2
\$\begingroup\$

I have this Inbras electrolyte analyzer, a rebranded version of the same device manufactured by Diestro. It uses a PIC18F87K22 (master) which communicates with the sensor using a PIC12F629 (slave) through 4 pins in a custom IDC-DB9 connector with the following connections:

Connections between the two microcontrollers.

I will be referring to the slave device's pins since it is what I am interested in.

This device is supposed to measure the level of two liquid containers, but actually just counts down from a fixed volume. I want to program a microcontroller to replace it and actually measure the level of these containers, but to do so I need to figure out the communications used without having access to the programs stored in the microcontrollers (I don't have any programmers and it probably also is copy-protected).

enter image description here

The package where the reagent bottles are kept and the "sensor" attached to the green bottle.

enter image description here

There are no sensors at all. It just connects to the analyzer through the IDC connector and these pads do nothing.

I used a generic FX2 based logic analyzer along with Sigrok + PulseView to capture the data. Samples here. All these captures should indicate that the containers are empty and I unfortunatly only have access to these right now.

Here are some of the things I would like to find out:

  • Which pins are for transmission and reception?
  • What is the baud rate?
  • Which protocol is being used?

Some observations:

Sample from the slave-connected-calibrate.sr file.

Sample from the slave-connected-calibrate.sr file.

A bit closer in.

A bit closer in, with SPI decoder (CLK = GP1, MISO = GP0, MOSI = GP5, CS = GP2 and CS polarity = active-high).

  • Signal seems to be an asynchronous, since there is no apparent clock signal.
  • Signal frequency is 7 kHz.
  • GP2 seems to be some sort of chip enable pin because it stays high during 8 long pulses.
  • GP1 probably is the transmission pin because there’s so much data in it.
  • Probably not UART (at least not using with the common baud rates).
\$\endgroup\$
  • 1
    \$\begingroup\$ Going by the pinout of the PIC18F device you could be looking at SPI. RC3/4/5 can be SCK/SDI/SDO, while RJ2 would be he select line. \$\endgroup\$ – brhans Jul 1 at 18:44
  • \$\begingroup\$ You can get the baud rate by looking at either the clock period (if you can identify a clock) or the width of the smallest interval you can see on the data line. \$\endgroup\$ – Adam Haun Jul 1 at 18:53
  • \$\begingroup\$ For all this effort, I'd consider designing a new implementation of the features you want. \$\endgroup\$ – rdtsc Jul 2 at 13:37
3
\$\begingroup\$

I doubt it's plain SPI, though it's bidirectional with a clock. The way I see it:

GP1 is some kind of clock, that seems obvious.

GP2 acts as a kind of chip select, but not quite. When it goes low, GP1 either has 1 or 2 low-high-low transitions before GP2 goes high again. Question is what the second transition indicates because it has a meaning for sure.

After GP2 went high again, GP2 has one low-high-low transition where GP0 is always low. Then follow two more transitions but for the first one, GP0 is always high. For the second transition, GP0 is mostly high but sometimes low.

I'd guess GP0 is MOSI and that the first two clock cycles after GP2 went high are always 0 and 1, followed either by a read/write indicator flag (with read=high which could explain why it occurs more often) or maybe a few slave address bits.

GP5 looks like MISO but sometimes, it is low for extended periods of time after a packet was transmitted. This could be a "busy" indication mechanism, telling the master to not send anything while GP5 is low.

Unfortunately, you posted nowhere near enough about this device to make an educated guess about anything else, really.

What are brand and model? What do the devices look like? How many sensors can be attached to the master? What do those sensors measure and how? What information does the master show about the attached sensor(s)?

Since this is a completely custom protocol, maybe reading out the PIC's flash and reverse engineering it is an easier route to go, depending on your skill set.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Thanks for the feedback, I added more info on the device in question. As I mentioned, the "sensor" doesn't measure anything at all, it just counts down from a know volume. You are right about GP1 being a clock, I wasn't aware of gated clocks. GP1 has a lot of activity, but not much actual information. I may be able to get more information once I sample sensors which output something other than an "empty" status. \$\endgroup\$ – ablon Jul 2 at 13:36
1
\$\begingroup\$

Offhand it looks like SPI with a gated clock, but I'd need more resolution on GP1 (which I think is the clock). GP2 would be the chip select, and GP0 and GP5 would be MISO and MOSI. You could probably find out by determining from the processor spec what SPI mappings are possible with this chip.

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Added a more clarifying image to the post and here: i.stack.imgur.com/dpFNT.png \$\endgroup\$ – ablon Jul 1 at 19:28
  • \$\begingroup\$ Looks like SPI, how do the decoded, apparently 24b messages correspond to what you expect to see? \$\endgroup\$ – Cristobol Polychronopolis Jul 1 at 19:46
  • \$\begingroup\$ Thanks a lot for the info! I was not aware that there was such a this as a gated clock. Honestly, the signal looks like gibberish... I am now certain it is a custom protocol. I may be able to get more information once I sample sensors which output something other than an "empty" status. \$\endgroup\$ – ablon Jul 2 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.