🇨🇳 TP-Link Tapo P110 Smart Plug: Part 2 (Serial Debug Interface) [#TCE0683] @Brfff
🇨🇳 TP-Link Tapo P110 Smart Plug: Part 2 (Serial Debug Interface) [#TCE0683]  @Brfff
Uploaded April 2026 | Updated September 2026, 3 weeks ago
Ad-free version on my Patreon ... patreon.com/TheCluelessEngineer
Let's have a look at the serial debug logs from the Realtek RTL8710CF microcontroller - I'm using an Arduino Mega 2560 as it has several hardware serial ports ... one port from MCU and one port to my computer. You could also use a 3.3V TTL to USB dongle as well.

Part 1 video here:
youtu.be/b5snm9TfyWc

As the Realtek is a 3.3V device I am powering it via the Arduino's 3.3V output. There is no issue to receive serial from 3.3V-to-5V, but to send commands to the Tapo MCU I used a simple voltage divider to drop the 5V level: a 1KΩ resistor between Arduino TX and Tapo MCU RX and a 2.2KΩ pulldown resistor to ground.

I could get the boot up logs which showed it connecting to my WiFi network that it remembered from when it worked. I could get the 'help' command to list out some WLAN commands, such as ATWS to scan WiFi networks, but it wouldn't accept it, so some further investigation is needed there.

WLAN AT COMMAND SET:
==============================
1. Wlan Scan for Network Access Point
# ATWS
2. Connect to an AES AP
# ATW0=SSID
# ATW1=PASSPHRASE
# ATWC
3. Create an AES AP
# ATW3=SSID
# ATW4=PASSPHRASE
# ATW5=CHANNEL
# ATWA
4. Ping
# ATWI=xxx.xxx.xxx.xxx
[MEM] After do cmd, available heap 29688

I could also trigger an "image download" mode by pulling test point TP2 high (3.3V) when booting:

== Rtl8710c IoT Platform ==
Chip VID: 5, Ver: 3
ROM Version: v3.0
Test Mode: boot_cfg1=0x20
Download Image over UART2[tx=16,rx=15] baud=115200

All the info is on my Github here:
github.com/BrettHallen/TP-Link_Tapo_P110

00:00 ... Intro
01:55 ... Arduino setup
04:09 ... Serial port interaction
09:35 ... Channel thanks & outro

--------------------------------
From Part 1:
One of my TP-Link Tapo P110 smart switches failed (see below) so I pulled it apart some time ago. I wasn't really planning a full teardown ... I decided today that I wanted to design my own simple, local-network-only replacement and was curious how they managed the AC-to-DC conversion as I'm accustomed to vintage computers with massive transformers, diodes, capacitors and a hot-running linear regulator.

We use these devices to control lights (turn on/off automatically in the evening & randomly when we're away) and for the pool pump when the solar panels are generating power (save me walking outside to do it manually) ... neither of these tasks really require phoning home to China.

I'm happy to just configure via a local web interface and then forget, hence why I want to work on my own. I'm pretty happy with how my Router Rebooter [#TCE0678] is working so want to invent more.

Sure, it's no doubt already been done far better than I could, but I learn more designing it myself, including all the mistakes.

It looks like the main chips are:
- Shanghai Belling BL0937 energy meter that measures RMS current & voltage, etc.
- Realtek RTL8710CF microcontroller on a daughterboard labelled "KB-6160" and "ZSL-1"
- Silergy SY22841 buck regulator (labelled ZRxyz) to convert AC to DC (?)

It's also got a pair of Churod A1-S-105IA2F relays with 5V coil to switch the active/neutral lines.

The microcontroller daughterboard has 12 connections, labelled P1 to P12, to the main board as well as six Test Points:
- TP1 = ?
- TP2 = pull high to trigger image download
- TP3 = 3.3V (P2)
- TP4 = GND (P12)
- TP5 = serial receive
- TP6 = serial transmit (115200 bps, 8 data/no parity/1 stop bit 8N1)

Regarding the failure ... it looks like a 470µF capacitor failed. It had a slight bulge in the lid and measured at less than 1nF (i.e. nothing). A shame that the device is NOT repairable ... well, by me at least ... I made a right mess trying to get it open.

My Router Rebooter Github:
github.com/BrettHallen/Router-Rebooter
youtu.be/Fz1aSylL9KQ
--------------------------------
Check out my Patreon for regular blog-type updates between videos - there is a free membership tier and two paid tiers (US$2 and US$5). There is also a one-week trial for the paid tiers so if you don't think it's worth it, then cancel ... no hard feelings ... I appreciate any support, even if it's just subscribing to my YouTube channel!

patreon.com/TheCluelessEngineer
--------------------------------
Background music:
Nocturne No. 2 in E Flat Major Op.9 no.2 by 🇵🇱 Frédéric Chopin
classicals.de
Publisher: Musopen Kickstarter Recording Project - Set Chopin Free
Copyright: Creative Commons - Public Domain Mark 1.0 Universal
🇨🇳 TP-Link Tapo P110 Smart Plug: Part 2 (Serial Debug Interface) [#TCE0683]🇯🇵 National ナショナル CF-3000 MSX Computer: Part 2 (HDMI Upgrade 1/2) [#TCE0701]🇯🇵 Sanyo PHC-30N MSX Computer: Part 2 (Pico9918 Installation & Keyboard Clean) [#TCE0686]🇯🇵 National ナショナル JR-200: Part 1 (First Look) [#TCE0695]🇷🇺 Sura PC8000 (Сура ПК8000): Part 1 (First Look) [#TCE0690]🇬🇧 Psion Organiser: Part 2 (Comparing the Organiser I & Organiser II) [#TCE0527]🇦🇺 Breville BSK500 Kitchen Scale Teardown [#TCE0500]
The Clueless Engineer |

🇨🇳 TP-Link Tapo P110 Smart Plug: Part 2 (Serial Debug Interface) [#TCE0683]

SHARE TO X SHARE TO REDDIT SHARE TO FACEBOOK WALLPAPER