Interior of Meross MSS550 switches, MRE3S module, Mediatek ARM MT7682, catalogue note

p.kaczmarek2 891 1

TL;DR

Two Meross MSS550-EU-TOUCH V3.0 smart wall switches—one touch-based and one microswitch-based—were dismantled and compared, including the internal Meross MRE3S Wi‑Fi module.
The touch board uses a BS813A controller, and the mechanical version adds two relays plus an OB2222MCP-based non-isolated 5 V supply.
The MRE3S_Rev3.0 module appears to map like TYWE3S/WB3S, and the MT7682 catalog note lists an ARM Cortex‑M4 at 192 MHz with 384 KB RAM and 1 MB Flash.
The serial boot path looks promising through HIF_EN (GPIO_4) and HIF_SEL (GPIO_13), but UART traffic could not be captured from this copy.
Both variants use the same MSS550 name and nearly identical packaging, so the touch and clicky versions are easy to confuse.

Generated by the language model.

Treść została przetłumaczona

Zobacz oryginalną wersję tematu

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

» | Topic author Helpful post? (+3)

Post #1
21865085 18 Mar 2026 10:09

Here I will introduce two Meross MSS550 switches, the first a touch-sensitive version and the second based on a 'clicky' microswitch. I'll examine how they are built and then I'll post the information I've gathered so far about the interesting Wi-Fi chip on the inside - the Mediatek ARM MT7682.

I guess we should start with the fact that despite such a dramatic difference as the control method (touch vs. mechanical), both products share the same model name and I don't see any distinguishing features on the packaging except for the picture. This is quite strange and potentially problematic.

The full model name is in both cases MSS550-EU-TOUCH V3.0. There is also a US version, but it is for this "rectangular" box. How to connect the switch is specified in the manual:

Here you might wonder why the C and L1 and L2 designation when there is one touch - it's because this switch supports a staircase installation. It alternately switches on either L1 or L2, and C in turn stands for Common - a common line - see image from instructions.

The switch is compatible with the Meross app - then you can connect it to Apple Homekit:

The control itself is no different from other popular apps such as Tuya or eWeLink. What deserves a mention, however, is the pairing. Here, the app asks us whether we want the full version or the abbreviated version, and in the case of the full version it even displays instructions as to the electrical connection. There is also no clutter here as in Tuya, here we pair products by their previously known model by the app.

After pairing as standard - we have remote control, automations, timers.
From curiosities in the app we have a forum - even quite extensive, there are topics, posts, profiles:

Interior of the MSS550
However, I'm most interested in the build of these types of products and whether they can be altered with firmware to make them cloud-free. For this reason, I took a quick look inside.

The markings on this Wi-Fi module don't tell me anything. Could this be some kind of novelty, or rather something I haven't seen before?

The board itself is very simple, so we won't find the answer to that here, although you can still see the BS813A, the touch button controller, in the corner.

The Wi-Fi module therefore needs to be soldered out. Rather only hot air comes into play, but first you need to remove the component from the touch button, which is easy to melt. Simply peel it off.

The first one, however, I soldered off the screen. Inside the module is a Mediatek chip.

I didn't stop there though, as I wanted to check the pad markings on the description layer.

The power supply location (ground and 3.3V) agrees with TYWE3S. The position of the EN (enable) pin does too. What I don't know is where the UART is.

The module is signed as MRE3S_Rev3.0. The name suggests that this is a module manufactured for/by Meross. The 3S designation matches WB3S/TYWE3S and indicates the format of the module. I couldn't find any more information about it except for the FCC report, which did however clarify a bit about the pinology:

This confirms the location of the UART in line with the expected standard. Unfortunately an attempt to collect data from it failed, my copy doesn't seem to be sending anything:

For the sake of completeness, I'm posting pictures of the mechanical version of the button below. PCB designation: MSS550X_EU_RF_V10 2019/09/29 No major changes. Same Wi-Fi module.

Now a look at the executive board - power supply and relays.

Designation: MSS550X_EU_PR_V10

There are two relays inside - in line with the L1 and L2 outputs, shorting them to C (Common).

The whole is powered by a non-isolated inverter based on the OB2222MCP. It generates 5 V. There is also a fuse and varistor in the circuit.

The second board is identical:

Information about MT7682
The MT7682 catalogue note is available on the web. I include it in the appendix.
The chip features an ARM® Cortex®-M4 core with FPU, clocked to 192 MHz, 384 KB of RAM and 1 MB of Flash memory. Unfortunately, Flash is quite scarce here, a bit like in the regular ESP8285. There may be a problem here with updating the firmware via Wi-Fi, because then you have to fit both images at once in non-volatile memory.
Personally, I'm most interested in changing the firmware, and for that you need boot settings. The hope, however, is an external Flash - the option to boot from it via SPI.

The serial option looks promising. So we are interested in the HIF_EN (GPIO_4) and HIF_SEL (GPIO_13) pins. These are available on the MRE3S pads.
There is a matching SDK available on GitHub:
https://github.com/Kamwing1992/SDK_For_MT5932-MT7682-MT7686-MT7687-MT7697-AW7698
Supported chips:
- smart MCU series: MT2523/MT2533
- wi-Fi series: MT5932/MT7682/MT7686/MT7687/MT7697/AW7698
- bT Audio series: AB155x
The SDK is based on the GCC, Keil and IAR toolchains.
The tools include IOT_Flash_Tool :

According to the "About" tab, the version of this tool is 2.8.9. What surprises me is the compilation time. I fired it up on the 24th, and the same date appeared in the program.

The port selection suggests that, in addition to the virtual COM ports, there is the possibility of operations directly via USB.

At this point we probably have everything to compile, rip and upload the batch. We need to set the appropriate levels on the GPIO and connect the USB to UART converter. However, I will report the results in a separate topic.

Summary
MT7682 is a fairly unknown and already old platform. I've been testing various IoT devices for a long time, and only now did I come across this one. The analysis presented in this topic shows that it would be potentially possible to compile your own firmware for this type of chip and make it cloud free. There is a chance for a OpenBeken port, but a lot also depends on how many devices with MT7682 are actually produced. Have you encountered chips from this family? Thank you in advance for any information!

Attachments:

meross user manual.pdf (4.16 MB) You must be logged in to download this attachment.

Cool? Ranking DIY
Helpful post? Buy me a coffee.
About Author
p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Offline

Joined: 26 Dec 2014

Posts: 14621

Help: 655

Posts rating: 12637

Points: 144402
p.kaczmarek2 wrote 14621 posts with rating 12637, helped 655 times. Been with us since 2014 year.
ADVERTISEMENT
#2 21871319 26 Mar 2026 18:44

auntlydia auntlydia

Level 10

Posts: 70

Help: 2

Rate: 14
Helpful post? (0)

Post #2
21871319 26 Mar 2026 18:44

Hello p.kaczmarek2! I was very surprised and happy to find your post here. Thank you, it is good to know I am not the only one with this module!

I still had two unused modules in my parts collection, one of them is MR3E_MWA6E, which has RTL8710CF and which I was able to flash yesterday, thanks to newly supported platforms in your OBK flasher and firmware.

The other one is exactly the one from your topic here, the MRE3S with Mediatek MT7682SN. While going through different posts for flashing instructions for the RTL chips, I had the secret hope that the method would work for the Mediatek too, as I thought maybe it is just another label but is the same as the Realtek, but obviously it is not. I have done some digging and traced back all the relevant traces that are usually interesting for the flashing process. I used the datasheet and double checked, it should be all correct. I was almost ready to connect it and try flashing with OBK RTL method, just to see if it works, but then I found your post here and I think it is not necessary to try because it is not supported yet. However, I want to share the pictures and traces, so just in case it would be supported in the future, we would have already a good reference where to connect our wires.

My first WiFi sockets I bought were all meross devices and I already sold most of them because I rebuilt my smart home to be off-cloud as much as I can. I assume that lots of meross devices have this module.

I only kept two of my meross devices:
- 2-Gang Outdoor Smart Socket (MSS620), that came with the MR3E_MWA6E (https://templates.blakadder.com/meross_MSS620.html)
- 5-Gang 4x Power Extension Strip, with USB (MSS425F), that came with the MRE3S (https://templates.blakadder.com/meross_MSS425F.html)

I replaced the modules with suitable ESP modules to run them with tasmota. I kept the original modules and now at least one of them can be used again, thanks to you and the community =)

To the question about the chip's popularity: the question is, if lots of their buyers and users are the target group to open and modify their smart devices. Probably not as much as Tuya devices.

Of course it would be awesome if this chip would be supported in the future! If I can do anything to help, let me know.

Also, I attach here the full data sheets of MT7682 chip and meross MRE3S module for reference.
Mediatek_M...asheet.pdf (1014.72 kB)You must be logged in to download this attachment. meross_m..s.pdf (615.49 kB)You must be logged in to download this attachment.

Cheers =)
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Didn't find an answer? Ask Artificial Intelligence

*I agree to send the question to OpenAI, Anthropic PBC, Perplexity AI, Inc., Kagi Inc., Google LLC - owners of language models in order to prepare the best response. The companies may monitor and log information entered into the form.

*I agree to publicly display my question and answer. The question and answer will be publicly available to everyone. The process may take a few minutes. Upon completion, you will be redirected to the page with the answer.

Wait...(2min)

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Devices
/
Interior of Meross MSS550 switches, MRE3S module, Mediatek ARM MT7682, catalogue note

FAQ

TL;DR: With 1 MB flash and a 192 MHz Cortex-M4, the Meross MRE3S is not a Tuya-style drop-in; as the teardown notes, "The serial option looks promising." This FAQ helps smart-home modders identify MSS550 internals, MRE3S pin functions, and the safest path toward cloud-free firmware or module replacement. [#21865085]

Why it matters: Meross MSS550 devices look simple outside, but the internal MT7682 platform changes flashing, UART access, OTA limits, and modding strategy.

Feature	Touch MSS550	Mechanical MSS550
User input	Capacitive touch with BS813A controller	Clicky microswitch
PCB marking shown	Wi-Fi board with touch-related parts	`MSS550X_EU_RF_V10 2019/09/29`
Wi-Fi module	MRE3S Rev3.0	MRE3S Rev3.0
Power/relay board	`MSS550X_EU_PR_V10`	Same board reported
Relay arrangement	2 relays for C/L1/L2 switching	Same arrangement

Key insight: The two MSS550 variants differ mainly in the front-end input hardware, not in the Wi‑Fi core. Both units use the same MRE3S module with a Mediatek MT7682, so firmware research can focus on one module family. [#21865085]

Quick Facts

The MT7682 in the MRE3S module is described as an ARM Cortex-M4 with FPU at 192 MHz, 384 KB RAM, and 1 MB Flash, which is tight for dual-image OTA updates. [#21865085]
The MRE3S pad layout partly matches TYWE3S/WB3S format: 3.3 V, GND, and EN align as expected, while UART needed confirmation from module documentation and trace work. [#21865085]
The MSS550 executive board uses a non-isolated supply based on OB2222MCP and generates 5 V; the board also includes a fuse and varistor. [#21865085]
The switch uses 2 relays to connect L1 or L2 to C (Common), which matches staircase switching behavior in the manual. [#21865085]

1. What are the hardware differences inside the Meross MSS550 touch switch and the mechanical click-switch version?

The main hardware difference is the input method, not the Wi‑Fi platform. The touch version uses a BS813A touch controller and a touch assembly, while the mechanical version uses a clicky microswitch. Both versions were shown with the same MRE3S Wi‑Fi module and the same relay/power concept. The mechanical board was marked MSS550X_EU_RF_V10 2019/09/29, and the executive board was the same MSS550X_EU_PR_V10 design with two relays. [#21865085]

2. Why do both Meross switch variants use the same MSS550-EU-TOUCH V3.0 model name even though one is touch-based and the other uses a microswitch?

They appear to share the same retail model name despite different front-panel hardware. The teardown explicitly notes that both products were labeled MSS550-EU-TOUCH V3.0, and the packaging showed no clear differentiator beyond the product image. That makes identification harder before opening the box. It is a labeling and packaging issue, not a sign that the internal Wi‑Fi module differs. [#21865085]

3. How does the C, L1, and L2 wiring work on the Meross MSS550 for staircase installation?

The MSS550 uses C as the common line and alternately connects it to L1 or L2. That is why one switch face can still expose three terminals. Inside, two relays implement that path switching, each shorting either L1 or L2 to C. This layout matches the manual image and the relay board teardown. [#21865085]

4. What is the MRE3S module in Meross devices, and how does it compare to TYWE3S or WB3S modules in layout and pinout?

The MRE3S is a Meross-branded Wi‑Fi module built around the Mediatek MT7682SN. Its name and footprint suggest a 3S-format module similar in shape to TYWE3S or WB3S. The teardown reports that GND, 3.3 V, and EN are in the expected positions, so the mechanical layout partly matches those common modules. UART was less obvious and had to be verified from documentation and traced pads. [#21865085]

5. Where are the UART, 3.3V, GND, EN, HIF_EN, and HIF_SEL pins on the Meross MRE3S module with the Mediatek MT7682SN?

The thread identifies 3.3 V, GND, and EN in positions consistent with TYWE3S-style modules, and later confirms the UART location from the FCC-related pinology image. It also states that the MT7682 boot-selection pins HIF_EN on GPIO_4 and HIF_SEL on GPIO_13 are available on MRE3S pads. A follow-up post adds traced photos of the same MRE3S module to show practical wire points for future flashing work. [#21871319]

6. How do you safely desolder the MRE3S Wi-Fi module from a Meross MSS550 without damaging the touch button parts?

Use hot air, but remove the touch-button part first. The teardown says that component can melt easily. A safe sequence is:

Peel off the touch-related part near the module.
Heat the MRE3S with hot air, not brute force.
Lift the module only after the solder fully releases. That reduces the chance of deforming the touch assembly while exposing the MT7682 shielded module. [#21865085]

7. Why might the MT7682 UART show no boot log or serial output when connected to a USB-to-UART adapter?

A direct UART hookup may show nothing because the module may not emit a boot log in its current state or mode. The teardown author connected for data capture and reported, "my copy doesn't seem to be sending anything." That means silence is a real failure case, not a wiring myth. It also suggests that boot-mode pins such as HIF_EN and HIF_SEL may matter more than UART alone for recovery or flashing access. [#21865085]

8. What is the Mediatek MT7682, and what are its CPU, RAM, and flash specifications for IoT firmware development?

The Mediatek MT7682 is an IoT Wi‑Fi SoC that integrates compute, memory, and wireless functions on one chip. In this thread, it is described as an ARM Cortex-M4 with FPU clocked at 192 MHz, with 384 KB of RAM and 1 MB of Flash. Those specs are workable for custom firmware, but the 1 MB flash budget is tight for features that need large images or robust OTA workflows. [#21865085]

9. What is a non-isolated inverter power supply, and what does the OB2222MCP do inside the Meross MSS550?

A "non-isolated inverter power supply" is an AC-to-DC power stage that generates low-voltage rails without galvanic isolation from mains, which saves space and cost but raises handling risk. In the MSS550, the OB2222MCP is the controller used in that supply section, and the thread says it generates 5 V. The same board also includes a fuse and a varistor for basic protection. [#21865085]

10. How would you put an MT7682-based MRE3S module into serial download or flashing mode using HIF_EN and HIF_SEL?

Use the MT7682 boot-setting pins exposed on the MRE3S pads. The thread says the serial option looks promising and identifies HIF_EN as GPIO_4 and HIF_SEL as GPIO_13. The practical flow is:

Wire USB-to-UART to the confirmed UART, 3.3 V, and GND pads.
Set HIF_EN and HIF_SEL to the required boot levels.
Power the module and start the flash tool. The exact logic levels were not tested successfully in the post, so the method remains a work path, not a finished recipe. [#21865085]

11. Which Meross products are known to use the MRE3S module or other Mediatek MT7682 family chips?

This thread directly shows the MRE3S module inside both MSS550 switch variants and also reports it in the Meross MSS425F power strip. A second post says the author kept an MSS425F with MRE3S and MT7682SN, while an MSS620 outdoor socket used a different module, MR3E_MWA6E with RTL8710CF. That gives at least two confirmed Meross product lines for comparison. [#21871319]

12. Meross app vs Tuya vs eWeLink: how do pairing flow and device setup differ for smart switches like the MSS550?

The Meross app uses a more guided, model-aware pairing flow than the thread author saw in Tuya or eWeLink. It offers a full or abbreviated setup path, and the full path even shows electrical connection instructions. The author also notes less clutter than Tuya because the app already knows the product model during pairing. After setup, the usual functions remain: remote control, automations, and timers. [#21865085]

13. What problems can 1 MB of flash cause for OTA firmware updates on the MT7682, and how could external SPI flash help?

A 1 MB flash can block easy OTA because dual-image updates often need room for both the current and new firmware. The teardown compares this limit to ESP8285-class constraints and flags it as a real issue. The author points to a possible workaround: booting from external SPI flash. If that boot path works, external storage could ease image-size pressure during development and wireless updates. [#21865085]

14. How practical would an OpenBeken port for Mediatek MT7682 be compared with replacing the module with an ESP module and running Tasmota?

Replacing the module with an ESP is the practical option today, while an OpenBeken MT7682 port is still speculative. One poster already replaced original Meross modules with suitable ESP modules to run Tasmota, then kept the old MRE3S boards aside. The first post says an OpenBeken port is possible in principle, but its value depends on how many MT7682 devices actually exist. Today, ESP replacement has the clearer path and proven outcome. [#21871319]

15. What tools, SDKs, and flashing software are available for developing or dumping firmware from MT7682-based modules like the Meross MRE3S?

The thread identifies a matching GitHub SDK for MT7682-family chips and says it supports GCC, Keil, and IAR toolchains. It also shows the IOT_Flash_Tool, with an About screen reporting version 2.8.9. The port-selection screen suggests two transport paths: virtual COM ports and direct USB operation. That means a developer has both a build environment and a vendor-style flashing utility to start experimenting with dumps or custom firmware. [#21865085]