I have a garden and would like to water it automatically with rain. For this I bought a «Gardena Battery Rain Water Tank Pump 2000/2» and would like to control via an ESP8266.

After opening the control panel, I found that the board is molded in black plastic, but there is an interface with 6 ports.

Schematic Control Panel

I checked this interface with a logic analyzer and identified the following ports:

  • 1 > TX,
  • 2 > GND
  • 3 > RX

As soon as the device is switched on, RX and TX switch to high and data is sent via TX. When switched off, they remain high and go low after 10 seconds.

[1Logic Analyzer View]2

Logic Analyzer Detail View

The baudrate is 9600 8N1 and I think the interface type is UART.

I receive the following data formatted as HEX:


HEX converted to ASCII:


I think 0xFE is the start and 0xFD is the end byte.

To create the checksum, start reading after the first byte, end before the checksum byte and calculate the checksum using the CheckSum8 Xor algorithm.

Checksum Calculate

As soon as I send data, I get "0xFF" as output followed by a start and end byte with the data listed above. I assume that 0xFF is an error code.

I have looked at the sent data with the logic analyzer and the scheme of the sent corresponds to the received.

Do you have any idea what kind of protocol this is?

Update: 2022/04/28

I tried to send various data to the RX interface, here is my result:

0x00 > return 0xFF followed by the data
0x01 > return 0xFF followed by the data
0x02 > return 0xFF followed by the data

0xE0 > return the data without 0xFF
0xE1 > return the data without 0xFF
0xE2 > no return, but if the value was sent twice, data will be sent
0xE3 to 0xFF > no return

0xFE, 0x32, 0xFD > no return
0xFE, 0x32, 0x3B, 0xFD > no return
0xFE, 0x32, 0x3B, 0x49, 0xFD > no return
0xFE, 0x32, 0x3B, 0x00, 0xFD > return 0xFF followed by the data
0xFE, 0x32, 0x3B, 0x00, 0x3A, 0xFD > return the data without 0xFF
0xFE, 0x32, 0x3B, 0x00, 0x3A, 0x30, 0xFD > return 0xFF followed by the data

Update: 2022/07/06

I was now able to detach the plastic from the board. On the board it has an imprint with the pinout.

  1. TX
  2. GND
  3. VCC
  4. DAT
  5. RST
  6. CLK

The interface reminds me of ICSP, but the labeling is not identical. Unfortunately, I don't see any RX. Could DAT possibly be RX?

I can't completely decipher the labeling of the microcontroller. The following I could read:

  • 511CD?
  • 043
  • (CC or DD) 2?27(8 or 9)1 > Example "CC 2?2781"
  • ??-ZV

Update: 2022/07/08

I spent the last two days trying to identify the microcontroller.

Front View

Back View

I found NU-Link, a SWD debugger that uses the DAT, CLK and GND pins. When I searched the website of the manufacturer, I found the Nuvoton NuMicro ML51TC0AE.

MC View

Datasheet: https://www.nuvoton.com/export/resource-files/DS_ML51_ML54_ML56_Series_EN_Rev2.02.pdf

I have ordered a NU-Link from Taiwan and will try to communicate with it via SWD.

Update: 2022/08/03

I have created a new post: Gardena battery rain water tank pump 2000/2 – SWD Interface

  • \$\begingroup\$ Are you sure this is regular UART? Usually, the TX signal is high when idle. \$\endgroup\$
    – Codo
    Commented Apr 26, 2022 at 12:01
  • \$\begingroup\$ Hi Codo, thanks for your help. I have just updated my request: As soon as the device is switched on, RX and TX switch to High and data is sent via TX. When switched off, they remain High and go Low after 10 seconds. \$\endgroup\$
    – valeum
    Commented Apr 26, 2022 at 13:08
  • \$\begingroup\$ Did the pump come with a manual? \$\endgroup\$ Commented Apr 26, 2022 at 16:47
  • \$\begingroup\$ Hi user253751, you can find the manual under the following link. gardena.com/tdrdownload//pub000081324/doc000149307 It is not an official way to talk to the interface, so it is not documented. \$\endgroup\$
    – valeum
    Commented Apr 27, 2022 at 5:16

1 Answer 1


After the first three bytes it looks like a bunch of key:value pairs in ASCII.


I see no indication that the UART interface can be used to command the pump.

  • \$\begingroup\$ Hi Jasen, thanks for your help. It may be that this is a debug interface which sends the data only via TX. If this is the case, I have to destroy the switch of the device to emulate a press switch via the ESP8266. This would be a pity, maybe someone has another idea. \$\endgroup\$
    – valeum
    Commented Apr 27, 2022 at 6:32
  • \$\begingroup\$ It's possible that this connector is also a programming interface, but that seems like a world of pain especially if the installed code is unreadable. \$\endgroup\$ Commented Apr 27, 2022 at 21:26
  • \$\begingroup\$ esp-prog uses a 6 pin uart header but the pinout is different. maybe ask in reverseengineering.stackexchange.com \$\endgroup\$ Commented Apr 27, 2022 at 21:31
  • \$\begingroup\$ Hi Jasen, i also think this is a painful task, however the solution may put the pain into perspective. I looked at the ESP-Prog interface and the pinout is really diffrent. I will measure again today. I did various tests yesterday and have updated my question. \$\endgroup\$
    – valeum
    Commented Apr 28, 2022 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.