Identify protocol from logic analyzer data capture

Question

I have a EG7500DH electric heater that I'd like to sniff the communication data between the display module and the main control board so that I can eventually capture the data with an esp8266 and send to Home Assistant.

The communication port has four wires labeled VCC, GND, RX, TX so I initially thought it was probably TTL UART. I connected a Saleae Logic Analyzer to GND, RX, and TX pins but soon discovered that the signal does not seem to be a standard uart. The data has varying pulse widths that are not multiples of each other. Some of the pulses in the message are 1ms wide and others are 375us wide. Hoping someone might be able to help decode this.

display control board display board comm port logic analyzer

The IC on the display module is a Tenx TM52F0A28 however I could not find a datasheet for it to get any clues from it. The IC on the main control board is completely unmarked.

9/11/2024 Update: I created an analyzer to decode the packets based on @Jasen's response below and collected some data on the Rx and Tx channels with various settings entered through the display and also at various room temps. There are two Rx and two Tx packets sent between the two boards that repeat over and over with what seems like the first byte being an ID of some type (0xAA and 0x55). There is a strong correlation between the Rx 0x55 packets pertaining the measured room temperature but I haven't been able to decode the data into anything meaningful yet. The data is shown below.

decoded messages decoded messages (zoomed in)

Act Temp	Rx_55_hex	Rx_55_bin
80F	0x555B0C00	01010101010110110000110000000000
84F	0x553B4C00	01010101001110110100110000000000
84F	0x553B4C00	01010101001110110100110000000000
86F	0x55BBCC00	01010101101110111100110000000000
88F	0x557B2C00	01010101011110110010110000000000
90F	0x55FBAC00	01010101111110111010110000000000

Update 9/17/2024: I was able the decode the packets and break them down into commands from the display and the main control board. I was able to use an ESP8266 to decode the messages and send the parsed values to my Homeassistant home automation server. Fun project. Thanks to everyone for the help and guidance!

• Lundin: Looks quite similar to Manchester encoding - did you try that?
• the busybee: Now with Jason's answer you can record some more (different) packets and add them here. Add also the result on the display or the executions of buttons related to them, please.
• sully81: @Lundin, wouldn't the pulse width still be constant for Manchester encoding?
• the busybee: @sully81 Your doubts about Manchester encoding are justified, the signal would have differing edges in equal intervals, which is not the case. This signal has non-equal pulse widths.
• Lundin: @sully81 Yes but binary number 10 (2) will look like short low, long high, short low.

Answer 1

enter image description here

it looks like a code where where a 0 is a long low followed by a short high, and a 1 is a short low followed by a long high.

not all columns are interesting (some don't change)

 *** ***
80F 0x555B0C00 01010101 010 11011 000 0110000000000 
84F 0x553B4C00 01010101 001 11011 010 0110000000000 
86F 0x55BBCC00 01010101 101 11011 110 0110000000000 
88F 0x557B2C00 01010101 011 11011 001 0110000000000 
90F 0x55FBAC00 01010101 111 11011 101 0110000000000 

it looks like like the first interesting column is bit-reversed

010
100
101
110
111

presumably 82 would be 011 reversed (so 110 written forwards)

The bits to the right might also be part of the number (here shown in reverse order).

011010 26
011100 28
011101 29
011110 30
011111 31

So T/2-14, or possibly 11011010 etc for T/2+178

The last interesting column seems to be the same numbers but with a different offset

110000 =わ 48
110010 =わ 50
110011 =わ 51
110100 =わ 52
110101 =わ 53
so T/2+10

• the busybee: Yeah, it looks as if the bits are coded by different pulse widths. There are 33 pulses, which could be a 32 bit value with an extra bit for start, stop, or parity. The leading very long pulse might be just a lead-in.
• sully81: Yes, this looks promising! I'll review this again later and look at a few additional packets to see if I can decode the messages.
• sully81: I collected some data with a bunch of different room temps to see if I could decode the messages that change values when the temp changes but I haven't been able to decode the bits into any temp units. I added the data to the original post.
• sully81: With your help I was able to decode the data from the messages. I now have an ESP8266 that sniffs the packets, decides the messages, and sends the parsed values to Homeassistant.