Author Topic: Hacking the Bosch GLM 20 Laser Measuring Tape  (Read 1598 times)

0 Members and 1 Guest are viewing this topic.

Offline STMartin

  • Contributor
  • Posts: 22
  • Country: us
Hacking the Bosch GLM 20 Laser Measuring Tape
« on: September 29, 2017, 01:36:19 PM »
MOSTLY IRRELEVANT BACKGROUND
So, I've decided to hack a laser measuring tape (laser distance finder) for a project I've started. My siblings and I have decided to build my dad a cornhole set for his birthday, and my contribution will be an electronic scoring device, which will probably be expanded on in another post. I wanted to incorporate a distance finder so we can set the distance of the boards properly without having to break out the tape measure. I bought the cheapest model I could find; about $50 USD at a home improvement store.

RELATED WORKS
This has been done before. Someone has attempted to hack a model very similar to this one, but it doesn't seem like they figured it out:
http://robotshop.com/letsmakerobots/laser-range-finder-hack
There was/is a Uni-T tape measure that was hacked some years ago and became quite popular among the drone and robotics communities. Although, since then most vendors seem to have caught on, and the price went from about $60 to $100 or more. Sparkfun also has a LADAR module for about $150 that does just what I need. I could go for either of those solutions, but this is more fun and gave me an excuse to buy a logic analyzer. Plus, the Bosch is smaller and lighter than the Uni-T, and cheaper than the Sparkfun module. If I can hack this out, it'd be nice if everyone had another option for their distance measurement needs.

POST PURPOSE
I'll be documenting my progress here. Mostly with the hope that the hack is successful and others can refer here for information. Also I'll inevitably get stuck somewhere, and since I barely know what I'm doing, forum feedback will be invaluable. I'll pretty much be writing this post as I go along.

ON WITH IT THEN
This is our subject, the Bosch GLM 20.



The back cover is held on with 6 Torx T-6 screws. Two of them are under a sticker, which I've already removed.



Taking off the back cover shows us the good stuff. To get the board out entirely, there are two more Torx T-8 screws that hold the board to the front cover.



Now we've got the board itself. First the back...



...and the front.



The first thing I notice are seven test pads on the back of the board. I'll have a poke at those in a minute; first I want to see what else is going on. I can barely see a microcontroller under the optics module. Removing two more Torx T-8 screws should let me take it off.

It doesn't come off easily, so after unclipping the LCD, I can see two pegs holding it to the PCB.



The pegs have nothing to do with it. It seems the laser riser board is glued to the optics module. I'll just desolder the riser board for now so I can get a look at that microcontroller.

Turns out it wasn't glued at all. Mostly desoldering the riser board let me tilt it back very carefully; enough so the optics module came out. The microcontroller is an ARM STM32F051R6:
Datasheet -> http://www.st.com/content/ccc/resource/technical/document/datasheet/55/53/3e/86/29/61/41/d9/DM00039193.pdf/files/DM00039193.pdf/jcr:content/translations/en.DM00039193.pdf



Neat!



There doesn't seem to be any kind of display driver chip, so I assume the micro is controlling the LCD directly, unless there's a chip under the LCD that I can't see. In any case, if I can't get anything out of the debug pads, I'll have to resort to sniffing the LCD signals. Not ideal, but hey.

I buzzed out the debug pads, and found where they go. Going by my picture, from top to bottom (Pad 1 to 7):
1: Pin 7 - Reset
2: Pin 46 - SWDIO (Serial Wire Debug In/Out)
3: Pin 49 - SWCLK (Serial Wire Clock)
4: Battery -
5: Battery -
6: Battery +
7: Through two 5k resistors to Pins 58 and 59 (I2C SCD/SCL, USART TX/RX, Timer 16/17, or touch sensor IO 3/4)

This agrees with other people's work, so it seems I have a good place to start. I'm not going to need access to the microcontroller anymore, so I out everything back together and made sure I didn't ruin it already.



Yay!


That's all the time I have for today, and I'll be gone for the weekend, but I'll keep this post updated as I go along.
« Last Edit: September 29, 2017, 01:47:44 PM by STMartin »
 
The following users thanked this post: Hero999, MasterT

Offline alterbaron

  • Contributor
  • Posts: 42
  • Country: ca
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #1 on: October 01, 2017, 06:12:54 AM »
Was this cap in your images originally part of the unit?

 

Offline STMartin

  • Contributor
  • Posts: 22
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #2 on: October 02, 2017, 02:11:47 AM »
Uh oh, I hope not. :palm: When I get home I'll compare to the original pictures.

Good eye, though!
 

Offline STMartin

  • Contributor
  • Posts: 22
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #3 on: October 08, 2017, 11:11:56 AM »
PART 2

POPPIN CAPS
So, as alterbaron pointed out, there's a chance I popped out a capacitor while working on the laser. You can see the desoldered cap in at least two of the pictures. I looked through the pictures I took, and couldn't find anything different, nor could I find the cap (which I was foolish enough to look for). I looked at the unit itself, and found where it possibly went on the laser riser board:



Oops!

It may or may not belong there; but it doesn't seem to matter much; it still seems to work. It does display 'Err' every once in awhile, but that can be cleared by pressing the button again. I can still try and interface with it. If it winds up being an issue, I can slap in a random cap from something in the junk pile, or just get another laser.

In any case, now it's time to start sending some serial commands to this thing!

INITIAL OBSERVATIONS
On the debug pads I found before, I have a choice of Serial Wire Debug (SWD), I2C, or USART. SWD might work for my purposes. I'm not familiar with it at all, but it turns out ARM has a whole suite of tools that would work with SWD; their DS-5 software. Seems like it lets me read data, write data, dump memory, and tons of other useful things. The community (free) edition doesn't support the Cortex-M0, and I have to request a price for any of the other editions. I hate having to contact companies to request pricing, so screw SWD for now, and screw DS-5 in particular.

That leaves I2C and USART. I don't know for sure, but I believe I2C needs at least two wires; I don't think I can do the clock and data from the same wire. All that's left is USART, which is what I'm going to assume the manufacturer intended that pad for. I soldered in some wires to all the pertinent debug pads to see what might be there.



After connecting to the logic analyzer, I fired up the laser.



I don't have the other pads shown here, but trust me: there was nothing. I do get one 11.37 ms pulse on startup from pad 7; nothing more. Lame. I suppose it's time to interface with the Arduino.


ARDUINO INTERFACING...
My computer isn't convenient to use at the bench, so I'm going to try and power this from the Arduino. I ran the power supply through my bench meter set to min/max to measure the current the laser draws. It seems to draw about 100 mA maximum. I have an Arduino Due which can supply up to 800 mA through the 3.3V pin, which should be plenty. The Due uses 3.3 volt logic, and according to the logic analyzer the laser's pulse is about 2.7V. The micro on the laser is 5V tolerant on those pins anyway. All of which is to say, the Arduino should be just fine running the whole show.

This is the test setup:



Since the laser has both Tx and Rx on the same wire, and the Arduino can't do that, the one wire coming out of the laser is going to two pins on the Arduino. The logic analyzer just has to watch that one pin (glad I got the 16 channel version...). I captured the startup again to make sure everything was working as before.



Huh? I get two pulses now? I don't know why this is but it seems to happen randomly. I'm turning the laser on by dragging a wire across the button contacts; which is probably pretty electrically noisy. Maybe that has something to do with it? Anyway, let's start sending some commands.

...DOESN'T WORK THAT WAY
I have found that just connecting the Rx and Tx pins together on the Arduino is not going to work. UART protocol requires the Tx pin to idle high, so everything on the bus stays at logic high. I did some searching for single-wire serial and someone, somewhere suggested a resistor be placed between the Rx and Tx pins, then connect the wire to the Rx side. This didn't work wither, although I may have got the resistance value wrong: I tried using a 2k with no luck. At this point, the logic analyzer isn't seeing the initial 11 ms pulse from the laser anymore.

So I disconnected the laser, and tried to just see the data coming from the Arduino. That doesn't come up either; or maybe the LA triggering isn't properly set. This is probably because I'm triggering on a rising edge, and the Arduino starts out high and stays that way. I also tried looking for a single wire UART library I could slap in, but the only one available comes from Arduino's SoftwareSerial library. This library is only for AVR based boards, which the Due is not. Unlike many Arduino boards, the Due has four hardware UART ports, so I guess nobody thought it was necessary. I may have to bit-bang.

I then tried to just get data coming from the Tx port of the Arduino, and the LA did pick it up sometimes. There were always some kind of framing errors, and sometimes I didn't get anything at all. At this point, I'm not sure if I programmed the Arduino wrong (I'm trying to bit-bang), or if I have the LA triggered wrong, or some of both.

OKAY, START AGAIN FROM THE TOP
All of this so far took place in a few hours here and there during the week. After mulling it over the last few days, I've decided I need to start at the beginning and make sure I can get data out of the Arduino and properly framed on the Analyzer. For that I need to choose between hardware UART or bit-banging my own single wire solution. Once I'm sure I can get data out, and the LA properly triggered, I can move on to sending commands. First thing I'm going to try is two 5k resistors on the Arduino's Rx and Tx lines, just like the laser, and see if that lets me see the 11 ms pulse again.

The 5k resistors don't seem to work, I think. Applying logic high to the laser's serial pin results in the laser turning on with a blank display (although it is illuminated), and no laser. Perhaps this is how they did the testing? When testing the laser and connecting it to a debugger, the Tx line would idle high, turning on the laser. Maybe it's waiting for some commands anyway, and the 11 ms pulse is a red herring? I think I'll try connecting the laser to just the Arduino's Tx pin, sending some commands, and see what happens.



I just sent a blank terminated string, and didn't get anything. At least I know the LA is triggering properly, and the laser is definitely receiving commands, even if it isn't responding. Next, I think I'll start sending some characters and see if anything bites.

On second thought, it may be trying to send something, but I can't see it since the Arduino's Tx line is pulling the bus up. Looks like I'm going to have to bit-bang something to make a single pin workable for serial. Alright, lets make up a quick Single-Wire serial function. I think I'll be ditching the resistor idea too.

A little bit of programming later, I have a workable write function:



It looks pretty much the same as the hardware UART output from the last image; which is good. Now I can have Tx and Rx on the same pin.

I also poked around a little more, and found when the laser is in the blank display mode, it's actually the laser that's pulling up the bus. So perhaps it's time to just go through all the combinations of states for the reset and serial pins, and see exactly what the laser does under all the possible combinations.

Arduino ResetArduino SerialLaser ResetLaser Serial
FloatingFloatingLowLow
LowFloatingLowLow
HighFloatingHigh11.24 ms pulse @ ~4.8 Hz
FloatingLowLowLow
FloatingHighLowHigh (Blank Display Mode)
LowFloatingLowLow
LowHighLowHigh
HighFloatingHighLow
HighHighHighHigh (Blank Display Mode)
LowHigh-ZLowLow
HighHigh-ZHigh11.24 ms pulse @ ~4.8 Hz
High-ZLowLowLow
High-ZHighLowHigh (Blank Display Mode)

NOW WE'RE GETTING SOMEWHERE!
In the process of making that table, I found a few interesting things. For one, the blank display mode happens if the serial pin is high, and the reset is floating or high. It does not happen if the reset pin is low. This makes sense, since the micro's reset is active low. In this condition, the reset pin and serial pin are both latched high when disconnected from the Arduino. It does not enter this mode reliably though. Sometimes it does, sometimes not. I can find no rhyme or reason to it.

Also, if the reset pin is high and the serial pin is floating/high-impedance we get an 11.2 ms pulse at a rate of about 4.8 Hz.



Some kind of heartbeat? Is it waiting for a command? It's obviously similar to the pulse I had on startup. I'm not sure, and I don't know if I'll pursue that thought because...



RS-232!! I don't think it's actual RS-232, as the micro isn't capable of driving negative voltage, and I don't see any converter chips. This came up when I accidentally brushed the serial line against logic high while the reset was floating. It doesn't come up every time, but if reset is floating/high-Z and you brush the serial line against logic high, it comes up fairly frequently. This makes me think I just need to put the right width pulse on the serial line, and I can enter the fabled RS-232 mode. I tried putting my function generator on it, and scrolling through different pulse widths, but all that got me was blank screen mode at about a 150 ms pulse. So, I'm going to see if I can get it in RS-232 mode while the LA is running, and get an idea for what size pulse I'll need.

But before that, I'm going to get something to eat; I'm starving. I'll continue this later tonight, and probably make another post with further progress.
 

Offline rtv

  • Newbie
  • Posts: 3
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #4 on: October 25, 2017, 01:44:49 AM »
These commands work with Bosch PLR15 serialport

send frame:    [startbyte][command][length]([data])[checksum]
receive frame: [status][length][...][checksum]

Get serialnumber: C006004A
Get "firmware" version:C00400BA
Backlight ON:C0470020
Backlight OFF:C0480062
Laser ON:C0410096
Laser OFF:C042001E
Start measure:C04000EE

Example measure:
send C04000EE ->reply 00 04 13 0E 00 00 32
Change endianness
distance in mm=0x00000E13*0,05=180mm

Max measurement rate is about 4 times per second


Unknown commands:
C0030074 reply->000100AE


First byte in reply is status:
0x00 -> OK
0x01 -> communication timeout
0x03 -> checksumerror
0x04 -> unknown command
0x05 -> invalid accesslevel
0x08 ->harware error
0x10 ->device not ready
(0D=invalid accesslevel + harware error)


Sensor SPI-bus data is interesting.
Sensor(SPAD) size is 2x32x32 pixels.
It is sending light intensity and something(phase/tof?) to spi bus data.
Capture.jpg image shows data packets collected from spi and visualized per pixel.
Other images are measurement values from serial port (Object is not moving)

« Last Edit: October 29, 2017, 12:39:27 AM by rtv »
 

Offline skipjackrc4

  • Regular Contributor
  • *
  • Posts: 235
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #5 on: October 29, 2017, 08:26:59 AM »
Sensor SPI-bus data is interesting.
Sensor(SPAD) size is 2x32x32 pixels.

Interesting.  So you're saying that that optical sensor is 32x32 resolution?  I would have thought that it would be a single "pixel" to provide time of arrival data with no spatial awareness.  Do you know how they use this spatial data?
 

Offline rtv

  • Newbie
  • Posts: 3
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #6 on: October 30, 2017, 12:33:40 AM »
Array size is quess based on image.

I was able to see external laser pointers dot in intensity part of dataflow, which matched array horizontal positions.
Laser pointer didn't interference with measurement.

I think distance is calculated from phase difference of transmitted and received modulated laser pulse.(+light intensity)
 
The following users thanked this post: Hero999, jgustavoam

Offline skipjackrc4

  • Regular Contributor
  • *
  • Posts: 235
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #7 on: October 30, 2017, 04:14:45 AM »
Very cool to see a closeup of the sensor; thanks!
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #8 on: December 07, 2017, 12:53:38 PM »
Hi Guys,
I´m trying to decifrate how to read data in the GLM20 , too.
I found some interesting things.
I discover that laser sensor uses SPI interface .  Counting pins from right to left (corner solder pins - rear view)

Pin 1 = +3,28V
Pin 2= GND
Pin 3= +1,46V
Pin 4 = +2,18V
Pin 5 = 12 MHz Clock
Pin 6 = SPI- Clock
Pin 7 = SPI-MISO
Pin 8 = SPI-MOSI
Pin 9 = SPI- Enable

Configuration of Logic analyzer :  SPI Decoder

LSB First ( probably)
16 bits per transfer - OK
CPOL = 1 OK
CPHA = 1 OK
Enable Active High OK

Some screens of analyzer. But I cannot decifrate, yet !
See attached images.  Measure = 0.327 meters

Some pictures of GLM20 :
https://www.flickr.com/photos/jgustavoam/albums/72157673963890225


« Last Edit: December 07, 2017, 12:56:36 PM by jgustavoam »
 

Offline rhb

  • Regular Contributor
  • *
  • Posts: 236
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #9 on: December 10, 2017, 01:05:18 PM »
Try reading this:

https://www.acuitylaser.com/measurement-principles

I suspect that what's being done is forming an oscillator using the photodiode to modulate the laser and then measuring the frequency. That seems to me the most viable for US $40 retail pricing. However if it is using an array of photodiodes then it might well be using triangulation.  Though the lack of interference from a laser pointer suggests it is the oscillator method.  Pulse seems a stretch for $40.

I bought one recently and am quite amazed.  I've been interested in doing this for a very long time.
We all get what we deserve whether we want it or not, either as individuals or members of a group.  Sometimes this is as punishment and sometimes it's a blessing.  Which is always ambiguous and depends entirely upon what we do next.
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #10 on: December 10, 2017, 11:04:24 PM »
Hi RTV ,
May you send to us  the high resolution picture of Laser circuit board ?
With this image, I can try to make circuit diagram using my photografic enginering reverse process
Thank you.

Example of my process:
https://www.flickr.com/photos/jgustavoam/albums/72157663264163678
 

Offline rtv

  • Newbie
  • Posts: 3
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #11 on: December 11, 2017, 09:32:01 AM »
Some pcb images.
Sensor board desoldered.

https://app.box.com/s/ses65kecyer8hdrbm8wya31bwv04q62l

note: this is older V6 pcb
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #12 on: December 11, 2017, 10:45:23 AM »
RTV , Thank You very much ! Fantastic !
Here you can see and download my pictures (more high resolution photos) :
https://www.flickr.com/photos/jgustavoam/albums/72157673963890225
« Last Edit: December 11, 2017, 10:52:57 AM by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #13 on: December 11, 2017, 01:48:55 PM »
Using pictures of RTV , I confirmed that interface is SPI ! Thanks RTV .

Counting pins from right to left (corner solder pins - rear view)

GLM 20 Pin 1 = +3,28V  (VCC)
GLM20 Pin 2= GND
Pin 3= +1,46V ??
Pin 4 = +2,18V ??
Pin 5 = 12 MHz Clock
Pin 6 = SPI1- Clock (STM32F051 - pin 55 - PB3)
Pin 7 = SPI1-MISO (STM32F051 - pin 56 - PB4)
Pin 8 = SPI1-MOSI (STM32F051 - pin 57 - PB5)
Pin 9 = SPI1- NSS (STM32F051 - pin 50 - PA15)

See edited images on link :
https://www.flickr.com/photos/jgustavoam/albums/72157673963890225

32F051 Data sheet Link:
http://www.st.com/content/ccc/resource/technical/document/datasheet/55/53/3e/86/29/61/41/d9/DM00039193.pdf/files/DM00039193.pdf/jcr:content/translations/en.DM00039193.pdf
« Last Edit: December 11, 2017, 01:55:08 PM by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #14 on: December 12, 2017, 08:34:08 AM »
Today, more advances.
Editing and verifying images , I found those pins of STM32F051 in the circuit.

P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX


Serial wire debug port (SW-DP)
An ARM SW-DP interface is provided to allow a serial wire debugging tool to be connected to the MCU.

P46 = STM32F051 - SW DIO
P49 = STM32F051 - SW CLK
P07 = STM32F051 - NRST

Note 6. After reset, these pins are configured as SWDIO and SWCLK alternate functions, and the internal pull-up on the SWDIO pin
and the internal pull-down on the SWCLK pin are activated.

I2C Interface !!   (probably -  to be tested)
P61 = STM32F051 - I2C1- SCL
P62 = STM32F051 - I2C1- SDA 


 

Offline chris_leyson

  • Frequent Contributor
  • **
  • Posts: 615
  • Country: wales
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #15 on: December 12, 2017, 09:20:03 AM »
Distance has to be calculated by triangulation and not time of flight or phase detection for modulated lasers. Why would you need all of those pixels, also nothing on that laser board looks remotely high speed. You should really be reverse engineering the plastic optics between the laser the sensor and the target.
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #16 on: December 12, 2017, 09:23:28 AM »
Image of SPI Interface pins of STM32F051 MCU.

Pin 1 = +3,3V  (+VCC)
Pin 2= GND
Pin 3= STM32F051 P08 ? = ADC_IN10
Pin 4 = Emitter of Transistor 3F ?
Pin 5 = 12 MHz Clock
Pin 6 = SPI1- Clock (STM32F051 - pin 55 - PB3)
Pin 7 = SPI1-MISO (STM32F051 - pin 56 - PB4)
Pin 8 = SPI1-MOSI (STM32F051 - pin 57 - PB5)
Pin 9 = SPI1- NSS (STM32F051 - pin 50 - PA15)
« Last Edit: December 12, 2017, 09:27:56 AM by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 7
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #17 on: December 12, 2017, 11:46:36 AM »
I´m studying Laser sensors, and I Think they are Pixelized array detectors for calculating distance by Triangulation.
As RTV reported - two sensors of 32 x 32 pixels (total 1024 pixels each).

Reference material :
http://archives.sensorsmag.com/articles/0598/tri0598/
« Last Edit: December 12, 2017, 12:08:36 PM by jgustavoam »
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf