How to tell what serial protocol is used on a DB9 connector?

Question

I'm trying to reverse engineer communication between a host and client device that uses a DB9 connector. I'm able to measure voltage between the devices with a breakout board and multimeter.

The pin-outs for RS232 and RS485 protocols, for example, are very different with RS232 COM being pin 5, and RS485/RS222 being pin 1.

Some clues is pins 7/8 on the male end are missing.

What measurements can I take with a multimeter that will reveal what I'm dealing with? What voltages should I expect to see?

I tried wiring up a spy cable using this diagram and so far I'm not getting anything on an RS232 device:

I know the spy cable works because I did a loop back on my RS232 to USB adapter. (I also tried the non handshake version with just Tx Rx and COM wired).

I suspect RS485/RS222 but I would like a way to confirm with voltage readings. And I'm not sure what values I should be seeing for either protocol.

Measurements I took assuming pin 5 is COM (addition: pin 5 is not COM, pin 2 is, see below):

Disconnected (treadmil only):

• 1 and 5: 10.49V
• 2 and 5: -4.98V
• 3 and 5: 0V
• 4 and 5: 0V
• 6 and 5: -4.25V
• 7 and 5: -4.23V

Connected to console:

• 1 and 5: 7.07V to 7.11V
• 2 and 5: -4.96V
• 3 and 5: 0V to -0.38V
• 4 and 5: 0V to -0.54V
• 6 and 5: 6.45V to 6.50V
• 7 and 5: -4.91V

Additional Information:

The device itself is a Lifespan treadmil. I'm trying to read health data from the device for personal use. I originally left it out because I thought perhaps I could discover the protocol with some voltage checks, and I wanted the question to be more helpful to other applications.

The console has a USB port used for charging devices like mobile phones. I took it apart and found continuity between USB ground (black wire) and pin 2.

With this information I took new measurements:

Disconnected (treadmil only):

• 1 and 2: 15.43V to 15.53V
• 3 and 2: 4.97V
• 4 and 2: 4.21V
• 5 and 2: 4.97V
• 6 and 2: -0.47V
• 7 and 2: -0.25V

Connected to console:

• 1 and 2: 12.05V to 12.10V
• 3 and 2: 4.68V to 4.96V
• 4 and 2: 3.83V to 4.17V
• 5 and 2: 4.96V
• 6 and 2: 11.42V to 11.47V
• 7 and 2: 0.001V to 0.01V

I found a couple of Gists where users have successfully read data. But I do not know if they wired their own cable, or what serial protocol was used. My assumption is besides some pin shuffling, an off-the-shelf USB adapter was used.

One author did tell me what model they were using (TR800), which is different from mine (TR5000, got second hand), but it's within the same family. It's also possible Lifespan changed the pin-out on their Glowup refresh.

The gists are here:

https://gist.github.com/daeken/a3d3c4da11ca1c2d2b84 https://gist.github.com/lostmsu/1b0d4a33e5ca2418c2b52797eb720ec7

With the Python version this line stands out:

self.port = serial.Serial('/dev/tty.IHP-Serialport', 19200, timeout=1)

I have the retro console without bluetooth. Even so, people complain about the syncing. As a software engineer I thought I would try to get at the data and sync it to my health fitness app. And it (seemed) like a fun project.

Discovery:

Both scripts I linked to are serval over Bluetooth. So it can literally be anything. I would probably have a better chance tapping into the empty Bluetooth slot on the console board. Either way without a oscilloscope, that’s going to be impossible. Cheaper to try and get my hands on a Bluetooth console.

Answer 1

The RS-232 DB9 is well standardized. You'll have Rx on pin 2, Tx on pin 3 and GND on pin 5. Optional handshaking signals on the rest of the pins. This assumes that the device is a terminal at the end of the bus. Otherwise Tx/Rx may switch places in case the device is to be regarded as a "modem", a middle man between terminals.

As seen on for example Wikipedia, RS-232 logic levels are 3V to 15V for binary value 0 and -3V to -15V for 1.That is, the logic voltage levels look inverted compared to UART.

RS422/RS485 however use 5V logic levels just like UART. Since it's a differential signal, Tx+ idles 5V high and goes to 5V for binary 1 (exactly like UART), while Tx- does the opposite, idles 0V and goes to 0V for binary 1.

DB9 for RS422/RS485 is unfortunately not well standardized and all manner of strange pin-outs exist. A common one is this (ignoring handshaking signals):

1. Tx- (A)
2. Tx+ (B)
3. Rx+ (B)
4. Rx- (A)
5. GND

A and B being common terms when using RS485 semiduplex. Another one, which could be the one you are seeing:

1. GND
4. Rx+ (B)
5. Rx- (A)
8. Tx+ (B)
9. Tx- (A)

---

Some clues is pins 7/8 on the male end are missing.

In case of RS-232, pin 7 and 8 would be the most common handshaking signals RTS/CTS, so that's perhaps the case - to ensure there's no handshaking. In case of RS-485, you could be looking at yet another pin-out other than those above.

What measurements can I take with a multimeter

You don't, you use an oscilloscope. It is a mandatory tool for electrical engineering in general and serial bus trouble-shooting in particular.

Also pretty much every modern digital oscilloscope comes with a decoding feature for RS-232 or RS-485.

At idle voltages you could use a multimeter between pin 2 (red probe) and 5 (black probe) to see if you have a negative voltage. If so it's definitely RS-232. But when there's data being transmitted, the multimeter is unreliable and might show pretty much anything between -15V to +15V depending on bus load.