Decoding (reverse engineering) an unknown serial communication - Page 1
Forum section: electronics / general

author: crispus
author_rank: Regular Contributor
timestamp: September 27, 2024, 07:59:49 pm
content: Hello everyone,I'm trying to read the communication between 2 modules from my Mitsubishi Pajero 2007, between the audio system and so called "centre display" where the audio info is displayed (radio station, CD track, etc). The communication is on a single wire, one direction only: from audio unit to the display.According to the service manual:QuoteThe audio unit has aM16C/62P MCUthat on pin 29 sends the data to the display, and they say it is basically a 5V uart. On that pin, the MCU datasheet say that uart tx, SDA and GPIO functions are available.Now, I captured the data at the MCU pin and that looks like a 5V uart on some places, but I can't figure out when it is serial communication and where some free style GPIO:I attached the capture as well (it's a sigrok capture renamed as zip in order to upload it here). WDYT, is it UART and I did not find the right configuration (baudrate, stop bits, etc.) or some free style GPIO? Any hints are highly appreciated.Thanks!

author: Benta
author_rank: Super Contributor
timestamp: September 27, 2024, 09:42:22 pm
content: For this application and single-wire, I'd suspect LIN.https://en.wikipedia.org/wiki/Local_Interconnect_Network

author: m k
author_rank: Super Contributor
timestamp: September 28, 2024, 08:14:27 am
content: Stack those packets.All seem to start equally.

author: crispus
author_rank: Regular Contributor
timestamp: September 28, 2024, 10:40:18 am
content: You're right:Code:16 16 02 A0 A0 A2 C2 81 A2 A5 0316 16 02 A0 A0 AA C3 80 A0 A0 A0 A0 A0 A0 A0 A0 A2 AD 0316 16 02 A0 A0 AD E1 80 C3 A8 AD A0 A2 A0 A0 A0 A0 20 20 A6 A816 16 02 A0 A0 AD E1 80 B3 A0 A0 A0 AB A0 A0 A0 A0 20 20 A4 AC 0316 16 02 A0 A0 AF E1 80 C3 A7 AB A0 A2 A0 A0 A0 A0 20 20 20 20 AA A7 0316 16 02 A0 A1 A0 E1 80 A3 A6 A8 A0 A9 A0 A0 A0 A0 20 38 37 2E 35 AE AE 0316 16 02 A0 A0 AD E1 80 C3 A9 A6 A0 A2 A0 A0 A0 A0 43 54 AB A9 0316 16 02 A0 A0 AE E1 80 A3 A0 A0 A0 A0 A0 A0 A0 A0 46 4D 31 AB A6 0316 16 02 A0 A0 AD E1 80 A3 A8 AC A0 A9 A0 A0 A0 A0 4D 48 AA A3 0316 16 02 A0 A0 AC E1 80 B3 A9 A8 A0 AB A0 A0 A0 A0 5A A7 A6 0316 16 02 A0 A0 A2 C2 80 A2 A4 0316 16 02 A0 A0 A3 E3 80 80 AC A6 03 03I chose an arbitrary baudrate (even though I know it's not the right one) but I can see some patterns. Also, I think I will try to replay these captures, and make minor alterations to see what's what... Thanks for the suggestion.L.E: I probably spent way too much time to find the uart config while it might turn out it is not an uart after all...

author: neillnz
author_rank: Contributor
timestamp: September 28, 2024, 10:59:18 am
content: Can you use the hardware you have to zoom in on the bit stream and measure the width/time of one bit? Keep scrolling though until you find the narrowest 1 or 0. 1/bit = baudrate, for example if the width is around 8.68 us 1/.00000868 = 115.2k baud.The datasheet for the MCU should have info about the UART. Most likely it will have the usual options of 7,8 or perhaps 9 data bits. There must always be a start bit(low) followed by a number of data bits, then an optional parity bit and lastly 1 or 2 stop bits(high)That MCU summary sheet you linked to mentions that is has a "CCITT CRC calculation circuit" so keep that in mind when analysing frames. Since it has that feature there is a good chance it has been used.

author: crispus
author_rank: Regular Contributor
timestamp: September 28, 2024, 12:33:58 pm
content: I could have sworn that I had already tried this. The narrowest bit is ~70 us --> 14200 baudrate. Probably I didn't checked for this baudrate the parity bit as well.So, baud rate 14200, 8 bit, parity even, 1 stop bit and it works: I have now the audio unit sending the data to a usb-uart adapter rx --> python script to send data back --> adapter tx --> display and it works!With these settings, PulseView is happy as well!Thanks @neillnz!

author: Nominal Animal
author_rank: Super Contributor
timestamp: September 28, 2024, 12:47:19 pm
content: Quote from: neillnz on September 28, 2024, 10:59:18 amSome hardware also supports 1.5 stop bits, which can throw one off if looking for the shortest low pulse (for example if one is making an automatic baud rate detector using state duration histogram; especially so when there is no parity bit, so one can be confused about the 1.5× wide state at end). This is just a tidbit to consider when looking at the bit durations, though.Also, in some cases the signal can be inverted. I myself did this when using (similarly one-directional) UART over TOSLINK – which works surprisingly well for inverted signaling at high baud rates; IIRC I used 1Mbaud –, to get a lower LED duty, although you do lose carrier detection then.

author: crispus
author_rank: Regular Contributor
timestamp: October 04, 2024, 01:11:57 am
content: Thanks to you guys, I was able to reverse partially (work still in progress) the serial format:Thank you, all!