logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Sonoff S60TPG iPlug UK Smart Plug Investigation [ESP32-C3] [CSE7759B] [SM-049]

divadiow 2268 20
ADVERTISEMENT
Report a violation of the law
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • A product page for the Sonoff S60 UK Plug TPG 13A smart plug, showing the plug, its box, and promotional pricing details.
    Here are my experiences with a Sonoff S60TPG iPlug UK smart plug, along with teardown, flashing information and OpenESP32 experiments (OBK port).


    Gray box of Sonoff S60TPG iPlug Type G smart plug on a beige carpet. Box of Sonoff S60TPG iPlug UK smart plug with product label and barcode. Box of Sonoff Type G Wi-Fi Smart Plug on a beige carpet. Gray box of Sonoff iPlug S60TPG Type G placed on a beige carpet. Sonoff S60TPG iPlug smart plug, manual, and Type G box on a carpet. Close-up of the label on the Sonoff S60TPG smart plug with three UK metal prongs visible.
    The plug was bought from Ali Express
    https://nl.aliexpress.com/item/1005006764953793.html

    Glue seemed to be too strong and I didn't have the right width tools to contort it in a vice to crack it open. I resorted to drilling a hole at the chassis join from which it could be pried apart. Main PCB removed from power pins and then module de-soldered.

    Close-up of a UK smart plug with a drilled hole at the seam and visible crack along the plastic enclosure. Disassembled Sonoff S60TPG UK smart plug with exposed PCB and electronic components. Top view of the inside of a Sonoff S60TPG iPlug UK smart plug, showing electronic components on the PCB. Close-up of the internal PCB of a Sonoff S60TPG plug, showing the SM-049 ESP32-C3 module and electronic components. Close-up of a FANHAR relay and electronic components on a smart plug’s PCB. Close-up of the interior of a Sonoff S60TPG iPlug UK smart plug showing electronic components and connectors. Close-up of the inside of a Sonoff S60TPG smart plug, showing the PCB, power contacts, and electronic components. The inside of an empty Sonoff S60TPG iPlug UK plug case with visible partitions, no electronics inside. Close-up of a smart plug interior showing a PCB, two LEDs, and a Chipsea CSE7759B chip. Close-up of the Sonoff S60TPG smart plug PCB with visible electronic components, capacitors, and a relay. Close-up of a smart plug PCB with a FANHAR FH17-1A2TE relay and visible electronic components.
    Fragment of a round PCB from Sonoff S60TPG plug, with labeled pins and electronic components visible. A fragment of the Sonoff S60TPG PCB showing pin labels, electronic components, and solder pads. A PCB module with a black CSE7759B chip and markings ROHS and E506706. Top view of the SM-049 ESP32-C3 V1.3 PCB module, showing component layout and pin labels. ESP32-C3 SM-049 V1.3 module on a green PCB with pin labels, top view. Electronic module with CHIPSEA CSE7759B chip mounted on a green PCB with ROHS marking and several connectors.

    A module I've not seen before. A Coolkit SM-049 V1.3 - an ESP32-C3 with 4mb flash integrated. On the reverse of the module is a Chipsea Technologies CSE7759B energy metering chip. Module takes 5V from main PCB but then 3.3v supplied to ESP32 thanks to a MicrOne (Nanjing Micro One Elec) ME6211A33PG-N 6211A 2438/33 LDO.

    Close-up of ME6211A33PG-N 6211A voltage regulator IC on a green PCB, with visible 5V, KEY, and RST labels.

    from IO21/TX at 115200 baud, factory boot log

    Code: Text
    Log in, to see the code



    eWeLink app experience. fw ver 1.1.1 with update to 1.2.0 offered

    Screenshot of a mobile app showing the SONOFF S60TPG device detected during the add device process.Screenshot of eWeLink app with S60TPG smart plug turned on, showing zero power usage. Mobile app screen for the Sonoff S60TPG smart plug in eWeLink, showing firmware update notification and device stats. Mobile app screen showing energy summary with current 0.25 A, voltage 5.43 V, power 7.26 W, and 0 kWh energy usage today, yesterday, and this month. Screenshot of Sonoff S60TPG device settings in a mobile app, showing current firmware version and various configuration options. Firmware update notification explaining daylight saving time handling and update steps for the eWeLink app.


    IO9/Key grounded gets ESP into download mode

    Code: Text
    Log in, to see the code


    info gathering with esptool

    esptool.exe --port com73 get_security_info
    Code: Text
    Log in, to see the code


    good, no secure boot or flash encryption.

    espefuse.exe --chip esp32c3 --port COM73 summary
    Code: Text
    Log in, to see the code


    dump to file
    esptool.exe --chip esp32c3 --port COM73 --baud 921600 read_flash 0x000000 0x400000 flash_dump.bin

    Flashed OpenESP32C3 factory image with esp-flasher.exe from https://github.com/Jason2866/ESP_Flasher/releases

    Module contact tracing and labels

    ESP32-C3 SM-049 V1.3 board with labeled pins and a pinout diagram in the corner.
    Photo of an electronic module with a CHIPEA CSE7759B chip, labeled pins GPIO10, GPIO9 (KEY/BTN), and TX/C3-GPIO7, plus ESP32-C3 and CSE7759B diagrams.

    Fragment of a Sonoff smart plug PCB with labeled pins and signal names visible.

    Meaning the assignments are

    Code: JSON
    Log in, to see the code


    The blue wifi LED is controllable but the second red LED is linked to the relay. On=relay closed, Off=relay open.

    ESP builds are missing the CSE7766 driver (compatible with CSE7759B), so I enabled it with this PR https://github.com/openshwprojects/OpenBK7231T_App/pull/1642 but @insmod warned me in the comments that it may not work. This is my first CSE7759B - from what I've seen in other posts it seems only the driver needs starting and perhaps flag 26 ([UART] Use alternate UART for BL0942, CSE, TuyaMCU, etc) needs enabling in some situations. Unfortunately no readings on ESP32 with or without flag. IO7 is connected to TX on the CSE7759B.

    Diagram of the CSE7759B chip with the TI pin highlighted and labeled TX/C3-GPIO7.

    Screenshot of OpenESP32C3 web interface showing relay switched off and all sensor readings at zero.

    and that's the current state of play.
    Attachments:
    • User-Manual_S60TPGEN-V1.0.pdf (3.62 MB) You must be logged in to download this attachment.
    • esp32-c3_datasheet_en.pdf (887.58 KB) You must be logged in to download this attachment.
    • CSE7759B用户手册V1.3_1668152475.pdf (1.91 MB) You must be logged in to download this attachment.
    • 2410121248_MICRONE-Nanjing-Micro-One-Elec-ME6211A33PG-N_C236673.pdf (844.77 KB) You must be logged in to download this attachment.

    Cool? Ranking DIY
    About Author
    divadiow
    Level 38  
    Offline 
    divadiow wrote 4839 posts with rating 852, helped 420 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • #2 21555467
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    Interesting, which brings us the question how we can futher test and improve the CSE and UART drivers.... maybe try to get a valid CSE packet and then do remaining operations on the ESP dev board, while sending that packet through USB to UART converter?

    How good is CSE7759B driver anyway? As far as I remember I haven't tested it, it was submitted by a contributor.
    Helpful post? Buy me a coffee.
  • #3 21556046
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    I'll try to set up some kind of CSE simulation. Hopefully it'll be more reliable and indicative of a real CSE than the BL0937 simulator attempts with PWM and Arduino sketch.

    No idea about how good the CSE driver currently is. It doesn't seem to come up often on the forum and this is my first.

    Added after 3 [minutes]:

    How does the CSE driver know which GPIOs are UART and how they differ across platforms?

    Added after 6 [hours] 54 [minutes]:

    hmm. not 100% sure of the current state of the CSE7766 driver. I have started with a Python simulator communicating with more-likely-to-work BK7231N.

    Using the logs here https://www.elektroda.com/rtvforum/topic4018338.html#20843887 to send an example 24 bytes from a real CSE we get the following displayed in latest OBK

    Screenshot of OpenBK web interface with energy readings for the CSE7766 driver.

    If you go back to December 2023 release with same simulation:
    OpenBK7231N control panel with energy readings, WiFi status, and configuration buttons.

    does anyone have a real CSE on BK7231N to check?

    Added after 3 [minutes]:

    attaching script as file because Elektroda errors with this if posting as code block

    Screenshot showing an Access Denied message for a blocked website page.
    Attachments:
    • CSE7766_simulator.zip (577 Bytes) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #4 21556944
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    I've also got Sonoff but the one with CSE7761, which has different UART protocol. I will have few spare hours today and I will try porting some driver, but I'm not sure if it will work with unstable UART. Maybe we should fix UART first.

    All those tests results were done without calibration so I am not sure how reliable they are.
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #6 21556984
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    Is PROTA working for you on ESP?"

    I get:
    Code: text Expand Select all Copy to clipboard
    
2025-05-22 14:02:40: [Found matching file: OpenESP32C2_1645_merge_1d63268bd632.img]
2025-05-22 14:02:40: [Sending OTA data to http://192.168.0.162/api/ota]
2025-05-22 14:02:53: [Error sending OTA update: Wystąpił błąd podczas wysyłania żądania.]
    Helpful post? Buy me a coffee.
  • #7 21557019
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    yikes. a lot of artefacts now. worked though

    Display showing ESP32C3 device information: build date, online time, MAC address, name and ESP-IDF version.

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #8 21557028
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    Code: text Expand Select all Copy to clipboard
    
2025-05-22 14:32:23: [Found matching file: OpenESP32C2_cse_97086a1b8ac6.img]
2025-05-22 14:32:23: [Sending OTA data to http://192.168.0.162/api/ota attempt 0]
2025-05-22 14:32:23: [PostAsync ]

    I think I found a bug, it uses C2 binary for ESP32? Or am I the one mistaken?
    Helpful post? Buy me a coffee.
  • #9 21557030
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    Not sure what you mean. I was testing on C3 SuperMini and that was matched OK. Is your Sonoff not C2?
  • #10 21557034
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    No, it's ESP32 but code in PROTA uses Contains and it tries first binary with ESP32 in name - obviously a bug
    Helpful post? Buy me a coffee.
  • #11 21557044
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    oh i get you.

    yes my ESP32 gets sent C2 ota too
    Code: Text
    Log in, to see the code
  • #12 21557206
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    I've added a fix, the substring approach was treating ESP32S2 as ESP32.
    Helpful post? Buy me a coffee.
  • #13 21557599
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    How's it going with the CSE7761 experience on ESP?
  • #14 21557684
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    I've did some tests but I couldn't get receiving to work. I've also realized that we need HAL to choose custom UART pins on ESP32 (@insmod but I also may do it soon). My current plan is to just take an ESP32 dev board, and write a simple "UART test" driver that, for example, expects to receive growing numbers and checks for errors, and do the script for PC that sends those numbers, to make debugging easier. I will try to improve UART then and then, once UART is better, I can think about CSE.
    Helpful post? Buy me a coffee.
  • #15 21557691
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    I thought about playing with UART again and adding ESP pin selection after w800/berry and then bk7231u/7252 is merged.
    Initial idea is to add something like HAL_AddPlatformSpecificCommands() and executing it in user_main.
    Adding it as weak symbol in generics for other platforms ofc.
  • #16 21557726
    divadiow
    Level 38  
    Posts: 4839
    Help: 420
    Rate: 852
    insmod wrote:
    w800/berry and then bk7231u/7252 is merged

    this would be good. I'm just flashing new BK7252U device with same tests as in doorbell thread.
  • #17 21557891
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    So w800 + berry is ready to merge?
    Helpful post? Buy me a coffee.
  • #19 21557946
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    Permanent or recoverable via UART? Would it possible to add a safe check for that?
    Helpful post? Buy me a coffee.
  • #20 21557952
    insmod
    Level 31  
    Posts: 1353
    Help: 160
    Rate: 425
    >>21557946
    Recoverable.
    I don't know how OTA is performed on BL602, but if there is a header with unpacked size, then perhaps it's possible.
  • #21 21558003
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14394
    Help: 650
    Rate: 12314
    I remember that I added OTA for BL602 to rest_interface.c some time ago. It's taking a header and a compressed stream.
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/rest_interface.c
    Maybe ota_header_t struct could help? If it has uncompressed size... we could even settle for a soft check, on the Web App side.

    We would need to check is ota_header_t::len an uncompressed len or compressed? Let me open OpenBL602_1.18.104_OTA.bin.xz.ota in xvi32...
    Screenshot of the XVI32 hex editor with an open binary file and Data Inspector panel.
    Well it looks like compressed size to me. Maybe we could attempt decompress at web app level and check uncompressed size that way?

    Or maybe.. it's a xz format? Maybe it has some kind of header?
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

✨ The discussion centers on the Sonoff S60TPG iPlug UK smart plug teardown, firmware flashing, and experimentation with OpenESP32 firmware, focusing on the integration and testing of the CSE7759B energy metering IC and UART drivers on ESP32-C3 platforms. Challenges include strong glue complicating hardware disassembly, unstable UART communication, and the need for improved UART pin selection and calibration for reliable CSE driver operation. Contributors explore simulation approaches for CSE packets, compare CSE7761 and CSE7766 IC protocols, and address firmware OTA update issues related to ESP32 variants (C2, C3) and BL602 devices. Discussions also cover partition layout recommendations for BL602, OTA update mechanisms involving compressed streams, and potential safeguards against bricking during OTA. Development efforts include adding platform-specific HAL commands for UART configuration and debugging UART communication with test scripts to enhance driver stability before advancing CSE integration.
Generated by the language model.
Today's popular

FAQ

TL;DR: This FAQ helps modders and firmware testers investigate the Sonoff S60TPG UK smart plug. It confirms a 4 MB ESP32-C3 module, explains the relay/button pin map, and shows that “good, no secure boot or flash encryption” makes backup and reflashing practical before OpenESP32 experiments. [#21555140]

Why it matters: It turns a scattered teardown and driver-debug thread into a quotable reference for safely opening, dumping, flashing, and troubleshooting this specific Sonoff plug.

Item Sonoff S60TPG finding Compared with
Main MCU/module Coolkit SM-049 V1.3 with ESP32-C3 and 4 MB flash Other Sonoff plug discussed uses CSE7761 instead [#21555140]
Energy IC CSE7759B on module reverse side CSE7761 uses a different UART protocol [#21556944]
OTA tool issue PROTA could match the wrong ESP32-family image by substring Fix later added for ESP32S2/ESP32 matching [#21557206]

Key insight: The hardware is flashable, but reliable power telemetry is blocked by software maturity, not locked silicon. The thread points to missing ESP32 UART pin-selection support and unresolved CSE driver behavior as the real blockers. [#21557684]

Quick Facts

  • The SM-049 V1.3 module takes 5 V from the main PCB and regulates it to 3.3 V for the ESP32-C3 with a MicrOne ME6211A33PG-N LDO. [#21555140]
  • Factory boot output reports ESP-IDF v4.4.2-dirty, 40 MHz SPI flash speed, DIO mode, and 4 MB flash, with OTA partitions at 0x20000 and 0x210000. [#21555140]
  • Download mode appears when IO9/Key is grounded, and the ROM reports boot:0x5 (DOWNLOAD(USB/UART0/1)), which is the critical entry point for manual flashing. [#21555140]
  • The confirmed GPIO map is GPIO4 = Rel;1, GPIO5 = WifiLED_n;0, and GPIO9 = Btn;1; the separate red LED follows relay state rather than a user GPIO. [#21555140]
  • A full safety backup uses read_flash 0x000000 0x400000, which saves the original 4,194,304-byte flash image before OpenESP32C3 testing. [#21555140]

How do you open a Sonoff S60TPG iPlug UK smart plug for teardown when the case glue is too strong?

Open it destructively if the glue will not crack in a vice. The successful method here was to drill a hole at the chassis seam, pry the case apart from that hole, remove the main PCB from the power pins, and then de-solder the module. This approach worked because the adhesive was too strong for normal opening tools. [#21555140]

What is the Coolkit SM-049 V1.3 module in the Sonoff S60TPG, and how is it built around the ESP32-C3?

The Coolkit SM-049 V1.3 is the plug’s Wi-Fi control module, built around an ESP32-C3 with integrated 4 MB flash. It takes 5 V from the main PCB and feeds the ESP32-C3 with 3.3 V through a MicrOne ME6211A33PG-N regulator. The CSE7759B energy chip sits on the reverse side of the same module. [#21555140]

What is the CSE7759B energy metering chip, and how does it relate to the CSE7766 driver used in OpenBeken/OpenESP32?

The CSE7759B is the power-measurement IC on this plug, and the tester treated it as compatible with the existing CSE7766 driver. "CSE7759B is an energy-metering chip that reports electrical measurements over UART, with thread evidence suggesting software compatibility with the CSE7766 driver path rather than a dedicated ESP32 implementation." In practice, the driver was enabled by a pull request, but readings still failed on ESP32. [#21555140]

Which GPIO pins on the Sonoff S60TPG ESP32-C3 control the relay, WiFi LED, and button?

GPIO4 controls the relay, GPIO5 controls the blue Wi-Fi LED, and GPIO9 is the button input. The posted assignment map was 4: Rel;1, 5: WifiLED_n;0, and 9: Btn;1. A second red LED is not independently mapped; it follows relay state, with red on when the relay is closed. [#21555140]

How do you put the Sonoff S60TPG ESP32-C3 into download mode for flashing, and which pin needs to be grounded?

Ground IO9/Key during boot to enter download mode. Use this sequence:
  1. Power the board off.
  2. Ground IO9, labeled Key.
  3. Power it on and confirm boot:0x5 (DOWNLOAD(USB/UART0/1)) at 115200 baud. That ROM message confirms the ESP32-C3 is ready for flashing over USB or UART. [#21555140]

What do esptool get_security_info and espefuse summary show on the Sonoff S60TPG, and how can you tell secure boot and flash encryption are disabled?

They show an unlocked ESP32-C3 with security features off. get_security_info reported Flags: 0x00000000, Secure Boot: Disabled, and Flash Encryption: Disabled. The eFuse summary matched that result with SECURE_BOOT_EN = False and SPI_BOOT_CRYPT_CNT = 0b000. Those two outputs together mean the dump and reflashing path is open. [#21555140]

Why is the CSE7759B not giving any readings on OpenESP32 even after enabling the CSE7766-compatible driver and trying UART flag 26?

It is not giving readings because the ESP32 side still appears to have unresolved UART and driver support issues. The tester enabled the CSE-compatible driver, tried flag 26, and confirmed that IO7 is connected to the CSE7759B TX pin, yet OpenESP32 still showed no values. Later replies suggest custom ESP32 UART pin selection and UART reliability must be fixed before CSE support can work. [#21557684]

How does the CSE driver know which GPIOs are UART and how do those UART pin assignments differ across platforms like ESP32 and BK7231N?

It currently depends on platform support, and that support is not complete on ESP32. A later test note says OpenBeken needs HAL work so ESP32 can choose custom UART pins, while BK7231N was used as a more likely test target for the Python CSE simulator. That means the same driver logic cannot yet rely on equal UART pin handling across ESP32 and BK7231N. [#21557684]

What is PROTA in the OpenBeken/OpenESP32 workflow, and how does it send OTA images to a device?

PROTA is the OTA helper used here to pick a matching firmware artifact and post it to the device’s web API. "PROTA is an OTA update tool that fetches build artifacts and sends them to /api/ota, with a follow-up reboot request to /api/reboot for OpenBeken or OpenESP32 devices." In the working log, it found OpenESP32C3_cse_97086a1b8ac6.img, uploaded it, and then rebooted the device successfully. [#21557019]

Why did PROTA match an OpenESP32C2 binary for an ESP32 device, and what was the substring bug that caused it?

PROTA matched the wrong image because its code used a substring search with Contains. That made names like ESP32S2 or ESP32C2 match a generic ESP32 target first, so an ESP32 device could receive OpenESP32C2_cse_97086a1b8ac6.img. The maintainer later confirmed the bug and added a fix for that substring behavior. [#21557206]

How can you simulate a CSE7759B/CSE7766 UART data stream with Python to test the OpenBeken driver on a dev board?

Send a known 24-byte packet from a real CSE log through a USB-UART adapter into a dev board. The tester built a Python simulator, targeted BK7231N first, and reused bytes captured from an earlier real-device log to compare current and December 2023 OpenBeken behavior. This isolates driver parsing from mains hardware and makes UART debugging repeatable. [#21556046]

CSE7759B vs CSE7761: what are the protocol and driver differences when testing Sonoff power-monitoring plugs?

The key difference is protocol compatibility. The thread states that the other Sonoff plug uses CSE7761, which has a different UART protocol from CSE7759B. That means a driver path or test method that works for one chip cannot be assumed to work for the other, especially while ESP32 UART receive support is still unstable. [#21556944]

What needs to be added to the ESP32 HAL so OpenBeken can choose custom UART pins for chips like the CSE7759B and CSE7761?

ESP32 needs HAL support for custom UART pin selection. The proposed direction was a platform hook such as HAL_AddPlatformSpecificCommands() executed in user_main, with a weak-symbol default for other platforms. "HAL is a hardware-abstraction layer that exposes chip-specific features through common firmware code, with custom UART pin selection being the missing ESP32 feature highlighted in this thread." [#21557691]

What's the safest way to dump the original 4 MB flash from a Sonoff S60TPG before flashing OpenESP32C3 with esp-flasher or esptool?

Dump the full flash first with esptool and save the binary before any test image. Use this sequence:
  1. Enter download mode by grounding IO9.
  2. Verify security is off with get_security_info.
  3. Run read_flash 0x000000 0x400000 flash_dump.bin at 921600 baud. That captures the original 4 MB image, which gives you a clean rollback path if OTA or serial flashing fails. [#21555140]

Why can flashing a BL602 build with enough OTA space but not enough unpack space brick a device, and how could a safer size check be implemented?

It can brick the device because OTA storage can be large enough for the compressed file while RAM or flash workspace is too small for the unpacked image. The thread says this failure is recoverable via UART, not permanent. A safer check would inspect the OTA header or decompress on the web-app side to compare the uncompressed size against available unpack space before starting the update. [#21557952]
Generated by the language model.
ADVERTISEMENT