Disassembling Generic US Tuya RMC003 Smart Plug with LN882HKI MCU and CNHZ HZ32-1A3S-LH Relay

Basic RMC003 US 110-220V smart plug with 10A CNHZ HZ32-1A3S-LH relay, no power monitoring, 1 blue LED and 1 button.

Access was relatively easy - crushed the outer casing in a rubber-lined vice, just below the join rim, until there's cracking of the glue and gaps form for a spudger to then be inserted to complete the job.

Pics:



Plug was from JSPTECH store on Ali Express https://www.aliexpress.com/item/1005007884742225.html


PCB print:
RM-JG001-MAE2G
RM-SMART

The main MCU is a Lightning Semi LN882HKI -
https://www.elektroda.com/rtvforum/topic4027545.html
https://www.elektroda.com/rtvforum/topic4028087.html
https://www.elektroda.com/rtvforum/topic4032240.html
https://www.elektroda.com/rtvforum/topic4045532.html

Unfortunately the pads to capture UART boot log (B9), get into flash mode (A9 grounded) and then flash/dump (A2, A3) are inaccessible until the main PCB is de-soldered from the power pins. For me this was quite destructive, melting the plastic surrounding the pins. It had to get too hot before the solder would melt. I did mix some 63/37 pb solder in first but I guess not enough.



boot log @921600 baud from B9


TuyaOS SDK v3.5.4 like every other Tuya LN882H firmware we've captured to date. Version 1.0.0 - no OTA upgrade offered either, like all others.



Device schema e1k73cfg

I wrote off the power pins and made this so device could be tested on mains


Tuya_3.5.4_RMC003_US_PLUG_(schemaID-e1k73cfg)_ONPCB_LN882H_1.0.0.bin firmware dump: https://github.com/openshwprojects/FlashDumps/tree/main/IoT/LN882H

OBK template

LN882H on PCB, that's nice, did you know in advance that it will be LN882H-based or was it just a lucky shot?

It's a shame that Tuya uses non-isolated power supplies for such devices, otherwise it could be a very good candidate for DHT11/BMP280/anything weather sensor/station, but without mains isolation it could be risky... you could get live potential on DHT/DS18B20, etc.

p.kaczmarek2 wrote:

did you know in advance that it will be LN882H-based or was it just a lucky shot?

Lucky shot. Just see what comes.

p.kaczmarek2 wrote:

It's a shame that Tuya uses non-isolated power supplies for such devices,

what would you expect to see to know that there's isolation? How can you tell?

This is non-isolated power supply, a step down converter:

For example, this one is done with OB2222MCP chip.
On this schematic, you can see there is a continous line from mains N (or L, if you swap plug...) to the one of power supply output terminals. So, with this setup, you can sometimes get live potential on, let's say DHT11 ground. And then if you touch DHT11 ground with one hand, and, let's say, PC case with second hand, you'll get a serious shock.
Sample device where it's used: https://www.elektroda.com/rtvforum/topic3828223.html



And this is an isolated power supply, it's a flyback converter as usual. Very common topology, also used for 5V "chargers", etc:

As you can see, there is no continous connection between mains (L or N) and the power supply output - it's isolated by transformer. So, unless a fault occurs, it's more safe than a non-isolated converter, but still caution is recommended.
Sample device where it's used: https://www.elektroda.pl/rtvforum/topic4098965.html

very interesting. thank you.

Added after 11 [minutes]:

noticed earlier that the plug is marked as 110-220V. Our mains is typically 230-240v (going on the Atorch device reading when used - 241v today). I wonder if the 220 tolerance covers 230-240 or, if used in production, this device can be expected to fail after a short while

Added after 3 [minutes]:

relay does say 277vAC, black cap 400v and green cap 10v

You should check U1 for that. This is the most crucial element and it most likely tolerates higher voltages than 220V AC.

Assuming that you still have it open, and if not, don't worry, it will be certainly ok.

\Wait, I seem to be able to read the marking on one of the photos - BP2525? https://www.elektroda.com/rtvforum/find.php?q=BP2525

yes, BP2525