Czy wolisz polską wersję strony elektroda?
Nie, dziękuję Przekieruj mnie tamI have a Tuya Curtain Motor from Moes with WBR3 Chip. Can I flash the chip with OpenRTL87X0C_1.18.276.bin with USB to Serial converter?
Yes, but only under the right hardware conditions. If your module is truly a Tuya WBR3, then it is an RTL8720CF / AmebaZ2-family module, and the OpenBeken release dated March 17, 2026 includes the matching UART-flash image named OpenRTL87X0C_1.18.276.bin. (docs.libretiny.eu)
The important caveat: a USB-to-serial adapter alone is not enough unless you can also reach the boot/download strap and reset pins. LibreTiny’s WBR3 guide says UART flashing uses PA15/RX2, PA16/TX2, PA00 to enter download mode, PA13 high or floating, and CEN low to reset. It also explicitly notes that PA00 is on the bottom side of the WBR3 PCB, so UART flashing is usually not possible without desoldering the module. (docs.libretiny.eu)
So the practical answer is:
The first issue is firmware compatibility. OpenBeken release 1.18.276 contains a file explicitly named OpenRTL87X0C_1.18.276.bin, marked as the RTL87X0C UART Flash image. In the same release, the project lists WBR3 under the RTL8710C / RTL8720C (AmebaZ2) family, which is the correct family for OpenRTL87X0C. That means the firmware filename you mentioned is the right class of image for a genuine WBR3 module. (github.com)
The second issue is whether the hardware can actually be placed into download mode. For WBR3, LibreTiny documents the UART flashing path as follows:
The third issue is board accessibility. LibreTiny’s WBR3 page specifically warns that PA00 is on the bottom side of the PCB, and therefore WBR3 is usually not flashable via UART without desoldering. In practical repair terms, this is often the deciding factor for Tuya modules inside appliances: the silicon may support UART flashing perfectly, but the module layout prevents easy access to the required boot strap. For a curtain motor, where the module is often mounted on a compact control PCB inside a mains-powered enclosure, this is a serious mechanical limitation. (docs.libretiny.eu)
The fourth issue is voltage discipline. Tuya’s WBR3 datasheet specifies a working supply range of 3.0 to 3.6 V and an absolute maximum VDD of 3.6 V. Therefore, your USB-UART adapter must use 3.3 V logic, and if you power the module externally, that supply must also stay within the specified range. A 5 V TTL adapter is unacceptable here. (developer.tuya.com)
The fifth issue is tool choice. The most clearly documented primary-source toolchain for this family is ltchiptool, whose documentation states it supports RTL8720C, can dump full flash, and can write firmware files with automatic file-type detection. That makes it a sensible choice for both backing up the original firmware and writing OpenRTL87X0C_1.18.276.bin. (docs.libretiny.eu)
A sixth point, specific to your device type, is post-flash functionality. A curtain motor often does not have the Wi-Fi module directly driving the motor H-bridge or relay logic. In many Tuya appliances, the Wi-Fi module talks to another controller over a serial protocol. OpenBeken explicitly includes TuyaMCU support, so a serially mediated design is feasible under OpenBeken, but whether your exact Moes curtain motor needs that configuration cannot be confirmed without photos, logs, or a dump of the stock firmware. That part is an engineering inference from the product class, not a confirmed fact about your exact motor. (github.com)
A seventh point is module identity verification. Before flashing, confirm the can/module silkscreen really says WBR3. OpenBeken’s release notes distinguish several similar Tuya Realtek modules: WBR3 is in the RTL8720C family, but WBR3D/WBR3T are in the RTL8720D family, and WBR3S/WBR3N are in the RTL8720CS family. If your module is one of those variants, OpenRTL87X0C_1.18.276.bin would be the wrong image. (github.com)
As of March 17, 2026, OpenBeken release 1.18.276 is published and marked Latest, and it includes both OpenRTL87X0C_1.18.276.bin for UART flashing and OpenRTL87X0C_1.18.276_ota.img for OTA updates after initial installation. (github.com)
Current LibreTiny documentation also shows that the documented community workflow for these Realtek/Tuya modules is increasingly centered on ltchiptool for flashing and dumping, rather than improvised vendor utilities. ltchiptool’s docs cover RTL8720C, support both GUI and CLI usage, and recommend dumping stock firmware before modification. (docs.libretiny.eu)
One useful correction to some older advice: Tuya Cloudcutter is not a solution for WBR3. LibreTiny’s current Cloudcutter page explicitly says that it currently applies to BK7231T and BK7231N only, and cannot be used for other chips. Since WBR3 is Realtek-based, Cloudcutter should not be considered your primary path here. (docs.libretiny.eu)
For your case, the minimum wiring concept is:
| WBR3 signal | Function | USB-UART side |
|---|---|---|
| PA15 / RX2 | Flash RX | Adapter TX |
| PA16 / TX2 | Flash TX | Adapter RX |
| GND | Reference | GND |
| VCC | 3.3 V supply | 3.3 V |
| PA00 | Download-mode strap | Pull to 3.3 V |
| PA13 | Strap | 3.3 V or float |
| CEN | Reset | Pulse to GND |
That pin sequence is the one documented for WBR3 UART flashing. (docs.libretiny.eu)
With ltchiptool, the documented sequence is:
ltchiptool flash write <FILE>. A typical CLI workflow would therefore be conceptually:
ltchiptool flash read rtl8720c backup_wbr3.bin
ltchiptool flash write OpenRTL87X0C_1.18.276.binThe exact family string can be checked with ltchiptool list families, but the documented behavior is that writing can auto-detect the file type, while reading requires you to specify the family. (docs.libretiny.eu)
From an engineering and product-support perspective, third-party flashing is outside Tuya’s normal documented production flow, which is based on vendor flashing tools and Tuya authorization procedures. That does not prevent experimentation on your own hardware, but it does mean you are leaving the vendor-supported path. (developer.tuya.com)
From a safety perspective, a curtain motor is a mains appliance, so all probing, soldering, and flashing work should be done with the device fully isolated from AC power. That is a practical laboratory safety requirement.
My recommendation:
Open the unit and confirm the module marking really says WBR3. If it says WBR3D, WBR3S, WBR3N, or WBR3T, stop and choose the matching firmware family instead. (github.com)
Check physical access to PA00. If you cannot get to PA00, simple USB-UART flashing is not realistically possible on this module. LibreTiny explicitly warns about this on WBR3. (docs.libretiny.eu)
Use only 3.3 V logic and power. WBR3 is specified for 3.0 to 3.6 V operation. (developer.tuya.com)
Backup the original flash first with ltchiptool before writing anything. (docs.libretiny.eu)
Expect extra configuration after flashing. If the motor is a TuyaMCU-based design, OpenBeken may need serial-role assignment and datapoint mapping before the motor works normally. OpenBeken does support TuyaMCU, but your exact datapoints will be device-specific. (github.com)
Do not plan on Cloudcutter for this chip. That route is documented only for BK7231T/N. (docs.libretiny.eu)
The biggest uncertainty is not firmware compatibility; that part is relatively clear. The biggest uncertainty is the mechanical accessibility of the WBR3 boot strap pin inside your specific Moes curtain motor. If PA00 is buried under the module and there are no convenient test pads, the job may become significantly more invasive than a normal serial flash. (docs.libretiny.eu)
Also, I cannot confirm from the provided information whether your curtain motor uses direct GPIO control or a secondary MCU with Tuya serial protocol. That affects how much post-flash setup will be required. OpenBeken supports the latter case, but your exact device wiring is still unknown. (github.com)
If you want the highest chance of success, the next useful checks are:
Answer: Yes, a genuine Tuya WBR3 can be flashed with OpenRTL87X0C_1.18.276.bin using a 3.3 V USB-to-serial adapter, because WBR3 maps to the RTL8720CF / RTL8720C family and that exact UART image exists in the current OpenBeken release. (docs.libretiny.eu)
But the real constraint is hardware access: WBR3 UART flashing requires PA00 download-mode strapping, and LibreTiny states that PA00 is on the bottom side of the module, so in many cases you cannot do it in-circuit without desoldering. (docs.libretiny.eu)
If you want, I can give you a pin-by-pin flashing checklist for the WBR3, or help you determine from a PCB photo whether your specific Moes curtain motor is realistically flashable by UART.
User question
The sticker on the chip states it is a WBR3. If PA00 is accessible, I can only find out after desoldering. There is a MCU in the enclosure of the motor, which is connected via serial to the WBR3 PCB board.
Artificial Intelligence Response
Direct answer to the question
Yes: your description strongly indicates a TuyaMCU-style design. The WBR3 is the Wi‑Fi/BLE module, while the separate MCU in the motor enclosure is likely the device’s real motor-control processor. If PA00 is not broken out anywhere on the carrier PCB, then for UART flashing you will usually have to desolder the WBR3, because the WBR3 flashing strap pin PA00 is on the bottom side of the module. (developer.tuya.com)
Key points:
Detailed problem analysis
The important engineering conclusion from your observation is this:
That architecture matters because after flashing custom firmware, you usually do not control the motor by toggling random GPIOs on the WBR3. Instead, you configure the flashed firmware to speak the Tuya serial protocol to the host MCU. Tuya’s MCU Standard Protocol documentation is exactly for this “existing MCU + Tuya module” arrangement. (developer.tuya.com)
A second important point is the pin-role separation:
So if you traced serial lines from the motor MCU to the WBR3 board, those lines are far more likely to land on A13/A14, not on PA15/PA16. This is a common source of confusion, and it is one of the main corrections I would make to the sample answers. (developer.tuya.com)
The third major point is boot mode entry. LibreTiny’s WBR3 board documentation states that PA00 is the strapping pin required for download mode and that on the WBR3 module it is on the bottom side, which is why desoldering is usually required for UART flashing. The general RTL8720C flashing guidance matches this: pull PA00 to 3.3 V, ensure PA13 is not pulled to GND, then reset using CEN or by power-cycling. (docs.libretiny.eu)
There is also a subtle but important documentation inconsistency around the WBR3 silicon identity. Tuya’s current WBR3 datasheet text names W701-VA2-CG, while Tuya’s module-selection page still lists WBR3 = RTL8720CF, and Tuya’s naming rules say the WBR family is the Realtek Wi‑Fi/BLE family. LibreTiny likewise supports WBR3 under the RTL8720CF / AmebaZ2 path. In practical terms, for flashing tools and firmware selection, you should follow the WBR3 / RTL8720C / RTL87X0C ecosystem, not the BK7231 path. (developer.tuya.com)
Current information and trends
As of the currently indexed project documentation:
That means your overall direction is technically sound: WBR3 + separate MCU + custom Realtek build + TuyaMCU configuration is a coherent workflow. (docs.libretiny.eu)
Supporting explanations and details
A practical signal-flow model for your device is:
Wi‑Fi / BLE network ↔ WBR3 ↔ UART serial protocol ↔ motor MCU ↔ motor driver / limit logic
That is why replacing the WBR3 firmware usually does not replace the core motion-control logic inside the motor MCU. It replaces the cloud/network side and the serial protocol handler. (developer.tuya.com)
For flashing, the effective pin usage is:
Another correction to the sample answers: do not assume in-circuit flashing will be reliable while the module remains hard-connected to the motor MCU. Tuya’s own support notes that whole-machine power supply or MCU control can cause the programming tool to freeze, and it also confirms that A16/A15 are the relevant log UART lines for WBR3-class modules. In practice, isolating the module is the cleaner method. (support.tuya.com)
Also, use a real 3.3 V supply with enough current margin. LibreTiny explicitly warns that many failures during flashing are due to voltage drop or weak USB-UART regulators, and recommends a good regulated supply rather than relying on the adapter’s onboard 3.3 V output. (docs.libretiny.eu)
Ethical and legal aspects
These are general engineering cautions, but they are especially relevant for motorized household equipment.
Practical guidelines
Trace the MCU serial lines before removing anything.
Check continuity from the host MCU to the WBR3 module pads. On a standard WBR3, the first pins to inspect for the host serial link are RXD/TXD = GPIOA13/GPIOA14. (developer.tuya.com)
Look for any hidden breakout/test pad first.
If PA00 or CEN is available via a via or test pad, you may avoid full removal. But LibreTiny’s WBR3 note says the PA00 strap is on the bottom, so desoldering is commonly necessary. (docs.libretiny.eu)
Flash the module off-board if possible.
This avoids bus contention from the motor MCU and avoids the “whole machine / MCU interference” issue noted by Tuya support. (support.tuya.com)
Use the correct UART for flashing.
The flash/download UART is PA15/PA16, not the user RXD/TXD pins. (docs.libretiny.eu)
Back up the full flash before writing anything.
The WBR3 board definition shows a 2 MiB flash map with boot, OTA regions, calibration, and Tuya storage. Dumping the original image first is the correct recovery path. (docs.libretiny.eu)
After reflashing, configure the device as a serial/TuyaMCU design.
Since OpenBeken explicitly supports TuyaMCU and provides an analyzer, configure the pins that actually go to the motor MCU—most likely A13/A14—for the serial protocol role. (github.com)
Do not treat OTA as your primary plan.
OpenBeken supports OTA after OpenBeken is already installed, but that is different from expecting the stock Tuya firmware to accept an arbitrary third-party image. The currently available sources I checked only confirm the former. (github.com)
Possible disclaimers or additional notes
Suggestions for further research
Brief summary
Your observations are consistent with a WBR3 network module + separate motor MCU design. In that architecture, the WBR3 is flashable with the RTL87X0C / RTL8720C custom-firmware path, but if PA00 is not exposed, desoldering is usually required because that boot strap is on the module underside. The motor MCU link is most likely on A13/A14, while flashing uses PA15/PA16. So the correct plan is: remove or isolate the module, back up the flash, program it through the download UART, then re-install and configure it as a TuyaMCU serial device. (docs.libretiny.eu)
If you want, I can give you a pin-by-pin flashing checklist specifically for WBR3, or a post-flash TuyaMCU troubleshooting sequence for the curtain motor.