I followed the design of a board like those, and I can tell you: even inside the company there was so few information transferral, that any documentation regarding the design probably lies into a random folder in someone's laptop.
Small company, almost unknown, a few thousand pieces... So, I really see few possibilities to obtain useful infos, or even just schematics.
Did you try to write directly to "Carrier-APAC"? Maybe, if the reader is kind enough, you will have some help.
On the other hand, this kind of board is pretty easy to reverse-engineer, and regarding the uC, just wire manually a JTAG port, give supply, and try to talk with it.
If my eyes do not deceive me, I see a classic 3x2 socket footprint on the first board, a nice RESET button and a few LEDs, so it's worth trying.
I would not even try to disassemble the firmware which lies inside those uC, that probably are not even protected.
In any case, as said by TerraHertz, I would hardly find a real use for this kind of board, it's too big for a nice and small automation project, and maybe too customized to easily interface sensors and actuators.
It may be easier to just scrap them, desolder useful components (nice relays!) and design something new from scratch, what do you think?