Can anybody identify what kind of signalling protocol this is?

I'm sampling at 2 MHz. Here's the first falling edge of the signal, with a default UART protocol decoder for reference (8 bits, no parity, 1 stop bit, it's definitely wrong).

A screenshot of the signal in PulseView

Each symbol appears to be around 4.85 µs, so that's ~206,200 Baud. Seems just shy of the standard 230,400 baud rate.

A highlighted region showing 10 symbols taking around 48.5 microseconds.

The full trace is only <4 bytes, I've posted it here: .sr file, .pvs file

And beyond just the answer, is there a systematic approach to "brute force" a bunch of protocol analyzers, and filter down to only those that parse correctly?


I have a Herman Miller Motia Sit-to-Stand Desk, which has one really annoying deficiency: while it lets you save 4 preset heights, pressing the corresponding button doesn't make it move to that height (like how any sane person might expect it to). You need to sit there and keep holding the button, until it reaches the saved height (at which point it'll stop moving and you can release the button).

In the face of this mildest inconvenience, I did what any rational person would do: rather than wasting a few seconds every time I use the desk, I've decided to dedicate many hours to fix it. /s ... but hey, I'm among nerds here, I'm sure you can understand. Really, it's mainly just an exercise in learning about electronics.

I would like to hack it so a single button click will make it automatically go to the preset height.

I can trivially control sense and impersonate the buttons from my micro-controller (ESP32+ESPHome, but that's beside the point), but I also need to reverse engineering the signal that informs the height on the hand controller.

The desk's electronics has two main parts:

  • a LOGICDATA SMART-e-2-UNL-US motor controller (datasheet)
  • a LOGICDATA CBIclassic C button panel (datasheet)

The two are connected by a 7 pin DIN connector. I inspected the pin-out on my device, and it matches what's described on the datasheet:

I've tapped the signal between pin 6 (TxD) and the shell (GND). I've played around with all kinds of UART settings, but all of them come up blank.

I don't own a logic analyzer (bought one, it's on the way :D), so I improvised by using this library in conjunction with PulseView, to turn my spare ESP32 into a make-shift logic analyzer.

I did find two related projects, but both seem quite different, with much lower clock rates:

  1. Dreamdesk, which uses a LIN protocol at 19,200 baud
  2. RoboDesk, which uses a custom protocol, at only 1,000 baud
  • \$\begingroup\$ Can you just add an accelerometer and get the ESP32 to use that to decide when to release the button? \$\endgroup\$
    – DKNguyen
    Nov 8, 2022 at 4:39
  • \$\begingroup\$ @DKNguyen that’s very clever! It’ll only work in conjunction with the established presets (e.g. you can’t just command it to some arbitrary height, unless you did dead reckoning, which would be horrible), but would be pretty straight forward! I’ll resort to that if I can’t crack this code (literally) \$\endgroup\$
    – Alexander
    Nov 8, 2022 at 4:42
  • \$\begingroup\$ why not just latch the button for say, 5 seconds, does holding it too long cause issues? \$\endgroup\$
    – dandavis
    Nov 8, 2022 at 4:56
  • 2
    \$\begingroup\$ About the "having to press the button until it reaches the set height". All the desks I know have this behaviour. It's not a bug, it's a (annoying) safety feature to prevent accidents and damage to property... It's to old "safety vs. convenience" problem again :( So keep in mind that you are circumventing a safety feature here. \$\endgroup\$
    – kruemi
    Nov 8, 2022 at 6:08
  • 2
    \$\begingroup\$ Most bytes are decoded wrong, stop bit can't be low. It does not look correct even if you chaged to 7 bit data frames, or to 9 bit data frames. \$\endgroup\$
    – Justme
    Nov 8, 2022 at 6:33

1 Answer 1


If I understand correctly the HS1-HS4 are for Hall effect sensors which could used to determine the position of your desk. I believe the protocol that you are looking for is called the I2C protocol. It stands for Inter-Intergrated Circuit. It is used when a microcontroler communicates with a peripheral. The TxD transmits 8 bits of info. The Rxd sends a 1 bit acknowlegement . I included 2 links that could go into greater detail than I could. Hope it helps.



Perhaps change the positions of the sensors or the magnets that trigger the sensors to whatever position floats your boat- so to speak

  • 1
    \$\begingroup\$ That's not how I2C works. Even of it were I2C, it can't be known as if you only see a single data wire, because clock wire is missing. \$\endgroup\$
    – Justme
    Nov 8, 2022 at 9:06
  • \$\begingroup\$ Not quite, HS1-HS4 are "hand set" buttons 1-4 (the preset position ones). They're just digital signals that inform the motor controller to move to the corresponding height while held. I don't think this is I2C, because there doesn't appear to be a clock signal on any of the pins \$\endgroup\$
    – Alexander
    Nov 8, 2022 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.