PS2002H/TP3016M power supply uart commands

ps2002h.txt

pcb markings: MPT3050A-V5.6 2015-08-06 QJB7.820.290 698580
sold as PS2002H or Tekpower TP3016M

On the PCB there is CN2 connector with pins: TX, GND, RX. It is a uart at 115200 bauds which 
generates some debugging information from STM32F100 processor.
It does not respond to common AT commands, neither to any random characters transmitted over
uart, list of some received messages follows. If you will find out what protocol this device
uses, please let us know in comments section

power-on:
cm_test_mtz success
cm_read_user_zone success
cm_read_user_zone success
cm_read_user_zone success
c8 0 90 1 c8 0 2c 1 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f6 24 0 0 94                 
2 24 0 43 29 0 0 4 55 d9 ff 3 26 0 0 dc 93 26 0 1f 28 0 0 57 13 d8 ff 5 2 55 5a
Power On Reset occurred....
RCC-CSR:0xc000002
core_init saved da v: 0.946200 235.995605
core_init saved ad v: 1.056300 -253.414001
core_init saved da c: 0.973100 252.822006
core_init saved ad c: 1.027100 -261.648895
core_init ref status:5a
brightness pwm:999
contrast pwm:160
leds active
lcd active
keyboard active
core active
meter active
dcdc active
screen active
dcdc work_mode
cvc active
gpio_usb_switch off
core_set_cv_dac_without_adjust: 0

output-enable:
awd:1011
core_output_key_handler

output-disable:
core_set_cv_dac_without_adjust: 0
core_output_key_handler

presets:
storage_read_cvc:0 200 300
storage_read_cvc:1 65535 65535
storage_read_cvc:2 65535 65535
storage_read_cvc:3 65535 65535
storage_read_cvc:4 65535 65535

change-of-value:
cm_write_user_zone success

brightness-change:
brightness pwm:0
brightness pwm:999

contrast-change:
contrast pwm:0
contrast pwm:80
contrast pwm:160
contrast pwm:240
contrast pwm:320
contrast pwm:500

toggle-usb-output:
gpio_usb_switch off
gpio_usb_switch off

Cool! I currently have this power supply on my desk with a defect. I am going to attach my usb-Uart adapter to it soon and check if is giving me clues.

Update -
I tried sending varios packets to the PSU through serial link (Tried protocol used by other PSU manufacturers), even tried sending random generated bytes, but without any response

I tried connecting to the unit with STLink V2 (openocd on osx) since it uses STM32F100 microcontroller (it worked only when the unit was powered from mains), unfortunately the FLASH is protected:

sudo openocd -f /usr/local/share/openocd/scripts/interface/stlink.cfg -f /usr/local/share/openocd/scripts/target/stm32f1x.cfg
telnet localhost 4444

Open On-Chip Debugger 0.10.0+dev-00957-g9de7d9c8 (2019-11-09-23:50)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select '.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : clock speed 1000 kHz
Info : STLINK V2J29S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.279840
Info : stm32f1x.cpu: hardware has 6 breakpoints, 4 watchpoints
Info : Listening on port 3333 for gdb connections
Info : accepting 'telnet' connection on tcp/4444
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x08009ce8 msp: 0x20001688
Info : device id = 0x10016420
Warn : STM32 flash size failed, probe inaccurate - assuming 128k flash
Info : flash size = 128kbytes
Error: flash bank 1 does not exist

stm32f1x options_read 0
option byte register = 0x3fffffe
write protection register = 0xffffffff
read protection: on
watchdog: software
stop mode: no reset generated upon entry
standby mode: no reset generated upon entry
user data = 0xffff

I dumped the 8KB RAM and this was the only human readable information I found there:
##@@@@@----Copyright 2010-2012 hangzhou Sunshare tech----@@@@@##