logo elektroda
logo elektroda
X
logo elektroda

WBR2, WBR3, WBRU, W701-VA2-CG pinout, datasheet, flashing for Home Assistant

p.kaczmarek2 20967 166
ADVERTISEMENT
📢 Listen (AI):
  • #151 21809027
    divadiow
    Level 38  
    post it anyway so we can see what state it's in :)
  • ADVERTISEMENT
  • #152 21809035
    geniack
    Level 6  
    Ah good to know. Well I got several of these devices, I can use the next one to contribute to this archive :)

    Added after 10 [minutes]:

    Niiice! I could connect to the wifi of the newly flashed firmware and now I see myself in front of a lot of settings to configure this chip. That is really sweet.

    Added after 57 [minutes]:

    The device seems to be connected to my MQTT broker now:

    Control panel for RTL87X0C device with firmware 1.18.245 and MQTT integration

    But... How does it know it's a thermostat?
  • #153 21809090
    DeDaMrAz
    Level 22  
    geniack wrote:
    But... How does it know it's a thermostat?


    this is where more information on the device needs to be known. Can you share a bit more about it, maybe model number, pictures of the device, disassembled preferably so we can suggest what driver needs to be used etc.

    There is almost every option available to set up all sorts of devices and build, implement and run different drivers but we need more info from you to best assist.
  • ADVERTISEMENT
  • #155 21809094
    DeDaMrAz
    Level 22  
    Here you can find more data on that device, it's been done before and I'll try to provide to you the setup process once I get familiar with it - https://www.elektroda.com/rtvforum/topic4056015.html#21119558

    Also this can explain a bit about TuyaMCU devices, and integration with OBK - https://www.elektroda.com/rtvforum/topic4147617.html

    Added after 16 [minutes]:

    Open WebApp from the device index page (Launch Web Application button), on the WebApp go to File system Tab and click "Create File" button, popup will appear with the name autoexec.bat - click save and a new /autoexec.bat button will appear somewhere on the lower right side - click on it a and paste the code below, it should look something lie this:


    Web interface with script file editor and Tasmota autoexec startup code

    Next, click on the "Save, Reset SVM and run file as script thread" and let us know what your index page looks like, you should get 2 new channel reading (0 if WBR3 module is not attached back to the device) and test what is going on and report back. There may be a complete autoexec for this device somewhere but I wasn't looking too hard as I have the same device only without WiFi (my ordering mistake).

    Let us know and we can continue to create a setup for your device that works. Reboot a device if no channels appear on the index page.


    //starting TuyaMCU driver and it's sensor submodule
    startDriver TuyaMCU
    startDriver tmSensor
    
    // may be needed, depends on device, some devices also use 115200 or other baud rates
    tuyaMCU_setBaudRate 9600
    
    //before proceeding make sure we are connected
    waitFor WiFiState 4
    
    // dpID 1 is tempererature div 10
    linkTuyaMCUOutputToChannel 24 val 1
    setChannelType 1 temperature_div10


    // dpID 1 is tempererature div 10
    linkTuyaMCUOutputToChannel 26 val 1
    setChannelType 2 temperature_div10
  • #156 21809110
    geniack
    Level 6  
    >>21809094

    Do I need both of these parts in the autoexec.bat ?

    Two sets of TuyaMCU configuration commands for temperature channels
  • #157 21809111
    DeDaMrAz
    Level 22  
    Give it a try, from the extracted dpID's I see them both as current temperature no harm done at this stage of figuring it out.

    Credit to @divadiow for extracting dpID's

    {"1":"Switch","2":"Set Temperature","3":"Current Temperature","4":"Mode","5":"Working status","8":"Child lock","13":"Sound","16":"Fault alarm","20":"Temperature calibration","21":"Max setting temperature","25":"Sensor selection","26":"Frost protection","31":"RESET","41":"Backlight brightness","42":"Working day setting","43":"Weekly procedure (working day)","101":"常闭型_常开型","105":"Temperature control switch difference","107":"External Sensor temperature limit"}


    Just a translation for dpID 101, it's probably relay configuration - NC/NO but we are far from that now.
  • #158 21809140
    geniack
    Level 6  
    >>21809111

    "Far" ? :D I thought I had the hardest part behind me. I just soldered back the WBR3 and put the device back together. I will have to wait for tomorrow before I will be able to check how it works inside my walls. I will report back. Thank you for your time and maintaining this project!
  • ADVERTISEMENT
  • #159 21809639
    geniack
    Level 6  
    Okay I have put the thermostat into the wall and have saved those settings to autoexec.bat. It's coming up and I see it in the list of MQTT devices in home assistant. This is a screenshot of the index page:


    OpenRTL87X0C control panel showing temperatures and MQTT connection status

    Temperature sensor looks reasonable, that's whats on the device's display too. But I think it's 1 or 2 degree higher than the old thermostat, and I feel like the old thermostat was right.
  • #160 21809664
    DeDaMrAz
    Level 22  
    In the web app you can change channel type in this window as well, change it to temperature instead of temp_div10
    Device configuration panel with GPIO pin settings and channel types

    Looks like CH2 is not the current temp just CH1, so you can delete everything related to CH2 from the autoexec file.

    On the temp reading, it is being done by tuyaMCU and as far as I know there is no calibration for that unfortunately. But you have the basic principle of operation, you assign dpID to a channel, figure out what the value is and then publish that via MQTT to HA. It's not supper difficult just takes time to figure out, especially on a device that has not been done fully before.

    Feel free to ask questions and welcome to the project :)

    EDIT: Looks like dpID 20 is some sort of calibration - no idea how it is implemented or what it does.
  • #161 21809694
    geniack
    Level 6  
    >>21809664

    Will I be able to control the temperature setting for this device through HA or is this purely to report the temperature?
  • #162 21809696
    DeDaMrAz
    Level 22  
    DeDaMrAz wrote:
    {"1":"Switch","2":"Set Temperature","3":"Current Temperature","4":"Mode","5":"Working status","8":"Child lock","13":"Sound","16":"Fault alarm","20":"Temperature calibration","21":"Max setting temperature","25":"Sensor selection","26":"Frost protection","31":"RESET","41":"Backlight brightness","42":"Working day setting","43":"Weekly procedure (working day)","101":"常闭型_常开型","105":"Temperature control switch difference","107":"External Sensor temperature limit"}


    These are the parameters that are exposed and some of them are controllable. I have this device on order so I can tell you more about it once i get it but until then all I can do is suggest to you how to start as I don't know how this device behaves or what should it do.
  • #163 21809865
    geniack
    Level 6  
    >>21809696
    Sounds good! Then I would take your advice on how to start, maybe I can contribute this way by finding out these things :) The temperature looks reasonable now, so probably no need to calibrate. I think setting the temperature would be my most important concern for now, so if you could help me figure that out, that would be great.

    Edit: Also the temperature sensor I can see in the obk web application, doesn't show up in HA yet, so this would be even more important. The device also isn't listed on my default page in HA. I have one other MQTT device and this showed up right after connecting to HA.

    Edit: I desoldered another WBR3 from the next thermostat and tried to read the memory of it using your flasher tool right away but the result was the same as before, there seems to be nothing stored.

    Edit: This is what I have found so far:

    // Current Temp
    linkTuyaMCUOutputToChannel 24 val 1
    setChannelType 1 temperature

    // target temperature (15°)
    linkTuyaMCUOutputToChannel 26 val 2
    setChannelType 2 temperature

    // Lower Temperature Limit (10°)
    linkTuyaMCUOutputToChannel 16 val 3
    setChannelType 3 temperature

    // Upper Temperature Limit (40°)
    linkTuyaMCUOutputToChannel 19 val 4
    setChannelType 4 temperature

    // 1
    linkTuyaMCUOutputToChannel 2 val 5
    setChannelType 5 temperature

    // 1
    linkTuyaMCUOutputToChannel 1 val 6
    setChannelType 6 temperature

    // 1
    linkTuyaMCUOutputToChannel 103 val 7
    setChannelType 7 temperature

    // Kinds of periods of time mode (OF: Close, 01: 5+2 day mode, 02: 6+1 day mode, 03: 7+0 day mode)
    linkTuyaMCUOutputToChannel 104 val 8
    setChannelType 8 temperature

    Since this is only the read-only values, how do I test the write values?
  • #164 21812007
    geniack
    Level 6  
    I think I have found more or less all I need:


    Control panel with temperature settings and three active device switches

    Using the setChannel command allows me to set the target temperature, which will trigger the thermostat to start heating if the value is higher than room temperature. Now I am struggling to correctly integrate what is coming from the thermostat into home assistant. How on earth will I be able to use some kind of input in HA that allows me to set the temperature without writing all that yaml myself. I was under the impression that I will define the data type in openbeken and HA will just magically construct all the GUI elements from it.
  • #165 21856121
    danek309044
    Level 2  
    >>21394332

    Hello everyone,

    I was able to flash the Gosund SP112 the same way as @nemetila did his SP1. From the looks of it, the SP112 is just rated for 16A and also is equipped with 2 USBs with the output 5V 2.1A.

    I probably damaged the rest of the plug in the process, but the chip still works, so I will probably use it for some other projects. Also, I was unable to find the GPIOs for the relays, etc., as it didn't want to work when plugged into AC. For my safety, I will probably throw it away.

    Just writing here about it if someone with the SP112 is more skilled in this kind of device modding and wants to use openbeken on it. I also included the backup because I think you can get the GPIO config from it or something.
    Attachments:
    • readResult_RTL87X0C_2026-05-3-19-25-52.bin (2 MB) You must be logged in to download this attachment.
  • ADVERTISEMENT
  • #166 21856127
    divadiow
    Level 38  
    >>21856121

    hmm yeh, no pins in upk

    Code: JSON
    Log in, to see the code


    Added after 53 [minutes]:

    @danek309044 is the module in the SP112 a CUCO_Z0_V1.1?
    Close-up of a PCB labeled “CUCO_Z0_V1.1” with a metal shield marked “2”
  • #167 21856191
    danek309044
    Level 2  
    >>21856127

    Mine was CUCO_Z0_R_V1.2 . And the make of the smartplug was in 08/2021.

    Close-up of a PCB module labeled “SP112-R 1.0.1” with “CUCO Z0 R V1.2” printed above.
📢 Listen (AI):

Topic summary

✨ The discussion centers on flashing and integrating Tuya modules based on the RTL8720CF chip (W701-VA2-CG), including WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU, for cloud-free operation with Home Assistant (HA) using the AmebaZ2 PG Tool and OpenBK7231T (OBK) firmware. Detailed pinouts, flashing jigs, and boot logs are shared, highlighting the need to access specific pins (A0, A15, A16) often located on the PCB underside, sometimes requiring desoldering. Users report successful flashing on devices like Kasa HS200, Gosund SP1 (BL097), and Tapo P110, with calibration support for BL0937 power monitoring chips. Challenges include reading and backing up firmware, especially system and calibration data, which may be stored in efuse or inaccessible flash areas. The community collaborates on templates for device configuration, MQTT integration, and HA discovery, including channel type mappings (e.g., OpenStopClose, LowMidHigh, dimmer) for TuyaMCU protocols. OTA updates and UART communication are tested, with ongoing development of tools and firmware support for these Realtek-based modules. Additional discussion covers the similarity between WBR3 and WBRU modules for firmware transplantation and the presence of Tuya config partitions. The thread also touches on related devices like thermostats (WT50-WH-3A, WT100-WH-3A, WT200-16A-W, HY609-WE) and the FR8016HA MCU in some modules. Overall, the topic provides a comprehensive guide and collaborative troubleshooting for flashing, configuring, and integrating RTL8720CF-based Tuya modules with open-source firmware and Home Assistant.
Generated by the language model.

FAQ

TL;DR: With 3.3 V wiring and 4–6 UART connections, you can flash WBR2/WBR3/WBRU Tuya modules; as one contributor put it, "the connection ... is the same" even when switching to newer tools. This FAQ helps Home Assistant and OpenBeken users identify pinouts, choose the right flasher, and recover MQTT discovery on RTL8720CF-based devices. [#21375223]

Why it matters: These modules appear in thermostats, plugs, breakers, switches, heaters, blinds, and IR devices, so one reliable flashing method unlocks many Tuya products without cloud dependence.

Tool Best use Write support Read/backup support Notable thread detail
AmebaZ2 PG Tool 1.2.47 Legacy RTL8720CF flashing Yes No practical read option discussed early on Original step-by-step guide used it first [#21375223]
BK7231GUIFlashTool Preferred newer workflow Yes Yes, later RTL87X0C read/write support added RTL87X0C support expanded through 2025 [#21708748]
ltchiptool Linux/CLI alternative Yes Not the main focus here One user wrote a 719.1 KiB image successfully on Linux [#21398455]

Najważniejsza wskazówka: On WBR3, the working UART boot path uses the log UART on A15/A16, not the normal user UART on A13/A14. Most failed flashes came from wrong UART choice, unstable adapters, or weak 3.3 V power. [#21375223]

Quick Facts

  • WBR3, WBR2, and WBRU in this thread all center on W701-VA2-CG / RTL8720CF, a Wi-Fi + BLE 4.2 Realtek platform typically running at 100 MHz with 256 KB SRAM in the shared comparison table. [#21375443]
  • The proven boot wiring uses 3.3 V, not 5 V logic, and the guide explicitly recommends a solid external 3.3 V LDO because some USB-UART adapters cannot power the module reliably from their 3.3 V pin. [#21375223]
  • WBR3 flashing usually needs access to underside pads: connect A15/A16, pull A0 and A13/RXD high, then reset with EN to GND. WBR2 exposes similar signals more accessibly. [#21375223]
  • Later tool work added practical dump support: one successful RTL87X0C backup read a full 0x200000 = 2 MB flash and verified it with a SHA-256 hash match before extraction attempts. [#21727461]
  • Real-world confirmation spans several devices, including a Kasa HS200, Gosund SP1 plug, and Tapo P110 variants, showing the method is not limited to one Tuya product family. [#21381809]

How do I flash a Tuya WBR3 or WBR2 module based on W701-VA2-CG / RTL8720CF with OpenBeken using AmebaZ2 PG Tool or BK7231GUIFlashTool?

Flash it over the log UART, not the normal serial port. 1. Power the module from a stable 3.3 V supply and wire A16→USB-UART RX, A15→USB-UART TX, plus GND. 2. Pull A0 and A13/RXD high to enter bootloader, then reset by shorting EN to GND. 3. Write an OpenRTL87X0C binary with AmebaZ2 PG Tool or the newer BK7231GUIFlashTool, then remove the boot straps and reboot. The guide states this method works for WBR1, WBR2, WBR3, WBR2L, WBR3L, and WBRU-class RTL8720CF modules. [#21375223]

What is W701-VA2-CG, and how is it related to Realtek RTL8720CF, WBR2, WBR3, and WBRU modules?

W701-VA2-CG is the RF module core used by several Tuya-branded boards, and in this thread it is treated as the same platform as Realtek RTL8720CF. "W701-VA2-CG" is an embedded Wi-Fi + Bluetooth module family that packages the RTL8720CF-class chip into different Tuya footprints, including WBR2, WBR3, and WBRU, while keeping the same flashing concept and similar GPIO families. That is why one firmware family, OpenRTL87X0C, can target multiple module shapes even though the pin headers differ. [#21515587]

Which pins do I need to connect on WBR3, WBR2, and WBRU to enter bootloader mode and flash over UART?

Use the log UART pins plus two boot straps. For WBR3, connect 3.3 V, GND, A16 to USB-UART RX, A15 to USB-UART TX, then pull A0 and RXD/A13 high and reset with EN. For WBR2, the same rule applies, but A15 and A16 are on the back and A13 is labeled RXD. For WBRU, the note is explicit: A15 and A16 are the debug/flashing UART, while A13 and A0 must be pulled high for bootloader mode. [#21375223]

Why does a WBR3 usually need to be desoldered before flashing, and are there any practical alternatives like a jig or NodeMCU adapter hack?

WBR3 usually needs desoldering because its critical flashing pads sit on the underside. Multiple replies confirm you generally must remove it to reach A15 and related pads, although practical alternatives appeared in the thread: a spring-pin jig in development and a NodeMCU carrier hack with wires routed below the module. Those ideas reduce repeat soldering, but the tested method remained full access to the underside pads. One concise reply put it plainly: "yes. WBR3 pads on the underside would need to be accessed." [#21376702]

What is AmebaZ2 PG Tool 1.2.47, and when should I use it instead of BK7231GUIFlashTool or ltchiptool for RTL87X0C devices?

AmebaZ2 PG Tool 1.2.47 is the legacy Realtek flashing utility first used in this guide for RTL8720CF-based Tuya modules. Use it when you only need a known-good write path on Windows and want to follow the original screenshots exactly. Prefer BK7231GUIFlashTool when you need newer RTL87X0C support, backup features, or config extraction workflows. Use ltchiptool when you want a Linux CLI path; one user flashed an OpenRTL87X0C image from /dev/ttyUSB0 and the tool auto-detected a 719.1 KiB Realtek AmebaZ2 image successfully. [#21398455]

How do I set up OpenBeken after flashing a WBR3 or WBR2 so it joins Wi-Fi and appears in Home Assistant via MQTT discovery?

After flashing, boot OpenBeken, join its AP, and configure Wi-Fi at 192.168.4.1. Then set your MQTT broker, save, and either run Home Assistant discovery manually or add scheduleHADiscovery 5 to autoexec.bat so discovery starts about 5 seconds after MQTT connects. The thread shows this works once the right channel types are assigned; missing or old channel types were a real cause of absent entities. One contributor confirmed the fix immediately after updating the firmware and keeping discovery in autoexec. [#21564801]

Why does flashing a WBR3 with an FT232 adapter fail with XMODEM timeouts, while a CH340 works better for some users?

The thread’s strongest pattern is adapter quality and UART stability, not the module itself. A user repeatedly hit XMODEM timeouts and short-packet errors with an FT232-based adapter, then switched to a CH340 and obtained a proper RTL flash backup with hash verification. Another contributor noted many FT232 boards are fake, while CH340 and CP210x adapters worked reliably in their experience. Stable 3.3 V power also matters, because a weak adapter supply can look like a protocol failure. [#21809020]

What do the WBR3, WBR2, and WBRU pinouts look like, including the hidden A15/A16 log UART pads used for flashing?

The important difference is where the log UART appears. WBR3 exposes 16 edge pins, including A13/RXD and A14/TXD, but A15 is on the back and A16 is the log TX pin used for internal output. WBR2 has 11 main pins, with A15 and A16 again available on the rear pads. WBRU is more convenient: both log UART pins, L_RX = A15 and L_TX = A16, are on the sides together with TX = A14 and RX = A13. That hidden A15/A16 pair is why photos and board diagrams matter so much. [#21375223]

How can I read or back up flash contents from RTL8720CF / RTL87X0C devices, and what tools currently support dump and restore?

Today, use BK7231GUIFlashTool for practical dump and restore on RTL87X0C. By October 2025, the thread showed full read and write working, including a 2 MB backup, flash ID detection, hash verification, and config extraction attempts. Earlier in the thread, the answer was effectively “not yet” for AmebaZ2 PG Tool, which lacked a straightforward read-to-file path for users. There was also experimental CLI work around AmebaZ2 reads, but the clearest usable path became BK7231GUIFlashTool rather than the older vendor flasher. [#21708748]

What is TuyaMCU, and how do I map Tuya dpIDs to OpenBeken channels for thermostats, heaters, blinds, and kettles?

TuyaMCU is the secondary-MCU protocol layer many smart devices use between the Wi-Fi module and the product logic board. "TuyaMCU" is a serial protocol interface that carries dpIDs such as switch, target temperature, blind position, or kettle temperature, and OpenBeken maps each dpID to a channel type, label, and direction. In practice, start the driver, set the baud rate, then use commands like linkTuyaMCUOutputToChannel 2 val 2 and setChannelType 2 dimmer or Temperature. The thread shows this method working on thermostats, blinds, heaters, and a smart kettle. [#21701460]

How do I troubleshoot a TuyaMCU device on WBR3 when startDriver TuyaMCU causes safe mode or when Home Assistant entities do not show up?

Start by removing the bad autoexec, rebooting cleanly, and launching TuyaMCU manually. If startDriver TuyaMCU still forces safe mode, the usual causes are wrong baud rate, wrong dpID/channel mapping, or a bad command in autoexec. If Home Assistant entities do not appear, update to a build that includes the needed channel types, then run scheduleHADiscovery 5. That exact issue happened with new OpenStopClose support: the entity appeared only after firmware update because the older May build lacked the required discovery behavior. [#21565324]

What is the difference between the log UART on A15/A16 and the user UART on A13/A14 on WBR modules, and which one is used for flashing?

The log UART on A15/A16 is the flashing path; the user UART on A13/A14 is the application serial port. The module tables describe A15 as UART_Log_RXD and A16 as UART_Log_TXD, while A13/A14 are UART0_RXD and UART0_TXD for user-side serial communication. The flashing note repeats the distinction: use A15/A16 for debug output and bootloading, and pull A13 plus A0 high to enter bootloader mode. That distinction explains many failed attempts through the wrong UART. [#21375223]

AmebaZ2 PG Tool vs BK7231GUIFlashTool vs ltchiptool for Realtek RTL8720CF flashing — which tool is better for writing, reading, and recovery?

BK7231GUIFlashTool is the best all-around choice in this thread’s later state. Use AmebaZ2 PG Tool for basic legacy writing, ltchiptool for Linux command-line writing, and BK7231GUIFlashTool for the broadest write-plus-read-plus-recovery workflow. By late 2025, BK7231GUIFlashTool added RTL87X0C read/write support, flash-ID handling, and config operations, while AmebaZ2 PG Tool remained mostly a vendor writer. ltchiptool proved practical for write-only Linux use, but the thread did not position it as the primary backup or recovery solution. [#21708620]

How can I preserve or reconstruct original device functionality after flashing OpenBeken, including importing templates, using GPIO Doctor, and writing autoexec.bat scripts?

Rebuild the device in layers: pins first, protocol second, automation third. 1. If it is not a TuyaMCU device, use GPIO Doctor or a known template to find relay, button, LEDs, and metering pins. 2. If it is a TuyaMCU device, extract or infer dpIDs and map them in autoexec.bat. 3. Add drivers, labels, MQTT, and Home Assistant discovery. The thread explicitly says original behavior is usually restored either by choosing GPIO roles manually or via template import, then extending it with scripts and TuyaMCU channel mappings. [#21420173]

What should I watch out for when moving firmware or backups between WBR3 and WBRU modules, especially around RF calibration, system data, and per-device settings?

Expect the main firmware to be portable, but treat per-device data cautiously. One reply says WBR3 and WBRU use the same W701-VA2-CG core and should run the same program image, yet the follow-up warning is RF and system data: calibration may be per-device, MAC is in efuse, and a later developer comment says system and calibration areas at 0x1000–0x3000 do not appear readable in normal dumps. So move the application image only when possible, not a blind full-device clone for certification-sensitive work. [#21516179]
Generated by the language model.
ADVERTISEMENT