This device could easily be found at the Chinese sellers. They advertise them as DS150E. Under the hood there is nice STM32 and STM8 pair. One is present on main PCB (in my case TCS MAIN V6.0), the other on relay board (TCS+RELAY V3.0). Both chips have their ST-Link headers broken out. If one want to read/write the firmware installed in internal flash, it should be as easy as connecting few of these pins.
Control board (STM32)
The main chip is STM32F205ZGT6 (where T6 is 144-pin variant). On this board there is J400 header. Its pinout is as below:
|Num.||Function||SoC pin||Num.||Function||SoC pin|
I don’t know, why PE15 is broken out here and why is it doubled. To ensure the pinout is not changing from version to version, one can probe continuity between J400 pin and SoC pin.
Relay board (STM8)
The slave chip is STM8S003K3T6C. On this board there is J001 header, matching the standard goldpin pitch, so should be extra easy to handle. Its pinout is:
Also here it is easy to check if pins on particular revision of board are the same using chip pin assignment.