Wouldn't RS422 need 2 TX and 2 RX?
1 is RS422 B
2 is RS422 A
3 & 5 - GND
4 & 6 - VCC
Not sure what 7 and 8 do.
I got inspired, and have plugged in my scope, and then an RS422 to serial adapter, and I'm getting XML encoded (weird) CAN messages, which I presume are the same as what's on the CAN bus exposed on some of the control box's ports. I'll get out the can analyser tomorrow and check.
Now the trick will be to reverse engineer this protocol. Here's a tiny sample:
<U>setCAN 0201000000236000000000000 </U=ce><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <U>setCAN </U=b2><U>getCAN 1 </U=00><U>Ping</U=db> <U>ackCAN 1</U=aa><U>Ping</U=db> <string name="parse_block_tag_ping"><U>Ping</U=db></string>
...
private static final byte[] f2305f = "getCAN ".getBytes(Charset.defaultCharset());
private static final byte[] g = MyApp.a().getString(R.string.parse_block_tag_ping).getBytes(Charset.defaultCharset());
private static final byte[] h = MyApp.a().getString(R.string.parse_block_tag_startu).getBytes(Charset.defaultCharset());
private static final byte[] i = "<request>Unknown</request>".getBytes(Charset.defaultCharset());