Where is the serial port?

[tjkolev]

Greetings,

My first post here. I've been consuming information off this forum for a few years. Thank you.

How do I go about finding a serial (UART) port on an undocumented PCB? What the methodology one would use. The goal is the get to the serial console to see what I can see. The target PCB is one for an old Ecobee Smart Si (wifi) thermostat. I don't know if it even has a serial port. New models seem to have one - https://www.l9group.com/advisories/ecobee3-lite-shell-from-serial-debug-port.

I have a Siglent SDS1104x-e, which I haven't used for decoding serial signaling. I poked at the J1 connecter (below the battery) without any success. Could the unpopulated J3 be a JTAG? I know next to nothing about those. The device uses an ARM based NXP i.MX28 application chip - the square one above the LCD connector. The two larger chips on its sides seem to be memory. I could not locate an UART chip.

Again - what's the process of finding a serial port, or determining that one does not exist.
Thank you.

tjk

[bitwelder]

For a serial port, I'd look for a group of 4 pins/pads [VCC, GND, RX, TX] of the same size (not necessarily ending with a connector, they could be also just pads to be contacted by pogopins). Also, I wouldn't expect them too far from the micro-processor/-controller.
For example, on that board I'd take a look at P4 (the 4 exposed pads next to connector P3)

[nvmR]

Following up on bitwelders answer, taking the unpowered board, take a look at where p4 goes using a dmm in short mode. It may go to unpopulated devices which are not placed in the production board (to save money).
You may need these unpopulated devices.
A clear giveaway of a serial port is an RS232 converter device (which usually has some caps around it)

The next step after blindly poking around is to look at the pinout of the MCU and try to find the UART port, and follow the traces. (Pro tip: there may be more than one).
A final calamity might be that the UART is enabled/disabled by a pull up which goes to an IO which is detected by SW.

happy probing!

[tjkolev]

bitwelder,

I forgot to mention, that I already tried those P4 pads before posting. Nothing. This thermostat is offered is several versions. Some can control additional equipment like humidifier, boiler, etc. I'd say those pads are for the extra prongs (that plug into the wall plate) to control that equipment. But right - they do look very much like a serial port quartet.

nmvR,

The P4 pads have short traces to the north (per my first photo), then they go on the other side and connect to the unpopulated pads for R1010 - R1013 (NE of the wifi chip). Those (missing) resistors are then connected back to component side to D16 - D19, which is where some transistors would be. There are a quite a few unpopulated pads in that area - the U16, U20, and north of that.

Per the microcontroller's datasheet it has 4 UARTs. And another DEBUG UART. But there's no way I can follow the traces for that.

I am at my limit for the time spent on chasing this... 

Thank you both for your comments!

tjk

[geggi1]

Start looking at the datasheet on the MCU and see if you manage to follow the traces form the serial port pins.
Another place to look is on all popolated and non polpulated headers.
You could start looking for the gnd and the 5v (possible 3v if its 3v logics) these can most likely be any gnd and 5v on the PCB.
If you got a scoop you can look for signals that is a stream of square waves .

[Renate]

P1 (in the lower left) is a JTAG 10 pin connector with those little alignment holes for a plug.
I'd check the jack adjacent to it for factory test with a serial on it.
Just power the board up and look for console spewing.

[tjkolev]

I spend some more time based on the suggestions provided. No luck. Could not find any "data" signal. Just flat levels. I would not be surprised if the company has implemented some "protection" against attempts like mine. For example jumper-ing some pins to enable serial output.

Oh, well - I can't allocate any more time on this endeavour.

Thank you all for your tips!
tjk

[DavidAlfa]

UART is low-level active. So Tx should show 3.3V/VCC when idling, I'd start by marking the pads having voltage.
Then the best option would be to attach a oscilloscope to one of these pads and turning on the board.
Wait 5 seconds, if nothing comes out, clear the mark from that pad and test next one.
It takes a while, but there aren't so many pads.

[LateLesley]

I echo geggi1's suggestion of looking for the MCU datasheet it can offer clues of where to look.
https://datasheet.octopart.com/MCIMX283DVM4B-NXP-Semiconductors-datasheet-82996223.pdf

In this case it has 5 serial ports, and a debug port.

It might help you trace where the port is. (have a look at page 2/3 for UART/DEBUG details, and 62/63 for pinouts. )

Also, another thing to watch for is the ports might have jumpers/resistors on the traces to the port which are removed during manufacturing, which might need reinstated to get the port operational again. I've seen this inside some routers.

EDIT : I also just found the JTAG is disabled unless you enter a "special boot mode"

https://community.nxp.com/t5/i-MX-Processors/How-to-use-the-jtag-on-the-i-mx28/m-p/625633

https://bootlin.com/~maxime/pub/datasheet/MCIMX28RM.pdf (page 950-951, looks like you'd have to manipulate LCD DATA pins. )

[DavidAlfa]

Being bga, the pinout won't help much, you can't trace the pins unless you lift the CPU or have a x-ray machine.
Any trace could go anywhere under it.