Exploring the WT1 Tuya 2CH*5A 12-36VDC WiFi & RF CV LED Controller's Components

jiribal 15 Dec 2023 18:24 5 3126 Cool? (+6)

📢 Listen (AI):

TL;DR

Teardown shows the WT1 Tuya 2CH*5A 12–36VDC WiFi & RF CV LED controller, a 2-channel CCT dimmer that also supports DIM mode, Tuya app control, RF remote control, and a push button.
Inside, a WB3S Wi‑Fi module talks to an sc95f8615p Tuya MCU over TXD1/RXD1 using TuyaMCU protocol, while the MCU handles PWM, RF control, button input, and mode switching.
OpenBeken flashing used a CH340 USB-TTL adapter in 3.3V mode, the BK7231 GUI Flash Tool, and a 115200 baud rate, with virtualized Windows on Linux.
After rebooting and uploading an autoexec.bat with TuyaMCU commands, the web UI exposed working LED controls and the controller connected to home Wi‑Fi.
The controller only enters the shown CCT setup after holding the mode switch button for 10 seconds, and the flashing process required two power reboots.

Generated by the language model.

Hello,

this is my teardown of the WT1 2 channel CCT LED controller. This is a device intended to dim WW/CW strips (CCT mode) but it can be also used as a 1 channel dimmer (DIM mode). One can control it using the Tuya app, dedicated remote control, or a physical push button.
The device is similar to the WT5 Multi-Channel LED controller described in a different Elektroda forum thread. But the whole OpenBeken installation process was not described step-by-step there so I thought I would cover that in this post.

The WT1 controller contains the WB3S chip which connects to WiFi. Additionally, there is also a chip labeled sc95f8615p. It is connected to WB3S via the TXD1 and RXD1 pins and communicates with it using the TuyaMCU protocol.
This latter Tuya MCU chip then controls:
- the PWM output for the LED strips,
- RF communication with the dedicated remote controllers,
- the physical button controls,
- and even switching between the CCT and DIM modes.
So by flashing the WB3S, we do not lose any of these capabilities and only get rid of the dependency on Tuya cloud.

My approach was to:
1) Disassemble the device, solder pins for flashing.
2) Flash OpenBeken firmware using a USB-TTL converter and the BK7231 GUI Flash Tool.
3) Configure the device using the web interface.

Disassembly

The disassembly is simple. The white case contains no screws and is held together by clips. Simply pry open the bottom part of the case and you can access the insides.

(the second photo is illustrative, please unplug all connected wires before opening the case)

Note that this diagram shows the chip from the bottom side, so the pins are mirrored compared to the real photo.

As mentioned, inside we find the WB3S chip along with a second chip that controls the PWM. We need to solder 4 pins as shown in the third image. For this I used DUPONT pins and soldered them directly to the WB3S chip pads.

Flashing OpenBeken

Then I was able to connect the USB to TTL converter. I used a CH340 based module from Aliexpress that has a 3.3V mode. Using a jumper, I set the 3.3V output on the converter and connected the pins to the WB3S chip:
VCC <-> 3.3V
TXD1 <-> RXD
RXD1 <-> TXD
GND <-> GND
For the VCC connection, I used two wires, so that disconnecting and reconnecting the power would be easy. This comes useful later in the flashing part.

For flashing, I wanted to use the nice and beginner friendly BK7231 GUI Flash Tool. I downloaded the last version from Releases in Github.

Because I run Linux, I needed to run the application in a local virtual machine with Windows 11. This part is therefore a bit specific to my setup and most people running Windows natively may skip the VirtualBox setup (skip the next paragraph).

I connected the CH340 to my laptop and checked that the Serial port appeared as /dev/ttyUSB0. In VirtualBox, I enabled the serial port through Machine Settings->Serial Ports->Port 1. There I set the following:
Port Number: COM1
Port Mode: Host Device
Path/Address: /dev/ttyUSB0
(Note: I also tried to expose directly the USB device to the guest system but didn't have success flashing the image that way)
(Second note: maybe one could run the flashing tool using Wine but I didn't attempt that)

I started the flash tool and the serial (UART) port was detected automatically as COM1. I also set the chip type to BK7231T (=WB3S) and set the Baud Rate to 115200 (the default value was crashing). Finally, I selected the "Do backup and flash new" option and everything went smoothly. During the flashing, the device needed to be rebooted two times. I did this by replugging the VCC cable.

For a more detailed flashing guide, I refer you to the Flash tool README.

Configuration

After flashing the device, the OpenBK-... access point showed up on my WiFi scan. I connected to the network and accessed http://192.168.4.1 in my browser.
There I went to Launch Web Application -> Filesystem.
I prepared a file called autoexec.bat with the following contents:


startDriver TuyaMCU
tuyaMcu_setBaudRate 115200
tuyaMcu_defWiFiState 4
tuyaMcu_setupLED 24 0

And I uploaded the file to the device by drag-and-drop to the Web UI and rebooted the controller.

Now on http://192.168.4.1/ I see LED controls and they work!

Note that this setup assumes that you switch to the CCT mode by holding the mode switch button for 10 seconds.

Finally, I also edited the Wifi settings through Config -> Configure Wifi so that the dimmer connects to my home wifi. The next step is to configure MQTT and integrate the device with your home automation system.

About Author

jiribal wrote 2 posts with rating 7 . Been with us since 2023 year.

Comments

Add a comment

divadiow 18 Sep 2024 07:33

https://github.com/OpenBekenIOT/webapp/pull/145 [Read more]

T3elektroda 10 Dec 2024 21:49

Just found your post today. So just opend my WT1 and found CB3 S inside. TuyaMCU is the same. Therfore my config looks like this: { "vendor": "Tuya", "bDetailed":... [Read more]

divadiow 10 Dec 2024 22:12

cool. please consider posting the backup firmware from your device for analysis. or if you think it contains your wifi credentials send it to me and i'll sanitise it first [Read more]

T3elektroda 11 Dec 2024 10:21

Here it goes... read from a brand new device. just unboxed it. [Read more]

divadiow 11 Dec 2024 18:54

after pairing, the storage area contains the following: { "gw_bi": { "uuid": "ae7f5f428005f88a", "psk_key": "NKxdNwKGwJ2wZesLW23A0Q4GoDizbJwqYt0Io", "auth_key": "KUNkidPQRJMLXEZfxpV1GLQ7SJyTv6E0", ... [Read more]

FAQ

TL;DR: For users who want local control of a WT1 LED controller, this guide shows a 4-wire flash process and one key fact: "we do not lose any of these capabilities" when only the Wi-Fi module is replaced with OpenBeken. It solves Tuya-cloud dependence while keeping CCT, dimming, RF remote, and button control working. [#20862731]

Why it matters: The thread proves the WT1 is a practical OpenBeken target because its lighting and RF features stay on the separate TuyaMCU, not in the cloud app.

Variant	Wi-Fi board	Chip	Flash selection	Core config note
WT1 revision A	WB3S	BK7231T	Select BK7231T	Use TuyaMCU at 115200 baud
WT1 revision B	CB3S	BK7231N	Select BK7231N	TuyaMCU remains the same

Key insight: On the WT1, OpenBeken replaces only the Wi-Fi side. The sc95f8615p TuyaMCU still handles PWM, RF, button input, and mode switching, so the hardware features continue to work after flashing.

Quick Facts

Input rating shown for the controller is 12-36 VDC, and the product name identifies it as a 2-channel, 5 A per channel CV LED controller for CCT or DIM use. [#20862731]
The successful UART wiring uses 4 connections: 3.3 V, GND, TXD1, and RXD1, with TX and RX crossed between the WT1 module and the CH340 USB-TTL adapter. [#20862731]
The working OpenBeken serial setup in the thread uses 115200 baud, and the author states the default baud rate caused crashes during flashing. [#20862731]
The posted Tuya data points map functions to IDs: 20 on/off, 21 mode, 22 white brightness, 23 color temperature, 25 scene, 26 timer, 27-29 special write commands. [#21343911]

How do I flash OpenBeken onto a WT1 Tuya 2CH*5A 12-36VDC WiFi & RF CV LED Controller using a USB-TTL adapter and BK7231 GUI Flash Tool?

Flash it by opening the case, soldering UART wires to the Wi-Fi module, and using BK7231 GUI Flash Tool in backup-and-flash mode. 1. Solder pins for 3.3 V, GND, TXD1, and RXD1 on the WT1 module. 2. Connect a CH340 USB-TTL adapter with TX/RX crossed and set the adapter to 3.3 V. 3. In BK7231 GUI Flash Tool, select BK7231T for WB3S, set 115200 baud, choose "Do backup and flash new," and reboot the board twice by replugging VCC when prompted. [#20862731]

What is the TuyaMCU protocol, and how does it let the WB3S or CB3S module communicate with the sc95f8615p chip in the WT1 controller?

TuyaMCU is the serial protocol linking the Wi-Fi module to the controller MCU over UART. "TuyaMCU is a serial control protocol that lets a Wi-Fi module exchange commands and status with a separate device MCU, using defined data points and baud settings." In the WT1, the WB3S connects to the sc95f8615p through TXD1 and RXD1, and that second chip handles PWM, RF, buttons, and mode logic. The later CB3S-based unit keeps the same TuyaMCU arrangement. [#20862731]

What is a WB3S module, and how is it different from a CB3S module in Tuya LED controllers like the WT1?

WB3S is the WT1 Wi-Fi module version built around BK7231T, while CB3S is a later variant built around BK7231N. "WB3S is a Tuya Wi-Fi module that provides network connectivity and firmware storage, while the lighting logic stays on a separate MCU in TuyaMCU designs." In this thread, the original teardown found WB3S/BK7231T, and a later user opened another WT1 and found CB3S/BK7231N instead. That changes firmware selection, not the basic TuyaMCU-based control concept. [#21342657]

Why does flashing only the WiFi module on the WT1 keep RF remote control, push-button input, PWM dimming, and CCT/DIM mode switching working?

Those functions keep working because the WT1 assigns them to the separate sc95f8615p MCU, not to the Wi-Fi module. The thread lists four retained functions: PWM output, RF communication, physical button control, and switching between CCT and DIM modes. OpenBeken replaces the Tuya cloud-facing firmware on the WB3S or CB3S, but the TuyaMCU chip still executes the local hardware tasks. That is why the author wrote that flashing the Wi-Fi side does not remove those capabilities. [#20862731]

Which pins do I need to connect on the WT1 board for flashing, and how should TXD1, RXD1, VCC, and GND be wired to a CH340 USB-TTL converter?

Use four lines: VCC, GND, TXD1, and RXD1. Wire them as VCC ↔ 3.3 V, GND ↔ GND, TXD1 ↔ RXD, and RXD1 ↔ TXD on the CH340 adapter. The author used a 3.3 V CH340 module and even added two wires to VCC so power could be unplugged and replugged easily during the flashing cycle. That wiring is the exact setup reported to work on the WT1 board. [#20862731]

Why is the BK7231 GUI Flash Tool baud rate set to 115200 for this WT1 OpenBeken flash, and what problems can happen with the default baud rate?

The thread sets the flash speed to 115200 baud because that value worked reliably, while the default value caused crashes. This is the main failure case reported during the WT1 flash: the tool detected the UART port, but the default baud setting was unstable. Lowering it to 115200 let the author complete backup and flashing smoothly. If the tool behaves erratically, baud rate is one of the first settings to check on this device. [#20862731]

What should I put in autoexec.bat to configure OpenBeken with TuyaMCU on the WT1 CCT LED controller?

Put four lines in autoexec.bat to start TuyaMCU support and expose LED controls. Use:

startDriver TuyaMCU
tuyaMcu_setBaudRate 115200
tuyaMcu_defWiFiState 4
tuyaMcu_setupLED 24 0

After uploading that file in the OpenBeken web app filesystem and rebooting, the author reported that LED controls appeared at 192.168.4.1 and worked. This setup assumes the controller is switched into CCT mode for correct operation. [#20862731]

How do I switch the WT1 from DIM mode to CCT mode after flashing OpenBeken so the LED controls work correctly?

Switch it by holding the mode switch button for 10 seconds. The thread states that the posted OpenBeken setup assumes the WT1 is in CCT mode, not plain DIM mode. If you leave the unit in DIM mode, the LED controls may not behave as expected for warm/cool white control. The mode change is done locally on the device, not in the flash tool. [#20862731]

What does the sc95f8615p chip do inside the WT1 Tuya LED controller, and which functions are handled by that MCU instead of the WiFi module?

The sc95f8615p is the WT1's local control MCU, and it runs the lighting and input functions. "sc95f8615p is a device MCU that drives outputs and local interfaces, while the Wi-Fi module only handles networking and high-level commands over TuyaMCU." In this controller, it handles PWM for LED strips, RF remote communication, physical button inputs, and switching between CCT and DIM modes. That division is the reason OpenBeken can replace Tuya cloud access without breaking core hardware behavior. [#20862731]

BK7231T WB3S vs BK7231N CB3S in the WT1 controller: what changes in firmware selection, flashing, and configuration?

The main change is chip selection: choose BK7231T for WB3S and BK7231N for CB3S. A later WT1 owner reported a CB3S module inside instead of WB3S, but also said "TuyaMCU is the same." That means the OpenBeken target changes at flash time, while the TuyaMCU-based configuration idea stays consistent. The posted CB3S JSON also keeps the same WT1 model, flags 1024, and references the same controller family. [#21342657]

How can I flash a WT1 controller from Linux if BK7231 GUI Flash Tool is a Windows app, and what VirtualBox serial settings were used successfully?

You can flash from Linux by passing the USB-TTL serial device into a Windows VM. The reported working setup used VirtualBox with Port 1 = COM1, Port Mode = Host Device, and Path/Address = /dev/ttyUSB0. The author first confirmed the CH340 appeared on Linux as /dev/ttyUSB0, then ran BK7231 GUI Flash Tool inside Windows 11. Direct USB passthrough was tried but did not flash successfully in that setup. [#20862731]

What do the Tuya dpIDs 20, 21, 22, 23, 25, 26, 27, 28, and 29 mean for this WT1 CCT controller?

The posted dpIDs map the WT1's Tuya functions directly. 20 is ON/OFF, 21 is Mode, 22 is White Brightness, 23 is Color Temperature, 25 is Scene, and 26 is Timer. The remaining write-type items are 27 Music Sync, 28 Real-Time Adjustment, and 29 Gamma Debug. The same dump also shows value ranges, including 22 = 10 to 1000 and 23 = 0 to 1000, which helps identify usable controls during integration. [#21343911]

How do I back up the original Tuya firmware from a brand-new WT1 before installing OpenBeken, and why is that backup useful for later analysis?

Back it up in the flash tool before writing new firmware by selecting "Do backup and flash new." That saves the factory image first, then flashes OpenBeken. A later poster specifically asked for the original WT1 backup from a brand-new device for analysis, which shows why the dump matters: it can reveal module type, TuyaMCU settings, storage layout, and profiles useful for future device support. Keeping the untouched backup also gives you a rollback path. [#20862731]

Why might a WT1 controller contain WiFi credentials or pairing data in flash storage after setup, and how can that data be sanitized before sharing a backup dump?

It can contain credentials because pairing writes cloud and Wi-Fi data into flash storage. The posted storage dump after pairing includes base64-encoded ssid and passwd fields, plus values such as uuid, auth_key, psk_key, and regional cloud endpoints. Another poster warned that the backup might contain Wi-Fi credentials and offered to sanitize it first before sharing. The safe workflow is simple: share a brand-new, unpaired dump, or remove those stored identifiers before publication. [#21343911]

What is Tuya CloudCutter, and how does adding a CC profile relate to devices like the WT1 with BK7231N and TuyaMCU?

In this thread, Tuya CloudCutter appears as a project that uses device profiles, called CC profiles, to support specific Tuya hardware variants. The important relation is that, after analyzing the WT1 data, a poster stated "CC profile added" and linked a commit for this controller family. That matters for WT1 units using BK7231N/CB3S with the same TuyaMCU design, because a matching profile can improve identification and support in that tooling workflow. [#21343911]

Generated by the language model.