What is the TR6260 chip in a Tuya mini WiFi relay module, and has anyone found a way to flash or replace it?
The TR6260 is a different chip from the usual Beken parts, and it is not the same as RTL8710; the project originally needed a UART flashing method to support it [#20968593] Later, the SDK and UTP flash tool were found, and reading/flashing works by grounding GPIO14/TOUT2 at power-on to enter spi-flash boot mode, then using `boot_nocrc.bin` with a 1 MB image length [#21310036][#21310437] The build environment appears to be an Andes `nds32le-elf` toolchain, and `make st_tr6260s1_diff` produces binaries such as `xip.bin` [#21312766] After that, an OpenBeken port was brought up: GPIO output, PWM, flash vars, config, LFS, I2C scanning and other basics worked, but the chip only has 128 KB SRAM so memory is tight [#21339241][#21345516]
I need to get/find my TR fast, hopefully it didn't drown when my basement got flooded..
im praying for its safe discovery and flash backup
Added after 1 [hours] 27 [minutes]:
OpenTR6260 boot output
Code: Text
Log in, to see the code
Added after 1 [hours] 15 [minutes]:
if using this exact ESP module adaptor then this may be of use. I made for my ref. Original on the left, headers relabelled for HLK-M20 module use on the right.
Progress report:
GPIO output and PWM works. Input still doesn't.
Flash vars works, alongside with config with no problems.
LFS works.
Both lfs and config/flashvars now uses OTA partition, 128kb for each. OTA partition itself is too small for real ota updates, so utilize it for something useful.
Enabled several drivers, but can't check them.
Use my own tcp server, but i don't recommend opening more than one page. There is something strange going inside private sdk, it will slowly consume available heap, but start giving it back after web pages are closed (which i believe is log-related).
At some point wifi is going to disconnect in a way it is unable to recover from. Currently i coded a reboot if wifi disconnects for any reason.
Crash will now won't halt the device - it will immediately reboot.
PWM is unavailable on main page - but can be changed from web app.
Can't set flags.
Added after 2 [hours] 35 [minutes]:
Main page PWM, setting flags and gpio input now works. Also added PWM deinit.
Do not enable fast connect, sdk won't be able to initialize wifi in time to connect, and you will need to enter safe mode to disable it.
Will it be merged soon? Right now it's in pretty good working order, most important peripherals are fine and it won't crash if only a single web page is opened (if opened another - can crash in several minutes, but not immediately. If a second page is closed soon - it won't crash).
Missing features: ADC (unneeded, at least for now), OTA (no docs, and i was unable to figure it out looking through the code), power save (i believe it is already enabled in main), sleep (no need too) and wifi scanning.
Also fixed fast connect, and after i tested it - it didn't connect faster, as the first try was always a failure. But at least it connects on the second try.
Still need to have someone check out if the i2c devices, ds18b20 and such are working.
I'm afraid I can't test much more today. Initial results are that DS18B20 didn't work on any GPIO of the HLK-M20 - sensor confirmed OK on Beken.
I've tried a few GPIO pairs with a BMP280 too without joy
Did you already confirm basic LED works on GPIOs? I will do that tomorrow. I didn't test all but some didn't seem to work.
Error:SENSOR:DS1820[21] - Reset failed
Debug:SENSOR:DS1820[21] - usleepds(5000) took 5 ms
Debug:SENSOR:DS1820[21] - usleepds(100000) took 10 ms
Error:SENSOR:DS1820[21] - usleepds duration divergates - proposed factor to adjust usleepds 10.000000
Note than not all gpios can be used as gpio, especially on S1 version of the chip. Usable are 1-6, 14-15, 20-22.
I previously tested a led on GPIO21, both as a relay and PWM, and it must have been configured by bootloader as GPIO in IOMUX, so it worked ootb.
GPIOs 20-SCL 21-SDA also a working combination for me
Added after 3 [minutes]:
insmod wrote:
Use my own tcp server, but i don't recommend opening more than one page. There is something strange going inside private sdk, it will slowly consume available heap, but start giving it back after web pages are closed (which i believe is log-related).
indeed. not long until these appear. lots of reboots required in testing
That probably means some tests for the timing.
The driver uses a handcrafted usleep() for most SDK versions turned out to be far away from sleeping the number of useconds provided.
Since I don't own one of these, I can't do some tests with a logic analyzer to track down the right number of NOPs or usleep factor.
You might take LN882H as a template and try with "10*r" in the code for TR6260 in /src/driver/drv_ds1820_simple.c
if the log is kind of correct...
[Edit] changed the screenshot...
Added after 12 [minutes]:
... but since the "small" amount of 5.000us in the test loop takes 5ms (correctly) while 100.000us only take twice the time(10ms) it might also indicate we need an own implementation...
Thank you, I love your contributions @insmod . Merged, once the initial github build finishes without errors, I will look into editing the Release links to include binaries on Releases page. I also need to do that for ESP, because they are STILL not included there, because I was hoping I could find a way to zip together ESP binaries because our Releases table is growing bigger and bigger... hmm
We will be posting a detailed guide in a separate topic soon, would you be able to make some kind of short video, I don't know, TR6260 blinking LED, or TR6260 LED and button (on single channel), or DHT11 test, or anything?
Thank you for your good work @divadiow and @insmod ! I've decided to put up info together into single topic that we've made with @divadiow together, which is now available here:
TR6260 flashing guide If there is something missing in this topic, feel free to comment there.
If you think there is a mistake in first post, or you would like to add anything to first post, then just send me Private Message, I can edit first post.
And please continue discussion there, I will close the current topic for now.
✨ The discussion centers on the identification and development efforts related to the Tuya mini WiFi relay module equipped with the TR6260 chip, which differs from the expected Beken devices. The TR6260, including variants like TR6260S1, is a relatively new SoC used in devices such as the HLK-M20 WiFi module and ELM 327 WiFi diagnostic interface. Initial challenges included the lack of a known flasher tool and SDK, but progress was made with the discovery of the Skylab-provided TR6260 SDK and UTP flash tool. Users shared detailed boot logs, pin mappings, and hardware reverse engineering insights, including GPIO14/TOUT2 grounding for entering flash mode. The SDK was successfully compiled and tested, producing working binaries and enabling basic functionality such as GPIO output, PWM, flash variable storage, and WiFi connectivity with some limitations due to the chip's 128KB SRAM. Peripheral support like I2C, DS18B20, and BMP280 sensors was partially achieved, though some issues remain with sensor communication and memory constraints. The community contributed to porting OpenBeken firmware to TR6260, achieving stable operation with web server functionality and reboot handling on WiFi disconnects. Ongoing work includes refining drivers, improving memory management, and preparing detailed flashing guides. The thread concludes with plans to consolidate information into a dedicated topic and continued development collaboration.
TL;DR: Community devs cracked the Tuya-branded TR6260: 128 KB on-chip SRAM, OpenBeken v1464 now runs and reaches the web GUI in 7 s. “Still no possible flasher tool in sight” became history once the UTP utility leaked [Elektroda, p.kaczmarek2, #20587056; Elektroda, divadiow, #21310036].
Why it matters: The fix turns previously-locked Wi-Fi relays into fully hackable IoT nodes without hardware swaps.
TR6260 is a 2.4 GHz Wi-Fi SoC from Transa Semi using an Andes NDS32 core. The S1 suffix denotes the 28-pin QFN module variant found on HLK-M20 and Tuya mini-relays [Transa Semi DS; Elektroda, p.kaczmarek2, #20585437].
Can I swap a TR6260 module for an ESP8266/ESP-02S?
Yes, pads match the common ESP-02S footprint; several users desoldered TR6260 and fitted ESP02S successfully [Elektroda, ferbulous, post #20499837] You lose the chance to test new firmware, so flashing in-situ is now preferred.
Is an official SDK available?
A complete SDK, Andes toolchain and the proprietary "UTP" flasher were published by Skylab in Nov 2024 [Elektroda, divadiow, post #21290330] It builds sample binaries; OpenBeken uses the same headers.
How do I enter flashing mode?
Ground GPIO14 (labelled TOUT2 on LSC6260 modules).
Apply 3.3 V power while keeping it low.
Start UTP, load boot_nocrc.bin at 0x0 and full image at 0x4000, then click “GetFromChip” or “Download”.
Users report 0x100000 length for 1 MB flash [Elektroda, divadiow, post #21310036]
Which pins are safe for GPIO work?
Usable lines are 1–6, 14–15, and 20–22 on the S1 package. Others connect to RF or crystal and should stay untouched [Elektroda, insmod, post #21341050]
The TR6260 usleep() runs ten times faster than nominal, so 1-Wire slots shorten and CRC mismatches occur [Elektroda, max4elektroda, post #21341667] Patch the driver with a 10× delay multiplier.
What happens if flashing the full dump from 0x0?
UTP reports “Please add partition” and the chip drops to UART boot with ‘spi-flash bad magic’. Trim the first 0x4000 bytes or prepend boot_nocrc.bin [Elektroda, divadiow, post #21310437]
Datasheets for TR6260, LSC6260 module and HLK-M20, plus pre-built OpenBeken images, are collected at github.com/divadiow/TR6260 [Elektroda, divadiow, post #21315543]
What's the memory footprint after loading web and MQTT?
OpenBeken reports ~29 KB free heap with both GUI and log page open, dropping to 24 KB after 5 minutes, then stabilising [Elektroda, divadiow, post #21349195]
