Category Archives: networking

Review of Itead Sonoff Intelligent WiFi Socket

The intelligent WiFi mains socket is a device which is inserted into the original mains plug and has a mains socket itself. The mains output of the device can be controlled and switched on/off over an Internet connection.

The Itead Sonoff smart socket caught me with its simple design and with the possibility to upload custom firmware. The 10 amps socket is controlled by the WiFi capable ESP8266 microcontroller. ESP8266 is the leading platform for budget IoT devices. Its SDK is free and is well documented. It has built in WiFi, TCP/IP stack, free compiler and tools.

The device is produced by ITEAD studio, based in Shenzhen, China, website The wiki product page is In the Downloads section of this page you can find the product schematics.

The socket comes in EU, US, UK, and China versions. This review covers the EU version of the socket, however most of the statements should be valid for the other versions.

The device comes packed into a solid cardboard box. The box is custom for the version of the smart socket and clearly shows how the specific plug looks like.

the box in which the socket is sold

The box in which the socket is sold

The box looks quite luxurious from inside. There is a cardboard piece which supports the plug and is probably also customized for the version of the socket as on this piece there is a profile of an EU plug.

the socket unboxed

The socket unboxed

The external look shows a well built plastic case. The touch of the socket feels quite solid like an expensive device. The holes of the socket are fitted with child protection. There is a single button on the front of the socket.

front of the socket

Front of the socket

On the back of the socket there is an adjunct plug. On the plug there are explicit marks for L (line), N (null) and ⏚ (ground). A warranty seal with red Chinese inscription covers a hole with a screw which allows dismantling of the socket. A label reads:

WiFi Smart Power socket
Model: S20_EU
Input: AC 110 – 240V
Max Power: 2000W
Power Consuming: ≤ 0.3W

If we are not catchy for the funny English, the label is quite informative. As there is quite a wide voltage range, it seems the same schematics are used for all versions of the socket, and probably S20_EU is the EU version of the socket, S20_US is the US version of the socket, S20_UK is the UK version of the socket and S20_CN is the China version of the socket. The mains frequency 50 Hz or 60 Hz is not stated, as it is probably not important for the pulse switching power supply.

back of the socket

Back of the socket

Now let’s look what is inside. We remove the warranty seal and undo the screw. Once you have undone the screw, there are several plastic locking fingers which have to pried

the socket pried from the side

The socket pried from the side

The firs look inside shows the wires are welded to the plug with electrical current. The pros for such welding are the high temperature and corrosion stability of the welding. The cons are that if the control of the welding is not good, weak electrical connection may occur.

The wiring looks quite neat. There is no foreseeable chance of a wire to melt down its isolation and to short circuit another wire, or a conducting surface to mechanically touch another conductive surface with the opposite potential. There are springs which create pressure for good electrical contact between the socket and the plugs which will be inserted. The discrete electronic components are well spaced from one another.

the front of the socket opened

The front of the socket opened

There is an inscription on the board which reads S20_EU_V1.0.0 . After all it seems that they use different boards for the EU, US, UK and China variants.
On the electrical relay there is a label which reads:

p/w: WWJG000627

The first line looks like a software version. The second line looks like a MQTT ID of the unit, and the third line is either a part number, or a password which allows access to the unit or with which the unit accesses a server.

The electronic board can be easily separated from the enclosure after undoing the two screws which support the board. The third screw which supports the board is the screw which is used to open the case of the socket and it has already been undone.

The socket board extracted

The socket board extracted

The power cables are soldered to the board. This is a point where weaknesses can appear, but with good control of the soldering this is OK. The cables conveniently keep the shape they had while in the enclosure, thus making the assembly to be easy.

if we look at the back of the board, we see insulation channels cut in the board which keep the low voltage part of the board from the high voltage part. The power lines on the board are tinned in order to carry more current.

the back of the extracted socket board

The back of the extracted socket board

On the bottom we can see the ESP8266 chip with a label


The WiFi antenna can be seen in the bottom left of the picture.
In the bottom right can be seen an 8 Mbit, i.e.1MB, serial flash with label

This means the socket has plenty of space for firmware.

Let’s return to the front of the board.

serial port, programming

The serial port of the board

To the right of the button there is a RGB LED, which is used to indicate the status of the smart socket. To the left of the button there are 4 lines VCC, RX, TX and GND which can be used for programming. The button itself is connects GPIO0 of ESP8266EX to the ground, so when the board is powered while the button is pressed, ESP8266 enters programming mode and new firmware can be flashed.

In the upper right corner we can see a 10 A fuse which is meant to protect the high-power circuit in case of current overload.

Finally let’s look at the power relay.

the relay of the socket, HF32FA-G, 10A, 250VAC

The relay of the socket

The relay has a label
10A 250VAC

The 10A of the relay give a little safety factor of 10% over the advertised switching power of 2000 W for 220 V mains voltage. To stay on the safe side, I would use the power socket for loads of up to 1000 W.

I purchased the socket from Aliexpress , for $16.70, with shipping via Singapore Post for $1.73. The item was dispatched and delivered very quickly.

If you want to gain experience with ESP8266 there is a free SDK, documentation, cheap hardware modules and plenty of programming examples freely available in Github and other sites.

Belkin F6D6230-4 v1 Teardown

I recently bought a Belkin F6D6230-4 v1, also known as F6D6230uk4, router from eBay UK for £15.99, with free P&P. The router came with its original box, original polyethylene protecting film and looked like new.

IMG_3716I had read some really negative comments about this model, so I decided to change its firmware with OpenWRT or DDWRT firmware. I spend an evening looking for a successful installation of such firmware, but I didn’t come upon any. The devil, though black and horned, as you can see on the photo, is sometimes not so evil, so I decided to start looking a way to get enough information to port such firmware on it. The first step is to make a research information is available on the internet for that particular model. The second step is to make a tear-down of the hardware in order to see the hardware, and the third step is to make the actual port, or to assist to some person who is responsible for porting the firmware to new router models.

in the first step of the research, I came to the WikiDevi page for this model. this model comes with 8 MB flash memory, 64 MB RAM, BCM4718A1 CPU, in which is integrated the 2.4 GHz radio, and BCM43224 in which is integrated the 5 GHz radio. The router comes also with 1 USB port, 4 LAN ports and 1 WAN port, with a BCM53115 switch chip.

The Teardown

Let’s see the label. The private information is removed.

Label of Belkin F6D6230-4 v1, private information is removed

Label of Belkin F6D6230-4 v1, private information is removed

Now let’s have a look inside. There are two hidden screws under the front panel cover. There are two approaches to unscrew the screws. You can either peel the front panel cover off, or just make holes into it. I preferred the second approach.

F6D6230-4 hidden screws

F6D6230-4 hidden screws

After that the top cover must be priced:

Pricing of the top cover

Pricing of the top cover

Below is given a photo of what we see inside.

Belkin F6D6230-4 v1 inside

Belkin F6D6230-4 v1 inside

The first things which comes to my attention is that we see that the antennas are used for both 2.5 GHz and 5 GHz bands. Each antenna is fed with 2 coax cables. One of the cables is white and the other cable is black. The white cables seem to be used for 2.4 Ghz, while the black cables are probably used for 5 GHz signals. This brings the question of how efficient the antennas are. Usually combining 2 different bands lowers the efficiency of the antennas. I will leave this question open and will not dismantle the antennas for now.

The antenna attachment

The antenna attachment, You can see both coax cables.

Both antennas are attached permanently. It is not possible to change the antennas without changing the design of the router.

Near the main chip BCM4718A is the serial port connector, and a port for which no pins are soldered, most probably the JTAG connector. You will find how to use the serial connector in the next article of the series for Belkin F6D6230-4.

BCM4718A, serial port connector and JTAG

BCM4718A, serial port connector and JTAG

Another view of the chip, the serial connector and the JTAG:

BCM4718A, serial port connector and JTAG - another view

BCM4718A, serial port connector and JTAG – another view


The 5 GHz radio chip is Broadcom BCM43224KMLG. It has a separate quartz oscilator.



The 5-port ethernet switch chip BCM53115SKFBG is said in its product brief to be for speed 10/100/1000 Mbps. Together with the line transformers LG-4811X-1 it sets the Ethernet speed to 1000 Mbps.


The ethernet switch chip BCM53115SKFBG

The antenna cables are interestingly born by soldered pins.

Antenna cable bearings

Antenna cable bearings

The back side of the board is less interesting:

F6D6230 back side of the board

F6D6230 back side of the board

Flash memory of Belkin F6D6230

Flash memory of Belkin F6D6230

There are 3 quartz oscillators for the three main chips:

Quartz oscilator for BCM4718A


Quartz oscilator for BCM53115

Quartz oscilator for BCM53115

Quartz oscillator for BCM43224

Quartz oscillator for BCM43224

The RAM memory is EnronTech EM68B16CWPA-25H, 32 M x 16 bit, DDR2, 400 MHz.




Interesting notice

I noticed something very interesting while playing with the router. The main chip BCM4718A gets very hot. When I put my finger on the chip, I almost feel pain, which means the temperature is over 60 degrees Celsius, about 140 degrees Fahrenheit, which is the temperature threshold for feeling pain. Many of the complaints for this router are related to the system stability, and it is very likely the poor stability is related with the overheating of the central processor, which works in synergy with the poor firmware.


The system parameters of this router look quite good, its price is just right for its current firmware suport, but for the future the device seems a bit underestimated. I hope that with a heatsink for the BCM4718A chip and an open source firmware, this router will become a pearl in the crown in my home network.