How to identify an unknown protocol with a logic analyzer?

I have this Inbras electrolyte analyzer, a rebranded version of the same device manufactured by Diestro. It uses a PIC18F87K22 (master) which communicates with the sensor using a PIC12F629 (slave) through 4 pins in a custom IDC-DB9 connector with the following connections:

I will be referring to the slave device's pins since it is what I am interested in.

This device is supposed to measure the level of two liquid containers, but actually just counts down from a fixed volume. I want to program a microcontroller to replace it and actually measure the level of these containers, but to do so I need to figure out the communications used without having access to the programs stored in the microcontrollers (I don't have any programmers and it probably also is copy-protected).

The package where the reagent bottles are kept and the "sensor" attached to the green bottle.

There are no sensors at all. It just connects to the analyzer through the IDC connector and these pads do nothing.

I used a generic FX2 based logic analyzer along with Sigrok + PulseView to capture the data. Samples here. All these captures should indicate that the containers are empty and I unfortunatly only have access to these right now.

Here are some of the things I would like to find out:

• Which pins are for transmission and reception?
• What is the baud rate?
• Which protocol is being used?

Some observations:

Sample from the slave-connected-calibrate.sr file.

A bit closer in, with SPI decoder (CLK = GP1, MISO = GP0, MOSI = GP5, CS = GP2 and CS polarity = active-high).

• Signal seems to be an asynchronous, since there is no apparent clock signal.
• Signal frequency is 7 kHz.
• GP2 seems to be some sort of chip enable pin because it stays high during 8 long pulses.
• GP1 probably is the transmission pin because there’s so much data in it.
• Probably not UART (at least not using with the common baud rates).
• Going by the pinout of the PIC18F device you could be looking at SPI. RC3/4/5 can be SCK/SDI/SDO, while RJ2 would be he select line. Jul 1, 2020 at 18:44
• You can get the baud rate by looking at either the clock period (if you can identify a clock) or the width of the smallest interval you can see on the data line. Jul 1, 2020 at 18:53
• For all this effort, I'd consider designing a new implementation of the features you want. Jul 2, 2020 at 13:37

I doubt it's plain SPI, though it's bidirectional with a clock. The way I see it:

GP1 is some kind of clock, that seems obvious.

GP2 acts as a kind of chip select, but not quite. When it goes low, GP1 either has 1 or 2 low-high-low transitions before GP2 goes high again. Question is what the second transition indicates because it has a meaning for sure.

After GP2 went high again, GP2 has one low-high-low transition where GP0 is always low. Then follow two more transitions but for the first one, GP0 is always high. For the second transition, GP0 is mostly high but sometimes low.

I'd guess GP0 is MOSI and that the first two clock cycles after GP2 went high are always 0 and 1, followed either by a read/write indicator flag (with read=high which could explain why it occurs more often) or maybe a few slave address bits.

GP5 looks like MISO but sometimes, it is low for extended periods of time after a packet was transmitted. This could be a "busy" indication mechanism, telling the master to not send anything while GP5 is low.