Hackaday.io has a description of several pads on the main board.
The keypads on my device main board are different to the description above.
Debugging pads on the main board backside providing acces to the STM32 SW debug port. I tried with an ST-Link V2 just to find the chip being locked in protection level 1. So one can not read the firmware. However, there are two chips missing on the main boards back side. So I probed the with an oscilloscope. Found three pins with activity on which is an unidirectional SPI bus.
Details about the bus that I found so far:
- Signal level is 0V to 3V.
- Clock frequency 37KHz.
- The are 8 long clock pulses and one short pulse for each byte. Data is LOW in first, second and third byte of each sub-frame during this short pulse (byte data is a command). For any other byte in sub-frames DATA is HIGH during this short pulse (byte data are LCD symbols).
- Data sampling at rising clock edge.
- Bit order seems to be MSB first.
- CS signal (D2 in above plots) is high when bus inactive, there is a short strobe pulse at the end of each byte.
- In continuous measurement mode the main frame is randomly split and the 17 bytes sub-frames are transmitted with a pause in between. Obviously a timing issue when the controller is busy while measuring distance.