[ECR6600][BL0937] Tuya Wifi Smart Plug With Energy Measurement

Question

Bought another smart plug hoping for BL0942 as reported recently in the forum, but got something else... From Here Typical plug appearance, no markings on outside Better polymer capacitors maybe, but no fusible resistor or MOV, but two LEDs Usual BP2525, BL0937, and AMS1117 (hardly visible) New...

divadiow · Accepted Answer

boot log from IO13 on WG236 after burning your backup Code: TextLog in, to see the code not getting to pairing mode I guess because I don't have BL0937 present. IO24 appears to be reset/btn Added after 3 [hours] 36 [minutes]:@Jamiwi have you traced out each pin/gpio to btn, rel, led, bl0937?

miegapele · Accepted Answer

Here is my backup, seems mostly the same as others with minor (data?) differences. Looks like wifi performs good, RSSI is reported similar to bk7231n nearby, and gpio finder performs well. No way to get boot log on TX0?

miegapele · Accepted Answer

And here is full config: Led for relay is hardwired, not controllable individually. Code: text Expand Select all Copy to clipboard{   vendor: Tuya,   bDetailed: 0,   name: Wifi Smart Plug With Energy Measurement,   model: Smart plug,   chip: ECR6600,   board: TODO,   flags: 1028,   keywords: [     TODO,     TODO,     TODO   ],   pins: {     14: BL0937CF;0,     15: BL0937SEL;0,     20: BL0937CF1;0,     22: WifiLED;0,     24: Btn;1,     25: Rel;1   },   command: ,   image:    wiki:  }

divadiow · Answer

nice. *instantly orders*

p.kaczmarek2 · Answer

Is there a datecode on the PCB? I wonder if it was produced after T34 batch or before.

miegapele · Answer

PCB has no marking at all. BL0937 has date code 2439, so this must be made after week 39, 2024.

Jamiwi · Answer

You don't have to wait until spring, here is some information from me about this plug

p.kaczmarek2 · Answer

How did you take flash backup? Can you share boot log?

divadiow · Answer

>>21444672 cool, thanks. another one for the ECR6600 collection

Jamiwi · Answer

No flashback was attempted, there is no boot log. The power supply to the module had to be established separately, the voltage from the serial converter was not sufficient.

Jamiwi · Answer

I didn't investigate anything further, for me the most important thing was to preserve the Flash content.At the moment there is no ready-made alternative firmware for these plugs

divadiow · Answer

thanks for confirming assignments. we've seen a couple of these in recent weeks. The template was added from this thread not too long ago Added after 7 [minutes]:I've still to get lucky and get one of these for myself. I'm keen to see what the AT firmware/RDTool running on there will read from efuse, if anything. ref:

miegapele · Answer

efuses appears to be not readable in my plug either. But why they are important? We already can read and write firmware, so that means there is no encryption anyway.

divadiow · Answer

ah just in case there's anything in there that may relate to the encrypted Tuya config stuff from 0x1D5000 Added after 10 [minutes]: but did you try with AT?

miegapele · Answer

What is AT?

divadiow · Answer

well, I assume the Skylab firmware that came on the WG236 modules can be used in conjunction with RDTool to read the efuse. @insmod could maybe elaborate...? My plan was to get one of these real Tuya devices using ECR6600, flash the WG236 firmware to it, then try reading efuse config in RDTool. Dunno if that's worth a try. Also, are the right UARTs even accessible on this plug with its limited number of test pads. Might not even be possible without a lot of effort I guess.

miegapele · Answer

It seems you can read efuses by just modifying firmware to do that. My plug has first 21 bytes set to something, others are 0. Code: text Expand Select all Copy to clipboard17,e2,19,82,04,8d,0d,80 9d,24,00,1c,66,0a,07,2d 25,00,c0,30,10 It's hard to understand what this is. Looks like some chip config/calibration, not likely to be any sort of encryption keys

divadiow · Answer

Oh cool. Nice. Can I ask what address(es) this was done at? If that's a valid question...

miegapele · Answer

These are first 21 bytes as read by basically this. So basically addresses 0x00 to 0x14 as I understand.

epolet · Answer

Hello, guys. May I ask you is that fifth pad put aside of row of others really boot pad? If yes, could you please advise how to use it to upload firmware to the chip? If not then how put chip to program mode to upload new firmware? I read about reset (ground CEN/RST) or power-on 3.3V to the device but really do not understand it. Where is that cen/rst pin is or how can I power-on it when it is always under power. Sorry for dilettantish question. I'm really confused with this chip. Thanks.

divadiow · Answer

I can trace it shortly, but it is not needed to backup and program the flash. backup and flash procedure Added after 18 [minutes]:it's pin 26

epolet · Answer

Thank you for your info. I checked by multimeter and mentioned pad is shorted to 26 pin of chip. So I used it to program flash. As described under link you provided I shortly connected that pad to GND right after programming start. I don't know was it the reason but now BurnTool gives errors sync failed and download failed (log below for two bin-files). ECR6600F_standalone_allinone.bin 2025-04-12 21:53:03.341 INFO PARSE_AIO: find 5 bin in all-in-one file 2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 0 info: dlType: 0 startAddr: 0x10000 len: 0x28e4 2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 1 info: dlType: 2 startAddr: 0x00 len: 0x1000 2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 2 info: dlType: 2 startAddr: 0x1000 len: 0x4dd0 2025-04-12 21:53:03.341 INFO PARSE_AIO: get file 3 info: dlType: 2 startAddr: 0x7000 len: 0xab1d4 2025-04-12 21:53:03.353 INFO PARSE_AIO: get file 4 info: dlType: 2 startAddr: 0x1fb000 len: 0x3000 2025-04-12 21:53:04.345 ERROR sync failed! 2025-04-12 21:53:04.463 ERROR download failed! OpenECR6600_1.18.76.bin 2025-04-12 21:53:42.779 INFO PARSE_AIO: find 4 bin in all-in-one file 2025-04-12 21:53:42.779 INFO PARSE_AIO: get file 0 info: dlType: 0 startAddr: 0x10000 len: 0x3704 2025-04-12 21:53:42.780 INFO PARSE_AIO: get file 1 info: dlType: 2 startAddr: 0x00 len: 0x1000 2025-04-12 21:53:42.780 INFO PARSE_AIO: get file 2 info: dlType: 2 startAddr: 0x1000 len: 0x4fe8 2025-04-12 21:53:42.781 INFO PARSE_AIO: get file 3 info: dlType: 2 startAddr: 0x7000 len: 0xaf6c4 2025-04-12 21:53:43.800 ERROR sync failed! 2025-04-12 21:53:43.909 ERROR download failed! Maybe someone met such situation and can advise how to overcome? BTW. Before that I, seems, successfully uploaded file ECR6600F_standalone_allinone.bin to the chip without usage of RST pin. Just clicking start button in BurnTool. I noted new wifi appeared instead of previous one. Now it has CMQLINK-590488-38ca. I'm able to connect to it. But don't know to which IP-address to go to open any site. Lan scan doesn't help. Does anyone know is there any use for that change? Thanks in advance.

epolet · Answer

>>21517031 No advice. So I moved forward alone and reached success.Two secrets helped me in this.1) I just clicked button Start of RDTool again and again2) After click wait 1 second, connect RST to GND and disconnect immediately. When you will lucky download (as for me it is more upload than download but ok, let it be called download, what confused a lot nevertheless) file OpenECR6600_1.18.76.bin will start and finish successfully.Btw. I found much more convenient location to touch RST to GND See picture below. Hope all is clear.Going that way I successfully reprogrammed the socket, connected to it via WiFi, configured its WiFi connection and accessed to it via my home lan. Thanks to all who helped me to reach this result.Now the question, if you allow.AFAIK this socket has power meter. Could anyone clarify me how to use it?Thanks in advance.

divadiow · Answer

Glad you got there in the end. BL0937 support was added in v1.18.61 so if you are on that version or higher simply importing the template or settings pin as below for this device and rebooting should be enough Code: TextLog in, to see the code

epolet · Answer

>>21521656 Thank you. It works. Now I see status of electricity on socket site and MQTT messages. Thank you. I'm pretty sure more questions will happen. But later. Thanks again.

Michaelred · Answer

How do these TNCE plugins from ECR660 vs the older ones on BK7321 perform with the original firmware on tuya cloud? How about the wifi coverage? Is it actually better on this Wifi 6. That antenna printed flat on the PCB somehow doesn't encourage The power consumption meter is reasonably accurate? EDIT: The plug has now arrived. Looks like I got the same as the subject author. Bought a 16A plug but got a 20A one. The wattmeter seems to work ok , However, the wattmeter readings are worse than those on the Aubess and on such a normal meter without wifi. The socket opens them very easily because they are only lightly glued. In the promos on aliexpress in the combined offers tab for about 9zł each were. Wattmeter readings after 24 hours from the same socket Silvercrest 1.41 kWh TNCE 1.46kWh Aubess 1.38kWh This shows that after subtracting the consumption of the 2 smart sockets (approx. 0.03 kWh/24h) the Aubess has virtually identical readings with the Silvercrest wattmeter. It assumes an intake of about 0.7w per socket. The TNCE socket overestimates the consumption a little. It also shows a higher mains voltage than the Silvercrest and Aubess. . . . .

[ECR6600][BL0937] Tuya Wifi Smart Plug With Energy Measurement

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Topic summary