logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[ECR6600 ] Teardown and OpenBeken Conversion of TNCE TUYA Smart Plug WiFi from AliExpress

djbios 2883 20
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • Laboratory power supply and prototype board on a glass desk.
    Hi all! Let me share my teardown of TNCE TUYA Smart Plug WiFi I recently bought on AliExpress for 5 euros. The original Tuya firmware was pretty unstable and I decided to covert it to OpenBeken. Luckily, OpenBeken supports ECR6600 platform so it was possible to flash it via UART. I'll show the flashing process here step by step.

    Here is the look of the device
    A person holding a white electrical adapter with a Schuko socket on a dark background.
    Electrical adapter held in a hand.
    Smart electric socket in gray with a visible power button.
    Travel adapter with two pins on a dark background.

    To open up the device without much damage I used a vice: slightly squeezing from both sides till the little crack sound allows to crack the glue and split the plastic into 2 parts

    Electrical socket adapter with an on/off switch.

    Then removing one little screw allows to extract the PCB


    Open plug with visible interior.
    A circuit board held in hand with various electronic components.
    Close-up of a blue printed circuit board with visible electronic components.
    Close-up photo of a blue circuit board with electronic components and the inscription ESWIN.
    A printed circuit board with electronic components held in a hand.
    Blue circuit board with a mounted relay.
    Blue circuit board with a lever switch on a black background.

    We can see that the socket is built on the basis of ECR6600, which OpenBeken recently supported. To measure the voltage/current they use BL0937CF.

    On the back of the PCB, there are convenient pads to solder the USB-UART adapter

    Electronic circuit with JIEYING relay and connected wires.

    Then we need an external 3.3V power source, I used an adjustable lab one

    Laboratory power supply and prototype board on a glass desk.

    I used this guide https://www.elektroda.com/rtvforum/topic4111822.html to flash the firmware, in a nutshell you need to:
    1) Download ESWIN_ECR6600_RDTool_v1.0.21.zip from here https://github.com/openshwprojects/FlashTools/tree/main/TransaSemi-ESWIN and use RDTool.exe
    2) In RDTool you double click "develop tool" tab, select the COM port, and on "all-in-one file path" select the firmware from latest release https://github.com/openshwprojects/OpenBK7231T_App/releases/ (ECR6600 UART Flash) - I used OpenECR6600_1.18.62.bin
    3) Then you need to click start and enable the power source of a device. You might not get in sync from the first attempt (there is some very specific timing, smth like 0.5 sec to power device after start clicked) - that's okay, you will succeed eventually.
    4) After the program finishes the flashing - you all set, the device runs free firmware now.

    Now you can unsolder the wires, put PCB back in a case and try to put it in the socket. WiFi hotspot should be running now.

    The pins configuration is:

    Code: JSON
    Log in, to see the code


    UPD: Attached the original firmware

    Enjoy!
    AI: Did you encounter any specific issues or challenges during the teardown or firmware conversion process?
    No, just needed to collect the info from different sources
    AI: How familiar are you with similar teardown and firmware flashing processes?
    A bit
    Attachments:

    Cool? Ranking DIY
    About Author
    djbios
    Level 2  
    Offline 
    djbios wrote 2 posts with rating 7. Been with us since 2025 year.
  • ADVERTISEMENT
  • #2 21486307
    p.kaczmarek2
    Moderator Smart Home  
    Thank you for sharing! It's good to see that ECR6600 support is being useful for our users. Did you see that, @divadiow @insmod ? You did good job with research and porting.

    Did you try some other drivers as well, like NTP or SSDP?

    I think we also may need to look into powersave feature for such plugs, I've already seen one with broken capacitor due to the too high current consumption.

    Interestingly enough, I've received a very similar plug just yesterday, but it was T34-based and not ECR6600: https://www.elektroda.com/rtvforum/topic4112776.html
    Helpful post? Buy me a coffee.
  • #3 21486425
    divadiow
    Level 35  
    p.kaczmarek2 wrote:
    Did you see that, @divadiow @insmod ? You did good job with research and porting.

    😁😁

    are you finding wifi is OK @djbios?

    what's your RSSI shown in OBK? what's the distance from device to router/AP? what speed has it connected (if your router tells you)?

    Added after 14 [minutes]:

    I thought I'd submitted the previous one of these for the device list. I guess not. https://www.elektroda.com/rtvforum/topic4111822.html#21480857

    Also, did you miss the LED @djbios - P22?

    https://github.com/OpenBekenIOT/webapp/pull/187
  • ADVERTISEMENT
  • #4 21486794
    p.kaczmarek2
    Moderator Smart Home  
    @divadiow how many ECRs did you have with WiFi problems?
    Helpful post? Buy me a coffee.
  • #5 21486822
    divadiow
    Level 35  
    only the WG236 modules in testing. Same as @insmod. I don't have a real ECR6600 device yet.
  • #6 21486846
    p.kaczmarek2
    Moderator Smart Home  
    Did they come blank by default or with AT firmware? Is there a RF-calibration utility in the SDK?
    Helpful post? Buy me a coffee.
  • #7 21486856
    divadiow
    Level 35  
    They come with something on. It feels more likely it's a calib issue with the WG236 modules specifically, yes. I'll take a fresh look this evening. I have already transplanted RF nv partition from Tuya firmware to module to no effect.
  • ADVERTISEMENT
  • #8 21503392
    jannie_doedel
    Level 2  
    works like a charme !!
    Tried to load NTP and worksfine too.
    Only chip temp is 0.0. Without config it showed 44 degrees.
    Display showing energy consumption data and parameters of the OpenECR6600 device.
    What is the pin for wifiled ?
  • #9 21503405
    divadiow
    Level 35  
    divadiow wrote:
    Also, did you miss the LED @djbios - P22?

    this one maybe?

    Added after 52 [seconds]:

    template in device list is

    Code: JSON
    Log in, to see the code
  • #10 21503446
    jannie_doedel
    Level 2  
    >>21503405
    Yes thats the one.
    Thx !

    Added after 2 [minutes]:

    >>21503392
    The temperature indication must have been a glitch as it is working now
  • ADVERTISEMENT
  • #11 21503467
    insmod
    Level 27  
    >>21503446 Not a glitch, on your screenshot there are 2 incomplete boots. If more than one - internal temperature readout is disabled.
  • #13 21637258
    mlb
    Level 12  
    It worked! :)
    I've modified 3 plugs successfully. The small challenge is indeed to turn power supply in a blink of an eye after pressing the start button in RDTool. Another issue I've noticed with the current firmware version is the Home Assistant discovery does not recognize this Tasmota instance, while the messages in MQTT seem correct. Nevertheless, a success, thanks for your work to make it possible!
  • #14 21640559
    mlb
    Level 12  
    After trying to use those plugs for a few days, unfortunately I've discovered recurring wifi issues.
    They existed before uploading the new firmware, so I guess this is related to faulty wifi in ECR6600 chip. I have many other smart plugs like that I've bought in the past, and they all work well, only the new with ECR6600 is problematic.
    Problems start if you have more than one of those plugs located close to each other. Then, only one smart plug will connect to wifi, others will keep trying forever. And, it is random which plug connects first... It was fun to play with those, but because of unreliable wifi - I would not recommend wasting your money on it.
  • #15 21640570
    divadiow
    Level 35  
    maybe they have the same mac address. Do they each connect fine, in turn, if only one is switched on at any one time?

    I flashed my EU ECR6600 smart plug last night and mac is generic/0s, but I did erase whole flash before flashing OpenECR6000

    Screenshot showing ECR6600 device info with MAC address 00:06:06:00:00:00

    Added after 9 [minutes]:

    seems manual mac address change feature works for ECR6600

    Network interface showing IP 192.168.1.114 and MAC 00:06:01:23:00:00
  • #16 21642454
    kennyyzm
    Level 2  
    Hi guys, I have the same smart plug but I was not able to either backup old firmware not flash a new one. I keep getting RECV_RSP: recv timeout: recv length is: 1 (sometimes it's 3).

    RDTool window showing RECV_RSP error during firmware flashing process.

    Can someone help please? I have no idea what's that error about...
  • #17 21642461
    p.kaczmarek2
    Moderator Smart Home  
    So, how do you connect UART to your plug? Can you share some photos?
    Helpful post? Buy me a coffee.
  • #18 21642470
    kennyyzm
    Level 2  
    Here's the photo, I broke both TX and RX pads and resorted to use the copper trace for both.

    Electronic boards connected with wires on a cluttered desk with tools, glasses, and paper notes.
  • #19 21642476
    p.kaczmarek2
    Moderator Smart Home  
    Well, first of all, you need to have a common ground between power supply and the UART... if you use external power supply, GND must connect to both external power supply GND and USB to UART converter GND.
    Helpful post? Buy me a coffee.
  • #20 21642493
    kennyyzm
    Level 2  
    @p.kaczmarek2 Wow, it works right away. Thanks for your help. I thought it's not possible to flash it anymore since I broke the pads, hehe, Thanks again!
  • #21 21644658
    mlb
    Level 12  
    divadiow wrote:
    maybe they have the same mac address. Do they each connect fine, in turn, if only one is switched on at any one time? 


    Yeah I've checked that too.... Nope, they have original, distinct MAC addresses. In my router logs I can just see them connecting sometimes, trying to authenticate (the network has WPA2 security), retrying a few times, then giving up. I do have pretty crowded wifi for IoT devices, with mesh/roaming and VLAN enabled, maybe that's why. Just other devices do not have such issues, it takes them a few seconds at most to connect successfully. Some of them are smart plugs too, a bit older generation, still working fine with Localtuya.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

A teardown and firmware conversion of the TNCE TUYA Smart Plug WiFi purchased from AliExpress was performed, focusing on replacing the unstable original Tuya firmware with OpenBeken firmware. The device is based on the ECR6600 platform, which supports flashing via UART. The disassembly method involved carefully cracking the glued plastic casing using a vice and removing a single screw to access the internals. Discussion highlighted the successful use of OpenBeken on this platform, including loading additional drivers such as NTP and SSDP. WiFi performance metrics like RSSI and connection speed were queried, with mention of a WiFi LED connected to pin P22. Temperature sensor readings initially showed glitches due to incomplete boots but stabilized after multiple restarts. Some users noted power consumption concerns related to capacitor failures in similar plugs and compared the ECR6600-based device to a T34-based variant. Firmware details, boot logs, and product IDs were shared, with references to RF calibration challenges on WG236 modules and the transplantation of RF non-volatile partitions from Tuya firmware without improvement. A device template listing pin assignments for components such as BL0937 energy metering IC, WiFi LED, button, and relay was provided.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT