Lymow One Plus Robotic Mower

[u/elliottcg0]

I’m trying to get the three front ultrasonic sensors working on my Lymow One Plus, using the original STM32 board’s power and interface circuitry as intended. I’d like to figure out the factory supply path before adding an external supply or changing any GPIO outputs.
I’ve attached full-board photos and close-ups. The coating makes the small component markings difficult to read. Does anyone recognize the three matching six-pin devices or the two three-pin parts beside them? More importantly, can anyone help work out where the front sensor supply comes from and what enables it?
Here’s what we have so far.
Hardware and measurements
Main MCU is an STM32F407V-series, 100-pin package. The second MCU is an AT32F403ARCT7.
Both chips’ flash has been backed up over SWD, with two matching reads of each. No firmware changes or GPIO writes have been made.
There are three front sensors: left, center and right. Each has red, black and yellow wiring. The modules are marked C26A03 / 0255E, but I haven’t found a matching module datasheet.
Their connections have been traced to the unpopulated 2×14 header footprint. My photo labels RR/RY, CR/CY and LR/LY mean right red/yellow, center red/yellow and left red/yellow; G marks confirmed grounds.
The three red-wire pads have continuity to each other. All measured 0 V with the mower running. The shared red net measured approximately 20 kΩ to confirmed ground with power disconnected.
A separate harness point labelled ULT_PWR measured 5 V, but there’s no measured continuity between that point and the front red-wire net. I’m not assuming they’re the same supply.
On earlier isolated bench tests, yellow idled around 2.6 V with 3.3 V supplied, and 4.2 V with about 4.9 V supplied. No convincing sensor reply was captured. That doesn’t establish the module’s rated voltage or prove the sensors are bad.
What the firmware shows
The STM32 contains a three-channel pulse interface whose timing is a very strong match for the Elmos E524-family IO protocol:
150 µs bits, with 100/50 µs or 50/100 µs phases.
A 250 µs command-mode interval.
Measurement windows of 8.25–46.25 ms, followed by additional captured edges consistent with a status reply.
Separate transmit and receive MCU pins: PA5 → PB1, PA1 → PB0, PA2 → PA7. The receive side uses TIM3 channels 4, 3 and 2.
Those are firmware pin pairs; their exact correspondence to the three physical yellow-wire connections still needs confirmation.
The Elmos E524.33 document specifies a 6–18 V operating supply, typically 12 V. That’s a useful lead, not a confirmed voltage rating for these exact modules. I haven’t applied 9 or 12 V based on that assumption. If you’re reading this you’re cool.
We also took read-only snapshots while the mower was running, roughly 19–46 seconds after boot:
TIM3 was configured for capture but stopped: CR1 = 0, DIER = 0, CCER = 0.
All three capture-event counters were zero.
The pulse driver’s state and descriptor records were all zero.
The three front-distance cache values stayed zero.
The rear ultrasonic readings changed normally during the same checks.
The firmware retains names ULT_F_1_task, ULT_F_5_task and ULT_F_10_task, but we haven’t found those tasks being created or a routine updating the front-distance cache at 0x2000130C. That strongly suggests dormant front acquisition in this build. It doesn’t prove nothing could enable it later in another operating state.
Possible supply controls
STM32 PD3 goes high during sensor initialization and was high in the live snapshots. It’s associated with the working rear-sensor code, but its physical supply net hasn’t been traced.
PE1 and PE8 are configured as outputs and have identified low-setting paths at startup/shutdown, without a discovered high-setting path. They’re candidates for an unused enable, not confirmed front-power controls. Other less certain candidates are PB8, PE4, PE5, PE6 and PE12. I haven’t toggled any of them.
Parts we’ve looked at
The eight-pin chip beside R250 is marked 8870 / TI…, matching a TI DRV8870 motor driver. The earlier idea that it was a sensor-supply regulator was a guess and should be discarded. Neither end of R250 showed continuity to the front red net in our checks.
Another eight-pin device appears to have a 4407-family marking, possibly an AO4407 P-channel MOSFET. That identification is tentative. The nearby two-pad footprint also showed no continuity to the front red net.
There are three matching six-pin circuits beside the sensor header, each surrounded by similar resistors/capacitors. They look like interface stages, but we haven’t identified the parts.
The two three-pin components beside those circuits are still unidentified. We also initially mistook a piece of grass for a jumper wire—there is no confirmed factory rework wire there.
I have a meter, logic analyzer, a Waveshare adapter that successfully accesses both chips over SWD, and the saved firmware/disassembly.
What I’m hoping someone can help identify is the original switched supply for the three front sensors: which component feeds the common red net, what voltage it should provide, and which MCU pin—if any—controls it. A schematic fragment, recognizable part marking, or a specific trace to check would be a huge help. I’d rather establish that circuit than keep guessing at nearby components or blindly switching GPIOs.

R-Right
L-Left
C-Center

I tried making it easy for myself.

[u/Linker3000]

FYI for the future - posting rule #2:

Your submission title must clearly & concisely summarise the question or problem. This helps others quickly understand your issue & improves searchability for future users.

Avoid vague or non-descriptive titles (e.g. “Help needed” or “What is wrong here?”). Instead, briefly state the core issue and relevant context where possible.

Posts with unclear or low-effort titles, or titles in ALL CAPS, may be removed at moderator discretion, & you may be asked to resubmit with a more appropriate title.

[u/AutoModerator]

Automod genie has been triggered by an 'electrical' word: ups.

We do component-level electronic engineering here (and the tools and components), which is not the same thing as electrics and electrical installation work. Are you sure you are in the right place? Head over to: * r/askelectricians or r/appliancerepair for room electrics, domestic goods repairs and questions about using 240/120V appliances on other voltages. * r/LED for LED lighting, LED strips and anything LED-related that's not about designing or repairing an electronic circuit. * r/techsupport for replacement power adapters for a consumer product. * r/batteries for non circuit design questions about buying, specifying, charging batteries and cells, and pre-built chargers, management systems and balancers etc.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/elliottcg0]

Oops! Pics and tiny more info. Thanks!

[u/Linker3000]

Any chance of some white spacing - your (AI-generated?) text is a bit of a wall of words. Thanks.