How to probe a protocol having DC power over the bus pair ? - Page 1
Forum section: electronics / beginners

author: testman314
author_rank: Newbie
timestamp: September 22, 2023, 08:57:44 pm
content: Hello,I am trying to reverse engineer a protocol that is using a 19.67V DC powered bus pair with modulation of around 350mV peak to peak for the initial part of the protocol (272mV for idle case and 312mV for reset case).I own a SDS1104x-E, a DP10013 differential probe and a USB Logic Analyzer 24MHz/8-Channel.Trying to analyze the signal using that scope was not an easy task for me as I always end up with huge DC offset that moves and there are no protocol in the scope that I can customize in order to bring some meaning to the traces. I can do captures but not found a way to do precise data capture to perform frequency analysis and timing analysis out of the scope.Using the differential probe was even worse as here are lot of noise and the protocol signal itself that I can see in the scope with a regular probe is now lost (SNR issue ?).I was thinking of probing using the USB Logic Analyser but the DC range is not matching (around 20V in the protocol instead of around 5V as a start) and understanding that the DUT is pluged on the 240VAC live, I am a bit eager to plug a USB Logic Analyser into a PC.I am not looking into the reversing the complete protocol. Only a reset sequence of that protocol that is using an alternating two frequency signal 40Hz to 70Hz instead of the basic idle at 45Hz to 65Hz.Protocol is used by this famous european room manufacturer to segregate between old way of controling the windows/blinds using a +24/-24V DC and the new way of controling them using a proprietary protocol that has security thru obscurity and is mostly compatible only with the product from the same manufacturer at a quite premium cost.Here are my questions :- What is the best solution to probe such a signal using the tool I own ? I thought using a simple voltage divider, but I am not sure it is safe for the computer behing the USB device.- Which tool would you recommand me in order to perform the analysis of the reset sequence described ?Any ideas are welcomed.Best Regards,TM

author: ledtester
author_rank: Super Contributor
timestamp: September 22, 2023, 09:08:37 pm
content: Quote from: testman314 on September 22, 2023, 08:57:44 pmHave you tried AC coupling?

author: Doctorandus_P
author_rank: Super Contributor
timestamp: September 23, 2023, 12:15:35 am
content: The simplest is starting with reverse-engineering the hardware. Your gadget probably has some circuitry to translate between the signals you see on the DC wire, and some microcontroller pins. With a bit of luck, you can then just tap off the signal with your Logic Analyzer from one or two of the microcontroller pins.If you don't have access to the hardware, then build a de-modulator yourself. You are likely to need that anyway when you are further into the reverse engineering process, so why not simply start with the demodulator?

author: testman314
author_rank: Newbie
timestamp: October 03, 2023, 10:47:47 pm
content: Thanks Ledtester, using the AC coupling clearly helps. 👍I am now able to get better captures. But I am still wondering how to capture the protocol to have a more "long term" analysis out of the box.I am detecting an idle around 280mV peak to peak with a sawtooth descending signal of around 30Hz to 40Hz. But the signal frequency is slowly moving on a cycle basis.When I am pressing the reset button for some second to trigger the hard reset (and client device register phase), I can clearly see the sawtooth descending signal evolving to 320 mV peak to peak but having a dual alternating "tone" with two frequency I can not manage to mesure.Thanks Doctorandus_P, for the ideas. I don't expect now the MCU pin to get a better signal. The device is quite simple at the analog level and designed on purpose to make it very simple/cheap and efficent to be mass produced.This DUT is a controler of for simple "home appliances" of a famous brand in Europe for such kind of "appliances", the hard reset enable reregistration of the client devices (motors) with the controlers. The controler has two way to control the motors, one basic and one "smart". The smart is out of scope and the signal I can see at this time is the "basic" (say legacy) signal that I am trying to understand and woul like to replicate later on.How to analyse the Idle sweeping cycle to find the pattern and the dual tone pattern for hard reset ? I do not have found a way to get huge raw data out of the osciloscope to to use something like scilab to find the trend.

author: Infraviolet
author_rank: Super Contributor
timestamp: October 03, 2023, 11:57:49 pm
content: Huge DC offset...I don't know about or your scope specifically, but on a Tektronix TBS1052C (the oscope I have to hand), there are menu options which let you handle an ofset in diferent ways. You can move traces up and down in terms of screen divisions with the hardware knobs, it wouldn't work for your cases as this method is usually restricted to going up and down by one screen's worth, which means you couldn't move far enough when the volts per div was set to make 350mV nice and visible. But hidden in menus there's a way to offset by voltage which can take you faroutide the screen's limits, I'd be able to view a 350mV signal at a nice scale with offsetting of 20 or so V with that method. Does your scope perhaps do that too?As for AC coupling, remember you can both try it in your scope's settings and by running a capacitor from the trace under test from the signal carrying power rail to your scope's input.For analysing larger data sets you probaby want to design a PCB, or set up a breadboard, with circuitry to handle the DC offset in circuit and then amplify the 280mV up to enough volts to reliably control logic level inputs*. Then you could feed this to an arduino or some other microcontroller which you can connect to the DUT and have output serial data to your computer. You can have a python script running to collect the serial data and dump it in a text file for later analysis.*from your description I'm not sure if there are deliberate analog sawtooths going on, or if those are just tolerated aretefacts of the circuit the device uses for sending purely digital data, but if you amplify linearly with an op amp you can always route these signals to an ADC on a microcontrolelr and log those at various intervals as well as logging digital data.

author: BillyO
author_rank: Super Contributor
timestamp: October 04, 2023, 12:12:35 am
content: Quote from: testman314 on October 03, 2023, 10:47:47 pmYour scope is capable of capturing 14,000,000 points of data.Set up your scope so that you can clearly see the signal you want to capture. Set the trigger to fire on that signal. Set your trigger mode to "single" then zoom out until the horizontal information tells you you are at 14M pts. Then initiate a single trigger by hitting the "Run" button. Now you can zoom in to any point along the data you captured.There is also 14M pts, of history being captured all the time.History browsing and single event capture are both covered in your owner's manual.

author: testman314
author_rank: Newbie
timestamp: October 07, 2023, 12:03:29 am
content: Thanks Infraviolet, they are deliberately generating descending clean sawtooth. Some little artefact before and after the rising but the slope is clean.For capacitor, I was thinking something like that but had no idea what is the kind of capa rating is prefered for such a case.The almost 20V offset is approaching the limit of the offset I can set in some range, and it is just a massive pain as the offset somehow is reseted when changing any setings like H or V. I have tried to find a fixed offset in the settings but without much luck. Following your advice, I will have a second look.Thanks BillyO, this proved to be the way I was looking for. Now I need to find a way out to export those data... It tried the VXI11/Visa but I am stuck into the read of raw Siglent native data format. Event the Siglent tool does not seem to export raw data but a raster image rendring of it. Just surprised that the business case "give me my data" is not an easy way ... I tried to find an existing tool that will prevent me to do some dirty python code, but without a chance. I will dig further for the days to come and keep the thread updated.

author: testman314
author_rank: Newbie
timestamp: October 09, 2023, 12:24:24 am
content: After updateing my SDS oscilloscope to the lates firmware I was able to save the sample data (a CSV sample serie is attached as a zip archive).Direct recording usingg VXI11 from Pulseview is working from time to time but failing most of the time for unkown reason. So best way was the data log feature.I have tried PulseView to analyse this (import from CSV is working, but exporting to anything or saving is crashing btw) but I was not able to find any function to get rid of the sawtooth signal.I thing this signal act like a carrier signal for an amplitude modulation, but as I can see some frequency modulation as well, there might be some PWM down there.Anybody have an idea of an open/free tool to analyse a signal ? I was looking into scilab but there seem to be little timeserie functions out of the box, but sure you can code them, same thing about Octave or SageMath.

author: Infraviolet
author_rank: Super Contributor
timestamp: October 11, 2023, 05:58:37 pm
content: "open/free tool to analyse a signal "I'd say anything which can plot and analyse graphs, once it is logged as a csv file on a computer that is all a "signal" is.There are python libraries fr that sort of thing, there is the R studio package with R backend where you can load lots of stats and maths libraries, and there's Octave as the free matlab equivalent.R studio is the way I tend to work.

author: BillyO
author_rank: Super Contributor
timestamp: October 11, 2023, 06:09:00 pm
content: Quote from: testman314 on October 09, 2023, 12:24:24 amYou could use the spreadsheet in LibreOffice.

author: Infraviolet
author_rank: Super Contributor
timestamp: October 11, 2023, 10:13:03 pm
content: Personally I'd always recommend that analysing graphs is done with programming language type packages, where you write scripts commanding what to do to the data, rather than with spreadsheets. Trying anything mathematically involved with spreadsheets and pointing and clicking can get a lot more confusing than writing code to do the same. Also, R studio, and equivalents, have libraries for common and complex statistical operations already built in and usable with one line of code, in a spreadsheet you'd have to write a lot more for yourself to do such analyses.

author: BillyO
author_rank: Super Contributor
timestamp: October 12, 2023, 12:35:33 am
content: Quote from: Infraviolet on October 11, 2023, 10:13:03 pmSure, that's fine for someone that has experience writing code. Maybe the OP can, but chances are they can't. A spreadsheets may be clunky, but I'm willing to bet there are more people in the general population that know how to use a spreadsheet (they work like Excel these days) than know Python.

author: Swake
author_rank: Frequent Contributor
timestamp: October 13, 2023, 11:45:31 am
content: Quote from: testman314 on September 22, 2023, 08:57:44 pmName it.... there are quite some that fall not too far from this description. Many are documented already.Quote from: testman314 on September 22, 2023, 08:57:44 pmThese values with 2 digits behind the comma precision do not sound right. Only 300mV signal is going to be prone to interference. I think something is wrong here.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 13, 2023, 12:09:47 pm
content: Looks like a really weird protocol. Maybe it also supplies power to the device with those 19V DC?If so, 300mVpp for communication is really optimistic, expecting no ripple at all on the DC part.Quote from: testman314 on October 09, 2023, 12:24:24 amTry Flow CSV Viewer. Doesn't analyze anything but it does show the plot nicely.https://www.waveworks.dk/flow/However I'm not sure this sawtooth signal means anything. Looks like ripple to me?If it's 40Hz like you said, the scope ac copupling won't be suitable for this, use DC coupling and manually do the ac coupling with 1uF or larger capacitor in series.Why do people keep trying describing such things with words? You'd better show some pictures of the actual waveforms, including DC coupling!Maybe it's some kind of frequency/phase shift modulation? Sincerely, I don't think you can extract anything out of this.Probably your scope scale is lacking the required resolution to sample the small changes.If the 19.6V are steady, you could remove the bias using some basic electronics, then the scope will sample it a low better.