![[ZIGBEE] 20A Zigbee socket with energy metering (Tuya TS011F_plug_3)](https://obrazki.elektroda.pl/1000454900_1749493372_thumb.jpg)
![[W600 / TW-03] Door Sensor - Bootloop on 1.18.110/109 Firmware](https://obrazki.elektroda.pl/5552096400_1749191730_thumb.jpg)
Amysen YX-WS01, FCC ID 2AOT8-WS01, module YX-X3-T71C-VER03, chip TG7100C (a clone of the BL602)
I purchased these in Nov 2022 via Amazon.com in the US, hoping that they'd be Cloud-Cuttable, but was quickly discouraged after opening one up - the chipset was neither ESP8266 nor BK7321... and I did try to get it to go into AP mode, but no joy there. Upon closer examination, I found the chip on the Wifi module was labeled "TG7100C".
(Note that at least five different vendors (Esicoo, Ecoey, Amysen, Tuya, Unbranded, etc.) have sold smart plugs labeled YX-WS01, but both the firmware and chipset has changed over the years. The original version was easily convertible to Tasmota and/or Tuya, then some lockdowns due to firmware changes, and then came chipset change(s).
After some digging [ https://twitter.com/madushan1000/status/1367041198851035137 ] it seems that the TG7100C is just a clone of the BL602. Evidence is in the SDK [ https://github.com/Ai-Thinker-Open/Ai-Thinker...vice_tree/chip_factory_params_IoTKitA_24M.dts ], for instance.
In order to flash it, I had to do a teardown and solder/connect it via UART/serial, Bouffalo Labs flasher.
==========================================================
After removing module, connecting it via Bouffalo Lab Dev Cube w/ FTDI USB adapter:
Flashing the removed module worked fine, and here is a template for it:
I purchased these in Nov 2022 via Amazon.com in the US, hoping that they'd be Cloud-Cuttable, but was quickly discouraged after opening one up - the chipset was neither ESP8266 nor BK7321... and I did try to get it to go into AP mode, but no joy there. Upon closer examination, I found the chip on the Wifi module was labeled "TG7100C".
(Note that at least five different vendors (Esicoo, Ecoey, Amysen, Tuya, Unbranded, etc.) have sold smart plugs labeled YX-WS01, but both the firmware and chipset has changed over the years. The original version was easily convertible to Tasmota and/or Tuya, then some lockdowns due to firmware changes, and then came chipset change(s).
After some digging [ https://twitter.com/madushan1000/status/1367041198851035137 ] it seems that the TG7100C is just a clone of the BL602. Evidence is in the SDK [ https://github.com/Ai-Thinker-Open/Ai-Thinker...vice_tree/chip_factory_params_IoTKitA_24M.dts ], for instance.
/dts-v1/;
/include/ "bl602_base.dtsi";
// version: 17
// last_comp_version: 16
// boot_cpuid_phys: 0x0
/ {
model = "bl bl602 IOT board";
compatible = "bl,bl602-sample", "bl,bl602-common";
#address-cells = <0x1>;
#size-cells = <0x1>;
gpio {
#address-cells = <1>;
#size-cells = <1>;
max_num = <40>;
gpio0 {
status = "okay";
pin = <5>;
feature = "led";
active = "Hi"; //Hi or Lo
mode = "blink"; //blink or hearbeat
time = <100>; //duration for this mode
};
gpio1 {
status = "disable";
pin = <6>;
feature = "led";
active = "Hi"; //Hi or Lo
mode = "blink"; //blink or hearbeat
time = <100>; //duration for this mode
};
gpio2 {
status = "okay";
pin = <2>;
feature = "button";
active = "Hi";
mode = "multipress";
button {
debounce = <10>;
short_press_ms {
start = <100>;
end = <3000>;
kevent = <2>;
};
long_press_ms {
start = <6000>;
end = <10000>;
kevent = <3>;
};
longlong_press_ms {
start = <15000>;
kevent = <4>;
};
trig_level = "Hi";
};
hbn_use = "disable";
};
};
i2s {
#address-cells = <1>;
#size-cells = <1>;
i2s@40017000 {
status = "okay";
compatible = "bl602_i2s";
reg = <0x40017000 0x100>;
mclk_only = "okay";
pin {
mclk = <11>;
};
};
i2s@40017100 {
status = "okay";
compatible = "bl602_i2s";
reg = <0x40017100 0x100>;
mclk_only = "disable";
pin {
bclk = <12>;
fs = <29>;
do = <30>;
di = <31>;
};
};
};
i2c {
#address-cells = <1>;
#size-cells = <1>;
i2c@40011000 {
status = "okay";
compatible = "bl602_i2c";
reg = <0x40011000 0x100>;
pin {
scl = <32>;
sda = <13>;
};
devices {
list_addr = <0x18 0x21>;
list_driver = "i2c_es8311", "i2c_gc0308>";
};
};
i2c@40011100 {
status = "disable";
compatible = "bl602_i2c";
reg = <0x40011100 0x100>;
pin {
/*empty here*/
};
};
};
timer {
#address-cells = <1>;
#size-cells = <1>;
timer@40014000 {
status = "disable";
compatible = "bl602_timer";
reg = <0x40014000 0x100>;
};
timer@40014100 {
status = "disable";
compatible = "bl602_timer";
reg = <0x40014100 0x100>;
};
};
pwm {
#address-cells = <1>;
#size-cells = <1>;
pwm@4000A420 {
status = "okay";
compatible = "bl602_pwm";
reg = <0x4000A420 0x20>;
path = "/dev/pwm0";
id = <0>;
pin = <0>;
freq = <800000>;
duty = <50>;
};
pwm@4000A440 {
status = "disable";
reg = <0x4000A440 0x20>;
path = "/dev/pwm1";
id = <1>;
pin = <1>;
freq = <5000>;
duty = <50>;
};
pwm@4000A460 {
status = "disable";
reg = <0x4000A460 0x20>;
path = "/dev/pwm2";
id = <2>;
pin = <2>;
freq = <5000>;
duty = <50>;
};
pwm@4000A480 {
status = "disable";
reg = <0x4000A480 0x20>;
path = "/dev/pwm3";
id = <3>;
pin = <3>;
freq = <5000>;
duty = <50>;
};
pwm@4000A4A0 {
status = "disable";
reg = <0x4000A4A0 0x20>;
path = "/dev/pwm4";
id = <4>;
pin = <4>;
freq = <5000>;
duty = <50>;
};
};
ir {
#address-cells = <1>;
#size-cells = <1>;
ctrltype = <0>;
tx {
status = "disable";
pin = <11>; // only support 11
mode = "NEC"; // NEC,ExtenedNEC,RC5,SWM
interval = <100>; // ms
active_mode = "Hi"; //Hi,Lo
};
rx {
status = "okay";
pin = <12>; // only support 12 13
mode = "NEC"; // NEC,ExtenedNEC,RC5,SWM
active_mode = "Hi"; //Hi,Lo
data_check = <2>; //bit 0:check cmd, bit 1:check addr
};
};
uart {
#address-cells = <1>;
#size-cells = <1>;
uart@4000A000 {
status = "okay";
id = <0>;
compatible = "bl602_uart";
path = "/dev/ttyS0";
baudrate = <2000000>;
pin {
rx = <7>;
tx = <16>;
};
buf_size {
rx_size = <512>;
tx_size = <512>;
};
feature {
tx = "okay";
rx = "okay";
cts = "disable";
rts = "disable";
};
};
uart@4000A100 {
status = "okay";
id = <1>;
compatible = "bl602_uart";
path = "/dev/ttyS1";
baudrate = <115200>;
pin {
rx = <3>;
tx = <4>;
};
buf_size {
rx_size = <512>;
tx_size = <512>;
};
feature {
tx = "okay";
rx = "okay";
cts = "disable";
rts = "disable";
};
};
};
spi {
#address-cells = <1>;
#size-cells = <1>;
spi@4000F000 {
status = "okay"; /* okay disable */
mode = "master";
reg = <0x4000F000 0x100>; /* 4KB */
path = "/dev/spi0";
port = <0>;
polar_phase = <1>; /* 0,1,2,3 */
freq = <6000000>;
pin {
clk = <3>;
cs = <2>;
mosi = <1>;
miso = <0>;
};
dma_cfg {
tx_dma_ch = <2>;
rx_dma_ch = <3>;
};
};
};
gpip {
#address-cells = <1>;
#size-cells = <1>;
adc_key {
status = "disable";
pin = <9>;
interrupt = <3>;
key_vol = <0 100 400 300 500>;
key_pcb = "SW1", "SW2", "SW3", "SW4","SW5";
key_event = "Usr1", "Usr2", "Start", "Up", "Down";
key_raw = <1 2 3 4 5>;
};
};
qspi {
#address-cells = <1>;
#size-cells = <1>;
qspi@4000A000 {
status = "disable";
reg = <0x4000A000 0x1000>;/* 4KB */
};
};
wifi {
#address-cells = <1>;
#size-cells = <1>;
region {
country_code = <86>;
};
mac {
mode = "MBF";
sta_mac_addr = [C8 43 57 82 73 40];
ap_mac_addr = [C8 43 57 82 73 02];
};
sta {
ssid = "yourssid";
pwd = "yourapssword";
auto_connect_enable = <0>;
};
ap {
ssid = "bl_test_005";
pwd = "12345678";
ap_channel = <11>;
auto_chan_detect = "disable";
};
brd_rf {
xtal_mode = "MF";
xtal = <36 36 0 60 60>;
/*
pwr_table = < 4 3 3 186
4 3 4 176
4 3 5 167
3 3 0 159
3 3 1 149
3 3 2 140
3 3 3 129
3 3 4 119
3 3 5 110
2 3 0 101
2 3 1 91
2 3 2 82
2 3 3 72
2 3 4 62
2 3 5 52
1 3 3 10>;
*/
pwr_mode = "bf";//B: only use power offset in EFUSE; b: use power offset in EFUSE with incremental mode; F: only use power offset in Flash; f: use power offset in Flash with incremental mode
pwr_table_11b = <20 20 20 18>;//1Mbps 2Mbps 5.5Mbps 11Mbps
pwr_table_11g = <18 18 18 18 18 18 14 14>; //6Mbps 9Mbps 12Mbps 18MBps 24Mbps 36Mbps 48Mbps 54Mbps
pwr_table_11n = <18 18 18 18 18 16 14 14>; //MCS0 MCS1 MCS2 MCS3 MCS4 MCS5 MCS6 MCS7
pwr_offset = <10 10 10 10 10 10 10 10 10 10 10 10 10 10>;//due to the limit of current DTC, negative value is used. So we work around by adding all the poweroffset with 10. so 8 represents -2; 10 represents 0; 13 represents 3
};
rf_temp {
en_tcal = <0>;
linear_or_follow = <1>;
Tchannels = <2412 2427 2442 2457 2472>;
Tchannel_os = <180 168 163 160 157>;
Tchannel_os_low = <199 186 170 165 160>;
Troom_os = <255>;
//negative value is NOT supported. So we use '256' for 0, '255' for -1, '257' for 1,'511' for 256
};
};
bluetooth {
#address-cells = <1>;
#size-cells = <1>;
brd_rf {
pwr_table_ble = <13>; //range:-3~15dbm; if set -3, please set 253 here
};
};
};In order to flash it, I had to do a teardown and solder/connect it via UART/serial, Bouffalo Labs flasher.
==========================================================
After removing module, connecting it via Bouffalo Lab Dev Cube w/ FTDI USB adapter:
[00:14:07.525] - serial type is general
[00:14:07.580] - Open COM3 Success
[00:14:14.238] - start-----------hal
[00:14:14.242] - [MTD] >>>>>> Hanlde info Dump >>>>>>
[00:14:14.245] - name PARAM2
[00:14:14.247] - id 0
[00:14:14.250] - offset 001fc000(2080768)
[00:14:14.253] - size 00002000(8Kbytes)
[00:14:14.256] - xip_addr 00000000
[00:14:14.259] - [MTD] <<<<<< Hanlde info End <<<<<<
[00:14:14.261] - Read slot:0
[00:14:14.264] - No written slot found
[00:14:14.266] - [BL] [SEC] TRNG Handler
[00:14:14.310] - 1th channel,lo_vco_freq_cw=146
[00:14:14.312] - 2th channel,lo_vco_freq_cw=145
[00:14:14.315] - 3th channel,lo_vco_freq_cw=144
[00:14:14.319] - 4th channel,lo_vco_freq_cw=142
[00:14:14.322] - 5th channel,lo_vco_freq_cw=141
[00:14:14.324] - 6th channel,lo_vco_freq_cw=140
[00:14:14.327] - 7th channel,lo_vco_freq_cw=139
[00:14:14.330] - 8th channel,lo_vco_freq_cw=138
[00:14:14.333] - 9th channel,lo_vco_freq_cw=136
[00:14:14.336] - 10th channel,lo_vco_freq_cw=135
[00:14:14.338] - 11th channel,lo_vco_freq_cw=134
[00:14:14.345] - 12th channel,lo_vco_freq_cw=133
[00:14:14.347] - 13th channel,lo_vco_freq_cw=132
[00:14:14.352] - 14th channel,lo_vco_freq_cw=130
[00:14:14.355] - 15th channel,lo_vco_freq_cw=129
[00:14:14.359] - 16th channel,lo_vco_freq_cw=128
[00:14:14.363] - 17th channel,lo_vco_freq_cw=127
[00:14:14.366] - 18th channel,lo_vco_freq_cw=126
[00:14:14.369] - 19th channel,lo_vco_freq_cw=124
[00:14:14.374] - 20th channel,lo_vco_freq_cw=123
[00:14:14.377] - 21th channel,lo_vco_freq_cw=122
[00:14:14.381] - 0th channel,vco_idac_cw=10
[00:14:14.383] - 1th channel,vco_idac_cw=10
[00:14:14.386] - 2th channel,vco_idac_cw=10
[00:14:14.391] - 3th channel,vco_idac_cw=9
[00:14:14.393] - 4th channel,vco_idac_cw=9
[00:14:14.395] - 5th channel,vco_idac_cw=9
[00:14:14.399] - 6th channel,vco_idac_cw=9
[00:14:14.402] - 7th channel,vco_idac_cw=9
[00:14:14.404] - 8th channel,vco_idac_cw=9
[00:14:14.409] - 9th channel,vco_idac_cw=9
[00:14:14.411] - 10th channel,vco_idac_cw=9
[00:14:14.415] - 11th channel,vco_idac_cw=9
[00:14:14.417] - 12th channel,vco_idac_cw=9
[00:14:14.420] - 13th channel,vco_idac_cw=9
[00:14:14.425] - 14th channel,vco_idac_cw=9
[00:14:14.426] - 15th channel,vco_idac_cw=9
[00:14:14.430] - 16th channel,vco_idac_cw=7
[00:14:14.433] - 17th channel,vco_idac_cw=7
[00:14:14.435] - 18th channel,vco_idac_cw=9
[00:14:14.440] - 19th channel,vco_idac_cw=8
[00:14:14.442] - 20th channel,vco_idac_cw=8
[00:14:14.444] - LO locked 9 135
[00:14:14.447] - rosdac_i_gc3=25
[00:14:14.449] - rosdac_i_gc2=25
[00:14:14.451] - rosdac_i_gc1=25
[00:14:14.456] - rosdac_i_gc0=25
[00:14:14.457] - rosdac_q_gc3=36
[00:14:14.458] - rosdac_q_gc2=36
[00:14:14.460] - rosdac_q_gc1=36
[00:14:14.464] - rosdac_q_gc0=36
[00:14:14.468] - rbb_cap1_fc_i=26,rbb_cap2_fc_i=26,rbb_cap1_fc_q=26,rbb_cap2_fc_q=26
[00:14:14.475] - new rbb_cap1_fc_i=50,rbb_cap2_fc_i=50,rbb_cap1_fc_q=50,rbb_cap2_fc_q=50
[00:14:14.477] - LO locked 9 135
[00:14:14.481] - amp=128,step=32,adc_mean_i=40
[00:14:14.483] - amp=160,step=16,adc_mean_i=61
[00:14:14.485] - amp=176,step=8,adc_mean_i=72
[00:14:14.490] - amp=184,step=4,adc_mean_i=77
[00:14:14.492] - amp=188,step=2,adc_mean_i=80
[00:14:14.495] - amp=190,step=1,adc_mean_i=82
[00:14:14.500] - amp=191,step=0,adc_mean_i=82
[00:14:14.504] - tmx_cs=0, tmxcs_pwr_avg=27251, tmxcs_pwr_avg>>10=26
[00:14:14.509] - tmx_cs=1, tmxcs_pwr_avg=35585, tmxcs_pwr_avg>>10=34
[00:14:14.513] - tmx_cs=2, tmxcs_pwr_avg=46982, tmxcs_pwr_avg>>10=45
[00:14:14.519] - tmx_cs=3, tmxcs_pwr_avg=60930, tmxcs_pwr_avg>>10=59
[00:14:14.523] - tmx_cs=4, tmxcs_pwr_avg=76030, tmxcs_pwr_avg>>10=74
[00:14:14.527] - tmx_cs=5, tmxcs_pwr_avg=83497, tmxcs_pwr_avg>>10=81
[00:14:14.533] - tmx_cs=6, tmxcs_pwr_avg=78475, tmxcs_pwr_avg>>10=76
[00:14:14.536] - tmx_cs=7, tmxcs_pwr_avg=64380, tmxcs_pwr_avg>>10=62
[00:14:14.543] - tmx_cs_max=5, tmxcs_pwr_max=83497, tmxcs_pwr_max>>10=81
[00:14:14.546] - amp=256,step=64,adc_mean_i=-165
[00:14:14.550] - amp=320,step=32,adc_mean_i=-72
[00:14:14.553] - amp=352,step=16,adc_mean_i=-21
[00:14:14.555] - amp=368,step=8,adc_mean_i=2
[00:14:14.557] - amp=376,step=4,adc_mean_i=15
[00:14:14.563] - amp=380,step=2,adc_mean_i=22
[00:14:14.564] - amp=382,step=1,adc_mean_i=23
[00:14:14.566] - amp=383,step=0,adc_mean_i=27
[00:14:14.572] - tosdac_i=28,tosdac_q=38,tx_iq_gain_comp=1013,tx_iq_phase_comp=-6
[00:14:14.575] - amp=256,step=64,adc_mean_i=31
[00:14:14.578] - amp=320,step=32,adc_mean_i=91
[00:14:14.583] - amp=352,step=16,adc_mean_i=123
[00:14:14.586] - amp=368,step=8,adc_mean_i=141
[00:14:14.588] - amp=376,step=4,adc_mean_i=149
[00:14:14.591] - amp=380,step=2,adc_mean_i=153
[00:14:14.597] - amp=382,step=1,adc_mean_i=156
[00:14:14.599] - amp=383,step=0,adc_mean_i=156
[00:14:14.606] - tosdac_i=29,tosdac_q=39,tx_iq_gain_comp=1016,tx_iq_phase_comp=-2
[00:14:14.610] - amp=256,step=64,adc_mean_i=87
[00:14:14.614] - amp=320,step=32,adc_mean_i=130
[00:14:14.616] - amp=352,step=16,adc_mean_i=154
[00:14:14.621] - amp=368,step=8,adc_mean_i=166
[00:14:14.624] - amp=376,step=4,adc_mean_i=172
[00:14:14.626] - amp=380,step=2,adc_mean_i=176
[00:14:14.632] - amp=382,step=1,adc_mean_i=177
[00:14:14.635] - amp=383,step=0,adc_mean_i=178
[00:14:14.642] - tosdac_i=25,tosdac_q=44,tx_iq_gain_comp=1004,tx_iq_phase_comp=3
[00:14:14.645] - amp=272,step=68,adc_mean_i=40
[00:14:14.649] - amp=340,step=34,adc_mean_i=137
[00:14:14.651] - amp=374,step=17,adc_mean_i=190
[00:14:14.656] - amp=391,step=8,adc_mean_i=218
[00:14:14.661] - tosdac_i=24,tosdac_q=40,tx_iq_gain_comp=1004,tx_iq_phase_comp=-1
[00:14:14.665] - amp=224,step=56,adc_mean_i=132
[00:14:14.667] - amp=280,step=28,adc_mean_i=195
[00:14:14.672] - tosdac_i=23,tosdac_q=37,tx_iq_gain_comp=1000,tx_iq_phase_comp=6
[00:14:14.677] - amp=272,step=68,adc_mean_i=140
[00:14:14.679] - amp=340,step=34,adc_mean_i=205
[00:14:14.682] - tosdac_i=20,tosdac_q=37,tx_iq_gain_comp=990,tx_iq_phase_comp=4
[00:14:14.688] - amp=288,step=72,adc_mean_i=130
[00:14:14.692] - amp=360,step=36,adc_mean_i=191
[00:14:14.695] - amp=396,step=18,adc_mean_i=223
[00:14:14.699] - tosdac_i=28,tosdac_q=42,tx_iq_gain_comp=992,tx_iq_phase_comp=-1
[00:14:14.705] - amp=304,step=76,adc_mean_i=142
[00:14:14.708] - amp=380,step=38,adc_mean_i=208
[00:14:14.714] - tosdac_i=29,tosdac_q=40,tx_iq_gain_comp=994,tx_iq_phase_comp=5
[00:14:14.718] - [WF] [KEY] [CFG] nVAP is 2, endidx 10, startidx 8
[00:14:14.725] - ------ set default key 4201cf08, key ptr 00000000
[00:14:14.728] - ------ set default key 4201d2e0, key ptr 00000000
[00:14:14.729] - td_init
[00:14:14.733] - td_reset idx=0
[00:14:14.738] - td_reset idx=1
[00:14:14.742] - [WF] country code CN used, num of channel 13
[00:14:14.743] - Enable BMX IRQ
[00:14:14.751] - [WF] [KEY] [CFG] nVAP is 2, endidx 10, startidx 8
[00:14:14.756] - ------ set default key 4201cf08, key ptr 00000000
[00:14:14.759] - ------ set default key 4201d2e0, key ptr 00000000
[00:14:14.760] - td_init
[00:14:14.761] - td_reset idx=0
[00:14:14.762] - td_reset idx=1
[00:14:14.771] - [WF] country code CN used, num of channel 13
[00:14:14.772] - wifi init success!!
[00:14:14.773] - [000311] kv version:1.0
[00:14:14.779] - [000312] aos framework init.
[00:14:14.781] - -Welcome to AliOS Things-
[00:14:14.784] - [prt] log level set as: [ 3 ]
[00:14:14.791] - --------Firmware info--------
[00:14:14.794] - app: smart_outlet, board: tg7100cevb
[00:14:14.795] - Host: feige
[00:14:14.796] - Branch:
[00:14:14.797] - Hash:
[00:14:14.805] - Date: Aug 5 2021 14:53:55
[00:14:14.807] - Kernel: AOS-R-1.3.4
[00:14:14.809] - LinkKit: 2.3.0_FY_1.6.6-8
[00:14:14.814] - APP: app-1.6.6-20210805.145355
[00:14:14.816] - Region env: SINGAPORE-ONLINE
[00:14:14.822] - [MTD] >>>>>> Hanlde info Dump >>>>>>
[00:14:14.824] - name media
[00:14:14.825] - id 0
[00:14:14.830] - offset 001c5000(1855488)
[00:14:14.832] - size 00002000(8Kbytes)
[00:14:14.835] - xip_addr 231b4000
[00:14:14.840] - [MTD] <<<<<< Hanlde info End <<<<<<
[00:14:14.843] - version = ver0.0.1
[00:14:14.846] - KV = ProductKey:a1JG8An8ORa
[00:14:14.849] - KV = DeviceName:703e971ed91c
[00:14:14.852] - [000333] pk[a1JG8An8ORa]
[00:14:14.857] - [000333] dn[703e971ed91c]
[00:14:14.860] - [000338]<W> try secured ap config!
[00:14:14.865] - [000342]<E> no valied ap config found!Flashing the removed module worked fine, and here is a template for it:
{
"vendor": "Amysen",
"bDetailed": "0",
"name": "Amysen Wifi Smart Plug YX-WS01",
"chip": "BL602",
"board": "YX-X3-T71C-VER03",
"pins": {
"1": "LED_n;1",
"12": "Rel;1",
"16": "Btn;1"
},
"keywords": [
"plug",
"relay",
"TG7100C"
],
"image": "https://obrazki.elektroda.pl/9135692300_1704034050.jpg",
"wiki": "https://www.elektroda.com/rtvforum/viewtopic.php?p=20886589"
}
Cool? Ranking DIY
