Identifying SM-039 (BL602) Module in Woolley (Sonoff/Ewelink) SA-032 Smart Plug with BL0937

Sometimes I look for user-posted pictures of IoT devices on Ali Express in the off-chance they've included an internal shot that reveals a module I do not have or one I've never seen before. This was the case for a South American smart plug - Woolley SA-032 - Ewelink/Sonoff/ITEAD origin device.

https://vi.aliexpress.com/item/1005005782675033.html



I've scoured the internet for mention of the SM-039 inside, but there is nothing so far. It looks like it could be a Trolink SM-xx device, but they say their only BL602 modules are SDV-002 and SM-028. I've not heard back from Ewelink/Sonoff yet.

This is the SM-039 and I attach a dump taken from BLDevCube 1.8.9


uart boot:



The module in-situ and the device/packaging:



The power monitoring chip is a standard BL0937. There are two LEDs but with OBK finder I can only light one, a blue one. The second LED does light when probed with a multimeter. I've done a lot of tracing but some of the module pads remain a mystery, not helped by resistors being in the way of paths, my lack of a decent magnifying glass and the width of the end of my multimeter probes.

definitely a work in progress. Text is mostly scribbles about possibilities/unsureness.




The only 100% knowns are VCC and GND.

The silk-screen number prints of 1, 11, 0 (or 9) and 12 (or 2) don't seem to correlate to where I am tracing them to on the BL602 chip.

I have flashed with OBK and these are known:

"0": "Btn",
"1": "WifiLED", - Blue LED "LED1"
"12": "Rel"

I guess my question is, for the BL602 please confirm P# in OBK map to GPIO# on BL602

eg OBK P0 = GPIO0 = Pin 1 of IC ?

I ask because I'm just not seeing this map through when tracing with multimeter, though that could be because of the reasons given above.

On a different note, here are some semi-interesting bits in the binary seen in HxD, though I'm unsure if they're general SDK mentions or actual config for this device

cse7759 chip exist...cse7759b_uart_timer.cse7759bProcess.[%10u][%s: %s:%4d] cse7759b init OK (there's no mention of BL0937)

A bunch of AT commands



mentions of the module, GPIOs, blinky LEDs and button presses



but maybe that's just from the SDK/dts https://github.com/bouffalolab/BLOpenFlasher/...device_tree/bl_factory_params_IoTKitA_40M.dts

I dont' see that shape of socket very often. It reminds me mostly of the old sockets, it's suprising to see it used now.

The BL602 pin naming is very simple, you can see here:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/hal/bl602/hal_pins_bl602.c
There are no aliases, so internal pin numbers are used:

So that's how are pins manipulated:

It's simple as that on BL602. Still, keep in mind that it may be different for different platforms. On W800, for example, we have a lookup table to map artificial OBK pin numbers to W800/W600 ports and bits:
https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/hal/w800/hal_pins_w800.c

Sonoff support have replied to say the datasheet contains proprietary information so they will not supply. At least that confirms it's theirs.

I've asked them to supply what they can.

on a slightly different note, it is curious how the factory firmware was fine booting on my external PSU (up to 5A available to connected devices) but with OBK it will boot loop unless it's plugged into the mains. Could there be something specific to OBK/old SDK that causes BL602 to be weird with power when running OBK?

Measure current usage. They may have enabled powersave 1 by default. I could do it too, but I am not sure - I still remember those few strange reports about PowerSave breaking stuff. I know for certain that it breaks BL0937 and IR, but maybe there is more.

hmm. I don't really have a sensitive enough way to measure the module only. The XL4015 I'm using doesn't even register any current, which is unusual because it *does* register current for devices that draw less and do work fine.

Anyway, this BL602 just reboots continuously at this point at uart output "Start Wi-Fi fw @99ms"

I guess this is before powersave 1 can kick in, which is now set in startup command before I desoldered it again.



Added after 55 [seconds]:

I must have a load of AMS1117-3.3 I can make another ext PSU from to try.

Added after 4 [minutes]:

still doesn't make sense because the BL602 should be free to draw up to 1.5A (the cut-off I have set right now) from the XL4015

Added after 34 [minutes]:

forgot I had the lolin in my bits box. easy.



well it boots now. but has rebooted because of Reboot reason: BL_RST_POWER_OFF

fine. now I get on with attaching LEDs to work out the GPIOs properly.

Flimsy wires is most likely the issue. I noticed the same while dealing with bl602. It looks sensible to voltage drops. And that's why it works fine powered from original source.
You can make your wires better, or increase voltage to 3.6v and it should be fine

but of course!

how quickly one forgets. https://www.elektroda.com/rtvforum/topic3945435.html#20993476

maybe connecting 100nF capacitor between GND and VDD on the BL602 module itself can help it working while keeping wires long?

interesting. no wonder I was getting confused/frustrated. there appears to be two P1s. yes, test LEDs on both light when toggling P1 high







The unknowns do not light an LED or even blip the multimeter toggling any of the 3 IO doctor buttons

Are unknown connected anywhere?

well, they do. I had traced the BL0937 CF, EL, CF1 and had made notes in pics above. There also appears to be two P12s. There's continuity between the yellow P12 label and the red dots right to the BL602 GPIO12 pin.

Weird. Or is there a plausible explanation?

This is very strange. Maybe you could peel of some of the soldermask to investigate the tracks futher. I'd rather expect to find a short somewhere, but you've posted full photos of board and I see nothing like that...

indeed. Im hoping two more devices with same module will arrive soon. If they do, I wouldn't mind destroying this one just to find out. It's entirely possible I've damaged it, though it does still work.

I could do with an acid bath or something remove top layer of protection.

Added after 1 [hours] 53 [minutes]:

>>21132459

they looked connected to me

By the way, what is that 09 part doing? Is this a transistor? How is it connected?

https://www.aliexpress.com/item/1005002548586054.html

maybe?

UM809RS ?



Does the connection match?

yes, continuity between 09R GND and module GND, same for VCC to module VCC. reset leg goes to CEN

This is both very interesting and very strange. Why would they randomly start using UM809RS (power supervisor) in this particular WiFi module?

By the way, having this UM809RS chip on the board of Beken battery-powered sensors, may be a good way to prevent them breaking themselves while battery discharges.

that I do not know. I'm trying every angle to get a datasheet but it seems something is a secret about this module.

It reminds me of old industrial circuits that I sometimes check out in my teardowns. They often have voltage supervisor circuits next to their 8051 MCUs.
Here's a sample one: https://www.elektroda.pl/rtvforum/topic3917123.html