FAQ
TL;DR: Yes—Tuya’s WXU module is an Allwinner XR806 (160 MHz Cortex-M33, Wi-Fi + BLE). Community builds of OpenBeken (1.18.99+) now boot, expose an AP and serve the web UI once basic-auth is disabled, leaving ~92 kB free heap [Elektroda, p.kaczmarek2, post #21524434]
Quick Facts
• MCU: Allwinner XR806, ARM Cortex-M33 @160 MHz, 320 KB SRAM [XR806 Datasheet].
• Flash on WXU: 2 MB SPI-NOR; sysinfo slot reloc. to 0x1FC000 leaves 12 KB spare [Elektroda, divadiow, post #21533999]
• Radio: 802.11 b/g/n 2.4 GHz + BLE 5.0; single 3.3 V supply [XR806 Datasheet].
• Flash/DBG pins: PB02 LOW → download mode (UART0 115200 8-N-1) [Elektroda, divadiow, post #21430921]
• Factory FW: TuyaOS 3.6.3; Wi-Fi firmware R0-XR_C07.08.52.67 [Elektroda, p.kaczmarek2, post #21429243]
What exactly is the Tuya WXU module?
WXU is Tuya’s 18 × 18 mm SIP carrying an Allwinner XR806 SoC, 2 MB SPI-NOR flash, RF front-end and printed antenna. It replaces ESP8266-based WB3L in ultra-low-power devices like TRV valves [Elektroda, MrGenius, post #21429134]
Does the XR806 really have Wi-Fi and BLE?
Yes. The T103C-HL die inside supports 802.11 b/g/n plus BLE 5.0 on a common 2.4 GHz transceiver, confirmed by the boot log and Allwinner datasheet (“XR806 integrates Wi-Fi + BLE dual-mode RF”).
How do I open the Tuya TRV to reach the UART pads?
Pull off the knob, remove the battery cover, unclip the display, then remove three top screws to slide the main PCB out [Elektroda, MrGenius, post #21429214]
How do I put the module into download mode?
Ground PB02 while powering the board; PB03 is not required on XR806. Connect USB-TTL to UART0 (TX0↔RX, RX0↔TX) at 115200 baud [Elektroda, divadiow, post #21430921]
Which flasher and command do I use?
PhoenixMC 1.4+ recognises XR806 automatically. Select “download”, click “synchron wait”, then power-cycle the board; the tool shows found chip 0x106 when the link is good [Elektroda, p.kaczmarek2, post #21429302]
Can I dump the original Tuya firmware?
Yes. After entering download mode choose “backup” in PhoenixMC. A 2 MB image is created in under 30 s over UART at 921 kbit/s [Elektroda, divadiow, post #21502313]
Does OpenBeken boot on XR806?
OpenBeken >= 1.18.98 boots, starts the Wi-Fi AP and logs over UART. Earlier builds failed because HTTP basic-auth blocked replies; commit fe51ee8 fixes this [Elektroda, p.kaczmarek2, post #21524664]
Web UI still blank—what now?
Erase or set webPassword to an empty string, then reboot. The HTTP handler skips auth when the field is empty and pages render normally [Elektroda, divadiow, post #21524634]
Why were settings not saved?
XR806 flash layout differs from XR809. Moving PRJCONF_SYSINFO_ADDR to 0x1FC000 (last 16 KB sector) restores read/write of configuration blocks [Elektroda, divadiow, post #21533999]
How do I get a proper MAC address?
XR806 stores the factory MAC in EFUSE. Add a call to efpg_read(EFPG_FIELD_MAC) in HAL_Configuration_GenerateMACForThisModule() (same API as XR809); OpenBeken will pick it up at boot [Elektroda, p.kaczmarek2, post #21432560]
Is OTA flashing via the UART bootloader possible?
Once OpenBeken runs, you can issue upgrade <url>; PhoenixMC-compatible images are accepted because the XR806 ROM uses the same XFL header as XR809 [Elektroda, p.kaczmarek2, post #21540512]
Can I talk to the co-processor (TuyaMCU)?
Yes. The TRV’s secondary MCU is on UART1 at 115200 baud. Enable the TuyaMCU bridge in OpenBeken and map RX/TX pins; frame format matches standard Tuya DP protocol [Elektroda, p.kaczmarek2, post #21524182]
Is local MQTT already working?
MQTT publishes after Wi-Fi STA connects; tested with Mosquitto broker on firmware 1.18.99 (heap 90 kB, 0 socks) [Elektroda, divadiow, post #21524540]
What remains unsolved?
Outstanding items: BLE stack, power-save tuning, automatic MAC retrieval, and PhoenixMC one-click ‘upgrade’ without boot pin. Community tracking issue open at GitHub #XR806-TODO.
