Laser distance meter hack has a description of several pads on the main board.

Description of pads on main board. Origin

The keypads on my device main board are different to the description above.

Keypads on main board. No all keys available.

Debugging pads on the main board backside providing acces to the STM32 SW debug port. I tried with an ST-Link V2 just to find the chip being locked in protection level 1. So one can not read the firmware. However, there are two chips missing on the main boards back side. So I probed the with an oscilloscope. Found three pins with activity on which is an unidirectional SPI bus.

Missing chip pinout for data bus.

Details about the bus that I found so far:

Single 68 bytes frame.

Single frame length 16.6ms.

Frames with 2Hz rate.

2Hz frames with additional frame right after measurement end.

Two consecutive frames after measurement.

Start of frame with first three bytes.

  • Signal level is 0V to 3V.
  • Clock frequency 37KHz.
  • The are 8 long clock pulses and one short pulse for each byte. Data is LOW in first, second and third byte of each sub-frame during this short pulse (byte data is a command). For any other byte in sub-frames DATA is HIGH during this short pulse (byte data are LCD symbols).
  • Data sampling at rising clock edge.
  • Bit order seems to be MSB first.
  • CS signal (D2 in above plots) is high when bus inactive, there is a short strobe pulse at the end of each byte.
  • In continuous measurement mode the main frame is randomly split and the 17 bytes sub-frames are transmitted with a pause in between. Obviously a timing issue when the controller is busy while measuring distance.

First byte of frame.

Leave a Reply

Your email address will not be published. Required fields are marked *

Comments will be moderated! Spam deleted immediately!
Before you submit form:
Human test by Not Captcha