Help figuring out how to control a Weller WHP-3000 Preheater directly from a PC

[Spork Schivago]

Hi!

I have a Weller WHP-3000 preheater.   It has an d-sub 9-pin serial port on it.   I tore the preheater apart and the d-sub is connected to a TTL-to-RS232 MAX232 chip.   I've verified the voltages coming out are equivalent to RS232, not TTL.

These pre-heaters are meant to be hooked up and controlled via a rework station.   However, I don't have the rework station (like the WHA-3000).   I'd like to figure out how to control it directly via my PC.   I have a USB to serial adapter (Prolific).  I noticed Weller sells an adapter that lets you control these preheaters by some of their soldering stations (the WX1 or WX2).   Here's an adapter: http://media-weller.de/weller/data/images/big/3655800558764712Adapter_WHP_WFE.jpg

The adapter shows me only pins 1, 2, 3, 4, 6 and 7 are being used.    I hooked the preheater up to my Prolific USB-to-RS232 serial adapter.   I set a terminal program to 9600 baud, 8n1 for the settings.   There's a program that Weller provides to control the preheater but it seems to only work if you have the rework station as well.  I opened it with a hex editor and I can see various things, for example, 9600 baud.   I can also see what I think are commands that get sent to the preheater.   For example, I see stuff like:   HP-Infos vollständig

If I type this into the terminal program, with a 0x0A at the end, I get responses.   I added the -'s to make it easier to read.   They're all hex (minus the stuff in the parenthesis.)
Sent: 48 50 2D 49 6E 66 6F 73 - 20 76 6F 6C 6C 73 74 E4 - 6E 64 69 67 0A (HP-Infos vollständig)
Recv: 80 00 80 00 00 00 80 00 - 00 00 00 00 80 00 00
Sent: 48 50 2D 49 6E 66 6F 73 - 20 76 6F 6C 6C 73 74 E4 - 6E 64 69 67 0A (HP-Infos vollständig)
Recv: 80 00 80 00 00 00 80 00 - 00 00 80 80 80 00 00 80 00
Sent: 48 50 2D 49 6E 66 6F 73 - 20 76 6F 6C 6C 73 74 E4 - 6E 64 69 67 0A (HP-Infos vollständig)
Recv: 80 00 80 00 00 00 80 00 - 00 00 80 80 00 00 00
Sent: 48 50 2D 49 6E 66 6F 73 - 20 76 6F 6C 6C 73 74 E4 - 6E 64 69 67 0A (HP-Infos vollständig)
Recv: 80 00 80 00 00 00 80 00 - 80 00 00 00 00 00 00 00
Sent: 48 50 2D 49 6E 66 6F 73 - 20 76 6F 6C 6C 73 74 E4 - 6E 64 69 67 0A (HP-Infos vollständig)
Recv: 80 00 80 00 00 00 80 00 - 00 00 80 80 00 00 00

Sent three times, 48 50 2D 49 6E 66 6F 73 - 20 76 6F 6C 6C 73 74 E4 - 6E 64 69 67 0A (HP-Infos vollständig)
Recv: 80 00 80 00 00 00 80 00 - 80 00 00 00 00 00 00 80 00


There's other things I found in the exe with the hex editor, like @!.WHP3000-Temp-1    or @!.WHP3000-Temp-2, @!.WHP3000-Temp-3 (there's three IR heating elements).   There's also @!.WHP3000-Set.    I tried sending them, the only way I get any response is if I send the first three bytes before the @! stuff as well, like this

Sent: 0x00 0x00 0x14 0x40 0x21 0x0E 0x57 0x48 0x50 0x33 0x30 0x30 0x30 0x2D 0x54 0x65 0x6D 0x70 0x2D 0x33 (...@!.WHP3000-Temp-3)
Recv: 80 00 80 00 00 00 00 00 - 00 00 00 80 00
Sent: (again)
Recv: 80 80 00 80 00 00 00 00 - 00 00 00 00 80 80 00
Sent: (again)
Recv: 80 00 80 00 00 00 00 00 - 00 00 00 80 00
Sent: (again)
Recv: 80 00 80 00 00 00 00 00 - 00 00 00 80 00

I've tried sending the Set command but I can't get anything to change on the preheater.   From reading the manual, when the preheater is being controlled by the computer program or the actual rework station, the manual controls are locked.    I was thinking maybe a couple things could be going on here....

Maybe the reason I'm getting different responses from sending the same command is because my serial wire isn't right.   It's about 10 feet long.   I have pin 1 going to 1, pin 2 to 2, 3 to 3, etc.    I was thinking maybe there's some interference or something on the line.   Also, maybe I need to have some pins switched?   Like 2 and 3 switched around?     Another thought was maybe there's a command I need to send to put this into "remote operation" mode and until I do that, the unit is sending back commands that are essentally saying, hey, you're not in remote mode.    It's weird though, EVERY response includes either a 0x00 or an 0x80.    Does anyone have any suggestions on how I can proceed in order to figure out how to communicate with this preheater via a terminal program?    I would REALLY appreciate any help.  I'm willing to provide any information you request.

BTW - The circuit board has a PIC that I think controls the serial "language" or "protocol".    It's a PIC16F876.   I don't think I can safely extract the code from it without ruining the chip.

Thanks.

[Spork Schivago]

I decided to try a different terminal program because I was having weird things happening with RealTerm.   Anyway, the new terminal program, Terminal, seems to give different results.    Repeatable results to some degree.   First, I set it to 1200 baud, I set it to 7n1.

I send this:
$21$0E$57$48 (the $ just means hex in this program)
This equivalates to !, 0x0E, WH   (without the spaces, of course).   0x0E could be some sort of control character.   I can put stuff in front of this, like I can add @ in front of the ! and get results, I can put stuff at the end of it, like P3000-Temp-3, to have ! 0x0E WHP3000-Temp-3 (a string I found in the EXE with the hex editor) and it seems to make no difference, I get the same results, which I thought where some how temperature settings...

Here's the results:
Different terminal program:
Com1, Baud 1200, Data bits 7, Parity None, Stop bits 1, Handshake None
(This appears now when I turn it on, perhaps the startup temp?)
(hex) 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x61
(bin) 01100001
(dec) 97

Macro-3 (starts with 0x21) (!) (0x0E) WHP3000-Temp-3
43 30 36 35 37 15 (dec-->) 67 48 54 53 55 21
43 30 36 35 37 15 (dec-->) 67 48 54 53 55 21
43 30 36 35 32 10 (dec-->) 67 48 54 53 50 16
43 30 36 35 37 15 (dec-->) 67 48 54 53 55 21
43 30 36 36 30 0F (dec-->) 67 48 54 54 48 15

Macro-4 (just 0x21, 0x0E, 0x57, 0x48)
43 30 36 35 37 15 (dec-->) 67 48 54 53 55 21

The temperature is set to 150.  0x57 and 0x48 is just WH.   If I try sending Just the first three characters, I get no response.

I changed what I was sending to !<shift out>200 and the response changes (shift out is just 0x0E):
44 31 30 30 30 05 (dec-->) 68 49 48 48 48 05

Does anyone think I'm on the right path here?   Thanks.

[free_electron]

WELLER has a control program for that thing. you can download it. just sniff the bus.

i have the complete system at home. i can try to sniff the bus.

[Spork Schivago]

If you could try and sniff it for me, I would appreciate it.  I want to but because I lack the rest of the system, I cannot get the control program to even see my preheater.   Anyway, I think I'm onto something.   When I told the terminal program to display the info as Ascii instead of hex, I see the last three digits change when I change the temperature.   They're three sensors with three different values that are very close to what the temp on the display reads.    The first half of the string is just garbage though.   I don't know what that's supposed to be.   Maybe they're not supposed to be 8-bits?   Here's a copy of what I got by sending various commands:
C1292 C1297 C1285 C1277 C1282 C1280 C1280 C1277 C1282 C1277 C1282 C1280 C1272 C1272 C1270 C1257 C1252 C1247 C1245 C1245 C1242 C1235 C1230 C1230 C1212   C1207C120 C1200 C1197 C1187 C1187 C1182 C1180 C1177 C1170

I added spaces to make it more readable.   There's weird characters between the temps.    I had the temperature gauge set to 263F, the !<out>WHP3000-Temp-2 returned    C1292    (notice the last three digits there, 292....)   I turned the temp down and kept on sending commands, like WHP3000-Temp-1, WHP3000-Temp-2, WHP3000-Temp-3      and I could see the temp counting down each time.   I'm just reading it wrong or something.   I really appreciate you going through the trouble to sniff the traffic for me.

I tried contacting Weller through a company I purchase stuff through (A good company too).   They got a hold of them and Weller said it wasn't possible to control this preheater via serial by a PC because a PC doesn't provide enough power.   I don't think they realized what I was asking.   Maybe something was lost in translation.

[Spork Schivago]

WELLER has a control program for that thing. you can download it. just sniff the bus.

i have the complete system at home. i can try to sniff the bus.

BTW - I know time is precious and I truly doubt I will figure this out without the rest of the setup.   If you can successfully sniff the bus and show me the protocol, I can pay you a little bit of cash.   I don't have a lot of money.   But I could send you 20$ or so for your help.  It's greatly appreciated.

If you decide to help, I've seem to have the best luck with 1,200 baud, 7n1 for the settings, no handshaking.

[kc3ase]

Have you tried just asking Weller for the protocol?

[Spork Schivago]

Have you tried just asking Weller for the protocol?

Sorry for the late reply.   Yes, I contacted them directly (or at least I think I did).   It was hard to figure out what website was actually Weller.   I know the website I went to was called Weller.de.   I had to sign up in order to send them a message.   An automated system replied, but it was in German.   Google was able to translate.  One just asks me to confirm my address, I did that.   And then the other thanks me for signing up for some news letter.

I'm guessing because English isn't their native tongue they might not even bother translating my e-mail or they lose something in translation and don't understand what I'm asking.

[Spork Schivago]

Never mind, Weller from Germany got back a hold of me and gave me the whole protocol information!    Wonderful people there!   They even gave me contact info in case I had more questions!

Thanks!

[steffenmauch]

Could you share the information? Otherwise I will have to ask them too

[Spork Schivago]

Could you share the information? Otherwise I will have to ask them too

I can and will share the information but I'll have to look tomorrow.   I'm a bit sick right now and have a lot of work to do.   If you don't hear from me by tomorrow evening (at around this time), maybe you could post here again just to remind me.   Got a bit of a bad memory!   Thank you!

[Spork Schivago]

Could you share the information? Otherwise I will have to ask them too

I found the information in my e-mail and sent you a private message asking for your private e-mail address.   I'm not sure Weller wants me posting their PDF on-line or not so I'd rather share privately.   The PDF is poorly written.   I think maybe the person who wrote it might of had trouble with the English language.   However, I've sent a few e-mails to Weller and some other people, who were able to help me figure out exactly how to talk to the preheater.   You're more than likely going to have trouble talking to it as well, just by following the information in the PDF.   If you do though, I'll be more than happy to help you through it.   I suggest you download a terminal program and communicate via serial from the terminal program to test the commands you send, until you got it all figured out.   It helped me a lot!

Eventually, when I get some free time, I wanted to write an open source program for Linux and Windows that controlled the PDF.   I was going to use the GTK 2 libraries to do this and a library called libserialport.   Libserialport is still very new (it's used by the Sigrok project) but it allows me to write highly portable serial communication type code for Linux and Windows without having a bunch of #ifdef type pre-processor directives.

Let me know if you didn't get the PM.   Thanks!

[MilkmanCDN]

@Spork,

I too am interested in this protocol information.    Would you be able to share?

[iopq]

Hello.
I did a quick setup for weller WHA 3000p. to set the temperature to 222 C, we need to send 6 bytes of data containing - 113, 50, 50, 50, 48, x
x is calculated by the formula x = (113 + 50 + 50 + 50) mod 208