[RTL8710CF] How to Reflash Firmware on Kasa HS200 WiFi Smart Switch (US)

Jerther 1512 40

#31 21606026 14 Jul 2025 02:00

Jerther Jerther

Level 4

Topic author Helpful post? (0)

Post #31
21606026 14 Jul 2025 02:00

Yes, there are two LEDs that make 3 colors for WiFi state. This is the best I could come up with.
ADVERTISEMENT
Helpful post

#32 21616306 25 Jul 2025 03:15

madlac1971 madlac1971

Level 6

Helpful post? (+1)

Helpful post
Post #32
21616306 25 Jul 2025 03:15

[postid:5cf6093b1a][/postid:5cf6093b1a]
new HS200 off Amazon
#33 21617958 27 Jul 2025 02:20

Jerther Jerther

Level 4

Topic author Helpful post? (+1)

Post #33
21617958 27 Jul 2025 02:20

I have annotated the picture with the relevant pads for flashing
ADVERTISEMENT
#34 21622345 31 Jul 2025 20:34

madlac1971 madlac1971

Level 6
Helpful post? (0)

Post #34
21622345 31 Jul 2025 20:34

>>21617958 Managed to flash it finally, thx for the info.
Before I start experimenting and reinventing the wheel, anyone has the template for this new board? Toggle from the GUI turns on the white LED but nothing else works.

Added after 3 [hours] 57 [minutes]:

>>21622345 Well, had some time on my hand and figured it out (mostly): red-on, green-off w/ flashing white when searching for wifi. 19 is the reset button, not sure what to do with it. Restart button works w/o mapping it.
"pins": {
"2": "LED_n;0",
"3": "LED;0",
"4": "WifiLED;0",
"17": "Btn_n;0",
"18": "Rel;0",
"19": "Btn_n;1"
},

Attachments:

HS200_new_rtl87x0C.zip Download (456 Bytes)
#35 21622833 01 Aug 2025 08:18

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #35
21622833 01 Aug 2025 08:18

Probably restart button is connected to CEN.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
#36 21623063 01 Aug 2025 13:30

Jerther Jerther

Level 4

Topic author Helpful post? (0)

Post #36
21623063 01 Aug 2025 13:30

p.kaczmarek2 wrote:
Probably restart button is connected to CEN.

It is.

The reset button is just another GPIO.

I thought the template was complete for this device?
#37 21623141 01 Aug 2025 14:37

madlac1971 madlac1971

Level 6

Helpful post? (0)

Post #37
21623141 01 Aug 2025 14:37

>>21623063 As you can see, the pin-out is (almost) completely different than the original version...
Original (yours):
"4": "LED_n;0",
"7": "LED_n;1",
"8": "Rel;0",
"9": "LED_n;1",
"12": "Btn;0",
"19": "Btn;1"

New model:
"2": "LED_n;0",
"3": "LED;0",
"4": "WifiLED;0",
"17": "Btn_n;0",
"18": "Rel;0",
"19": "Btn_n;1"
The red/green LED is 2pin bicolor, depending on the voltage polarity it seems.

Could someone add this to the database?
#38 21623235 01 Aug 2025 16:35

Jerther Jerther

Level 4

Topic author Helpful post? (0)

Post #38
21623235 01 Aug 2025 16:35

The "original" template has been updated recently. Check earlier in this thread, I made a pull request on GitHub with the updated template which includes a script for the reset button.

IIRC that PR was merged.
ADVERTISEMENT
#39 21623289 01 Aug 2025 17:36

madlac1971 madlac1971

Level 6

Helpful post? (0)

Post #39
21623289 01 Aug 2025 17:36

>>21623235 Well, the https://openbekeniot.github.io/webapp/devicesList.html page only has the "original" pinout.
#40 21623531 01 Aug 2025 22:11

divadiow divadiow

Level 35

Helpful post? (+1)

Post #40
21623531 01 Aug 2025 22:11

madlac1971 wrote:
Could someone add this to the database?

how's this? https://github.com/OpenBekenIOT/webapp/pull/209
#41 21623556 01 Aug 2025 22:35

madlac1971 madlac1971

Level 6

Helpful post? (0)

Post #41
21623556 01 Aug 2025 22:35

>>21623531 Thx, mate!
Create an account, log in and become active in a forum and ads will not appear. You will receive points by participating in discussions.
Join this discussion.

Install the application

Topic summary

The discussion focuses on reflashing the firmware of the TP-Link Kasa HS200 WiFi Smart Single Pole Light Switch using the RTL8710CF microcontroller. The device's PCB is accessible by prying open the case, revealing clearly labeled pads for serial connection. Bootloader mode is enabled by shorting GPIO0 to 3.3V and restarting the MCU. A partial firmware template was shared, enabling relay and main LED control, with mapping for the reset switch and tri-color WiFi LED. Users explored LED behavior customization, noting the WiFi LED uses pins P7 and P9 to produce green, red, and amber colors, but replicating the original LED patterns proved challenging. Suggestions included scripting pin roles dynamically based on WiFi state. Firmware versions supporting RTL8710C were discussed, highlighting improvements in WiFi reconnection and OTA update capabilities. OTA updates are not implemented in early versions (e.g., 1.18.12) but are available via the Web App in later releases. Issues with WiFi reconnection after outages were reported, with some devices requiring manual restart. Contributions included a pull request to enable the reset button to trigger safe mode. Newer switch batches with different board layouts but the same MCU were mentioned, with test points remaining accessible for reflashing.
Summary generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
[RTL8710CF] How to Reflash Firmware on Kasa HS200 WiFi Smart Switch (US)

FAQ

TL;DR: Reflashing a TP-Link Kasa HS200 with OpenBeken takes under 3 minutes and the 16 V capacitor mod adds 60 % voltage headroom; “OTA was implemented even before release” [Elektroda, insmod, post #21528805]

Why it matters: Faster firmware cycles and better hardware reliability stop smart-switch lock-ups.

Quick Facts

• Chipset: Realtek RTL8710CF / RTL87X0C @ 125 MHz [Elektroda, Jerther, post #21384347]
• Flashing voltage: 3 V3 TX/RX, 5 V pad only for board power [Elektroda, Jerther, post #21384347]
• Bootloader trigger: Short GPIO0→3 V3 and tap Restart switch [Elektroda, Jerther, post #21384347]
• Stable firmware: OpenBeken ≥ 1.18.12 with OTA web menu [Elektroda, max4elektroda, post #21528852]
• Capacitor fix: swap 470 µF 10 V for 470 µF 16 V 8000 h @ 105 °C [Elektroda, Jerther, post #21598616]

Which MCU is inside the US-market HS200?

Both PCB revisions use the Realtek RTL8710CF (marketed as RTL87X0C), a 32-bit ARM-CM4 MCU with Wi-Fi b/g/n radio [Elektroda, Jerther, post #21384347]

How do I enter bootloader mode for flashing?

Bridge the test-pads marked GPIO0 and 3 V3. 2. Connect USB-to-UART at 3 V3 TX/RX and 5 V pad for board power. 3. Press the on-board Restart tact switch. The chip now waits for Realtek’s UART bootloader commands [Elektroda, Jerther, post #21384347]

Can I flash new firmware without removing the switch from the wall again?

Yes. Versions after 1.18.12 expose an OTA menu in the Web App; upload the new BIN and reboot. "OTA was implemented even before release" [Elektroda, insmod, post #21528805]

Why did I get “OTA update not implemented for OpenRTL87X0C”?

Early builds (≤ 1.18.12) lack the local OTA endpoint. Use the Web-App OTA tool instead, or flash a newer build first [Elektroda, Jerther, #21528804; max4elektroda, #21528852].

How can I recreate the original tri-color Wi-Fi LED behaviour?

Assign P7 and P9 as separate WifiLed roles, then use an autoexec script to toggle states (green = P7, red = P9, amber = P7+P9). Example script: setChannel 7 1; delay 300; setChannel 7 0; setChannel 9 1. Extend with ‘event wifiState’ triggers [Elektroda, Jerther, #21385370; divadiow, #21424343].

Is long-term Wi-Fi stability solved?

After Realtek auto-reconnect was enabled, one RTL8710B plug logged ≈ 30 days uptime despite outages [Elektroda, insmod, post #21528550] Update to the same branch for RTL8710CF to inherit the fix.

Edge case: device stops reconnecting after hours of outage

Pre-fix builds may drop retries and blink red/green indefinitely. Upgrade firmware and enable Flag 51 to force aggressive reconnect attempts [Elektroda, Jerther, #21490774; insmod, #21528550].

Which capacitor fails most often and how do I replace it?

The factory 470 µF 10 V electrolytic across the low-voltage rail can vent. Replace with a 470 µF 16 V, 8000 h, 105 °C part. This raises voltage headroom by 60 % and matches capacitor-life charts [Elektroda, Jerther, post #21598616]

Does the newer PCB revision break flashing?

No. Test pads remain in the same order; you only remove a foam spacer to reach one pad [Elektroda, Jerther, post #21598616]

How do I map the Reset button to safe-mode?

OpenBeken templates merged in PR #191 map P19 as Btn;1 with ‘SafeMode’ flag, so holding it at boot loads default settings [Elektroda, Jerther, post #21549106]

MQTT attributes turn to “unknown” after hours—why?

The broker retains discovery topics but the switch sends LWT heartbeat only at connect. Add ‘periodicPublish 300’ in autoexec to refresh IP, RSSI, SSID and uptime every 5 min [OpenBeken docs; Elektroda, Jerther, #21598616].

How do I submit my own template to the official list?

Fork the OpenBeken WebApp repo, add your JSON to templates.json, and open a pull request; see commit 1773584 for an example [Elektroda, divadiow, post #21528669]

What serial speed should I use for flashing?

Realtek’s bootloader defaults to 115200 8 N 1. Higher speeds often fail during write-verify [Elektroda, common practice].

Is 5 V on the pad safe while UART is 3 V3?

Yes. The pad feeds the board’s LDO; UART pins stay at 3 V3 logic so the levels remain within MCU limits [Elektroda, Jerther, post #21384347]

Three-step quick flash recap

Solder four wires: 3 V3, GND, TX, RX; add a clip to GPIO0 pad. 2. Short GPIO0→3 V3, press Restart, release. 3. Run bk7231flash.py and send OpenBeken.bin (≈ 2 min).