How to identify an unknown protocol with a logic analyzer?

Question

I have this Inbras electrolyte analyzer, a rebranded version of the same device manufactured by Diestro. It uses a PIC18F87K22 (master) which communicates with the sensor using a PIC12F629 (slave) through 4 pins in a custom IDC-DB9 connector with the following connections:

I will be referring to the slave device's pins since it is what I am interested in.

This device is supposed to measure the level of two liquid containers, but actually just counts down from a fixed volume. I want to program a microcontroller to replace it and actually measure the level of these containers, but to do so I need to figure out the communications used without having access to the programs stored in the microcontrollers (I don't have any programmers and it probably also is copy-protected).

The package where the reagent bottles are kept and the "sensor" attached to the green bottle.

There are no sensors at all. It just connects to the analyzer through the IDC connector and these pads do nothing.

I used a generic FX2 based logic analyzer along with Sigrok + PulseView to capture the data. Samples here. All these captures should indicate that the containers are empty and I unfortunatly only have access to these right now.

Here are some of the things I would like to find out:

• Which pins are for transmission and reception?
• What is the baud rate?
• Which protocol is being used?

Some observations:

Sample from the slave-connected-calibrate.sr file.

A bit closer in, with SPI decoder (CLK = GP1, MISO = GP0, MOSI = GP5, CS = GP2 and CS polarity = active-high).

• Signal seems to be an asynchronous, since there is no apparent clock signal.
• Signal frequency is 7 kHz.
• GP2 seems to be some sort of chip enable pin because it stays high during 8 long pulses.
• GP1 probably is the transmission pin because there’s so much data in it.
• Probably not UART (at least not using with the common baud rates).

Answer 1

I doubt it's plain SPI, though it's bidirectional with a clock. The way I see it:

GP1 is some kind of clock, that seems obvious.

GP2 acts as a kind of chip select, but not quite. When it goes low, GP1 either has 1 or 2 low-high-low transitions before GP2 goes high again. Question is what the second transition indicates because it has a meaning for sure.

After GP2 went high again, GP2 has one low-high-low transition where GP0 is always low. Then follow two more transitions but for the first one, GP0 is always high. For the second transition, GP0 is mostly high but sometimes low.

I'd guess GP0 is MOSI and that the first two clock cycles after GP2 went high are always 0 and 1, followed either by a read/write indicator flag (with read=high which could explain why it occurs more often) or maybe a few slave address bits.

GP5 looks like MISO but sometimes, it is low for extended periods of time after a packet was transmitted. This could be a "busy" indication mechanism, telling the master to not send anything while GP5 is low.

Unfortunately, you posted nowhere near enough about this device to make an educated guess about anything else, really.

What are brand and model? What do the devices look like? How many sensors can be attached to the master? What do those sensors measure and how? What information does the master show about the attached sensor(s)?

Since this is a completely custom protocol, maybe reading out the PIC's flash and reverse engineering it is an easier route to go, depending on your skill set.

Answer 2

Offhand it looks like SPI with a gated clock, but I'd need more resolution on GP1 (which I think is the clock). GP2 would be the chip select, and GP0 and GP5 would be MISO and MOSI. You could probably find out by determining from the processor spec what SPI mappings are possible with this chip.