3 Bus intercept hardware and logic analyzer connection
In order to analyse the data comm protocol in detail I need to be able to separate the Tx and Rx directions of both channels, clock and data.
My first idea was to connect two line drivers back-to-back and have one of them be the optocoupler version with separate Tx and Rx. This failed because
- when the line drivers are connected back-to-back, the special logic levels that prevent feedback and bus lockup also ensure that the signal output of one (Sx, Sy) is not recognised as input by the other (Sx, Sy) -- so signals are not propagated.
- altough Tx and Rx are apparently separated, this circuit does not prevent the output being recognised and fed back as input, so is of little use.
The design finally adopted is a special combination of two P82B96 chips connected one after the other. Inputs and outputs all use Vcc=15V*.
I assembled these on one board complete with pullup resistors, voltage dividers to provide 3V3 signal levels to the logic analyzer, and a 10-pin box header to connect directly to the logic analyzer interface with a ribbon cable rather than fiddly probes etc. I also included plenty of Test Point eyelets to easily connect an osclloscope or voltmeter.
- *Note: an alternative design would be to pull up the four logic analyzer sample lines - Tx, Rx, Ty, and Ry - to a 3V3 power supply, but I found it simpler to use four potentiometers as voltage dividers rather than add a power regulator to my board.
I use a generic unbranded Chinese 8-channel logic analyzer interface together with the Sigrok Pulseview (free) software running on an iMac. I use channels 0, 2, 4 and 6 simply because these are the easiest to wire up on a prototype board. (Ch 1 is linked to Ch 0, 3 to 2, 5 to 4, and 7 to 6 for the same reason, but the odd channels are not used).
Initial results confirm the first oscilloscope tests. Data is transmitted in 8-bit packets with no ACK. Lines are normally high. The data line is pulled down to start a new package. The clock appears to always come from the controller - so far I have not seen any signal on the Clock Rx channel.
My "reverse-engineering workbench" now looks like this ...
If you find any of the ideas in this repository useful, please Buy Me a Coffee