Laser Tape Measure Hacking Challenge
Ever thought about hacking a laser tape measure? Now's your chance!
Have you ever played with one of those nifty laser tape tape measures, you may have thought, "Could I hack this thing..?" If that idea has never crossed your mind - well - then maybe this new tutorial (and associated incentive) will change your mind.
This tutorial, "Laser Tape Measure Hacking," comes from SparkFun CEO Nate Seidle (aka, El Queso Grande). Nate was intrigued by the idea that if he could hack a laser tape measure, it could be used in autonomous vehicles, 3D scanning, or any number of other applications. So Nate set out to hack the device. Unfortunately, he wasn't able to wrangle the serial controls and hit a wall. That's where you come in.
This is the "advice" from Calculated Industries. Helpful.
We are issuing a challenge to any of you SparkFunners out there - if you can hack the serial interface for the above Leica-based laser Interferometer (or something similar), we will give you $100 of SparkFun credit and 15 minutes of fame on the homepage (and maybe buy you a beer if we ever meet you). You'll need to document the build and provide us with the proof you did it via our project call form or by providing a link in the comments section of the tutorial.
Check out Nate's tutorial for a good start on hacking this device and the issues he encountered. Good luck!
How about setting up a web page where we can send serial commands and serial parameters and a webcam to see the results from the display and the serial port?
.
Hi, you should check out the two videos Part 1 and Part 2 of a guy who hacks a Bosch DLE40 laser rangefinder. It's fairly similar to the Prexiso X2 in terms of price and performance. The DLE40 can't be found on amazon.com but the DLR130K can be. They both look identical, the DLE40's range is 40m, the DLR130K's range is 130ft, and 40m is ~130ft so it's probably just renamed for the US market.
Have you tried the old AT command: "+++", or "AT" for that matter? Just a shot in the dark.
The site below explains how to modify a Leica A3 to build a bluetooth laser rangefinder with inclinometer and compass, primarily for mapping caves. it works by sniffing out the simple standard 'SPI connection between the Disto’s CPU and display'. How hard is it to sniff this kind of thing out? I've never done anything like this before and can't find much info so really have no idea..
http://paperless.bheeb.ch/download/DistoX.pdf
Have a look, see what you think. Is it easily done?
This year, the popular Russian magazine "Radio" (something like "Make") published my article about hacking the laser rangefinder. On-line article is on page 33 (see the link below). It's in Russian, but the illustrations help to understand the topic. In brief: information about the distance is obtained by analyzing the data sending to the LCD display. Good luck!
http://issuu.com/gloria_gl/docs/radio_04_2011?mode=a_p
any chance we could have a copy of the original text to run through google translate? would be really appreciated!
http://www.shareforweb.com/file/jOkLpvc_STEtIGVLwM1hswBB/%D0%A0%D0%B0%D0%B4%D0%B8%D0%BE-4-2011
You can try this link (page 33).
Here is the modification done to a Leica Disto A3 http://paperless.bheeb.ch/download.html
The Bluetooth Serial Port Profile is the communication method.
Perhaps hacking a Leica Disto A6 with Bluetooth data transfer and sniffing the data would provide necessary details about the communication protocol, although it has a heftier price tag.
Very possible Leica locks out serial data transmission on purpose and only use the serial lines for QA.
I wonder how many of the Leica units have been sold due to this challenge!
Here is another two devices - "doppler speedmeters" - How wheels radar gun - http://www.edparadis.com/radar/ and pocket radar http://pocketradar.com/ which are just asking for such serial hacking :-)
I opened up a Stanley FatMax a while back. I poked around on the connector between the main circuit board and the measurement head. Here is what I found starting with connector pin 1 as the one nearest the edge of the board....
(1) - 4v power I think (2) - looks low (3) - low (4) - 3.4v 5.0 mhz after shot, 10mhz before shot (5) - 10mhz before shot, 5mhz after. AC coupled 200mv or so (6) - 50 uS low-going pulse on trigger (7) - looks like serial clock pulses - 24 pulses multiple times during measurement (8) - ground i think - connected to pin 3 (9) - looks like serial data pulses (10 - seven pulses, 12.5ms long at 50ms intervals (11) - looks like constant 1 volt (12) - 18 pulses 2.3ms long, about 4ms apart. missing pulse after pulse 2 (13) - 3.6v whenever power is on (14) - 3.36 v normally, but dips very slightly, apparently as the unit seeks distance (15) - powers up during measurement, powers down with slight decay after more or less 1/2 second (16) - gnd (17) - complicated - initial pulse from 1.7 up to 3.6, then series of 7 up down spikes (18) - even more complicated
I didn't have a logic analyzer at the time, so I didn't go any further with it, but pins 7 and 9 look very promising to me.
I focused most of my time on those data pins (7&9) but the data never changes and I became convinced that they were part of the laser pattern and did not contain range data. I could be wrong.
-AR
Really? That is surprising. And confusing. And disappointing.
Also, on segment decoding - I have been tempted to do this with a device or two but stay strong and find a less hackish solution. It's worth it!
Ordered my Prexiso X2 just now; it will arrive Friday. Here's to hoping someone doesn't beat me to the hack!
Try TXing on the RX line. I do a lot of serial coms and I've never seen this, but I also do a lot with chip design and pins cost money. If you were setting up a calibration station one bi-directional pin per unit would be cheaper and easy to do..... Just an idea.
The "DistoX" (Information here: http://paperless.bheeb.ch/download.html ) does/did close to what you want via LCD decode. I have a Stanley "FatMax" Laser range finder (Same basic Leica guts) that I took apart a year ago to do the same thing but finally gave up after a few weeks of trying.
You may have to power up the unit with one or more pins pulled low (or high) to activate the serial input port...
Is there a way others of us can sweeten the pot for the person that cracks this?
I posted this earlier but for some reason it posted in a random spot on the page and don't think Nate saw it. So here goes again.
I found something interesting that may be of use. http://www.engineeringsurveyor.com/software/tps-dna-online_v114.pdf and the site I found it on with links to a bunch of user manuals. http://www.engineeringsurveyor.com/utilities/#Leica_Programs
Leica makes these TPS Total Stations and Digital Levels and provide the commands to interface via serial commands on purpose. If I was a betting man I would say they possibly use similar command structures across their systems to keep things easy. I also looked for the '?' char in the document and found it showing up as the response from the unit which was VERY promising. They use a combination of GET, SET, PUT and CONF commands and they use slashes between commands which is kind of odd. I bet you might be able to come up with some combination of commands based on that structure that would get it to spit some data back to you.
Such as some of the CONF commands can set units, date and time, rounding, baud rate, parity etc... and those seems like something that would be from a standard software base possibly.
Unfortunately, I don't have the time to buy the unit and try this out for myself but hopefully this gives you a new direction to look. Have FUN!
Thanks for linking to these datasheets! I have seen them and some others from Leica. The ? is so common through them all it's painful! I have sent a\r\n (turn unit on) and b\r\n (power down) with no response from the unit (and no physical response either) so I am still left scratching me head...
hmmmmm have you tried changing the Baud rate or contrast of the screen via commands? Did you put put slashes between the commands like the data sheet? ie CONF/30\n\r which would return the beep setting of the unit?
Looks like this would give you the data you want, but not via the serial port, looks like it decodes the screen data.
Very cool! Someone has obviously had a similar problem and jumped straight to segment decoding which is a great way to do it. I'm still tempted to hope for a serial port solution. This is great to see tho - I completely missed that other connector footprint on my board (pins connect to the button pad area).
Also cool is that the Fluke 411D internally looks exactly like your Prexiso ... from the IC layout to the screen icons. I found the Fluke for sale in Boulder, so I might get that and chance it.
Huh, interesting... After also failing to gain serial control of a unit I started to go the route of decoding the LCD mux lines, until a slip toasted a mcu output to the LCD in a critical segment. Cool someone makes a board that does that now! Good luck to you all!
I have a embedded protocol analyzer. If I had one of these devices it would be pretty trivial to reverse engineer the commands.
The trick is to send a command in the first place. You can't reverse engineer them any other way than trial and error. You have to keep poking until something happens. Anyway, I know many devices need to recieve a sequence prior to emitting the "?" to get them to talk to you in their diagnostic/set-up mode. e.g. an X-Port needs xxx. At a higher level of hacking... the easiest way to make a LRS is to modulate the beam and look for the phase shift. The transmit and recieve pulse trains should be discoverable and intercepted to roll your own distance estimates.
then get one if it's so trivial
You'll probably have much better chance getting to talk to an engineer if you go to their R&D office in person. For an undergraduate senior design project, I went with a group of students to a local company (Invacare) and we got to talk to engineers and they gave us free parts. We had no luck getting any information from them over the phone or email. We decided to come to the main office, and we scheduled a meeting with them within a week. So, just go there and say you're working on a senior design project or a thesis.
It looks like their R&D office might be in Westford, MA. If somebody from the community lives there, they might be able to talk to them and get some technical details.
http://www.leica-geosystems.us/en/Leica-Geosystems-Offices_54176.htm
Good luck!
Years ago I purchased a bunch of ICL 9520 VFD displays. 8031 based Point of Sale display. With some trickery I was able to dump out the internal ROM and disassemble it. Say several tricks they did, like reversing the traditional roles of the 9th bit used for multiprocessor mode. They also send a 0xE0 between each byte, but even with this knowledge I still couldn't crack the POSLan protocol, as I later found it to be. A google search turned up a resume of one of the team members who worked on the 9520. He replied to emails and made an attempt to see if the protocol was no longer proprietary, but alas it was, so he was unable to forward any information to me.
Here is <a href='http://www.amazon.com/gp/product/B001U89QBU/'>a cheaper meter by Bosch for only $82.77</a> Also sold on Amazon.com
So I'm thinking this isn't an "interferometer" which measures relative movement at very high accuracy - and is used for listening to Osama Bin Laden in his Pakistan-provided villa; rather, this uses time-of-flight measurement to estimate absolute distance by averaging many round trips. An interferometer requires complicated optics and a simple circuit - whilst time-of-flight relies on simple optics and wicked fast electronics.
Dude, B.L. is dead. Reason: Ninja (looking forward to killing you since 2005).
Would love to have seen guy that read the email's face - would have been classic!
Also... look at Parallax Laser Rangefinder
I'm surprised no one has suggested using a logic analyzer to identify when commands are sent/received on the line.
I actually used the Logic analyzer from Saleae extensively! Have a look at the tutorial and let me know if something doesn't make sense.
I'd more than gladly try and hack it, But the price tag for the meter is a tad bit to high....
Wait.... Why are you trying to interface to the MCU?
My solution: Hook up a MCU (And perhaps a Oscilloscope) to the range finder, not the other way around. Reading direct raw values should be easier than attempting to figure out a serial protocol.
Not casting any doubt on your engineering ability Nate
but
where is David Carne when you need him? ;)
Oh that hurts :)
David did win the cell phone camera contest! I had forgotten that.
I'm around ;). I'd look @ the LRF but my "todo" inbox is more of a heap than a neat pile.
Also; Nate's a pretty smart guy. I'm not sure I'd be any better at blindly poking at the serial port than he'd be.
Dont worry about it. It feels like a long time ago that David was helping me answer tech support calls....
I'd love to know if some one can crack Leica's serial output. I spent 6 months trying for my thesis:
http://www.dtic.mil/cgi-bin/GetTRDoc?Location=U2&doc=GetTRDoc.pdf&AD=ADA524323
I was getting data out but I couldn't make heads or tails of it.
Nice thesis. What did you do to get it to send data out?
The model I had could output continuous data to the LCD screen. I would read the TX pin of the Leica chip (which I'm pretty sure is a re-stamped Atmega) but I couldn't decode it. I had to read the LCD screen and manually enter the measurements once the computer aimed the laser at a feature.
Got an example of the serial output? I know at least one format but it is fairly straight forward to decode; perhaps you have a different format.
I might, it was over a year ago. I'll have to look on my old computer, but the format was anything but staight forward.
Maybe we should write a Perl script to sort of "attack" the device with all possible character combinations over serial. Sort of like those dictionary attacks (http://en.wikipedia.org/wiki/Dictionary_attack). We can automate this process and check if the device responds to any string of characters - an electronic form of criminal interrogation if you will !!! The poor meter would definitely break and let out its secret!! Could be fun :)
And if that doesn't work, let's just use <a href="http://xkcd.com/538/">alternate methods</a> on the device itself.
ROFL!!
Being able to use on of these sensors would be great (so keep it up). But what we really need is to get a hold of Neato Robotics "Revo LDS" sensor (http://www.hizook.com/blog/2009/12/20/ultra-low-cost-laser-rangefinders-actualized-neato-robotics). Just if Sparkfun could contact them and resell their sensor. I talked to Neato at CES this year and it seemed like sharing their sensor was not on their minds at that moment (with the whole getting your company off the ground thing). But maybe Sparkfun could convince them…
We did contact Neato in hopes of convincing them and they gave us the cold shoulder. I don't know enough of the right people there to show them the potential.
Unfortunately not everyone understands the potential size of the alternative use market. I wonder how many more Kinects get sold independent of an XBox. I suspect the number is not trivial.
I agree! I think a lot of companies should be more aware of the size of the hacking community and it's potential market (eg Roombas). I have a feeling some candy companies may have picked up on the popularity of MintyBoost and the corresponding increase in Altoids tin sales, because I am seeing similar tins popping up.
Prexiso obviously doesn't realize the market value of letting people reverse engineer/hack their device. Ironic, no?
My issue is the $100 price tag to buy the laser. Sure we get a $100 Sparkfun credit for getting the job done, but we're out the cost of purchase, plus hacking expenses...begins googling for a cheaper source
Right - sorry, I'm not trying to break the bank for anyone. Mostly I wanted to gather information from other folks who already have begun hacking laser tape measures to let us know about their successes or failures.
I'd like to try, but I can't afford the shark, let alone the "laser".
Can you post a link to the product you purchased? Just to make sure we order the right part to try a hand at this.
The one Nate hacked is this guy - the Prexiso X2 3350
It says "1 used from $89.91". Nate, you aren't fooling us. We know thats you out there trying to sell it back.
Hah! I promise not to resell it. At least on Amazon :)
Intriguing... Obviously Calculated Industries doesn't feel like they have a quality product. Perhaps it should be opened to any laser tape measure on the market.