Decoding unknown UART

Question

I'm struggling with a project here. I have an Elechomes EC5501 air humidifier that I want to make "smart". When taking it apart, I found out it uses a circuit board similar in most points to this one here. But on mine, there is a 4-pin connector labeled "UART" that connects the humidifier with the display. By measuring I found out there is a 5V pin, a GND pin, and 2 RX/TX pins that enable communication between the user interface (display with touch buttons) and the main unit with ultrasonic + thermal humidification and the humidity sensor. I now built a small connector that goes between those plugs and has all 4 wires go out so I can measure on them. When rigging up my logic analyzer I get the following communication coming up every ~8 ms:

This should be the communication of the display unit asking for a sensor reading (Channel 1) and possibly what is the main unit's answer (Channel 0). What brings me to this conclusion is the Ch1 line going low just a few µs before the signal on Ch0 starting. Also Ch0 looks like DHT11-type answer code for me - long pulse = 1, short pulse = 0. As you see, there is a significant long low-time on Ch1 in between (see red circle). This makes it nearly impossible for me to fit a UART analysis in in Saleae Logic without it throwing frame errors. What also makes me wonder are two thing: 1.) There are some very short pulses in between with a high-time of 600 ns. I think I can possibly just ignore those (see red circle). 2.) the shortest pulses I can measure besides on this line are 16-20 µs long. This would make a Baudrate between 50000 and 62500 - so possibly 57600? The strange thing is, although the display should just ask for values as I don't do anything on it, the codes seem to change a bit every time:

Those are 4 adjacent requests. Does anybody have an idea on how to interpret this?

If you want to have a closer look, the file is uploaded for viewing in Saleae Logic right here.

EDIT: Just realized the short pulses might still be important. It seems that there are 9 pulses transmitted on CH0, and then there comes a short pulse on Ch1, followed by a short pause on both channel before CH0 starts to transmit the next 9 (or, in one case, 10) bits. There is a small IC on the bottom side of the circuit board with a SOIC-16 package, but without any labeling.

Answer 1

Ok I think it is in fact I2C, Ch 0 = SCL, Ch 1 = SDA Notable features of the waveform:

• I2C has 9 pulses for each byte + ACK bit
• the very short pulse you see might be the ACK bit. The master stops pulling the line low and there is an instant before the servant pulls the line low to acknowledge)
• the start condition for I2C is SDA goes low, then SCK goes low, which is what we see
• the stop condition is SCL goes high then SDA going high, which is what we see

Do you see a pair of resistors near the traces of this signal?

Decoding with Logic, the device address is always 0x50, the last byte is a checksum, which is the sum of the first 2 bytes in a burst plus 0xA0. E.g. 0x06+0x66+0xA0 = 0x0C (trimmed to 8 bits)

Answer 2

That's not UART signaling.

That's I2C.

Assume upper trace is clock SCL and lower trace is data SDA. You can also have the logic analyzer decode I2C.

• Data goes low while clock high - start condition
• Data changes only while clock is low
• Every 9th bit is ACK bit, where one device stops driving the data bus low to release it high and the other device starts driving data bus low for acknowledge. This creates the quick high going glitch.

Transaction seen in the last diagram is:

start - 0xA0 with ACK (I2C write address) - 0x04 with ACK - stop

start - 0xA1 with ACK (I2C read address) - 0x81 with ACK - 0x25 with NAK - stop

That matches basically a register read or I2C EEPROM read of 2 bytes from address 0x04.