Analyzing 4-pin data port to determine protocol

Question

I have a Solar controller for my pool, it controls the pump and actuator for routing water onto the roof to heat it up, when required. The controller knows the pool and roof temperatures, as well as the state of the pump and actuator. All of which I'd like to monitor.

The controller has a 4-pin port labelled "Data". I would like to interface to this port to monitor the controller and pool parameters, if possible. I contacted the manufacturer but they responded with a generic "this port isn't supported for end users" kind of thing, as I expected they would. I have searched around, of course, but nobody has documented this port.

I would like to determine if this 4-pin data port speaks a standard protocol that I could potentially connect to. This "Data" port has 4 pins labelled: "BK", "W", "R", "BL". (See photo)

I assume these labels are abbreviations for Black, White, Red, Blue.

Based on that, I've made an assumption that "BK" is Ground.

With a multimeter I have probed pairs of pins to determine:

BK <-> W     +5V
BK <-> R     0V
BK <-> BL    +5V

I borrowed a Saleae Logic Analyzer from a friend and wired up its probes to analyze the port output. Again, assuming BK was Ground. The analysis revealed chatter on the W pin, although all the other pins revealed no activity. See the two screen shots below, one showing the full analysis (i.e. zoomed out) and the other showing the zoomed in detail of one of the spikes.

Saleae Logic has a bunch of protocol analyzers built in, and I tried the ones that makes sense with these set of pins, but haven't been able to make any useful sense out of any of them.

I was wondering if this port could simply be a USB port. The latest Logic contains a USB 1.1 analyzer, but it did not recognise anything useful from the probe.

Any suggestions on what kind of port it could be or recommended steps to continue the reverse engineering process would be great.

Answer 1

It is far too slow to be USB. Also, USB is differential and this does not appear to be. It looks a lot like some sort of serial protocol. Presuming BK is ground, then it would make sense if W is transmit, R is receive, and BL is +5V power.

It definitely looks similar to a standard UART serial signal with a baud rate of between 6000 and 8000 bits per second. I would suggest playing around with the UART decoder settings, especially number of bits and number of parity/stop bits. Some of those pulses look pretty narrow, though - I'm not sure what to make of that.

Have you tried looking at the signal with an oscilloscope? It would be beneficial to confirm the signal levels.

Also, can you take the top off and try to figure out what is in there that those pins might be connected to? That may provide some insight into what sort of a signal that might be.