logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Teardown and Reflashing of Tuya Smart Socket EU20A with LN882HKI Chip Analysis

bogdanelhh 16269 75
Best answers

How do I flash a Tuya EU20A smart socket with an LN882HKI chip and configure its pins for Home Assistant use?

Yes — this plug can be flashed to OpenBeken for Home Assistant by using the LN882H UART0 pins on A2/A3 (not B8/B9), pulling A9 to GND at power-on, and powering the board from an external 3.3 V supply with a common ground [#21334246][#21334409][#21832386] One successful wiring report used 3V3, GND, A9 shorted to GND during flashing, TX, and RX, and confirmed that flashing worked even though the original factory firmware could not be dumped [#21334409] For the power metering chip, the BL0937 connections were identified as CF = B4/pin 25, CF1 = B5/pin 26, and SEL = B6/pin 27 [#21799323] Another EU20A/OpenBeken template in the thread maps LED_n to 6, Btn to 7, Rel to 19, and the BL0937 signals to 20/21/22, so you can use that as a starting point if it matches your board [#21614566] After flashing, set up Wi‑Fi and then configure the pins in Config → Configure Module or in the WebApp; once metering values appear, calibrate them from the Tools tab [#21453872]
Generated by the language model.
ADVERTISEMENT
Report a violation of the law
Reply | New topic
  • #1 21333751
    bogdanelhh
    Level 4  
    Posts: 8
    Rate: 6
    Teardown of Tuya Smart Socket EU20A Wifi Smart Plug With Power Monitoring Smart Life APP Remote Control Support Google Assistant Alexa bought from aliexpress here https://vi.aliexpress.com/item/10050078840687...6hMe&gatewayAdapt=glo2vnm#nav-description

    Tuya Smart Socket EU20A WiFi power monitoring plug.

    Product looks like this:

    White smart plug with a power button on a dark background. View of a white Tuya EU20A Wi-Fi smart plug with technical specifications on a map background. White Tuya smart plug lying on a world map.

    Disassembled looks like this:
    Disassembled Wi-Fi smart plug lying on a world map. Close-up of the dismantled electronic board of a Tuya smart plug with visible components. Close-up of a circuit board with a microchip in a smart socket. Close-up of a circuit board with a chip labeled LIGHTNING LN882HV16. Close-up of a circuit board with a BL0937 chip and resistors. Close-up of the internal circuit of a disassembled Tuya Smart Socket.

    After some reads on this forum and also some investigation, I'm dealing with :
    Part NumberPackage Flash SizeTemperature
    LN882HKIQFN-32, 5mm pitch2MB Flash-40℃~105℃

    Haven't found yet documented the pinout of this chip here, and I must admit that my time is very limited on investigation. But I managed to identify on board the following pins: GND, 3V3, A9, B9. Considering the schematic below A9 is for switching the boot mode and B9 is TXD0 of chip which should print out to serial port.
    B8 (RXD0) is missing any breakouts and that's why the delay on hooking into it as I need to figure out how to solder to that tiny pin without breaking anything.
    Electrical schematic showing connections and pin layout for the WCN-LN882H chip.

    Chip used for energy monitoring is marked with BL0937, which I didn't investigate about it by now considering my focus on switching firmware of this chip and after that managing the peripherals.

    I'll keep this updated with my investigation while I'm wondering if anyone managed to reflash this specific model.
    AI: What is your ultimate goal with reflashing the Tuya Smart Socket EU20A? Are you aiming to change its functionality or integrate it with a specific system?
    I am planning to integrate it with Home Assistant
    AI: Have you tried any specific methods or tools for reflashing the LN882HKI chip so far, and if so, what were the results?
    Not yet
  • ADVERTISEMENT
  • #4 21334409
    bogdanelhh
    Level 4  
    Posts: 8
    Rate: 6
    Thanks Max. I managed to flash it successfully. It seems I was trying the wrong serial :D I haven't managed to dump the original firmware, but I don't care about it.

    Close-up of a PCB with soldered wires in various colors: red, white, gray, green, and an unsheathed wire.

    I soldered the wires as it shows in the picture above and:
    Red is 3v3
    Unshielded one is GND
    Gray is A9 which I shorted to the unshielded GND while flashing
    Green is TX of LN882HKI
    White is RX of LN882HKI

    My time for investigation is done for the day but since flashing is successful tomorrow I'll trace the config to fully functional device (fingers crossed).

    Edit: I used external 3v3 with common ground.
  • #5 21334441
    max4elektroda
    Level 24  
    Posts: 756
    Help: 48
    Rate: 187
    Good news!
    So next task will be to trace the pins to BL0937 so you can configure them in the config page.
  • #6 21335189
    bogdanelhh
    Level 4  
    Posts: 8
    Rate: 6
    Here is the config:

    Code: JSON
    Log in, to see the code
  • ADVERTISEMENT
  • #8 21335360
    bogdanelhh
    Level 4  
    Posts: 8
    Rate: 6
    >>21335223

    The stock firmware I wasn't able to dump it. But I will post a backup here after installing on the next one, as this one was already configured with MQTT, WiFi and HA. I'll be back today with the blank backup.

    Added after 4 [hours] 43 [minutes]:

    Here is the bin file. I extracted it by config page. But during retrieval device lost connection multiple times, seems that web service is pretty unstable. However the first device I flashed has same issues with web config but in Home Assistant is stable.

    I suspect this behavior is because is logging constantly, and I should update the mqtt message update interval but I need to check the docs for that.
  • ADVERTISEMENT
  • #9 21338644
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    bogdanelhh wrote:
    Here is the bin file. I extracted it by config page.

    thank you but this is not a backup of the factory firmware taken before flashing OpenBeken. Not to worry.
  • #10 21339154
    bogdanelhh
    Level 4  
    Posts: 8
    Rate: 6
    >>21338644
    I tried to extract that stock firmware but I suspect something was wrong in it because I waited for 2 screens of dots and it was not done after 1.5 hrs.
  • ADVERTISEMENT
  • #11 21416332
    nerdman
    Level 2  
    Posts: 2
    Just in case the image of this device is still needed.... I took approx. 40 minutes, is this normal?
    Attachments:
    • flashdump_flash.bin (2 MB) You must be logged in to download this attachment.
    • flashdump_otp.bin (1 KB) You must be logged in to download this attachment.
  • #13 21450678
    romicacotoiul
    Level 2  
    Posts: 2
    Hello, I am trying to flash this socket. But I don't manage to get it in download mode, I suppose (I am pulling A9 to GND and checked lots of times the connections to UART (I'm using a CH340 module (could it be that it doesn't support 2000000 baud?). After powering up the module, the onboard LED starts to flash. Is this expected even in download mode? Thanks.
  • #14 21450692
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    romicacotoiul wrote:
    After powering up the module, the onboard LED starts to flash. Is this expected even in download mode?


    No, this sounds like the device is booting into Tuya firmware. Are your grounds all connected and is there continuity between them all? Are you removing all power between.retries - USB UART adaptor AND 3.3v power source (Assuming you're not using 3.3v from USB UART only)?

    Added after 1 [minutes]:

    Feel free to post pics detailing your whole layout in case we can spot something missing
  • #15 21450694
    romicacotoiul
    Level 2  
    Posts: 2
    Thanks a lot! Bad contacts on some alligators dupont connectors. After securing them, I got two sockets flashed.
  • #16 21450696
    divadiow
    Level 38  
    Posts: 5065
    Help: 438
    Rate: 893
    >>21450694

    Ah excellent. Did you take any backups? 🤓
  • #17 21451857
    Powl654
    Level 3  
    Posts: 9
    Rate: 1
    Hello,
    I am also trying to flash this device, but it is not working using the GUI (see this post).
    But maybe I am not in the correct download mode?
    I'm also using a CH340 module and A9 to is pulled to GND.

    Powering up the module (A9 is pulled to GND) turns the blue LED on the socket constantly on but not as bright as normal.
    Is that the correct LED behavior for download mode?

    Thanks!
  • #18 21451913
    max4elektroda
    Level 24  
    Posts: 756
    Help: 48
    Rate: 187
    Powl654 wrote:
    Powering up the module (A9 is pulled to GND) turns the blue LED on the socket constantly on but not as bright as normal.

    Exactly, this will show you at least entered download mode.

    Since flashing starts, I would suggest
    Lower speed of serial, e.g. only use 115200 (instead of 921000)
    Shorten the cables
    Use a different power supply, especially if you are using the USB adapter to power the device
  • #19 21453362
    Powl654
    Level 3  
    Posts: 9
    Rate: 1
    Thank you, I will try the different speed.

    Yes, the cables are quite long (60cm + 20cm dupon male-female cables).
  • #20 21453808
    Powl654
    Level 3  
    Posts: 9
    Rate: 1
    It worked after shortening the wires and reducing the speed to 921000! :-)

    As of now I connected to the sockets AP and entered my wifi network credentials. After rebooting the socket, I connected again to its new IP within my network.

    Now I need to find out how to set up my Tuya socket with LN882HKI chip correctly. I want to hook it up to the micro inverter of my two solar panels to track the energy production by looking at the socket's webpage or if it exists, by an App since I am not having something like Home Assistant in my network.

    What do I have to do next?
    1.) I assume I need to configure the pins in the config page. If yes, is there a template or a howto?
    2.) Where exactly do I have to configure the pins? "Config" -> "Config Module" or "Launch Web Application"?
    3.) And do I need to calibrate the socket to measure the power correctly?

    Thank you so much for all your work and help!
  • #21 21453872
    max4elektroda
    Level 24  
    Posts: 756
    Help: 48
    Rate: 187
    If you find the same plug somewhere, there's a good chance, someone posted a template you can use in the webapp to configure your pins (IIRC it's the "import" page there).
    Or you simply do it by hand, directly in "Config" --> "Configure Module" or in the WebApp.

    If you don't know the pins, you can also try the "pin doctor" in the app.

    After power metering chip is configured correctly (you will see some values, even if they are not correct) you need to calibrate the chip (on the "Tools" tab in the app).
  • #23 21580275
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14622
    Help: 655
    Rate: 12637
    LSPA9 plugs came with different chips and circuits. I saw WB2S ones, CB2S, and even lately T34-based. Not to mention the LN882H from this topic and similar...

    Added after 19 [seconds]:

    luckily all those chips are supported by OBK.
    Helpful post? Buy me a coffee.
  • #25 21583981
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14622
    Help: 655
    Rate: 12637
    Which flashing approach are you planning to take? Hot air with full chip desolder? Or soldering to pads with thin wires?
    Helpful post? Buy me a coffee.
  • #27 21597405
    blacksun2
    Level 8  
    Posts: 59
    Rate: 1
    Hello,
    yesterday I successfully saved the original firmware and installed OpenBeken.
    Have you also had the problem that the smart plug stopped working and the plug was no longer supplied power by the power outlet?
    If I supply power to the SoC via the two solder points 3V3 and GND, the SoC works.
  • #28 21597557
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14622
    Help: 655
    Rate: 12637
    Maybe capacitor? Did you enable PowerSave? Put PowerSave 1 command for startup?

    To be clear - are you saying that it works when powered via 3.3V directly, but the power supply on the plug itself is not working? No LED?
    Helpful post? Buy me a coffee.
  • #29 21597569
    blacksun2
    Level 8  
    Posts: 59
    Rate: 1
    p.kaczmarek2 wrote:
    To be clear - are you saying that it works when powered via 3.3V directly, but the power supply on the plug itself is not working? No LED?

    correct. When I power the chip via soldering points with 3.3V and GND, the Chip + WiFi comes up. When I plug the device in a power outlet, nothing, no LED, no Wifi, no Power at exit.

    I simply flashed the OpenLN882H_1.18.130.bin from https://github.com/openshwprojects/OpenBK7231T_App/releases/tag/1.18.130
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion focuses on the teardown and reflashing process of the Tuya Smart Socket EU20A, which uses the LN882HKI chip and supports power monitoring via the Smart Life app with Google Assistant and Alexa integration. The original poster successfully soldered wires to the chip's UART pins (notably A9 to GND for download mode) and flashed the device using an external 3.3V power supply and a CH340 USB-to-serial adapter. Key UART pins identified include RX0/TX0 on A3/A2 (pins 11 and 10) and RX1/TX1 on B8/B9. The reflashing process involves entering download mode by pulling A9 to ground, with LED behavior indicating mode status. Users reported challenges with unstable web configuration interfaces and long firmware dump times (~40 minutes). A configuration template was shared, mapping pins for LED, button, relay, and BL0937 power metering chip signals. Calibration of the BL0937 chip is necessary for accurate power measurement, achievable via the device's web app tools. Backup of original firmware before flashing is recommended but often difficult due to instability. Alternative flashing methods and device variants with different chips (e.g., T34, BK7231N) were noted, with OpenBeken firmware supporting multiple chipsets. Practical advice includes using short cables, lowering serial baud rates (e.g., 115200 or 921000), and ensuring solid ground connections to improve flashing reliability. The community provided links to related resources, firmware repositories, and configuration guides to assist in reflashing and configuring the device for custom use cases such as solar panel energy monitoring.
Generated by the language model.
Today's popular

FAQ

TL;DR: For Home Assistant users, this EU20A teardown confirms a 2MB flash LN882HKI plug can be reflashed by UART, and “A9 pulled to ground at power-on” is the key step. Use external 3.3V, wire RX/TX to the correct serial pins, then load the BL0937 pin map for power readings. [#21334409]

Why it matters: This thread turns a hard-to-identify Tuya smart plug into a documented OpenBeken target, including wiring, boot mode, pin mapping, and the most common failure fixes.

Topic Tuya stock firmware OpenBeken on LN882H
Pairing/recovery method Long-press style pairing behavior discussed by users Safe mode after 5 fast power reboots within the first 5 seconds
Power monitoring Native in stock app Works after BL0937 pins are mapped and calibrated
Flashing entry Not applicable A9 must be tied to GND at power-on
OTA file expectation Normal vendor flow Users reported LN882H uses .bin, while WebApp expected .rbl

Key insight: Successful flashing is only half the job. On LN882H plugs, power monitoring appears only after you identify the BL0937 CF, CF1, and SEL lines and assign them to the right GPIOs.

Quick Facts

  • The opened EU20A sample used an LN882HKI in QFN-32 with 2MB flash and a stated operating range of -40°C to 105°C. [#21333751]
  • The working OpenBeken template posted for EU20A mapped pin 6 = LED_n, 7 = Btn, 19 = Rel, 20 = BL0937CF, 21 = BL0937CF1, and 22 = BL0937SEL. [#21335189]
  • A successful dump taken by the web method took about 40 minutes, and another user confirmed that duration was normal for this approach. [#21416338]
  • Users improved flashing reliability by shortening wires from about 60 cm + 20 cm and lowering UART speed to 921000 or even 115200 when errors appeared. [#21451913]
  • A related LN882H variant used BL0937 pin 6→LN882H pin 25, 7→26, and 8→27, which then worked as CF=B4, CF1=B5, SEL=B6. [#21799323]

1. How do I flash a Tuya Smart Socket EU20A with an LN882HKI chip using OpenBeken and UART wiring?

Flash it over UART with external 3.3V and the LN882H in download mode. 1. Solder GND, 3.3V, RX, TX, and A9. 2. Tie A9 to GND, then power the board so it enters download mode. 3. Flash OpenBeken, reboot normally, then configure the module pins for relay, LED, button, and BL0937. One working wiring report used red=3.3V, gray=A9, green=TX, white=RX, plus a common ground. The user explicitly said external 3.3V with common ground was used. [#21334409]

2. Which LN882H pins should I use for RX, TX, 3.3V, GND, and boot mode on the EU20A smart plug?

Use A3 as RX0, A2 as TX0, GND and 3.3V from the board supply points, and A9 as the boot strap. A correction in the thread states A3/A2 are the serial pins, while B8/B9 are RX1/TX1 and will mislead flashing attempts. For power, users either soldered directly to 3.3V and GND pads or used the AMS1117 regulator points. Boot mode requires A9 connected to GND during power-on. [#21334246]

3. Why does pulling A9 to GND at power-on put the LN882H into download mode, and what LED behavior should I expect?

Pulling A9 to GND at power-on selects the LN882H download mode instead of normal firmware boot. Users confirmed that if the plug still boots Tuya firmware, the LED flashes normally and you are not in download mode. A dim blue LED that stays on was described as correct behavior for download mode on one setup. If the LED blinks as usual, recheck ground continuity and fully remove power between retries. [#21451913]

4. What is the BL0937 chip in these Tuya smart plugs, and how does it handle power monitoring?

“BL0937” is an energy-metering IC that outputs pulse signals for electrical measurements, with separate CF, CF1, and SEL lines. In this plug family, OpenBeken reads those lines after you assign them to the correct GPIOs. The thread shows BL0937 is the dedicated power-monitoring chip on the EU20A board, and users only got voltage, current, and power data after tracing or importing the correct pin map. [#21333751]

5. Where do I import or enter the OpenBeken pin template for the EU20A: Configure Module or the Web Application?

You can do it in either place. The thread says a posted template can be imported through the WebApp, and the same pin roles can also be entered manually in Config → Configure Module on the device. If you do not know the pins, the WebApp also offers Pin Doctor for discovery. For this EU20A family, users shared a ready template, which is faster than mapping each pin from scratch. [#21453872]

6. How should I calibrate BL0937 power readings in OpenBeken after flashing an LN882H-based smart plug?

Calibrate it after the BL0937 pins already produce live values. The thread says you should first assign CF, CF1, and SEL correctly; once the device shows readings, even rough ones, use the Tools tab in the WebApp to calibrate the power metering. That sequence matters because calibration is pointless if the pulse pins are wrong or inactive. Users specifically described calibration as the step after functional pin setup, not before. [#21453872]

7. What causes Easy Flasher on LN882H to show repeated "Unknown command 'version'" errors, and how do I fix it?

That error usually means the chip never entered LN882H download mode. In the January 2, 2026 report, Easy Flasher kept repeating “Unknown command 'version'” until the user realized A9 was not tied to GND at power-on. After connecting A9 to GND correctly, flashing succeeded. If you see that exact loop, fix boot strapping first before changing firmware files or templates. [#21796709]

8. Why might an LN882H smart plug flash successfully but show no voltage, current, or power readings until the BL0937 pins are traced?

Because OpenBeken can boot and switch the relay before power metering is configured. The thread shows several cases where flashing worked, Wi‑Fi worked, and the plug web UI loaded, but voltage and power stayed empty until the BL0937 CF, CF1, and SEL lines were traced to the LN882H GPIOs. One later variant only worked after mapping BL0937 pins 6, 7, and 8 to LN882H pins 25, 26, and 27. [#21799323]

9. When flashing an LN882H socket with a CH340 adapter, what serial speed, wire length, and power supply setup work best?

Use short wires, reduce baud rate if needed, and avoid relying on weak USB-UART power alone. One user failed with long leads of about 60 cm + 20 cm, then succeeded after shortening them and dropping speed to 921000. Another recommendation was to try 115200 if higher rates were unstable. Multiple posts also stress using a solid external 3.3V supply with common ground, because some adapters cannot power the board reliably. [#21453808]

10. What is OpenBeken safe mode, and how is it different from Tuya's AP pairing mode on a smart plug?

OpenBeken safe mode is a recovery boot path, not Tuya-style pairing mode. Tuya users often expect AP mode from a long button press, but OpenBeken on this plug does not use that behavior. Instead, the thread says safe mode is triggered by 5 fast power reboots, each within the first 5 seconds of startup. Safe mode is for recovering access when the device is otherwise unreachable, while Tuya AP mode is the stock pairing flow. [#21646083]

11. How do I force an OpenBeken-flashed smart plug back into AP or safe mode if the physical button does not do it?

Use the web GUI if the device is reachable, or use repeated full power cuts if it is not. 1. If the plug is online, enable AP from the GUI. 2. If it is offline, cut mains power to the whole device and restore it quickly 5 times. 3. Do each reboot within the first 5 seconds so OpenBeken counts them as failed boots. The relay button does not count, because it does not reboot the Wi‑Fi module. [#21646083]

12. Why do some LN882H plugs lose Wi-Fi or fail to reconnect after an OTA update, and what troubleshooting steps are worth trying?

The thread reports intermittent LN882H Wi‑Fi reconnect issues after OTA, but no single root cause was confirmed. One user updated from 1.18.131 to 1.18.133 and then needed many unplug/replug cycles before Wi‑Fi returned. Practical steps from the discussion are: reflash by serial, reconfigure from scratch, verify the button still works locally, and test whether the issue persists across versions. That narrows whether the failure came from OTA state, configuration corruption, or an existing instability. [#21602868]

13. What is the PowerSave command on LN882H, and why does the thread say it should be placed in autoexec instead of Startup Command Text?

“PowerSave” is a startup power-management command that changes the LN882H sleep behavior, with level 1 used for light sleep when BL0937 metering is present. The thread says LN882H does not apply this command correctly from Startup Command Text, so users should place PowerSave 1 in autoexec instead. It also notes that values above 1 trigger deeper sleep, while PowerSave 0 disables the feature. [#21599335]

14. OpenBeken vs ESPHome on an LN882H smart plug with BL0937: which approach is more practical for power monitoring and Home Assistant?

OpenBeken is the more practical choice in this thread because it is already proven on the EU20A hardware. Multiple users flashed LN882H successfully, posted working pin templates, and showed BL0937 readings in the OpenBeken interface. By contrast, the ESPHome attempt raised a real interrupt concern for BL0937 on bank B pins, and the user only fixed it later by modifying LibreTiny. If you want the fastest path to Home Assistant, OpenBeken has the shorter path here. [#21614566]

15. What safety precautions should I follow when soldering to A9, A2, A3, or the AMS1117 regulator on a mains-powered smart plug?

Never flash or probe this plug while it is connected to mains. The clearest warning in the thread says flashing should NEVER be done with the plug on high voltage. Use isolated low-voltage power only, and be careful around A9 and nearby capacitors because a mistaken short can overcurrent USB power, overheat the chip, or kill the board. For AMS1117 access, the thread identifies pin 1 as GND, pin 2 as +3.3V, and pin 3 as 5V input on one related LN882H board. [#21832386]
Generated by the language model.
ADVERTISEMENT