Reverse Engineering to Emulate Ink Cartridges for a Epson Printer

Step 2 Signals

Now that I know the signal names, I wanted to see what the signals themselves looked like.
I got out my soldering iron, a ribbon cable (used to be an IDE cable from an old computer) and a craft knife. I cut 6 wire wide ribbon cable about 30cm long, stripped the ends carefully using the craft knife (a lot easier to use a craft knife to strip a ribbon cable than a pair of clippers or pliers), and soldered them onto the circuit board that mates with the ink cartridges.
I also stripped the other ends and soldered on some pins so I could plug them into my logic analyser.

After plugging in the logic analyser into the circuit board and having a look at the signals, I found that immediately the SCK, SDA look nothing like I2C, I’m pretty sure that Epson must have invented their own serial protocol for talking to the EEPROMs inside the ink cartridges.

What I found is that CVDD gets powered up and shortly after, CRST and CSDA go up at the exact same time shortly followed by CSCK which pulses. CSDA changes on the Rising Edge of the CSCK and I’ll assume it gets read on the Falling Edge.
CSCK is Serial ClocK
CSDA is Serial Data
CRST is Reset
and CVDD is the power
Looks easy enough but I wanted more information about this protocol, were there any addresses being sent?

I turned up the sample rate on my logic analyser and found that there are 4 clock cycles, a pause, then 8 cycles, pause, 8 more and so on. The 4 clock cycles at the beginning gave me the idea that the first four could possibly be a 4 bit address of the ink cartridge. Still a lot of information was unknown about this protocol. So I did some research!

Googling around found nothing about this protocol, the next best place to look was in patents.
Yes, patents, I searched for "Epson SDA SCK RST memory eeprom" on http://www.freepatentsonline.com/   and one of the patents I found (US7660008 ) contained exactly what I was looking for. It outlined the SCK, SDA, RST and VDD of the protocol.
I’ll save you the hassle and point out what I found:
1. Flow chart diagrams describing what the Host and Slave does
2. A timing diagram of the protocol
3. The first 3 bits are a 3bit address followed by a Read/Write bit (Read = 0, Write = 1)
4. The address counter always starts at 0x00 and increments by 1 every clock cycle (This must mean it writes in bits, not bytes)
5. The moment RST goes low, the EEPROM stops everything and resets itself
6. There are 252 bits to read, the last 3 bits (actually they’re at the start) is the address of the ink cartridge.

Using what I had found, I decided to start writing code