logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[BL602/BL0937] Yet another Smart Socket 20A (but 16A)

flobuljeedom 18696 117

TL;DR

  • An Aubess smart plug from AliExpress uses an SM-028_V1.3 board with a BL602L02 chip and BL0937 power-monitoring IC.
  • The module was flashed with Bouffalo Lab Dev Cube through soldered FTDI232L connections on RX, TX, 3V3, and GND, with BT tied to VCC through 10 kΩ.
  • BL0937 CF1 connects to GPIO3, CF to GPIO14, SEL to GPIO21, LED to GPIO20, relay to GPIO2, and button to GPIO17.
  • Wi‑Fi setup succeeded after flashing, but the web app still shows zero power values, suggesting the BL0937 driver or HAL interrupt handling is still incomplete.
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • #91 21064560
    Raufaser
    Level 10  
    Posts: 47
    Help: 3
    Rate: 16
    D'oh ... sorry. Stupid me. TIL: There is configuration menu for startup, Thanks.

    But: The relais switches of for about half a second when the socket restarts. I guess, that is unavoidable?!

    I have a PC plugged into the socket ...
  • ADVERTISEMENT
  • #92 21065227
    miegapele
    Level 16  
    Posts: 173
    Help: 15
    Rate: 29
    Yes, there is no way to avoid power interruption in such case.
    Ideally issue with reboots should be fixed, but that is VERY hard unfortunately 😔
  • #93 21065657
    zdzihu123
    Level 11  
    Posts: 11
    Rate: 1
    You can achieve your goal simply by replacing or modding relay to be NC (normally closed).
  • ADVERTISEMENT
  • #94 21066374
    omniron
    Level 11  
    Posts: 114
    Help: 1
    Rate: 6
    Raufaser wrote:
    D'oh ... sorry. Stupid me. TIL: There is configuration menu for startup, Thanks.

    But: The relais switches of for about half a second when the socket restarts. I guess, that is unavoidable?!

    I have a PC plugged into the socket ...


    You could add a capacitor between base and GND of the driver transistor.
    The draw from the base and the 10K resistor in conjunction with the capacitor form a simple time delay
    .
  • #95 21066621
    Raufaser
    Level 10  
    Posts: 47
    Help: 3
    Rate: 16
    Thanks guys for the idea with modifying the relais or adding a delay. I will look into that. It would be a very good modification for a lot of my smart plugs, because I use them for all my PCs to track the power consumption. The plugs with Beken chips almost never reboot. But it could happen. BL602 and LN chips ... it happens.
  • #96 21139038
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    >>20856171

    Hello,

    I just registered because of this post.
    I didn't know until now of how to flash this chips.
    Thank you all for your effort.

    You mention

    "Easy to open with pliers. "

    I bought a pack of 4 pcs of this.
    I destroyed one if this unit while trying to open.
    Completely destroyed the plastic.

    Can you or someone do a video or something of how to open this?
    Because to me it seemed, when trying to open, that was glued or plastic soldered, I couldn't easily opened.
    I have more units waiting for this treatement...

    Thank you!
  • #97 21139324
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    Here is some LSPA9 'how to open' guide: Another ELIVCO LSPA9: BSD342-2110 PCB with [LN882H] and [BL0937]
    Here is some video: How to Open a Tuya LSPA9 WiFi Smart Plug Without Damaging It?

    give it a go let me know how it went
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #98 21139347
    miegapele
    Level 16  
    Posts: 173
    Help: 15
    Rate: 29
    I like this method, you can use pipe wrench if you don't have clamps, takes a bit longer bit should be quite simple.
  • #99 21140229
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    Many LSPA9 pieces varies a lot in the terms on the physical connection strength/glue. I had some LSPA9s that were very hard to open, and, on the other hand, I had LSPA9s that were very easy to open, they were almost like no glued at all.

    So how did it go, @banid0 ?
    Helpful post? Buy me a coffee.
  • #100 21140247
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    >>21140229
    Right now I am trying the wireless exploit, that I found out shortly after this, because the mechanic method makes me nightmares.

    I am stalling in the simplest part, getting into slow blinking mode as I mentioned in this thread https://www.elektroda.com/rtvforum/topic4040928.html

    If you can help.. :)
  • ADVERTISEMENT
  • #101 21140249
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    Do you still have the manual for your socket? It should explain well how to get into AP mode pairing.
    Helpful post? Buy me a coffee.
  • #102 21140257
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    >>21140249
    I would say it is highly unlikely I find it.
    Either was thrown in the garbage or it is "saved" where I cannot find it...

    Can we have another suggestion? :(
  • #103 21140270
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    My teardowns are always coming with manuals. You can check my LSPA9 topic for the manual that I had:
    https://www.elektroda.com/rtvforum/topic3887748.html
    Helpful post? Buy me a coffee.
  • #104 21140275
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    In the meantime I found ouy this manual
    is is not for my socket, but it only mentions fast blinking

    https://www.google.com/url?sa=t&source=web&rc...IQFnoECDQQAQ&usg=AOvVaw2g9RFtlnTuAnHpJiQ_pPAo

    could it be it only has flast blinking mode?

    I followed your link, thank you, and saw the manual. from memory, it seems similar to the one I had.

    I tried holding on and it doesn't go to slow blinking mode...

    should I pair it with the tuya app, or will it make worse?

    Added after 24 [minutes]:

    ...

    Well I have a lot of thing in house.
    Turns out I was trying to do this on a zigbee smart plug... Which obviously doesn't work.

    What an idiot, I just lost 4 hours on this...

    I was confused by memory...
    I bought Aubess zigbee plugs and AWOW wifi plugs...
    Let me see if I cant find the wifi ones and try again :'(

    Thank you for your help.
  • #105 21140307
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    I see, but just to be sure, was this plug marked as Zigbee? Maybe somewhere on the case? If not, that is something we certainly need to watch for in the future.
    Helpful post? Buy me a coffee.
  • #106 21140399
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    Just to be perfectly clear

    THIS ISN'T A CASE OF A BAD MARKED ITEM that the community must be aware.

    I have both zigbee and wifi plugs in my network. Mainly zigbee.
    I am experienced in both, know perfetly the difference.

    It was just a stupid mistake of getting the first one BEING SURE it was an wifi tuya plug and it WASN'T.

    Completely my mistake, nevermind and thank you for your help!!!

    Added after 44 [minutes]:

    Well it is a AWOW EU3S.
    I can't find the brand and model as a profile in tuya cloud cutter.

    How can I know which is the compatible profile when not appearing in the tuya cloud cutter app?

    I tried pairing in the tuya app and it gives am an error when trying to pair in slow blinking mode, and it appears an Wifi hotpot.
    is when tryign to connect to hotspot that gives the error.
  • #107 21140604
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    Well actually there is no way to determine it in a reliable way. That's why I always prefer to flash by UART...
    Helpful post? Buy me a coffee.
  • #108 21140838
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    Well, I managed to pair it in fast mode and not in slow mode. It said v1.0.0
    I tried all the 1.0.0 versions in tuya cloud cutter with no success.
    Then I went to see the one tat is open and broken, and it is an ESP8.... I though it wasn't
    It doesn't work with tuya convert, I nought this back in 2020 and tried that method, and it couldn't because the exploit was patched.

    I assumed it was because it was a different chip, but no.

    What are my options to take if off the cloud and an open source firmware? I am talking without opening and flashing it... OTA...

    Thank you!
  • #109 21140849
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    If it's ESP8266 and Tuya-convert is not working then you need to solder wires.
    Helpful post? Buy me a coffee.
  • #111 21274357
    andrewbeyou
    Level 2  
    Posts: 2
    >>21027185 Hi, i'm new here. I managed to flash the bl602 chip but i'm stuck, because all my values are 0. I see yours is quite working. can you give a hint please?
    Screenshot of the OpenBL602 interface displaying ON and detailed energy data.

    Update: After OTA "OpenBL602_1.17.756_OTA.bin.xz.ota" the values are ok, but the physical button is not working. ( "17": "Btn;1", )

    Update: physical button on my plug tuya plug is "22": "Btn;1" not "17": "Btn;1".
  • #112 21274400
    banid0
    Level 6  
    Posts: 14
    Rate: 1
    From what i remember i flashed rhia with esp home and not open beken… 😎
  • #113 21274471
    andrewbeyou
    Level 2  
    Posts: 2
    >>21274400 i know esphome, can you show me your yaml code?
  • #114 21423243
    bezzubov
    Level 2  
    Posts: 2
    I have firmware 1.3.18 on wifi socket 16A and can't change firmware on it by wifi, no profiles for this firmware. No software updates in SmartLife.
    It BL0937 and T34. Can you help me to cut it from cloud?
    Close-up of a circuit board with visible integrated circuits like BL0937 and T34. Image of an open electronic module with a PCB and electronic components. Smart plug box standing on a table. Packaging of a smart plug compatible with Amazon Alexa and Google Assistant.
  • #117 21423817
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14589
    Help: 654
    Rate: 12611
    Your T34 has clearly visible pads with solder, so accesing them should be relatively easy...
    Helpful post? Buy me a coffee.
  • #118 21734265
    mrdart
    Level 2  
    Posts: 2
    Hello! Today I successfully UART flashed Elivco BSD33 (with BL602C20 onboard) to version 1.18.206
    Close-up of PCB with BL602CG20 chip and SM-028-V1.3 marking

    And it works fine when i connect to it using internal acceesspoint or safeboot.
    But if run socket in real life - its web interface completely freezes after a several seconds (no web, no ping etc.) - at the same time phisycal button keeps working (switching rele) together with led.
    I left only rele, button and led at configuration, no bl0937, no mqtt, no drivers, no flags, no startup items, even watchdog is off - it freezes.
    Any thoughts on this? I'm almost gave up(
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on a Smart Plug purchased from AliExpress, identified as an Aubess device with an SM-028_V1.3 board featuring a BL602L02 chip and BL0937 energy metering IC. Users successfully opened and flashed the device using FTDI232L and Bouffalo Lab Dev Cube tools. Challenges include incomplete BL0937 interrupt counter support, pin mapping uncertainties, and unstable OTA firmware updates on the BL602 platform. Various firmware builds and pull requests were tested to improve OTA reliability, including reducing binary size and modifying flash erase procedures. Watchdog timer implementation was a major focus to address device freezes and unresponsiveness, with a watchdog driver added and tested to enable automatic reboot on crashes. Some users reported inconsistent device freezes, sometimes with partial functionality (e.g., button still working), suggesting possible TCP socket or memory leaks. Discussions also covered relay default state on power-up, with solutions involving startup commands or hardware modifications to maintain relay state through reboots. WiFi reception issues were noted, attributed to channel congestion rather than hardware faults. Additional topics included difficulties opening the device casing without damage, and clarifications on device identification to avoid confusion with Zigbee models. The thread also references related devices and firmware versions, with community contributions to device templates and driver improvements. Overall, the conversation highlights ongoing development and troubleshooting efforts to stabilize BL602-based smart sockets with BL0937 metering, improve OTA updates, implement watchdog recovery, and enhance user experience with relay control and device reliability.
Generated by the language model.
Today's popular

FAQ

TL;DR: "All 5 devices are still available" after BL602 software-watchdog support. This FAQ is for BL602/BL0937 smart-plug owners who need one practical answer set for UART flashing, GPIO mapping, zero readings, OTA failures, and freeze recovery on SM-028_V1.3-class sockets. [#21032468]

Why it matters: These plugs can look identical outside but differ in button GPIO, OTA behavior, and crash recovery, so one wrong assumption can leave power metering at 0 or make the socket freeze.

Variant MCU/module Common button GPIO Best flashing path Typical issue in thread
SM-028_V1.3 smart plug BL602L02 17 UART + Bouffalo Dev Cube BL0937 stayed at 0 before interrupt support
RMC021 / similar BL602 plug BL602 / SM-028_V1.3 22 UART + OpenBeken/OpenBL602 Random freezes after minutes or hours
CB2S plug BK7231N Varies Use BK7231N firmware, not BL602 Wrong-thread / wrong-firmware risk
ESP8266 Tuya plug ESP8266 Varies OTA only if exploit works; otherwise UART Tuya-convert patched on older units

Key insight: The turning point was not the pin template alone. BL602 plugs started reporting BL0937 values reliably only after BL602-specific interrupt handling worked, and long-term usability improved further once chunked OTA erase and the software watchdog were added.

Quick Facts

  • The first confirmed SM-028_V1.3 wiring mapped BL0937 CF1 to GPIO3, CF to GPIO14, SEL to GPIO21, relay to GPIO2, LED to GPIO20, and button to GPIO17. [#20856171]
  • A later RMC021 template kept relay on GPIO2, CF1 on GPIO3, CF on GPIO14, LED_n on GPIO20, and SEL on GPIO21, but moved the button to GPIO22. [#21025378]
  • One BL602 OTA log showed the firmware partition at offset 0x000d8000 with size 0x00088000 or 544 Kbytes, while the incoming OTA size shown was 557056 bytes. [#20921739]
  • One power-stage repair check measured about 365 V on the BP2525 input, 5.2 V on its output, then only 1.8 V into LM1117 and 0.8 V out, indicating a board-side power problem rather than firmware alone. [#21026208]

How do I flash an SM-028_V1.3 smart plug with a BL602L02 over UART using an FTDI adapter and Bouffalo Lab Dev Cube?

Wire it as a 3.3 V UART job and boot the BL602 with BT pulled high through 10 kΩ. 1. Solder RX↔TX, TX↔RX, 3V3↔VCC, and GND↔GND between SM-028_V1.3 and the FTDI232L. 2. Connect BT to VCC through a 10 kΩ resistor. 3. Flash with Bouffalo Lab Dev Cube, then disconnect the wires, reassemble the plug, and enter Wi-Fi credentials in the web interface after reboot. [#20856171]

What GPIO template works for the BL602/BL0937 Smart Socket 20A or RMC021 plug, including relay, LED, button, CF, CF1, and SEL pins?

A working RMC021 template uses relay on GPIO2, BL0937 CF1 on GPIO3, CF on GPIO14, LED_n on GPIO20, SEL on GPIO21, and button on GPIO22. The startup command shown was startDriver BL0937; startDriver NTP; startDriver SSDP. That mapping produced working switching and metering on a BL602 socket sold as an eWeLink Smart WiFi Socket 20A with SM-028_V1.3 hardware. [#21025378]

Why do BL0937 readings stay at 0 on a BL602 smart socket even after flashing OpenBeken and setting the pin mapping?

They stay at 0 when BL602 does not count the BL0937 pulse interrupts yet. The thread explicitly states that the BL0937 interrupt counter on BL602 was still missing, so the web app showed only zeroes even after a correct-looking pin map and driver startup. In short, the template alone was not enough before BL602-side interrupt support existed. [#20858308]

What is the BL0937 energy metering chip, and how do its CF, CF1, and SEL pins interact with a BL602 in OpenBeken?

"BL0937" is an energy-metering IC that outputs pulse signals for electrical measurements, using separate logic pins instead of a digital bus. In this plug, CF1 went to GPIO3, CF to GPIO14, and SEL to GPIO21 on the BL602. OpenBeken then used those pulse lines plus the selector line to derive voltage, current, and power data from the socket hardware. [#20856171]

Why was BL0937 support on BL602 initially not working, and what interrupt-related changes were needed to make it report values?

It initially failed because the BL602 driver path was not actually counting incoming BL0937 pulses. The key change was to make the BL602 interrupt handlers fire for CF and CF1 so g_vc_pulses and g_p_pulses increased. The thread also points to BL602 GPIO interrupt setup, including hal_gpio_register_handler(...), and questions whether those handlers were being called at all. [#20919426]

Which button GPIO should I use on these BL602/BL0937 plugs when one board uses GPIO17 and another uses GPIO22?

Use the GPIO that matches your exact PCB revision, and switch to GPIO22 if GPIO17 leaves the button dead. A later user confirmed that after updating to OpenBL602_1.17.756_OTA.bin.xz.ota, the metering values were correct but the physical button still failed until Btn;1 was moved from GPIO17 to GPIO22. That makes GPIO22 the right fix for at least one later Tuya variant. [#21274357]

What is a software watchdog on BL602, and how does it help recover a smart plug that freezes and stops responding to web, ping, and MQTT?

"Software watchdog" is a recovery mechanism that reboots the MCU when normal code stops servicing a timer, giving a frozen device a chance to return without manual power cycling. In the thread, BL602 plugs later restarted with reboot reason BL_RST_SOFTWARE_WATCHDOG, and users reported that this kept previously freezing devices available. It does not cure the root bug, but it changes a hard freeze into an automatic reboot. [#21030199]

How can I make a BL602 smart plug restore the relay state after reboot or power loss using OpenBeken startup settings?

Set the relay start state to -1 in the OpenBeken Startup tab. That is the thread’s recommended retain-style setting for restoring the previous relay state after a reboot. It does not force permanent ON, but it tells the plug to come back in the last known state instead of always defaulting OFF. [#21064535]

Why does a BL602 plug still briefly cut power during a watchdog reboot even when the relay start state is retained?

It cuts power because the relay physically drops during the reboot window. One user measured the interruption as about half a second, and the reply was direct: there is no way to avoid that power interruption during this kind of restart. Retaining the start state restores the relay afterward, but it cannot keep mains continuous while the MCU reboots. [#21065227]

What caused unreliable OTA updates on BL602, and how did chunked flash erase improve OpenBeken OTA flashing stability?

The main OTA problem was slow flash erase blocking the HTTP update flow. A developer reported that once erase changed to chunks, OTA "now works very well." Earlier failures often stalled after receiving and writing a 253-byte chunk, which matched the theory that long erase operations were starving the connection rather than the image simply being too large. [#20944841]

Why does SetupEnergyStats make some BL602 smart sockets freeze exactly after the configured interval, and what should I check to debug it?

It points to a repeatable timer-triggered fault, not a random network issue. One user showed that SetupEnergyStats 1 60 60 froze the device after 59 seconds, while SetupEnergyStats 1 70 60 froze it after 69 seconds. First remove the command from Startup, then run it once manually, and capture the last serial or web log before the exact freeze time. [#20944817]

How can I troubleshoot a BL602 socket that freezes after minutes or hours even with only basic drivers like BL0937, NTP, or SSDP enabled?

Start by changing one variable at a time and watching whether the physical button still works. 1. Check free heap over time. 2. Note whether HTTP dies while the button still toggles the relay. 3. Test with fewer network-facing features to isolate the trigger. The thread suggests a possible TCP/HTTP allocation problem on BL602 when button control still works but the web server no longer answers. [#21026582]

BL602 vs BK7231N or ESP8266 in smart plugs — what differences matter for flashing method, stability, and firmware choice?

The chip family decides the firmware and often the flashing path. A CB2S module is BK7231N, not BL602, so BL602 firmware is the wrong choice for that hardware. ESP8266 plugs are different again; in the same discussion family, patched OTA routes left users needing soldered UART access. Verify the module name first, because identical-looking plugs can belong to completely different firmware ecosystems. [#21026358]

What is SSDP in OpenBeken, and how could SSDP-related traffic contribute to crashes or responsiveness issues on BL602 devices?

"SSDP" is a network discovery protocol that advertises devices on the local LAN, generating repeated multicast traffic during normal operation. In the thread, a developer recommended disabling the SSDP driver first because it "generates quite a lot of traffic," and that traffic was considered a plausible stress point for BL602 stability testing. It was not the only suspected cause, but it was an early isolation step. [#21025388]

What’s the safest way to open Aubess, Elivco, or LSPA9-style smart plugs without destroying the plastic housing before UART flashing?

Use a clamp-style twist method, or a pipe wrench if you do not have clamps. The thread explicitly recommends that approach as simpler and less destructive than random prying. It also notes that LSPA9-family plugs vary a lot in glue strength, so some units open easily while others feel almost plastic-welded. Slow, even force is safer than screwdriver levering. [#21139347]
Generated by the language model.
ADVERTISEMENT