logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Sonoff S60TPG iPlug UK Smart Plug Investigation [ESP32-C3] [CSE7759B] [SM-049]

divadiow 1287 20
ADVERTISEMENT
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
  • A product page for the Sonoff S60 UK Plug TPG 13A smart plug, showing the plug, its box, and promotional pricing details.
    Here are my experiences with a Sonoff S60TPG iPlug UK smart plug, along with teardown, flashing information and OpenESP32 experiments (OBK port).


    Gray box of Sonoff S60TPG iPlug Type G smart plug on a beige carpet. Box of Sonoff S60TPG iPlug UK smart plug with product label and barcode. Box of Sonoff Type G Wi-Fi Smart Plug on a beige carpet. Gray box of Sonoff iPlug S60TPG Type G placed on a beige carpet. Sonoff S60TPG iPlug smart plug, manual, and Type G box on a carpet. Close-up of the label on the Sonoff S60TPG smart plug with three UK metal prongs visible.
    The plug was bought from Ali Express
    https://nl.aliexpress.com/item/1005006764953793.html

    Glue seemed to be too strong and I didn't have the right width tools to contort it in a vice to crack it open. I resorted to drilling a hole at the chassis join from which it could be pried apart. Main PCB removed from power pins and then module de-soldered.

    Close-up of a UK smart plug with a drilled hole at the seam and visible crack along the plastic enclosure. Disassembled Sonoff S60TPG UK smart plug with exposed PCB and electronic components. Top view of the inside of a Sonoff S60TPG iPlug UK smart plug, showing electronic components on the PCB. Close-up of the internal PCB of a Sonoff S60TPG plug, showing the SM-049 ESP32-C3 module and electronic components. Close-up of a FANHAR relay and electronic components on a smart plug’s PCB. Close-up of the interior of a Sonoff S60TPG iPlug UK smart plug showing electronic components and connectors. Close-up of the inside of a Sonoff S60TPG smart plug, showing the PCB, power contacts, and electronic components. The inside of an empty Sonoff S60TPG iPlug UK plug case with visible partitions, no electronics inside. Close-up of a smart plug interior showing a PCB, two LEDs, and a Chipsea CSE7759B chip. Close-up of the Sonoff S60TPG smart plug PCB with visible electronic components, capacitors, and a relay. Close-up of a smart plug PCB with a FANHAR FH17-1A2TE relay and visible electronic components.
    Fragment of a round PCB from Sonoff S60TPG plug, with labeled pins and electronic components visible. A fragment of the Sonoff S60TPG PCB showing pin labels, electronic components, and solder pads. A PCB module with a black CSE7759B chip and markings ROHS and E506706. Top view of the SM-049 ESP32-C3 V1.3 PCB module, showing component layout and pin labels. ESP32-C3 SM-049 V1.3 module on a green PCB with pin labels, top view. Electronic module with CHIPSEA CSE7759B chip mounted on a green PCB with ROHS marking and several connectors.

    A module I've not seen before. A Coolkit SM-049 V1.3 - an ESP32-C3 with 4mb flash integrated. On the reverse of the module is a Chipsea Technologies CSE7759B energy metering chip. Module takes 5V from main PCB but then 3.3v supplied to ESP32 thanks to a MicrOne (Nanjing Micro One Elec) ME6211A33PG-N 6211A 2438/33 LDO.

    Close-up of ME6211A33PG-N 6211A voltage regulator IC on a green PCB, with visible 5V, KEY, and RST labels.

    from IO21/TX at 115200 baud, factory boot log

    Code: Text
    Log in, to see the code



    eWeLink app experience. fw ver 1.1.1 with update to 1.2.0 offered

    Screenshot of a mobile app showing the SONOFF S60TPG device detected during the add device process.Screenshot of eWeLink app with S60TPG smart plug turned on, showing zero power usage. Mobile app screen for the Sonoff S60TPG smart plug in eWeLink, showing firmware update notification and device stats. Mobile app screen showing energy summary with current 0.25 A, voltage 5.43 V, power 7.26 W, and 0 kWh energy usage today, yesterday, and this month. Screenshot of Sonoff S60TPG device settings in a mobile app, showing current firmware version and various configuration options. Firmware update notification explaining daylight saving time handling and update steps for the eWeLink app.


    IO9/Key grounded gets ESP into download mode

    Code: Text
    Log in, to see the code


    info gathering with esptool

    esptool.exe --port com73 get_security_info
    Code: Text
    Log in, to see the code


    good, no secure boot or flash encryption.

    espefuse.exe --chip esp32c3 --port COM73 summary
    Code: Text
    Log in, to see the code


    dump to file
    esptool.exe --chip esp32c3 --port COM73 --baud 921600 read_flash 0x000000 0x400000 flash_dump.bin

    Flashed OpenESP32C3 factory image with esp-flasher.exe from https://github.com/Jason2866/ESP_Flasher/releases

    Module contact tracing and labels

    ESP32-C3 SM-049 V1.3 board with labeled pins and a pinout diagram in the corner.
    Photo of an electronic module with a CHIPEA CSE7759B chip, labeled pins GPIO10, GPIO9 (KEY/BTN), and TX/C3-GPIO7, plus ESP32-C3 and CSE7759B diagrams.

    Fragment of a Sonoff smart plug PCB with labeled pins and signal names visible.

    Meaning the assignments are

    Code: JSON
    Log in, to see the code


    The blue wifi LED is controllable but the second red LED is linked to the relay. On=relay closed, Off=relay open.

    ESP builds are missing the CSE7766 driver (compatible with CSE7759B), so I enabled it with this PR https://github.com/openshwprojects/OpenBK7231T_App/pull/1642 but @insmod warned me in the comments that it may not work. This is my first CSE7759B - from what I've seen in other posts it seems only the driver needs starting and perhaps flag 26 ([UART] Use alternate UART for BL0942, CSE, TuyaMCU, etc) needs enabling in some situations. Unfortunately no readings on ESP32 with or without flag. IO7 is connected to TX on the CSE7759B.

    Diagram of the CSE7759B chip with the TI pin highlighted and labeled TX/C3-GPIO7.

    Screenshot of OpenESP32C3 web interface showing relay switched off and all sensor readings at zero.

    and that's the current state of play.
    Attachments:

    Cool? Ranking DIY
    Rust on Embedded Online Conference on 16 July with 33 per cent discount for elektroda users
    About Author
    divadiow
    Level 34  
    Offline 
    divadiow wrote 2987 posts with rating 508, helped 262 times. Live in city Bristol. Been with us since 2023 year.
  • ADVERTISEMENT
  • #2 21555467
    p.kaczmarek2
    Moderator Smart Home  
    Interesting, which brings us the question how we can futher test and improve the CSE and UART drivers.... maybe try to get a valid CSE packet and then do remaining operations on the ESP dev board, while sending that packet through USB to UART converter?

    How good is CSE7759B driver anyway? As far as I remember I haven't tested it, it was submitted by a contributor.
    Helpful post? Buy me a coffee.
  • #3 21556046
    divadiow
    Level 34  
    I'll try to set up some kind of CSE simulation. Hopefully it'll be more reliable and indicative of a real CSE than the BL0937 simulator attempts with PWM and Arduino sketch.

    No idea about how good the CSE driver currently is. It doesn't seem to come up often on the forum and this is my first.

    Added after 3 [minutes]:

    How does the CSE driver know which GPIOs are UART and how they differ across platforms?

    Added after 6 [hours] 54 [minutes]:

    hmm. not 100% sure of the current state of the CSE7766 driver. I have started with a Python simulator communicating with more-likely-to-work BK7231N.

    Using the logs here https://www.elektroda.com/rtvforum/topic4018338.html#20843887 to send an example 24 bytes from a real CSE we get the following displayed in latest OBK

    Screenshot of OpenBK web interface with energy readings for the CSE7766 driver.

    If you go back to December 2023 release with same simulation:
    OpenBK7231N control panel with energy readings, WiFi status, and configuration buttons.

    does anyone have a real CSE on BK7231N to check?

    Added after 3 [minutes]:

    attaching script as file because Elektroda errors with this if posting as code block

    Screenshot showing an Access Denied message for a blocked website page.
    Attachments:
  • #4 21556944
    p.kaczmarek2
    Moderator Smart Home  
    I've also got Sonoff but the one with CSE7761, which has different UART protocol. I will have few spare hours today and I will try porting some driver, but I'm not sure if it will work with unstable UART. Maybe we should fix UART first.

    All those tests results were done without calibration so I am not sure how reliable they are.
    Helpful post? Buy me a coffee.
  • #6 21556984
    p.kaczmarek2
    Moderator Smart Home  
    Is PROTA working for you on ESP?"

    I get:
    Code: text Expand Select all Copy to clipboard
    
2025-05-22 14:02:40: [Found matching file: OpenESP32C2_1645_merge_1d63268bd632.img]
2025-05-22 14:02:40: [Sending OTA data to http://192.168.0.162/api/ota]
2025-05-22 14:02:53: [Error sending OTA update: Wystąpił błąd podczas wysyłania żądania.]
    Helpful post? Buy me a coffee.
  • #7 21557019
    divadiow
    Level 34  
    yikes. a lot of artefacts now. worked though

    Display showing ESP32C3 device information: build date, online time, MAC address, name and ESP-IDF version.

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #8 21557028
    p.kaczmarek2
    Moderator Smart Home  
    Code: text Expand Select all Copy to clipboard
    
2025-05-22 14:32:23: [Found matching file: OpenESP32C2_cse_97086a1b8ac6.img]
2025-05-22 14:32:23: [Sending OTA data to http://192.168.0.162/api/ota attempt 0]
2025-05-22 14:32:23: [PostAsync ]

    I think I found a bug, it uses C2 binary for ESP32? Or am I the one mistaken?
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #9 21557030
    divadiow
    Level 34  
    Not sure what you mean. I was testing on C3 SuperMini and that was matched OK. Is your Sonoff not C2?
  • #10 21557034
    p.kaczmarek2
    Moderator Smart Home  
    No, it's ESP32 but code in PROTA uses Contains and it tries first binary with ESP32 in name - obviously a bug
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #11 21557044
    divadiow
    Level 34  
    oh i get you.

    yes my ESP32 gets sent C2 ota too
    Code: Text
    Log in, to see the code
  • #12 21557206
    p.kaczmarek2
    Moderator Smart Home  
    I've added a fix, the substring approach was treating ESP32S2 as ESP32.
    Helpful post? Buy me a coffee.
  • #13 21557599
    divadiow
    Level 34  
    How's it going with the CSE7761 experience on ESP?
  • #14 21557684
    p.kaczmarek2
    Moderator Smart Home  
    I've did some tests but I couldn't get receiving to work. I've also realized that we need HAL to choose custom UART pins on ESP32 (@insmod but I also may do it soon). My current plan is to just take an ESP32 dev board, and write a simple "UART test" driver that, for example, expects to receive growing numbers and checks for errors, and do the script for PC that sends those numbers, to make debugging easier. I will try to improve UART then and then, once UART is better, I can think about CSE.
    Helpful post? Buy me a coffee.
  • #15 21557691
    insmod
    Level 25  
    I thought about playing with UART again and adding ESP pin selection after w800/berry and then bk7231u/7252 is merged.
    Initial idea is to add something like HAL_AddPlatformSpecificCommands() and executing it in user_main.
    Adding it as weak symbol in generics for other platforms ofc.
  • #16 21557726
    divadiow
    Level 34  
    insmod wrote:
    w800/berry and then bk7231u/7252 is merged

    this would be good. I'm just flashing new BK7252U device with same tests as in doorbell thread.
  • #19 21557946
    p.kaczmarek2
    Moderator Smart Home  
    Permanent or recoverable via UART? Would it possible to add a safe check for that?
    Helpful post? Buy me a coffee.
  • #20 21557952
    insmod
    Level 25  
    >>21557946
    Recoverable.
    I don't know how OTA is performed on BL602, but if there is a header with unpacked size, then perhaps it's possible.
  • #21 21558003
    p.kaczmarek2
    Moderator Smart Home  
    I remember that I added OTA for BL602 to rest_interface.c some time ago. It's taking a header and a compressed stream.
    https://github.com/openshwprojects/OpenBK7231T_App/blob/main/src/httpserver/rest_interface.c
    Maybe ota_header_t struct could help? If it has uncompressed size... we could even settle for a soft check, on the Web App side.

    We would need to check is ota_header_t::len an uncompressed len or compressed? Let me open OpenBL602_1.18.104_OTA.bin.xz.ota in xvi32...
    Screenshot of the XVI32 hex editor with an open binary file and Data Inspector panel.
    Well it looks like compressed size to me. Maybe we could attempt decompress at web app level and check uncompressed size that way?

    Or maybe.. it's a xz format? Maybe it has some kind of header?
    Helpful post? Buy me a coffee.
Reply Cool? Ranking DIY | New topic
Notify about new articles
📢 Listen (AI):
Report a violation of the law

Topic summary

The discussion centers on the Sonoff S60TPG iPlug UK smart plug teardown, firmware flashing, and experimentation with OpenESP32 firmware, focusing on the integration and testing of the CSE7759B energy metering IC and UART drivers on ESP32-C3 platforms. Challenges include strong glue complicating hardware disassembly, unstable UART communication, and the need for improved UART pin selection and calibration for reliable CSE driver operation. Contributors explore simulation approaches for CSE packets, compare CSE7761 and CSE7766 IC protocols, and address firmware OTA update issues related to ESP32 variants (C2, C3) and BL602 devices. Discussions also cover partition layout recommendations for BL602, OTA update mechanisms involving compressed streams, and potential safeguards against bricking during OTA. Development efforts include adding platform-specific HAL commands for UART configuration and debugging UART communication with test scripts to enhance driver stability before advancing CSE integration.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT