Identify STM8 microcontrollers on a BLDC ceiling fan motor-driver PCB (third-party - Atomberg fans)

[srt]

I'm trying to identify an STM8 microcontroller on a BLDC ceiling fan motor-driver PCB (JV2-Gorilla-2017 Atomberg fan appliance board, not an ST eval board), with the goal of confirming whether I can reprogram it via the exposed SWIM header.

What I've confirmed so far:

• A 4-pad unpopulated header silkscreened SWIM / RST / 3V3 / GND
• Two TSSOP-20 ICs on the board (designators U3 and U4 in silkscreen)
• U4 shows a visible STMicroelectronics logo under magnification, but the part-number text beneath it is too worn/corroded to read reliably even after cleaning with isopropyl alcohol and raking light
• U3's top marking is fully illegible (possibly unbranded, possibly just more worn)
• Board also has a separate 8-pin SOIC gate-driver-looking IC, a 3-pin Hall-sensor connector, and a 3-phase MOSFET bridge under a heatsink — consistent with a BLDC commutation + speed-control board

Questions:

1. Given only a TSSOP-20 package and a genuine ST logo, is there a way to narrow down which STM8 family/part this likely is (e.g., is STM8S003F3/S103 the most common TSSOP20 choice for cost-optimized appliance control, or are there other likely candidates I should consider)?
2. Is there a reliable way to identify the exact part purely over SWIM (e.g., via STM32CubeProgrammer or STVP reading the device ID/flash size from silicon) without needing to read the marking at all? If so, what's the exact procedure/settings for connecting an ST-LINK in SWIM mode to an unknown STM8 target?
3. If the part turns out to have read-out protection (ROP) enabled — which I'd assume for a mass-produced consumer appliance — is dumping the original firmware realistically impossible, or are there legitimate documented recovery paths?
4. Any gotchas connecting SWIM to a board like this that's mains-referenced (i.e., isolation concerns between my ST-LINK/PC and the board while probing)?

Appreciate any pointers — happy to share close-up board photos if useful.

 

[Peter BENSCH]

Welcome ​@srt, to the community!

1. Well… it is the STM8S003F3P6
2. I am not aware of any way to read out the exact STM8 via SWIM.
3. Yes/No - in this order.
   That means dumping the original firmware is not impossible but hard to achieve (Yes), there are no legitimate recovery paths (No).
4. You can use the ST-LINK/V2-ISOL, which was developed specifically for this purpose.
   Perhaps a non-isolated ST-LINK can also be used together with an external isolator, but there is no application note for this.

Hope that helps?

Regards
/Peter

[srt]

The original firmware is not provided publically by Atomberg fans.

Can Stmicrocontroller’s  UM0708 + the STM8 BLDC firmware library ( + UM1477/STEVAL-IFN004V1 schematic as reference ) be used to overwrite the original firmware without any unforeseen issues? 

 

[faheem asad]

The STM8S003F3P6 identification from the package and board context is really helpful. I’d be especially interested in whether the SWIM header can at least confirm the target before attempting any firmware changes. The isolation warning is also an important point here, since a mains-referenced BLDC board can make otherwise simple debugging risky. For replacing the firmware, I’d probably verify the exact MCU, clock configuration, peripherals, Hall inputs, and gate-driver interface first rather than assuming the ST BLDC library will be a drop-in replacement.

[cartergray733]

SWIM is probably the easiest way to identify it without reading the marking. An ST-LINK can usually detect the STM8 device and provide identification details, but TSSOP-20 alone isn’t enough to reliably distinguish the exact STM8 variant. If ROP is enabled, firmware readback is generally blocked and recovery usually requires an erase. Also be very careful with a mains-referenced board use proper galvanic isolation before connecting the ST-LINK/PC.

[AScha.3]

from your pic:

 

...and U3 is probably :  DRV10983 BLDC driver

https://www.ti.com/product/de-de/DRV10983