Itead Sonoff RF WiFi & 433MHz switch: Identifying an unknown chip on the 433MHz card

I have the Sonoff RF which is a mains relay switch which is activated by either WiFi or a 433MHz remote. The particular Sonoff RF's I have arrived from China on 21/9/2017. I flashed these Sonoff RF's last week with the lastest tasmota firmware. The firmware version I flashed was sonoff.bin (there are many other tasmota firmwares available).

I understand that Sonoff RF firmware for the WiFi card (which is I beleive ESP8266-01 based), and the firmware for the 433MHz card are different and seperate. This makes sense becasue a Sonoff vesion is sold without the 433MHz card. Sold without the 433MHz card it is called the Sonoff Basic.

So by flashing new firmware to the ESP8266-01 card the 433MHz card is unaffected.

This I have confirmed through use of the 433MHz card since flashing the tasmota firmware: the 433MHz card behaves in the same way as it did with the original OEM Itead firmware. In any case the author of the tasmota firmware states that his firmware has no impact on the 433 MHz card.

I am interested in the 433MHz card becasue I beleive it could have a better firmware.

Currently a 433MHz remote paired with the card can only toggle the relay switch. For more useful functionality the remote needs to be able to set the switch to OFF or ON as well as having TOGGLE functionallity.

As part of my initial investigations of this card, I am trying to identify the chips on the card. I've used Google quite extensively with no luck in regard to one of the chips, so am wandering if anyone on here has some working knowledge of such a chip arrangement.

Below is a picture of what I call the front of the card

The picture above shows the SYN470R 1631 chip. The data sheet is here http://img.ozdisan.com/ETicaret_Dosya/453934_1928180.pdf

Below is a picture of what I call the back of the card

The above photo shows the can with 6.7458 stamped on.

I am unable to identify the 16 pin SMD chip, with 4 pins per side. As far as my eyes can see the chip text reads BB1 0 F 2 G A GOGA4 1620 A, but I may be wrong and your eyes may be better than mine. I've googled various possible permutations of this with no success. May be I missed something obvious. Eg I tried 8810 instead of what looks to me like BB10, etc.

Do you know what this chip is?

Perhaps you can shed some light on how this 433MHz board can be programmed for ON / OFF as well as Toggle switching functionallity. If so please post up.

PHOTOS ADDED BELOW IN ATTEMPT TO CLARIFY CHIP IDENTITY

Below photo shows side view. Seems to show 20-pin package

Below photo shows 5 tracks coming in from left. 4 lower down and one appears to go to the top corner pad. QFN20 has corner pads. So this potentially accords well with the package being a QFN20.

Below is from pg 48 on datasheet linked in the answer. Shows 4 pins at edge of chip & two corner pads.

• Most likely the actual remote functions are commanded from or to the main processor, not the radio. What you really need to do is investigate the communication channel in between, with a scope and/or logic analyzer. Also keep in mind that there's a lot of material out there on reversing simple remote commands, and you don't necessarily need anything like the original radio to work with most OOK systems. – Chris Stratton Jun 13 '19 at 15:34
• You really don't want to use a bloody 8051 in the year 2019. Everyone but Silabs stopped using these well over 20 years ago. If you wondered what could possibly be crappier than Arduino/AVR, this is the answer. Never parts from Silabs like EFM32 have radio on-chip, use those instead. – Lundin Jun 17 '19 at 14:18
• @Lundin which is the 8051? What are you recommending; I'm no too sure from you're comment. thanks – Kes Jun 18 '19 at 19:51
• If you don't know what an 8051 is, you should probably back away from this project right now. What I'm recommending instead was quite clear in my previous comment. – Lundin Jun 19 '19 at 6:25
• Hi @Lundin, I think this is the chip you mean en.wikipedia.org/wiki/Intel_MCS-51 ? But I can't be certian as I am not a mind reader & it's not obvious to me how "8051" is relevant. Can you please explain. I'd be grateful. I've many years experience - broadly - in micro electronics but haven't come across the 8051. Asking for your understanding : it's a vast field. – Kes Jun 20 '19 at 8:01

• According to the datasheet link @BeB00 has posted BB1=Busy Bee 1 Family, 0=Family Feature Set, F=Memory type is Flash, 2=Flash memory size is 2KB, G=Temperature Grade is -40 to +85, A=Chip Revision. Dataseet document does not seem to explain GOGA4. 1620 A is a date of manufacture & revision code. 16 is year 2016. 20 is week 20. A is the device revision – Kes Jun 13 '19 at 16:59
• The meaning of GOGA4 or is it QOGA4 (I can't quite see it) remains a mystery to me. – Kes Jun 13 '19 at 17:04