Relay module MCU issue, looking for help identifying MCU

[gmebey]

I am dealing with cheap Chinese relay controller that controls 16 relays through a USB connection. See attached image

The documentation is poor at best, and I feel there is some translation issues that are lading to errors.

I know it is a long shot, but I'm wanting to see if I can dump the hex code and de-assemble it. Or find someone that knows all the commands.

The identification numbers on the MCU have been ground off.

Here is what I know so far:
20-Pin TSSOP
16 Outputs (per relay)
Vcc is on PIN-9
GND is on PIN-7
There is only two programming lines
-- line-A is on PIN-8
-- line-B is on PIN-18

[PCB.Wiz]

See also this thread, where I merged two sets of documents to create a plausible command set, minus typos.

https://www.eevblog.com/forum/microcontrollers/do-you-know-this-relay-module-(and-how-to-control-it)/msg5509453/#msg5509453

The pinout looks to be a generic '003' like Nuvoton N76E003 / N76S003, but the part may be secured.


For your module, google finds this
https://www.amazon.com/fosa-Channel-Computer-Control-Sensitivity/dp/B07V42R6V7
which looks easy to try.
Looks simple ASCII

A similar one on AliExpress has this slight variant commands - looks to append a checksum, and includes Ch16 as 10
Vague if this is ASCII or binary, but easy to try both.

Code: [Select]

A0 01 01 A2 Open the 1st road
A0 01 00 A1 Close the 1st road
A0 02 01 A2 Open the 2nd road
A0 02 00 A1 Close the 2nd road
A0 03 01 A2 Open the 3rd road
A0 03 00 A1 Close the 3rd road
A0 04 01 A2 Open the 4th road
A0 04 00 A1 Close the 4th road
A0 05 01 A2 Open the 5th road
A0 05 00 A1 Close the 5th road
A0 06 01 A2 Open the 6th road
A0 06 00 A1 Close the 6th road
A0 07 01 A2 Open the 7th road
A0 07 00 A1 Close the 7th road
A0 08 01 A2 Open the 8th road
A0 08 00 A2 Close the 8th road
A0 09 01 A2 Open the 9th road
A0 09 00 A1 Close the 9th road
A0 0A 01 A2 Open the 10th road
A0 0A 00 A1 Close the 10th road
A0 0B 01 A2 Open the 11th road
A0 0B 00 A1 Close the 11th road
A0 0C 01 A2 Open the 12th road
A0 0C 00 A1 Close the 12th road
A0 0D 01 A2 Open the 13th road
A0 0D 00 A1 Close the 13th road
A0 0E 01 A2 Open the 14th road
A0 0E 00 A1 Close the 14th road
A0 0F 01 A2 Open the 15th road
A0 0F 00 A1 Close the 15th road
A0 10 01 A2 Open the 16th road
A0 10 00 A1 Close the 16th road


[gmebey]

Thanks PCB.wiz

The posted documentation on Amazon and AliExpress is incomplete and doesn't list the communication protocol. Through some research I found it to be 9600 8 N 1. So what else is missing?


The control syntax is:
Syntax: A0chSTAx(CRLF)

ch is the channel number,
-- 01-10 (hex)
STAx is relay state
-- 01A2 = Open
-- 00A1 = Close

My main issue is I need to know if there is a command to open all relays at once.

At a quick glance of the datasheets it appears that the Nuvoton N76E003 / N76S003
parts do not have a simple ISP port, and would require custom bootloader.

I knew this was  a long shot...... At this point is will simpler and quicker for me to do my own mini controller board.


Thanks,
Gerald

[PCB.Wiz]

The posted documentation on Amazon and AliExpress is incomplete and doesn't list the communication protocol. Through some research I found it to be 9600 8 N 1. So what else is missing?

They all seem to use the slow 9600.
Some of the reviews of these generic units mention needing long inter-command delays too, to make things even slower...

At a quick glance of the datasheets it appears that the Nuvoton N76E003 / N76S003
parts do not have a simple ISP port, and would require custom bootloader.
I knew this was  a long shot...... At this point is will simpler and quicker for me to do my own mini controller board.

You could search for hidden commands ?
The '003' pinout is becoming widely used, (originally from STM8S003) so you would need to find a photo, to confirm the vendor.
Most new MCUs like 76S003 (very new version of 76E003) have bootloaders included, so you could swap a new part for early development.
Nuvoton also have Debug eval boards, you could connect one of those to see if the debug path was secured ?


Addit: google also finds this MCU+relay variant
https://hackaday.io/project/5637-8-channel-usb-relay-module
https://vi.aliexpress.com/item/32959676321.html
That looks to use a Prolific USB-UART, Relay Driver and a STM8S003 MCU ?
At the other end of the scale, it seems to use a very compact control of one bit per relay, tho unclear if you need 0x51,0xRR pairs ?
A risk with their flow chart, is a power failure needs the 0x50 to unlock