TP-Link’s Kasa EP25: Energy monitoring for a hoped-for utility bill nose-dive

How easy is it to analyze and optimize how much power the device connected to a smart plug is drawing? The answer depends in part on which hardware and firmware version you’re running.

Next up in my ongoing TP-Link smart home device ecosystem series of hands-on evaluations and teardowns:

is the EP25 smart plug, which builds on the EP10 foundation with two feature set additions: Apple HomeKit (and Siri, for that matter) support, along with energy monitoring capabilities.

I bought a two-pack (with an associated “P2” product name suffix) from Amazon’s Resale (formerly Warehouse) sub-site for $13.29 plus tax during a 30%-off promotion last November. They also come in an “EP25P4” four-pack version. I’ll start with some stock photos:

An uncertain lineage

Although I’ve identified the EP25 as the enhanced sibling of the EP10, particularly referencing the naming-format commonality, those of you who’ve already analyzed the above graphic with device dimensions (not to mention the side switch location) might understandably be confused. Doesn’t it look more like the earlier, beefier, HS103? Indeed, it does. Here it is below the EP10:

And now underneath the HS103:

Perhaps the larger chassis was necessary to fit the additional feature-implementing circuitry? There’s one way to find out for sure; take it apart. So, let’s start, as usual with some box shots, as usual accompanied by a 0.75″ (19.1 mm) diameter U.S. penny for size comparison purposes:

This isn’t what the box backside originally looked like, actually:

When it arrived, there was a barcode-inclusive sticker stuck to it, as is typical with products that cycle back through the Amazon Resale sub-site after initial sale-then-customer return:

But stuck to it was something I’d not experienced before: another sticker, with a smaller black rectangle near its center:

I had a sneaking suspicion that I’d find a RFID or other tracking tag on the other side. I was right:

Continuing around the outer package sides:

Packaging assault

Judging from the already-severed clear tape on the bottom of the box, in contrast to the still-intact tape holding the top flap in place, I assumed the original owner got inside through the bottom-end pathway:

Yup. I don’t know what surprises me more (and I’ve also seen it plenty of times before): how brutishly some folks mangle the various packaging piece(s) to get to the device(s) inside, or that they still have the impudence to return the goods for refund afterwards. Now to cut the top’s transparent tape and try out the alternative entry path:

At least the original owner was thoughtful enough to put the sliver of quick-install literature back in the box prior to returning. Although, on second thought, he or she probably never even got to it before sending everything back. There was also this, reflective of its Apple protocol-friendliness:

You also may have already noticed in the earlier bottom-view open-box shot that one of the devices inside was still encased by a protective translucent sleeve, while that of the other device was missing. I went with the latter as my teardown victim, operating under the theory that its still-plastic-covered sibling was unused and therefore most likely to still be functional for future hands-on evaluation coverage purposes. Here’s our patient:

Monitoring implementation variability

This last shot of the underside of the device:

Specifically, this closeup of the specs, including the all-important FCC ID (2AXJ4KP125M):

is as good a time as any to explain the background to my “The answer depends in part on which hardware and firmware version you’re running” comment in this post’s subtitle. Note the following lines of prose on the product support pages for the EP25P2 and EP25P4:

Vx.0=Vx.6/Vx.8 (eg:V1.0=V1.6/V1.8)
Vx.x0=Vx.x6/Vx.x8 (eg:V1.20=V1.26/V1.28)
Vx.30=Vx.32 (eg:V3.30=V3.32)

I’d mentioned in the prior teardown in this series that TP-Link tends to cycle through numerous hardware revisions throughout a product’s life, with each hardware iteration accompanied by multiple firmware versions, and the cadence combination resulting in inconsistent functionality (said another way: bugs). The EP25 is no exception to this general rule. That said, “inconsistent functionality” seemingly is particularly notable in this product case (grammatical tweaks by yours truly):

On Amazon, I bought a 2-unit box set of the EP25P2 (“Hardware 2.6” in the Kasa app), and a 4-unit box of the EP25P4 (“Hardware 1.0” in the Kasa app). They market them as the exact same product, but the EP25P2 has much better energy and power consumption data and graphs, and a cost tool. The other just has a crude power read out. It seems like something they should’ve been clear about, and like something they could fix in the app software. I’m annoyed they did this and will return the EP25P4.

FWIW, looking back both at the device bottom closeup and the earlier bottom box shot, I’m guessing “US/2.6” references hardware v2.6. Again: . Curiously, the four-pack (EP25P4) support page lists three hardware versions (V1.60, V1.80 and V2.60), albeit not the V1.0 h/w mentioned in the earlier Reddit post…and the two-pack (EP25P2) page mentions only V2.60.

Unto the breach, dear friends

Time to delve inside. The case-disassembly methodology was unsurprisingly identical to that for the earlier HS103, so in the interest of brevity I’ll spare you another iteration of the full image suite of steps. See the earlier teardown for ‘em; here’s today’s teardown subset. One upside this second time around: no blood loss by yours truly!

As before, I ‘spect this is the assembly subset that you’re all most interested in:

once again based on (among other things) a Hongfa HF32FV-16 relay (the tan rectangular “box” at far right). Multiple products, along with multiple hardware versions for each, may evolve in a general sense, but some things stay the same…

Detailing the “smarts”

And specifically, here’s the “action” end:

From this side, the embedded antenna is visible; the PCB is otherwise bare:

You can see the antenna from the other side, too, plus a more broadly interesting presentation:

The PCB “lay of the land” is reminiscent of that inside February’s HS103, including the respective switch and LED locations:

This time, however, the prior design’s Realtek RTL8710 has been upgraded to the dual-core RTL8720 (PDF), whose beefier processing “chops” are presumably helpful for implementing the added energy monitoring and HomeKit protocol capabilities, as well as with expanded internal RAM and (optional integrated) flash memory. In this particular design, however, the flash memory is external, taking the form of an Eon Silicon Solution EN25Q32B 32 Mbit SPI serial device. It’s in the upper right corner of the PCB, next to the LED and occupying one of the IC sites you might have already noticed was unpopulated in the HS103 implementation. The other previously unpopulated IC site, below the EN25QH32B, now houses a Shanghei Belling BL0937 (PDF) single-phase energy monitoring IC. Eureka!

Tying up loose ends

As with its TP-Link (but not more amenable Amazon) smart plug predecessors, I was unable to wedge the EP25’s PCB away from the rear half of its enclosure, so there’ll be no circuit board backside photos for you…from me, at least. Alternatively, you can always check out the ones published by the FCC. If you do, you may walk away amazed (as I was) by the total area dominance by multiple large globs of solder.

In closing, I thought I’d share a somewhat related video I found while doing my research. It’s a review of the HS110, the energy monitoring variant of TP-Link’s original HS100 smart plug that I tore down nine years back:

As those Virginia Slims commercials used to say, “You’ve come a long way.” And with that, I’ll turn it over to you for your thoughts in the comments!

—Brian Dipert is the Principal at Sierra Media and a former technical editor at EDN Magazine, where he still regularly contributes as a freelancer.