I saw this on Amazon, this seems like it would be easier to hack... "Prexiso AG iC4 Laser Distance Measure Connector for iPhone 4 or iPhone 4S"

Another thought. You're thinking that 8-pin connector would have a cable attached to it for debug or communication. A lot of our debug cables will ground a pin when attached, to signal the micro that the cable is connected. The firmware then responds to commands from the cable. Any of those extra connector pins head back to the micro and has a pullup resistor on it?

I'm really surprised you didn't hang the logic analyser off of the RX pin and capture the data coming into the chip from the laser that way while the unit was used as normal. Or am I missing something?

So I've been searching for days and finally came across this laser rangefinder module. This is exactly what I have (personally) been looking for. Maybe it will work for some others out there. Either way, check it out:

http://www.egismos.com/index.php?route=product/search&search=Laser%20Rangefinder

In case the link is broken or anything, look up: Laser Rangefinder RS232 There are 3 versions: 30m, 60m and 100m.

I got across this project and red it. I am new in electronics but I can not figure out why you did not decided to hijack the photo ic output before the microcontroller chip reads it. I will guess that it is an analog signal that is feed. Well you guy know how a photo ic signal work. Can you please let me know why you did not go that rut? Thanks for the time you put to this project and to my post. Mingo

An add-on interface board for a similar rangefinder (Fluke 414D) is available from Porcupine Labs. http://www.porcupinelabs.com/lr4/

Do you know if similar devices with analog output exist ? I'd be interested to transform one into an optical microphone...

http://www.egismos.com/image/data/support/Laser%20Module/LRM%20RS232%20EV-Kit_re1.pdf ~ON<cr><lf> ~READ<cr><lf>

I have also begun a hack attempt on a Nikon laser 440 It is a pulsed time of flight rangefinder that uses an iterative search method with a gated avalanche photo diode with ~500m range capability. Currently I have it talking to my computer over the serial port but can’t get any data off of it. I have logic analyzer captures, pin assignments, and connection information on the point to point wiring. Most importantly, this rangefinder uses an Altera FLEX6000 PLD which can be reprogrammed over a standard JTAG adapter with their free quartus web edition software. If there was ever a rangefinder that I believed was hackable, this is it.

I have begun a hack attempt on a long range rangefinder, the Bushnell pinseeker 1500 It is a pulsed time of flight rangefinder with 1500m range capability. Currently I have it talking to my computer over the serial port but can't get any data off of it.

I know this is possible the least elegant way possible to solve this problem, but, connecting a micro-controller to the pins of the display would get you the number's being shown on the screen, provided the right pins were tapped into of course, and then setting some array's and matching them to the values would get you a distance. Assigning each segment in the display a values using something like this would help in creating arrays or matching values. ----1----- 2| |3 |----4----| 5| |6 ----7---- The wiring would be done in such a way as to make reading the the display as easy as possible, so that pin 1 would be in a segment 1 type place, pin 2 would be in a segment 2 type place, after pin 7 it would loop around so pin 8 would be in a segment 1 type place and so on. int store[0,0,0,0,0,0,0]; int values[0,0,0,0,0];//a place for every digit on the display. From what I could see there were 5 that mattered int zero_type_one[] = [0,0,0,0,0,0,0]; int zero_type_two[] = [1,1,1,0,1,1,1]; int one[] = [0,1,0,0,1,0,0];//or [0,0,1,0,0,1,0]; if that's how it works int two[] = [1,0,1,1,1,0,1]; int three[] = [1,0,1,1,0,1,1]; //and so on to 9 int final; for (int i = 0; i

I do installations of phased array real-time location systems for passive RFID tags / And some firmware + hardware dev. Accurate setup of the antennas is critical So, I've used the Prexiso constantly, as well as the more fancy Hilti PD 40 which give crazy accuracy. It's really cool to see it opened up, all of us at work have wanted to see the insides but didn't want to break the thing.

We have pretty good contacts at Hilti, and an email of a sales engineer at Prexiso. If I can dig it up will send your way.

I having an Ryobi RP4011 which having exactly same pcb. I was playing with, trying to get in a special menu for calibrating. I found this, I am not sure if it helping on the project: by pressing down "-" and "+" button and then ON button for 10 sec while keep holding on "-" and "+" for another 10 sec and release both button, I entered in some special menus. First screen on my is "0492" for first line and "9194" for second line. By pressing OFF it exit. by pressing any other (ex. "-" or"+" ) it scroll between menus and with ON I can enter to do some changes. At menu named "Addco" it looks we can recalibrate the laser meter.

Cheers

Unrelated Note: Have you seen this? Pretty nice, good price. If it works and is accurate, I like it. Could interface it with just about anything. SENIC

As an update for everybody, I've found a handheld laser distance meter that provides native serial output (the Uni-T UT390B). I wrote a small article about it at http://blog.qartis.com/arduino-laser-distance-meter/

Hi! I was interested in a project like this one and I wanted to know if it had been solved all the problems that occured before. Do you know an Arduino-Laser Sensor similar to this one https://www.sparkfun.com/products/8502 but laser?

Thank you so much.

While this might be a bit late, I've been working on getting this laser: http://www.boschtools.com/Products/Tools/Pages/boschproductdetail.aspx?pid=DLR130K#specs interfaced with one of my robots. Having similar difficulties finding and making sense of any serial transmissions on the board, we opted to read the data from the LCD breakout. Currently we've found a special clock line on the LCD (--__--, running at 650Hz) that appears to be used to sync the signals that correspond to the digits on the screen for reading data along with the specialized codes for each decimal digit on the screen. Definitely not the most elegant solution, but after we whip something together with a microcontroller it should be pretty easy to interface with and use for collecting data.

I realize this post is almost a year old but was wondering if the offer was still on the table? I work with laser rangefinders everyday and was thinking you may have more luck with a bluetooth model... I love the idea of this project!

can you help me?

what model of laser transceiver used in this device? I have a project at university, where I have to build a measuring device, and need to know what the best sensor to use. If you can help me, i would be grateful grateful.

I really like the sound of this and might buy myself one after Chinese new year and give it a go.

Have you tried decoding the LCD screen instead? Just look at the text and then strip out the data. It's a workaround, but should work just fine. It's either I2C or SPI protocol based communication to the LCD screen.

Yeah, I don't understand why hardware manufacturers don't look at us as unpaid sales staff, who are happy to tell people to buy hundreds of these products to incorporate them into other things.

I think they're afraid that we'll attempt warranty returns of our hacked devices, or that we'll overwhelm their support staff with calls.

RS232 on instruments is always a simple interface. No hardware or software handshaking. It is a slow, intermittent communication.

The default should be 9600. I would be surprised if it defaults to 19200.

The Leica chip should be consistent with the Leica Disto protocol. No sense in making multiple formats.

If you do have the correct RX pin sending garbage should get an error code in response. It may be case sensitive. I doubt if they would take the effort to fuse it.

"A" or "EXT" should set it to online mode. The lower case "a" powers it on. Until you get it into online mode the "?" is the only response you will get at power on.

Looks like this would give you the data you want, but not via the serial port, looks like it decodes the screen data.

Nate, you did a good job on hacking, it's almost done... Monitoring the old Leica software, I saw it pulls down the RTS line before sending the already known "power_on/reset" command ('a' \r \n). Moreover, looking at other Leica device's documents with serial interface, I would guess the first two pins on the 8-pin SMD connector footprint could be RTS/CTS.

Here is direct link what I found: http://lukse.lt/uzrasai/wp-content/uploads/2009/12/interfaceManual111_en.pdf

I did not tested if it is similar, but I have hacked other Leica distance meter. Check this link: http://lukse.lt/uzrasai/2009-12-leica-disto-d3/

The flow control was a good idea, however the block diagram for the serial port on the chip doesn't suggest that they have hardware flow control...maybe software XON?.....maybe... also there is another serial port on pins 21 and 22, anything registering on those pins? Also, the interrupt pin is optional on the chip so its not necessarily required for communication, depends on how the software was written. Good Luck

Well, after reading through what you've provided (in terms of diagnostics and troubleshooting/tracing). I would have to guess that you've actually found the serial Rx pin on the chip (particularly if it traces back to one of the pads near the Tx test point pad. The likely problem, however, is that when the chip was built, it was probably done so with a fusing mechanism, so that after programming/testing/calibration is completed, the fuse is then 'blown' to lock that programming (there would be no need to blow the Tx pin, just the Rx). And voila you have a locked chip that prevents anyone later from communicating with the chip.

This may even be the same chip used in their higher end devices (which have serial connectivity available), and the 'fusing' mechanism would just be for use in the lower end units.

Please understand that this is all supposition and conjecture, though certainly within the realm of probability.

There's a footprint for some external connection - I'd have a look at that.

Nate:

@tamagee is on to a good idea; check out the data sheet pointed at.

Looking at your photo, you do seem to be counting the wrong way around the chip. The big round depression is almost certainly the pin 1 marker.

Secondly, I have one of these here sold as the Fluke 411D but the inside matches your photos completely. This may give you more stuff to google for... good luck!

I'm not going to chase the serial. Look for connections coming to/from that largeish metal shield by the Renesas H8 CPU. That should contain the high frequency oscillators or sensitive phase measurement circuits. 100ft range (30m) signifies an oscillation frequency of 40Mhz IIRC (1/4 wavelength at 300x10^6 m/s over 30m). Accuracy is approximately 1/10000, and I suspect they're using either a capacitor or a downmixed phase comparator to produce a PWM signal, maybe through those hex inverters. Check pins 13, 15, and 17 per the datasheet.

Nate, Two comments. 1) In the past I have found some luck searching the Patent & Trademark Office website for any possible patents. A lot of times these are well documented even to the point of protocols & commands. 2) Have you looked at this: http://www.parallax.com/StoreSearchResults/tabid/768/txtSearch/laser/List/0/SortField/4/ProductID/774/Default.aspx. I know it wouldn't give you the "I figured it out myself" feeling but it looks promising.

Leica are fairly unimaginative in their command strings usually a character followed by a carriage return and possibly a line feed. I checked some code for the Leica Disto variants and they all use the same fire command - g \r or in binary { 0x67, 0x13 }. If you haven't already try the lower case 'g' with a CR or a CR LF.

It surprises me that nothing shows up on the serial line after pressing the measure button; all laser rangefinders I have worked with in the past return a result via the serial port regardless of how the measurement was triggered.

Some research identifies the processor 38326A54WV as perhaps being made by Renesas - HD64338326XXXWV.

8mhz 8bit.

may have been replaced by 38327 - http://documentation.renesas.com/eng/products/mpumcu/rej09b0144_h83827r.pdf

Pin 10 is listed as timer output, but given the orientation of the chip (pin 1 at beveled corner 1-10 along bottom) I think your pin 10 is actually 71 and 70 is RXD. Pin 69 is SCK. You may need to clock data in. Pin 72 is an IRQ, perhaps chip requires an interrupt to read?

There is another io port on the other side, pins 21-23.

Being able to use on of these sensors would be great (so keep it up). But what we really need is to get a hold of Neato Robotics "Revo LDS" sensor (http://www.hizook.com/blog/2009/12/20/ultra-low-cost-laser-rangefinders-actualized-neato-robotics). Just if Sparkfun could contact them and resell their sensor. I talked to Neato at CES this year and it seemed like sharing their sensor was not on their minds at that moment (with the whole getting your company off the ground thing). But maybe Sparkfun could convince them...

I am going to try to do this. I have a old Radioshack laser tape measure that I will first try it with.

reminds me of when i had to configure bluetooth.might be expecting AT commands? try typing 'AT' or 'at' but i dont think capitalization matters.

connect BT serial to RX>RX, TX>TX "type AT and you should see 'OK' returned"

PS - i remember something ridiculous about "set RTS on close" checkbox in device manager>ports

also if you see ascii i think your baud is fine. no idea though im a beginner.

I wonder if it is using some kind of amplitude modulation on the laser? Apparently modulating at a handful of frequencies and noting the phase shift can yield distance after some linear algebra, so I wonder if a) one could confirm whether there is modulation than varies by measuring the output of the laser with a detector, and b) whether the phase shift is represented in one of the signals you have probed. Very interesting.

Hey Nate, great attempt, actually, are you sure the '?' character is really a question mark and not an undisplayable ASCII char ? (I can't figure it out from the waveform). And is it constant no matter what distance you're measuring ?

Very interesting! I love a good puzzle.

I wonder if some sort of flow control is used.

It is interesting that you see the ?/r/n response when you trigger the laser. According the the DISTO protocol that is possibly a response to a command. If it is just a general ready for new command you would think it would only show up once on startup. Because it shows up ever time you press the trigger it makes me wonder if the trigger sends a command to the processor via another route.

Just some thoughts. Good luck

Nate, we'll try it.

UPDATE: Did some more digging, and that's apparently the protocol for an aftermarket Bluetooth add-on, not for the newer Bluetooth-enabled factory models. So it seems that's a "nevermind, nothing to see here". D'oh. May just have to install DistoTransfer on a PC and do some data sniffing to reverse engineer it, unless I can track down the API docs. They seem to keep them pretty locked down, though, so I'm not holding my breath.

I can't help with confirming that the serial protocol is the same as their Bluetooth models, but since they use SPP (well, until the newest ones that are iPhone-friendly), it seems a reasonable assumption. That being the case, after a few days of digging and trying to find the magical combination of keywords to coax it out of Google, I found the documentation for the Bluetooth serial spec:

http://paperless.bheeb.ch/download/DistoXAdvancedInformation.pdf

I'm hoping to sit down and try to get an OS X client for it going, since I haven't been able to find any commercial solutions, and Leica just shrugs and says, "You need to find a third-party solution that fits your needs for OS X support." More to follow...

Maybe it's compressed data. But that is not likely, as the message is just a couple pieces of serial crap... Hmmm...