ELIVCO LSPA9 Smart Plug

Background

A while ago a friend of mine recommended a smart plug Athom PG01EU16A that supports Tasmota, so I bought two from AliExpress for a total of €15.26 with free shipping, but later found that although the appearance was exactly the same, the printed model number was ELIVCO LSPA9 instead.

There are no external screws, according to this post, we can crack it open by applying pressure to the top sides.

Hacking

After disassembling it, I saw a model number CB2S printed on the WiFi module, a search showed that it's another Tuya module based on the Beken BK7231 series ARM SoC, this is the third time I stepped on these mines from Tuya.

And what made things worse is that the CB2S module is somewhat unique that there are no common ESP modules with a similar pinout:

Source

Anyway, I removed the module and reverse-engineered the circuit: the IC in the lower left corner is an "AMS1117-3.3" voltage regulator, it provides the +3.3V power source for the WiFi module as well as some other components; to its right is a "BL0937" AC power monitoring IC, which is used to measure the voltage, current and power on the plug.

The main circuit can be organized as follows, with components labeled as per their actual PCB silkscreen printings, some less important components have been omitted:

We can replace the CB2S module with a normal ESP module and connect the necessary pins; note that pin P26 which is connected to the relay should not use ESP GPIOs that will be pulled up at boot, such as 1, 2, 3, 16, etc., to avoid unintended powering.

Here I used an ESP-12F module, with corresponding pins selected as:

CB2S	ESP-12F
3V3	VCC
GND	GND
P6	GPIO5
P7	GPIO4
P8	GPIO2
RX1	GPIO13
P24	GPIO12
P26	GPIO14

And remember to pull up EN and pull down GPIO15.

Software

Example ESPHome configuration:

esphome:
  name: plug-1
  comment: 'Plug 1'

esp8266:
  board: esp12e
  restore_from_flash: true  # enable this for restoring the relay state on reset

preferences:
  flash_write_interval: 10min  # reduce writings to the flash to preserve its health, adjust it on demand

logger:
  level: WARN
#  baud_rate: 115200

wifi:
  fast_connect: true
  networks:
    - ssid: !secret wifi_ssid
      bssid: !secret wifi_bssid
      password: !secret wifi_password

api:
ota:
  password: !secret ota_password

status_led:  # use the on-board blue LED as status indicator (as it was originally)
  pin:
    number: 2
    inverted: true  # due to it's connected in sink logic

switch:  # the socket relay
  - platform: gpio
    pin: 14
    id: plug_1
    name: 'Plug 1'
    restore_mode: RESTORE_DEFAULT_OFF  # attempt to restore state and default to OFF if not possible to restore

binary_sensor:  # the button
  - platform: gpio
    pin:
      number: 13
      inverted: true
    id: button
    internal: true  # don't expose it to HASS, only use it locally
    on_release:
      then:
        - switch.toggle: plug_1  # toggle the relay

sensor:
  - platform: hlw8012
    model: BL0937  # note that the model must be specified to use special calculation parameters
    voltage_divider: 1600  # adjust it according to the actual resistor values on board
    sel_pin:
      number: 12
      inverted: true  # the logic of BL0937 is opposite from HLW8012
    cf_pin: 4
    cf1_pin: 5
    current:
      name: 'Plug 1 Current'
    voltage:
      name: 'Plug 1 Voltage'
    power:
      name: 'Plug 1 Power'
    energy:
      name: 'Plug 1 Energy'
      # convert it to kWh
      filters:
        - multiply: 0.001
      unit_of_measurement: 'kWh'
      accuracy_decimals: 4
    update_interval: 60s
    change_mode_every: 3

The parameter voltage_divider of the hlw8012 component needs to be calculated based on the actual voltage divider resistors, otherwise the voltage data will be inaccurate.

The value of the voltage divider on the board as (R_upstream + R_downstream) / R_downstream. Defaults to the Sonoff POW’s value 2351.

Source

According to the actual circuit, the voltage divider used in this smart plug is as follows:

So the theoretical value should be (680×1000×3+1000)÷1000=2041, but then the actual result is wrong; after lots of trial-and-error, I found 1600 as a relatively accurate value, but I still don't know the reason.

After that, we can add it directly in HASS: