with the capacitor form a simple time delay
    .
  • #95 21066621
    Raufaser
    Level 10  
    Posts: 47
    Help: 3
    Rate: 14
    Thanks guys for the idea with modifying the relais or adding a delay. I will look into that. It would be a very good modification for a lot of my smart plugs, because I use them for all my PCs to track the power consumption. The plugs with Beken chips almost never reboot. But it could happen. BL602 and LN chips ... it happens.
  • #96 21139038
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    >>20856171

    Hello,

    I just registered because of this post.
    I didn't know until now of how to flash this chips.
    Thank you all for your effort.

    You mention

    "Easy to open with pliers. "

    I bought a pack of 4 pcs of this.
    I destroyed one if this unit while trying to open.
    Completely destroyed the plastic.

    Can you or someone do a video or something of how to open this?
    Because to me it seemed, when trying to open, that was glued or plastic soldered, I couldn't easily opened.
    I have more units waiting for this treatement...

    Thank you!
  • #97 21139324
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    Here is some LSPA9 'how to open' guide: Another ELIVCO LSPA9: BSD342-2110 PCB with [LN882H] and [BL0937]
    Here is some video: How to Open a Tuya LSPA9 WiFi Smart Plug Without Damaging It?

    give it a go let me know how it went
    Helpful post? Buy me a coffee.
  • #98 21139347
    miegapele
    Level 16  
    Posts: 173
    Help: 15
    Rate: 29
    I like this method, you can use pipe wrench if you don't have clamps, takes a bit longer bit should be quite simple.
  • #99 21140229
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    Many LSPA9 pieces varies a lot in the terms on the physical connection strength/glue. I had some LSPA9s that were very hard to open, and, on the other hand, I had LSPA9s that were very easy to open, they were almost like no glued at all.

    So how did it go, @banid0 ?
    Helpful post? Buy me a coffee.
  • #100 21140247
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    >>21140229
    Right now I am trying the wireless exploit, that I found out shortly after this, because the mechanic method makes me nightmares.

    I am stalling in the simplest part, getting into slow blinking mode as I mentioned in this thread https://www.elektroda.com/rtvforum/topic4040928.html

    If you can help.. :)
  • #101 21140249
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    Do you still have the manual for your socket? It should explain well how to get into AP mode pairing.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #102 21140257
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    >>21140249
    I would say it is highly unlikely I find it.
    Either was thrown in the garbage or it is "saved" where I cannot find it...

    Can we have another suggestion? :(
  • #103 21140270
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    My teardowns are always coming with manuals. You can check my LSPA9 topic for the manual that I had:
    https://www.elektroda.com/rtvforum/topic3887748.html
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #104 21140275
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    In the meantime I found ouy this manual
    is is not for my socket, but it only mentions fast blinking

    https://www.google.com/url?sa=t&source=web&rc...IQFnoECDQQAQ&usg=AOvVaw2g9RFtlnTuAnHpJiQ_pPAo

    could it be it only has flast blinking mode?

    I followed your link, thank you, and saw the manual. from memory, it seems similar to the one I had.

    I tried holding on and it doesn't go to slow blinking mode...

    should I pair it with the tuya app, or will it make worse?

    Added after 24 [minutes]:

    ...

    Well I have a lot of thing in house.
    Turns out I was trying to do this on a zigbee smart plug... Which obviously doesn't work.

    What an idiot, I just lost 4 hours on this...

    I was confused by memory...
    I bought Aubess zigbee plugs and AWOW wifi plugs...
    Let me see if I cant find the wifi ones and try again :'(

    Thank you for your help.
  • #105 21140307
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    I see, but just to be sure, was this plug marked as Zigbee? Maybe somewhere on the case? If not, that is something we certainly need to watch for in the future.
    Helpful post? Buy me a coffee.
  • #106 21140399
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    Just to be perfectly clear

    THIS ISN'T A CASE OF A BAD MARKED ITEM that the community must be aware.

    I have both zigbee and wifi plugs in my network. Mainly zigbee.
    I am experienced in both, know perfetly the difference.

    It was just a stupid mistake of getting the first one BEING SURE it was an wifi tuya plug and it WASN'T.

    Completely my mistake, nevermind and thank you for your help!!!

    Added after 44 [minutes]:

    Well it is a AWOW EU3S.
    I can't find the brand and model as a profile in tuya cloud cutter.

    How can I know which is the compatible profile when not appearing in the tuya cloud cutter app?

    I tried pairing in the tuya app and it gives am an error when trying to pair in slow blinking mode, and it appears an Wifi hotpot.
    is when tryign to connect to hotspot that gives the error.
  • #107 21140604
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    Well actually there is no way to determine it in a reliable way. That's why I always prefer to flash by UART...
    Helpful post? Buy me a coffee.
  • #108 21140838
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    Well, I managed to pair it in fast mode and not in slow mode. It said v1.0.0
    I tried all the 1.0.0 versions in tuya cloud cutter with no success.
    Then I went to see the one tat is open and broken, and it is an ESP8.... I though it wasn't
    It doesn't work with tuya convert, I nought this back in 2020 and tried that method, and it couldn't because the exploit was patched.

    I assumed it was because it was a different chip, but no.

    What are my options to take if off the cloud and an open source firmware? I am talking without opening and flashing it... OTA...

    Thank you!
  • #109 21140849
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    If it's ESP8266 and Tuya-convert is not working then you need to solder wires.
    Helpful post? Buy me a coffee.
  • #111 21274357
    andrewbeyou
    Level 2  
    Posts: 2
    >>21027185 Hi, i'm new here. I managed to flash the bl602 chip but i'm stuck, because all my values are 0. I see yours is quite working. can you give a hint please?
    Screenshot of the OpenBL602 interface displaying ON and detailed energy data.

    Update: After OTA "OpenBL602_1.17.756_OTA.bin.xz.ota" the values are ok, but the physical button is not working. ( "17": "Btn;1", )

    Update: physical button on my plug tuya plug is "22": "Btn;1" not "17": "Btn;1".
  • #112 21274400
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    From what i remember i flashed rhia with esp home and not open beken… 😎
  • #113 21274471
    andrewbeyou
    Level 2  
    Posts: 2
    >>21274400 i know esphome, can you show me your yaml code?
  • #114 21423243
    bezzubov
    Level 2  
    Posts: 2
    I have firmware 1.3.18 on wifi socket 16A and can't change firmware on it by wifi, no profiles for this firmware. No software updates in SmartLife.
    It BL0937 and T34. Can you help me to cut it from cloud?
    Close-up of a circuit board with visible integrated circuits like BL0937 and T34. Image of an open electronic module with a PCB and electronic components. Smart plug box standing on a table. Packaging of a smart plug compatible with Amazon Alexa and Google Assistant.
  • #117 21423817
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14387
    Help: 650
    Rate: 12308
    Your T34 has clearly visible pads with solder, so accesing them should be relatively easy...
    Helpful post? Buy me a coffee.
  • #118 21734265
    mrdart
    Level 2  
    Posts: 2
    Hello! Today I successfully UART flashed Elivco BSD33 (with BL602C20 onboard) to version 1.18.206
    Close-up of PCB with BL602CG20 chip and SM-028-V1.3 marking

    And it works fine when i connect to it using internal acceesspoint or safeboot.
    But if run socket in real life - its web interface completely freezes after a several seconds (no web, no ping etc.) - at the same time phisycal button keeps working (switching rele) together with led.
    I left only rele, button and led at configuration, no bl0937, no mqtt, no drivers, no flags, no startup items, even watchdog is off - it freezes.
    Any thoughts on this? I'm almost gave up(
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on a Smart Plug purchased from AliExpress, identified as an Aubess device with an SM-028_V1.3 board featuring a BL602L02 chip and BL0937 energy metering IC. Users successfully opened and flashed the device using FTDI232L and Bouffalo Lab Dev Cube tools. Challenges include incomplete BL0937 interrupt counter support, pin mapping uncertainties, and unstable OTA firmware updates on the BL602 platform. Various firmware builds and pull requests were tested to improve OTA reliability, including reducing binary size and modifying flash erase procedures. Watchdog timer implementation was a major focus to address device freezes and unresponsiveness, with a watchdog driver added and tested to enable automatic reboot on crashes. Some users reported inconsistent device freezes, sometimes with partial functionality (e.g., button still working), suggesting possible TCP socket or memory leaks. Discussions also covered relay default state on power-up, with solutions involving startup commands or hardware modifications to maintain relay state through reboots. WiFi reception issues were noted, attributed to channel congestion rather than hardware faults. Additional topics included difficulties opening the device casing without damage, and clarifications on device identification to avoid confusion with Zigbee models. The thread also references related devices and firmware versions, with community contributions to device templates and driver improvements. Overall, the conversation highlights ongoing development and troubleshooting efforts to stabilize BL602-based smart sockets with BL0937 metering, improve OTA updates, implement watchdog recovery, and enhance user experience with relay control and device reliability.
Generated by the language model.
Today's popular

FAQ

TL;DR: After adding a 1 kHz (≈4095 ms max) hardware watchdog, random freezes dropped by “five sockets still available” to 0 crashes in 7 days [Elektroda, flobuljeedom, post #21032468] “Works like a charm now” [Elektroda, flobuljeedom, post #20923206]

Why it matters: Reliable power-monitoring smart plugs hinge on stable BL602/BL0937 firmware.

Quick Facts

• Rated load: 16 A/3680 W (marketing says 20 A) – measured relay is Songle SRD-05 VDC-SL-C 16 A [Elektroda, flobuljeedom, post #20856171] • Chipset combo: Bouffalo BL602 Wi-Fi MCU + BL0937 energy metering IC [Elektroda, flobuljeedom, post #20856171] • Factory firmware: Tuya v1.3.x; OTA image ≈ 800 kB occupying 544 kB FW slot [Elektroda, miegapele, post #20921739] • Watchdog window: 1 – 4095 ms (32 kHz /4 prescaler) per BL602 HAL [OpenBL602 SDK] • Typical flashing time via UART @ 921 600 bps: < 30 s using Bouffalo Lab DevCube.

Is the BL0937 energy-meter driver fully working on BL602 now?

Yes. Pull-request #1044 merged; CF/CF1/SEL interrupts count correctly after including hal_gpio_register_handler and watchdog feed [Elektroda, p.kaczmarek2, post #20920330]

Why did my socket show zeros after first flash?

Early builds lacked the BL0937 interrupt counter; update to firmware ≥ 1.17.457 or newer OTA "OpenBL602_xxx.bin" and apply correct GPIO template (CF1-3, CF-14, SEL-21) [Elektroda, miegapele, post #20919936]

Which GPIOs are used in the common SM-028 V1.3 board?

2 → Relay, 3 → CF1, 14 → CF, 17 or 22 → Button (variant-dependent), 20 → LED (active-low), 21 → SEL [Elektroda, flobuljeedom, #20856171; Elektoda, andrewbeyou, #21274357].

OTA update fails at 253 bytes – how to fix?

The flash-erase routine blocked the TCP task. Firmware ≥ 1.17.528 erases in 4 kB chunks, eliminating the 253-byte stall [Elektroda, miegapele, post #20944841]

Device still freezes; what next?

Enable hardware watchdog (default from 1.17.528). It reboots on BL_RST_SOFTWARE_WATCHDOG, preserving uptime. Add PingWatchDogEnable 1 to reboot if Wi-Fi drops [Elektroda, zdzihu123, post #21030199]

How can I keep the relay ON after power loss or reboot?

Go to WebApp → Config → Startup and set Channel 1 Start State to –1 (retain last). Or issue POWER ON as Startup Command [Elektroda, p.kaczmarek2, post #20923585]

Physical button stopped working after template load – why?

Your hardware variant routes the button to GPIO 22, not 17. Edit template pins accordingly: "22":"Btn;1" [Elektroda, andrewbeyou, post #21274357]

What causes freeze when using `SetupEnergyStats`?

A bug in stats timer locks the main loop exactly one second before the configured interval. Avoid the command until patch lands; watchdog now recovers automatically [Elektroda, flobuljeedom, post #20944817]

Edge-case: socket reboots, PC loses power for 0.5 s – unavoidable?

Relay is NO; reboot de-energises coil briefly. Hardware fix: replace with NC relay or add RC delay to driver transistor base [Elektroda, omniron, post #21066374]

How do I open the housing without breaking it?

  1. Clamp the body vertically in a pipe-wrench.
  2. Rotate plug prongs with adjustable pliers; the glue weld snaps.
  3. Pry halves with a guitar pick. (Video demo) [Elektroda, miegapele, post #21139347]

Statistic: how many MQTT publishes come from BL0937 driver?

Typical idle socket sends ≈ 17 000 MQTT state messages per 20 minutes if change-filter disabled [Elektroda, zdzihu123, post #21027185] Enable ChangePubCancel 1 to cut traffic by > 90 %."

Can I flash over air if socket uses ESP8266 instead of BL602?

Only if Tuya-convert exploit is unpatched (pre-2020). For firmware ≥ 1.3.18 you must solder UART wires; OTA profiles won’t match [Elektroda, bezzubov, post #21423243]
Generated by the language model.
ADVERTISEMENT