Help working out logic analyzer protocol

[sl46]

Hi,

Firstly I am new to any of this and therefore looking for some help to decipher what (if any recognized) protocol is in use here.
In summary, I have a hot-tub from which I am trying to intercept the signals (actually via a second port from the controller board) and decode these such that I can a) capture the sensor data and current status of various parts of the tub and b) potentially control this remotely.

So far, I have a cheap logic analyzer and have sampled each of the cables and it doesn't seem to need more than 1Mhz to caputre what is required.

I have been assuming that the controller may be using SPI but when I look at the traces I am not sure if this correlates and my experience with SPI is minimal to zero at the moment.

Could anybody advise if the traces look like they are SPI or if not what else they could be. There are 5 cables that appear to be active (after removing the 5V and ground) and therefore not sure what the 5th one would be.

I have included a couple of images of the trace - the first is 2 seconds worth at 1Mhz and the second is the same trace but zoomed in to cover approx 60 ms.

Thanks

[Rerouter]

Looms like uart with flow control at a glance. Rx tx cts rts

[sl46]

Thank you.

I have put these into the protocol decoder in the order you stated and get frame errors for each frame. That said, I know nothing about UART so will read up on that first to get a better understanding of how it works and see where I get to.

Thanks

[sl46]

Sorry - I just cant seem to make sense of this and mapping it to UART.

I have included a link to the SR file if you are able to open this as it may give a clearer view.

https://drive.google.com/open?id=1moFwHVMyG825vh-IDbsALxKoqoLoo75E


Thanks

[abraxa]

It would help if you'd state which vendor and model you're trying to connect to - not just to allow for online research but also to allow people who attempt to do the same find this post in the future.

That said, I came across https://lb.raspberrypi.org/forums/viewtopic.php?t=175399 and D4/D1 sure look like a clock/data pair, sampling D1 on falling edge of D4. However, that doesn't explain the activity of D4 that repeats exactly every 300ms. Both D1 and D4 don't look like UART signals because each bit always has a rising and a falling edge, whereas UART bits remain high or low depending on the bit state. So SPI is possible but there's no plausible chip select line and there are always 76 bits in a D4 burst. So either they use a 4-bit word size or... they indeed use a simple clocked data line as described in the thread I linked to, just with 76 bits instead of 21.
Still doesn't explain the 300ms bursts on D4, though.

The lines D0/D3/D7 appear to be unrelated to the communication itself, though it seems that there is some crosstalk between them and D1/D4.

[sl46]

Thanks for taking the time to have a look at this.

It is a Spaform SF273 controller which is currently connected to a VL801D top panel.

https://www.hottubpartsuperstore.co.uk/balboa-spaform-sf273-licensed-pcb-52604.html
https://www.hottubdiy.co.uk/balboa-vl801d.html

I cant seem to find anything about the controller/top panel protocols or pin-outs anywhere.

The post you suggested was actually the inspiration for me looking into the project which is very much a learning project for me although there appears to be many differences in our setups.

My top panel connects to the board via an RJ45 connector which has voltages across 7 of the 8 cables. One of the cables appears to be totally dead and therefore I have disregarded this (maybe a mistake??)

The top panel itself actually has 8 buttons for each of - Program, Mode, Heat Up, Heat Down, Blower, Pump 1 (2 speed settings), Pump 2, Light.

My controller has a second RJ45 port which I believe to be available for a second remote controller and also have some soldered blanks on the board that are marked computer port and SPI hence leading me down the track of assuming some form of an SPI interface.

I have conduced some basic continuity tests with the system powered off to see if the soldered blanks marked SPI are connected to lines of the controller port and they appear to be.

I hadn't really considered cross-talk as an issue and if I am totally honest dont understand it. I have conducted the tests via a simple board that I have put together consisting of a flat 8 core cable (actually an old Cisco light blue console cable if you are familiar with these) terminated onto some perfboard. Each of these goes into a 500 Ohm resistor then out to a loose jumper cable approx 6-7 Cm long. These plug direct into the logic analyzer. The cable from the board is approx 1.5m. Is this likely to cause cross-talk problems? I must confess they the jumper cables were not arranged neatly for the test and therefore could have looped over/under each other.

Do you think I should repeat the tests with more rigor about cable routing and/or at a higher sampling rate?

Interestingly on one of these tests I conducted it actually caused the controller to reduce the heat setting - could this indicate cross-talk? I tried to replicate this by tracing one wire at a time but the scenario didn't repeat.

I had assumed given the number of buttons on the controller that it wasnt simply a case of each of these being a gpio based push button and being controlled via some form of interface but I am totally confused by what I have seen.

Any further help would be appreciated.

Thanks

[Rerouter]

can you post a csv of a few messages, or even a clearer zoomed in image,

line 4 looks like inverted serial data to me but its far too blurry to tell.