I've wanted to play with a laser for distance sensing for a long time. Hand held laser rangefinders are often used in military applications and (of all things) golf. Since I don't frequent either one of these areas, I never had the impetus to purchase one. Then one day my friend Jen asked if I could hack a laser tape measure for her laser harps. 'I can do that! How hard can it be?'. The answer is obvious. The following tutorial is a lesson in how to hack, how to document, and hitting walls.
To skip to the punch line: I came close, but was unable to wrangle serial control. If you happen to hack the serial interface for this Leica based Laser Interferometer, we will give you $100 of SparkFun credit and 15 minutes of fame on the homepage (and maybe buy you a beer).
When Jen posed this challenge to me I had been thinking about laser range finding for years, but never had the words laser tape measure come to mind. This is very different and very important to my world. Instead of long range laser range finding (100s of yards or meters), a laser tape measure measures feet or meters. These distances are much more applicable to my world of robots and basic obstacle avoidance. If we can hack a laser tape measure there's hope for our autonomous vehicles, 3D scanning, you name it. It's amazing how those small words changed my search results.
I found the cheapest laser based tape measure on Amazon (Not ultrasonic, watch out!) and ordered it. A few days later the laser tape measure showed up. For being the cheapest thing I could find, I was fairly impressed with the quality of the unit.
Checkout those optics! You can see the laser diode illuminated on the right. The main lens has two small lenses built into it. I believe this unit uses laser interferometry. It even came with a carrying holster! Oh how you won't see the light of day...
Prexiso is the manufacturer, at least that's what the sticker says - I'm sure someone else actually builds it. I see a few very small torx bits; I think I've got some small tools that will make quick work of those. Everyone should own security bits and other hand tools that will remove small, specialized screws. Right?
Here we go! When hacking, I recommend you start a doc of some sort (I use google docs) and record all the random things you see, in the order you see them. Here's a snippet from the beginning of my log:
Laser measuring tape from Amazon
Opened up with small torx security bits.
One side is all LCD connections
20 pins a side, 80 pins total
Small, Crystal is near it but may be unrelated
5 pins per side, 2 sides, 14 pins total.
Near two large pads - EL back light maybe?
A freq test would tell.
Looks to be a HEX Schmitt-trigger
Y = A* inverter. Can be used to interface 3.3V to 5V devices.
This continues across a couple days worth of rambling. These are not specific or well composed thoughts, instead they are just your initial impressions. I cannot stress how important it is that you record these initial investigations. Later, when you really get stuck it can be very helpful to re-visit these first impressions.
Above is a picture of the back of the main board. Visual inspection of the board shows high quality layout and impedance matching. This is a serious PCB with some serious optics. This hack is not going to be as simple as finding an analog voltage and extrapolating a distance. I'm just hoping that there is some sort of data being passed around the board that will allow me to 'sniff' the data before it goes to the display.
This is an up close photo of the main IC. Initial searching for the IC by Leica produced nothing but hits on microscopes. Not what I'm looking for. Finding a datasheet for such a custom IC is usually pretty difficult so I gave up after about 30 minutes of searching and began probing around the board to identify ground, then VCC.
Continuity on a multimeter is very powerful. It can tell you what pads are connected to each other. Initially, I searched for what was physically connect to the positive and negative terminals of the two AAA batteries that power the device. Using a sharpie marker I marked the pads that had been identified. Then I powered up the unit and identified where power was being stepped up to 4.2V. This removed a few more pads from the pool of unknowns.
With a handful of ground and VCC (both raw 3V and 4.2V) pads removed from the unknown list, I decided to start soldering connection points to the test pads on the PCB. I've said this for the past few tutorials: the Logic Analyzer by Saleae saved my life. It has. If you don't have one, get one. You'll thank me later.
Using the logic analyzer, I first hooked up to the pads that seemed logical. This was a bank of 8 pins (see above, it's 7 round pads with one square pad). If I had to program a board using JTAG, it would probably be here. Note: While probing and hacking, it's important to retain a unit in functioning form. I disconnected the screen, but I kept the button pad around so I could Fire the Laser!
Powering up the unit I pressed the button to measure a few feet to my hand or the wall past my workbench and capture the data forms using the logic analyzer. We can see in the capture above that there are a few lines that do very little (channels 0, 1, 4, 5) and four lines that are very active (channels 2, 3, 6, 7). Let's ignore the channels that don't move for now.
Obviously there's a change in the wave forms at various points. I tried to identify a pattern or change when moving my hand. Unfortunately I'm not intelligent enough to recognize what's going on so I started to probe other pads on the board.
I probed about a dozen pins when I saw a blip. This was unique, it did not repeat. Time to look a little closer.
My heart sped up. Wait - is that serial?
Turning on the serial analyzer within the Saleae logic software, I turned on the auto-baud detect and when the wave form displayed '? \n \r' (? CR LF at 19543bps) I knew that I had found something major.
Discovering a random serial character is nothing that interesting. Discovering a single character (especially '?') followed by a carriage return and a line feed is something deliberate and very much the TX pin of the board. The board is transmitting serial! This is great! We've found it!
Once the transmit was found at 19543bps (this is within the margin of error of a very common 19200bps baud rate) I started to look for the RX pin. If I could transmit something sensible into the board then maybe I could gain control of the system. But does '?' indicate a bootloader? When I build anything on a microcontroller I will put a serial bootloader on it. A question mark '?' is a common character I might broadcast during power up to tell the world I could be bootloaded. But this is all guess work. Perhaps the mark means something else? Let the google research begin.
Here's more stream of conscience notes:
More from “Leica Survey Office”
Maybe called theodolites?
Laser distance meter software:
Leica DISTO™ instruments - Hmm
Hah! That looks like ours:
Downloaded and looking at serial protocol for DISTO software. Talks at 9600bps, Transmits “a” then \r \n.
After a few days of poking around on the interwebs it became obvious that Leica was big into laser surveying equipment. And that equipment often had a serial interface that was 9600bps to log what location and what variables where seen by the equipment. This was a very hot possible lead. What I needed was the ability to precisely transmit a stream or characters (such as 'a' \r \n) at the module. Breakout the trusty Arduino:
Here we have the laser model connected to a breadboard. The Arduino TX/RX and a GPIO is connected to the breadboard. The logic analyzer is just outside the picture frame and is there to show and verify what serial traffic is going back and forth. We knew what pin was TX, but what pin could be the RX pin?
Here are the pins as I identified them. To try to figure out what pin might be the RX pin, wanted to find where the TX pin was connected to the main IC. UART pins are customarily next to each other on a given microcontroller so it can be very helpful to know what pin the TX pin is on the main IC.
With the unit disconnected from power, I tried probing from the TX pad back to the main IC. For some reason I could not find continuity so I started poking around the main board. I found continuity to a resistor. On the far side of the resistor, I found it was connected to the main IC (pin 10). Measuring the resistor, it was 1k Ohm. Hmm. It's not uncommon to have inline resistors on the TX and RX pins to provide basic electrical protection, so I was encouraged. There is a very large pad next to this TX pad that seemed like it may be the RX pad.
Testing it I found that it runs through another 1K resistor and terminates at pin 11, right next to the TX pin. I assume that this is sufficient evidence that this unknown pad is the RX pin into the microcontroller. With this knowledge I then decided to barrage this pin with data.
It's also important to point out a couple other things. The pad labeled trigger: I found when I pull this pad low the unit activates the laser and initiates a measurement. So I control this pad from the Arduino before waiting to hear the ?\r\n from the unit and before sending any test strings. It's also worth pointing out that there is a footprint for a 8-pin SMD connector just below the large 7 square pads. It is painfully obvious to me that this is some sort of a serial connection.
So let's start hammering the laser module with serial strings!
Here we trigger the device, and 112ms later the module transmits the ?\r\n. Shortly after that the Arduino transmits a\r\n to the laser. We see no answer for 300ms so we transmit another a\r\n string. Again, no answer.
Nada. I tried many other strings as well (c\r\n, ?\r\n, SET/32/0\r\n) with no response.
What if we need to transmit some serial before we hear the ?\r\n from the unit? Above we transmit characters before and after the ?\r\n but no other activity is seen.
From reading various serial protocol datasheets from Leica I tried:
I tried these and many more, even at different baud rates. I tried transmitting before the unit sends the ?, after it, after the measure button was pressed, pretty much everything I could think of and I have not seen any response from the unit except the the '?' after the initial power on. I also downloaded Leica software that is supposed to connect over Bluetooth (serial port profile SPP) and inspected the characters. Not surprising the software transmits a "a\r\n" string to try to get a response from the device. I tried this string again with no luck.
In the end I have been unable to get the laser tape measure to output anything sensible over serial. I realize that I could connect wires to the display connector (20 pins) and decode the segments that the main IC is lighting up on the main display. This would probably allow me to read the distance, but would be a heck of a lot of work. It would be so much nicer to have serial control of the device.
For English support, Prexiso's website redirects to Calculated Industries - a website that is not at all encouraging. They look like just a reseller/distributor to me. I knew it was a long shot but I decided to ping their support line.
This is a phenomenally awesome 'resolution' if I have ever heard one. It's emails like this that make me want to slap my forehead. They just don't understand what we (the community of engineers, hackers, artists, students, and innovators) are trying to accomplish. Warranties are not a concern to me, instead I'd like to simply be directed towards someone that might know more. Ah well, I knew it was a long shot anyway.
I know there are other laser tape measure meters out there. But regardless of the model, I believe there are very good applications for short range, high accuracy distance sensing. If only the manufacturers added a basic serial interface (they added half?!!), then they might just see a very big explosion in sales because people like us (and we are growing) could then re-purpose their product for other projects. A pipe dream I know, but let's hope for the day.
We're trying to source a good, low-cost solution for laser range finding. If you have any luck hacking similar laser tape measures please let us know!