logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[RTL8710BX] [T102_V1.1] Generic Tuya 20A EU Smart Plug - a little exploration

divadiow 4359 2
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • This one looked like it might be slightly different to the many variants of this device I've seen around (not one I've bought before anyway). It is from the Digitaling store on Ali Express and boasts 20A working current, though further down the page it says 16A. The relay is marked as 20A at 120v and 250v but that datasheets I can find seem to suggest 15A max. It also has a Belling BL0937 power monitoring chip.

    White smart plug on AliExpress page labeled with WiFi and 20A.

    This is the appearance of the unit and packaging

    Disassembled smart plug with box in the background. View of a disassembled electronic device with a visible socket and plug on a carpet. White plastic adapter on a carpet background. Smart Socket EU 20A Wi-Fi device packaging.

    I opened the unit with a G-clamp, moving the clamp around and tightening until I heard cracking in enough places to be confident the glue had lost the battle and the unit would fall apart. Inside is the main PCB and a nice, not-so-often seen, T102_V1.1 with RTL8710BX chip alongside an external 16mbit/2megabyte flash module from GigaDevice. Detailed information about the T102_V1.1 can be seen in this post here https://www.elektroda.com/rtvforum/topic3815120.html#19504258.

    I know OpenBeken doesn't currently support the RTL chips but I wanted to see if I could at least grab the boot log and maybe the factory firmware and make it available for analysis.

    Through some Googling I found that TX needs to pulled to ground for the chip to enter boot mode. Then remove GND from TX to be able to flash/read firmware. With that in mind I unsoldered the whole module and put it into boot mode, with TX pulled low at power-on, before removing GND from TX.

    Some chip info:

    Screenshot displaying RTL8710BX chip information

    Without TX grounded at power-on I collected the boot log

    Code: text Expand Select all Copy to clipboard
    <RTL8195A>ROM:[V0.1]
FLASHRATE:4
BOOT TYPE:0 XTAL:40000000
IMG1 DATA[1168:10002000]
IMG1 ENTRY[8000541:100021ef]
IMG1 ENTER
CHIPID[000000f6]
read_mode idx:3, flash_speed idx:0
calibration_result:[1:11:9][3:d] 
calibration_result:[2:13:7][1:d] 
calibration_result:[3:0:0][ff:ff] 
calibration_ok:[2:13:7] 
FLASH CALIB[NEW OK]
OTA2 ADDR[80d0000]
OTAx SELE[fffffffc]
OTA1 USE
IMG2 DATA[0x80a1570:7508:0x10005000]
IMG2 SIGN[RTKWin(10005008)]
IMG2 ENTRY[0x10005000:0x800b17d]
===== Enter Image 2 ====
System_Init1
OSC8M: 8390004 
boot reason: 0 
System_Init2

11111111111111111111111111
interface 0 is initialized
interface 1 is initialized

Initializing[0 WIFI ...1-01 18:12:1
LD5 TUYA Info]O Mode, BD_[mqc_app.c:1Info: 0 
75] mqc app init ...
[01-01 18:12:15 TUYA Info
LD][sf_mqc_cb.O Mode, BD_c:42] registInfo: 0 
er mqc app callback
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:5 mqc_handler_cnt:1
[01-01 18:12:15 TUYA Debug][mqc_app.c:118] mq_pro:31 mqc_handler_cnt:2
[01-01 18:12:15 TUYA Debug][log_seq.c:724] read from uf. max:0 first:0 last:0
[01-01 18:12:15 TUYA Debug][svc_online_log.c:288] svc online log init success
[01-01 18:12:15 TUYA Notice][tuya_device.c:288] key:18, relay:15, led:5,epin:0,ivPin:12,ivcpin:14
[01-01 18:12:15 TUYA Notice][tuya_device.c:289] rtlbn_bl0937_plug_vxqn72kwtosoy4d3:1.0.2:Nov  1 2023:09:19:11
[01-01 18:12:15 TUYA Notice][tuya_device.c:291] < TUYA IOT SDK V:1.0.7 BS:40.00_PT:2.2_LAN:3.3_CAD:1.0.2_CD:1.0.0 >
< BUILD AT:2020_08_07_18_07_40 BY embed FOR ty_iot_wf_rtos_sdk AT rtl8710bn >
IOT DEFS < WIFI_GW:1 DEBUG:1 KV_FILE:0 SHUTDOWN_MODE:0 LITTLE_END:1 TLS_MODE:2 ENABLE_LOCAL_LINKAGE:0 ENABLE_CLOUD_OPERATION:0 ENABLE_SUBDEVICE:0 ENABLE_ENGINEER_TO_NORMAL:0 OPERATING_SYSTEM:2 ENABLE_SYS_RPC:0 TY_SECURITY_CHIP:0 RELIABLE_TRANSFER:RELIABLE_TRANSFER ENABLE_LAN_ENCRYPTION:1 ENABLE_LAN_LINKAGE:ENABLE_LAN_LINKAGE ENABLE_LAN_LINKAGE_MASTER:ENABLE_LAN_LINKAGE_MASTER >

[01-01 18:12:15 TUYA Notice][tuya_device.c:293] firmware compiled at Nov  1 2023 09:19:11
[01-01 18:12:15 TUYA Notice][tuya_device.c:299] 
 USER SET LOG_LEVEL_NOTICE 

[01-01 18:12:15 TUYA Notice][simple_flash.c:430] key_addr: 0x1eb000   block_sz 4096
[01-01 18:12:15 TUYA Notice][simple_flash.c:498] get key:
0x43 0xed 0xc7 0x14 0xe4 0xe5 0x0 0xa9 0xf6 0x81 0xe6 0x52 0xc5 0x3c 0xe6 0xf6 

WIFI initialized

init_thread(55), Available heap 0xf758[01-01 18:12:15 TUYA Notice][tuya_uart.c:125] 1   9600
[01-01 18:12:15 TUYA Notice][tuya_main.c:394] mf_init succ

LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0 

LDO Mode, BD_Info: 0 

WIFI initialized
[01-01 18:12:16 TUYA Notice][tuya_main.c:128] current product ssid name:tuya_mdev_test2
[WIFI NOTICE]not find scan ssid (tuya_mdev_test2)
[01-01 18:12:17 TUYA Notice][gw_intf.c:3557] serial_no:d8d6688fef4e
[01-01 18:12:17 TUYA Notice][gw_intf.c:3592] gw_cntl.gw_wsm.stat:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3595] gw_cntl.gw_wsm.nc_tp:1
[01-01 18:12:17 TUYA Notice][gw_intf.c:3596] gw_cntl.gw_wsm.md:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3635] gw_cntl.gw_if.abi:0 input:0
[01-01 18:12:17 TUYA Notice][gw_intf.c:3636] gw_cntl.gw_if.product_key:vxqn72kwtosoy4d3, input:vxqn72kwtosoy4d3
[01-01 18:12:17 TUYA Notice][gw_intf.c:3637] gw_cntl.gw_if.tp:0, input:0
[01-01 18:12:17 TUYA Err][hw_ctrl.c:177] hw_set_relay 15: on
[01-01 18:12:17 TUYA Err][app_switch.c:564] =============long_key_time==========5000======
[01-01 18:12:17 TUYA Err][app_switch.c:564] =============long_key_time==========5000======
[01-01 18:12:17 TUYA Notice][tuya_gpio.c:225] id 18 {0x1001af24}
[01-01 18:12:17 TUYA Notice][hlw8012.c:896] get prod test result!!!:1
[01-01 18:12:17 TUYA Notice][hlw8012.c:943] v_ref = 561,i_ref = 25842,p_ref = 15765,e_ref = 1320

[01-01 18:12:17 TUYA Notice][hlw8012.c:1091] enter ele 000
[01-01 18:12:17 TUYA Notice][hlw8012.c:1095] enter ele 1111
[01-01 18:12:17 TUYA Err][hlw8012.c:1105] sys_start_timer 0 
[01-01 18:12:17 TUYA Err][hlw8012.c:1107] sys_mode 16 
[01-01 18:12:17 TUYA Notice][app_dltj.c:237] get ele data err.
[01-01 18:12:17 TUYA Notice][tuya_device.c:427] device_init ok ! free_mem_size:60176

LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0 

LDO Mode, BD_Info: 0 

WIFI initialized

LwIP_DHCP: dhcp stop.
Deinitializing WIFI ...
WIFI deinitialized
Initializing WIFI ...
LDO Mode, BD_Info: 0 

LDO Mode, BD_Info: 0 

WIFI initialized
[01-01 18:12:19 TUYA Notice][app_switch.c:1336] wifi status is :1


    And that's as far as I have gone!

    A collection of interior pics:
    Close-up of the interior of an electronic device showing PCB elements. Close-up of a PCB with electronic components and soldered connections. Close-up of an electronic component with visible connector labels: VD33, GND, IO18, IO23, IO14, IO15. Close-up of an electronic module with RTL8710BX and GD25Q16 chips visible. Interior of a disassembled electronic device with a visible PCB and components. Photo of an open electronic device showing the PCB and components on a carpet. Internal view of a PCB with electronic components. Close-up of a PCB with integrated circuits, including BL0937. Close-up of JIEYING JY3FF-SH-DC5V-A(K) relay on a PCB. Image of the interior of an electronic device showing a connector on a PCB with labeled connection points.
    Attachments:
    • RTL8710BX_T102_V1.1_fw.bin (2 MB) You must be logged in to download this attachment.
    • RTL8710BX_T102_V1.1_efuse.bin (256 Bytes) You must be logged in to download this attachment.

    Cool? Ranking DIY
    About Author
    divadiow
    Level 38  
    Offline 
    divadiow wrote 4839 posts with rating 852, helped 420 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • Helpful post
    #2 20940868
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12315
    I am very happy to see you've got RTL! I've started already a WIP fork for BN version in the past, I just had no time to develop it futher, you can look here:
    https://github.com/openshwprojects/OpenRTL8710BN
    But I will be looking into that and BX version soon , hopefully. I've already got chips from the donators, so I just need some time...

    However, as I said, LN882H got the priority:
    [LN882H] [WL2S] Elivco 20A BSD34 EU Power Monitoring Plug [BL0937]

    For now, if you want to run OBK, you'd need to swap module, or alternatively, if you want to run Tasmota (cause it's compatible with OBK Device groups etc) you could do a swap to ESP02S.

    I'll let you know when some testing is needed.
    Helpful post? Buy me a coffee.
  • #3 21398115
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    template updated in device list. P1 should be WifiLED because there's a second blue LED fixed to the relay behaviour for on/off status

    Code: JSON
    Log in, to see the code
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law
Today's popular

FAQ

TL;DR: Despite the “20 A” label, the JY3FF relay is only certified for 15 A at 250 V AC [Jieying, 2023]. "OpenBeken doesn't currently support the RTL chips" [Elektroda, divadiow, post #20940181] Flash access and power-monitor readings are possible via the BL0937.

Why it matters: Knowing the real limits and flashing options prevents overloads and wasted hacking time.

Quick Facts

• MCU: Realtek RTL8710BX, ARM Cortex-M4F @ 166 MHz typical [RTL8710BX Datasheet]. • External flash: 16 Mbit GD25Q16E SPI NOR [Elektroda, divadiow, post #20940181] • Relay rating: 15 A / 250 V AC (UL) [Jieying, 2023]. • Power-monitor IC: BL0937, ±1 % energy accuracy typ. [Belling, 2021]. • AliExpress cost: US $7–9 per piece in 2-packs [AliExpress listing, 2024].

1. What chipset powers this Tuya 20 A EU smart plug?

It uses the Realtek RTL8710BX Wi-Fi SoC mounted on a T102_V1.1 module, unlike the more common ESP8266 [Elektroda, divadiow, post #20940181]

3. How do I enter boot (flash) mode on the module?

Follow three steps: 1. Tie TX to GND, then power the board. 2. Release TX from GND. 3. Connect a 3.3 V UART at 115 200 bps to read or write flash [Elektroda, divadiow, post #20940181]

4. Is the plug really safe at 20 A continuous load?

No. The installed JY3FF-S-DC5V-A relay carries a certified 15 A continuous rating; advertising 20 A exceeds that limit [Jieying, 2023]. Sustained 20 A may overheat contacts and enclosure.

5. How accurate is the BL0937 power-monitor chip inside?

Belling rates the BL0937 at ±1 % active-energy error over 0.1–10 A when properly calibrated [Belling, 2021]. User calibration is still required for voltage and current offsets.

6. Which GPIO pins control the relay, button and LEDs?

Current template: P10 → Relay, P11 → Button, P1 → Wi-Fi/status LED, P0/P8/P9 interface the BL0937 [Elektroda, divadiow, post #21398115]

7. Where is the open-source work happening for RTL8710BX?

Development lives in the OpenRTL8710BN fork on GitHub; BX support will branch from there once testing starts [Elektroda, p.kaczmarek2, post #20940868]

8. What failure behaviour should I watch for?

Logs show repeated Wi-Fi de-init and DHCP stop loops when the plug can’t find a configured SSID, leading to rapid relay toggling [Elektroda, divadiow, post #20940181]

9. How can I open the glued enclosure without damage?

Author used a G-clamp, tightening around the seam until the glue cracked; the shell then separated cleanly [Elektroda, divadiow, post #20940181]

10. Can I back up the factory firmware before experimenting?

Yes. After entering boot mode, use Realtek’s Ameba-D flasher or esptool-py fork to read the full 2 MB flash and save a binary image [Elektroda, divadiow, post #20940181]

11. Why does the product page list 16 A while branding says 20 A?

Sellers often quote the IEC maximum for Schuko contacts (16 A) while printing higher marketing figures. The internal relay remains the limiting 15 A component [AliExpress listing, 2024; Jieying, 2023].

12. Does swapping to an ESP02S affect power-monitoring?

No, the BL0937 communicates via GPIO pulses; remap the same pins in Tasmota or OpenBeken and readings work normally.
Generated by the language model.
ADVERTISEMENT