Author Topic: Hacking the Bosch GLM 20 Laser Measuring Tape  (Read 44403 times)

0 Members and 1 Guest are viewing this topic.

Offline STMartinTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Hacking the Bosch GLM 20 Laser Measuring Tape
« on: September 29, 2017, 03:36:19 am »
MOSTLY IRRELEVANT BACKGROUND
So, I've decided to hack a laser measuring tape (laser distance finder) for a project I've started. My siblings and I have decided to build my dad a cornhole set for his birthday, and my contribution will be an electronic scoring device, which will probably be expanded on in another post. I wanted to incorporate a distance finder so we can set the distance of the boards properly without having to break out the tape measure. I bought the cheapest model I could find; about $50 USD at a home improvement store.

RELATED WORKS
This has been done before. Someone has attempted to hack a model very similar to this one, but it doesn't seem like they figured it out:
http://robotshop.com/letsmakerobots/laser-range-finder-hack
There was/is a Uni-T tape measure that was hacked some years ago and became quite popular among the drone and robotics communities. Although, since then most vendors seem to have caught on, and the price went from about $60 to $100 or more. Sparkfun also has a LADAR module for about $150 that does just what I need. I could go for either of those solutions, but this is more fun and gave me an excuse to buy a logic analyzer. Plus, the Bosch is smaller and lighter than the Uni-T, and cheaper than the Sparkfun module. If I can hack this out, it'd be nice if everyone had another option for their distance measurement needs.

POST PURPOSE
I'll be documenting my progress here. Mostly with the hope that the hack is successful and others can refer here for information. Also I'll inevitably get stuck somewhere, and since I barely know what I'm doing, forum feedback will be invaluable. I'll pretty much be writing this post as I go along.

ON WITH IT THEN
This is our subject, the Bosch GLM 20.



The back cover is held on with 6 Torx T-6 screws. Two of them are under a sticker, which I've already removed.



Taking off the back cover shows us the good stuff. To get the board out entirely, there are two more Torx T-8 screws that hold the board to the front cover.



Now we've got the board itself. First the back...



...and the front.



The first thing I notice are seven test pads on the back of the board. I'll have a poke at those in a minute; first I want to see what else is going on. I can barely see a microcontroller under the optics module. Removing two more Torx T-8 screws should let me take it off.

It doesn't come off easily, so after unclipping the LCD, I can see two pegs holding it to the PCB.



The pegs have nothing to do with it. It seems the laser riser board is glued to the optics module. I'll just desolder the riser board for now so I can get a look at that microcontroller.

Turns out it wasn't glued at all. Mostly desoldering the riser board let me tilt it back very carefully; enough so the optics module came out. The microcontroller is an ARM STM32F051R6:
Datasheet -> http://www.st.com/content/ccc/resource/technical/document/datasheet/55/53/3e/86/29/61/41/d9/DM00039193.pdf/files/DM00039193.pdf/jcr:content/translations/en.DM00039193.pdf



Neat!



There doesn't seem to be any kind of display driver chip, so I assume the micro is controlling the LCD directly, unless there's a chip under the LCD that I can't see. In any case, if I can't get anything out of the debug pads, I'll have to resort to sniffing the LCD signals. Not ideal, but hey.

I buzzed out the debug pads, and found where they go. Going by my picture, from top to bottom (Pad 1 to 7):
1: Pin 7 - Reset
2: Pin 46 - SWDIO (Serial Wire Debug In/Out)
3: Pin 49 - SWCLK (Serial Wire Clock)
4: Battery -
5: Battery -
6: Battery +
7: Through two 5k resistors to Pins 58 and 59 (I2C SCD/SCL, USART TX/RX, Timer 16/17, or touch sensor IO 3/4)

This agrees with other people's work, so it seems I have a good place to start. I'm not going to need access to the microcontroller anymore, so I out everything back together and made sure I didn't ruin it already.



Yay!


That's all the time I have for today, and I'll be gone for the weekend, but I'll keep this post updated as I go along.
« Last Edit: September 29, 2017, 03:47:44 am by STMartin »
 
The following users thanked this post: Zero999, MasterT

Offline alterbaron

  • Contributor
  • Posts: 42
  • Country: ca
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #1 on: September 30, 2017, 07:12:54 pm »
Was this cap in your images originally part of the unit?

 

Offline STMartinTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #2 on: October 01, 2017, 03:11:47 pm »
Uh oh, I hope not. :palm: When I get home I'll compare to the original pictures.

Good eye, though!
 

Offline STMartinTopic starter

  • Contributor
  • Posts: 36
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #3 on: October 08, 2017, 12:11:56 am »
PART 2

POPPIN CAPS
So, as alterbaron pointed out, there's a chance I popped out a capacitor while working on the laser. You can see the desoldered cap in at least two of the pictures. I looked through the pictures I took, and couldn't find anything different, nor could I find the cap (which I was foolish enough to look for). I looked at the unit itself, and found where it possibly went on the laser riser board:



Oops!

It may or may not belong there; but it doesn't seem to matter much; it still seems to work. It does display 'Err' every once in awhile, but that can be cleared by pressing the button again. I can still try and interface with it. If it winds up being an issue, I can slap in a random cap from something in the junk pile, or just get another laser.

In any case, now it's time to start sending some serial commands to this thing!

INITIAL OBSERVATIONS
On the debug pads I found before, I have a choice of Serial Wire Debug (SWD), I2C, or USART. SWD might work for my purposes. I'm not familiar with it at all, but it turns out ARM has a whole suite of tools that would work with SWD; their DS-5 software. Seems like it lets me read data, write data, dump memory, and tons of other useful things. The community (free) edition doesn't support the Cortex-M0, and I have to request a price for any of the other editions. I hate having to contact companies to request pricing, so screw SWD for now, and screw DS-5 in particular.

That leaves I2C and USART. I don't know for sure, but I believe I2C needs at least two wires; I don't think I can do the clock and data from the same wire. All that's left is USART, which is what I'm going to assume the manufacturer intended that pad for. I soldered in some wires to all the pertinent debug pads to see what might be there.



After connecting to the logic analyzer, I fired up the laser.



I don't have the other pads shown here, but trust me: there was nothing. I do get one 11.37 ms pulse on startup from pad 7; nothing more. Lame. I suppose it's time to interface with the Arduino.


ARDUINO INTERFACING...
My computer isn't convenient to use at the bench, so I'm going to try and power this from the Arduino. I ran the power supply through my bench meter set to min/max to measure the current the laser draws. It seems to draw about 100 mA maximum. I have an Arduino Due which can supply up to 800 mA through the 3.3V pin, which should be plenty. The Due uses 3.3 volt logic, and according to the logic analyzer the laser's pulse is about 2.7V. The micro on the laser is 5V tolerant on those pins anyway. All of which is to say, the Arduino should be just fine running the whole show.

This is the test setup:



Since the laser has both Tx and Rx on the same wire, and the Arduino can't do that, the one wire coming out of the laser is going to two pins on the Arduino. The logic analyzer just has to watch that one pin (glad I got the 16 channel version...). I captured the startup again to make sure everything was working as before.



Huh? I get two pulses now? I don't know why this is but it seems to happen randomly. I'm turning the laser on by dragging a wire across the button contacts; which is probably pretty electrically noisy. Maybe that has something to do with it? Anyway, let's start sending some commands.

...DOESN'T WORK THAT WAY
I have found that just connecting the Rx and Tx pins together on the Arduino is not going to work. UART protocol requires the Tx pin to idle high, so everything on the bus stays at logic high. I did some searching for single-wire serial and someone, somewhere suggested a resistor be placed between the Rx and Tx pins, then connect the wire to the Rx side. This didn't work wither, although I may have got the resistance value wrong: I tried using a 2k with no luck. At this point, the logic analyzer isn't seeing the initial 11 ms pulse from the laser anymore.

So I disconnected the laser, and tried to just see the data coming from the Arduino. That doesn't come up either; or maybe the LA triggering isn't properly set. This is probably because I'm triggering on a rising edge, and the Arduino starts out high and stays that way. I also tried looking for a single wire UART library I could slap in, but the only one available comes from Arduino's SoftwareSerial library. This library is only for AVR based boards, which the Due is not. Unlike many Arduino boards, the Due has four hardware UART ports, so I guess nobody thought it was necessary. I may have to bit-bang.

I then tried to just get data coming from the Tx port of the Arduino, and the LA did pick it up sometimes. There were always some kind of framing errors, and sometimes I didn't get anything at all. At this point, I'm not sure if I programmed the Arduino wrong (I'm trying to bit-bang), or if I have the LA triggered wrong, or some of both.

OKAY, START AGAIN FROM THE TOP
All of this so far took place in a few hours here and there during the week. After mulling it over the last few days, I've decided I need to start at the beginning and make sure I can get data out of the Arduino and properly framed on the Analyzer. For that I need to choose between hardware UART or bit-banging my own single wire solution. Once I'm sure I can get data out, and the LA properly triggered, I can move on to sending commands. First thing I'm going to try is two 5k resistors on the Arduino's Rx and Tx lines, just like the laser, and see if that lets me see the 11 ms pulse again.

The 5k resistors don't seem to work, I think. Applying logic high to the laser's serial pin results in the laser turning on with a blank display (although it is illuminated), and no laser. Perhaps this is how they did the testing? When testing the laser and connecting it to a debugger, the Tx line would idle high, turning on the laser. Maybe it's waiting for some commands anyway, and the 11 ms pulse is a red herring? I think I'll try connecting the laser to just the Arduino's Tx pin, sending some commands, and see what happens.



I just sent a blank terminated string, and didn't get anything. At least I know the LA is triggering properly, and the laser is definitely receiving commands, even if it isn't responding. Next, I think I'll start sending some characters and see if anything bites.

On second thought, it may be trying to send something, but I can't see it since the Arduino's Tx line is pulling the bus up. Looks like I'm going to have to bit-bang something to make a single pin workable for serial. Alright, lets make up a quick Single-Wire serial function. I think I'll be ditching the resistor idea too.

A little bit of programming later, I have a workable write function:



It looks pretty much the same as the hardware UART output from the last image; which is good. Now I can have Tx and Rx on the same pin.

I also poked around a little more, and found when the laser is in the blank display mode, it's actually the laser that's pulling up the bus. So perhaps it's time to just go through all the combinations of states for the reset and serial pins, and see exactly what the laser does under all the possible combinations.

Arduino ResetArduino SerialLaser ResetLaser Serial
FloatingFloatingLowLow
LowFloatingLowLow
HighFloatingHigh11.24 ms pulse @ ~4.8 Hz
FloatingLowLowLow
FloatingHighLowHigh (Blank Display Mode)
LowFloatingLowLow
LowHighLowHigh
HighFloatingHighLow
HighHighHighHigh (Blank Display Mode)
LowHigh-ZLowLow
HighHigh-ZHigh11.24 ms pulse @ ~4.8 Hz
High-ZLowLowLow
High-ZHighLowHigh (Blank Display Mode)

NOW WE'RE GETTING SOMEWHERE!
In the process of making that table, I found a few interesting things. For one, the blank display mode happens if the serial pin is high, and the reset is floating or high. It does not happen if the reset pin is low. This makes sense, since the micro's reset is active low. In this condition, the reset pin and serial pin are both latched high when disconnected from the Arduino. It does not enter this mode reliably though. Sometimes it does, sometimes not. I can find no rhyme or reason to it.

Also, if the reset pin is high and the serial pin is floating/high-impedance we get an 11.2 ms pulse at a rate of about 4.8 Hz.



Some kind of heartbeat? Is it waiting for a command? It's obviously similar to the pulse I had on startup. I'm not sure, and I don't know if I'll pursue that thought because...



RS-232!! I don't think it's actual RS-232, as the micro isn't capable of driving negative voltage, and I don't see any converter chips. This came up when I accidentally brushed the serial line against logic high while the reset was floating. It doesn't come up every time, but if reset is floating/high-Z and you brush the serial line against logic high, it comes up fairly frequently. This makes me think I just need to put the right width pulse on the serial line, and I can enter the fabled RS-232 mode. I tried putting my function generator on it, and scrolling through different pulse widths, but all that got me was blank screen mode at about a 150 ms pulse. So, I'm going to see if I can get it in RS-232 mode while the LA is running, and get an idea for what size pulse I'll need.

But before that, I'm going to get something to eat; I'm starving. I'll continue this later tonight, and probably make another post with further progress.
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #4 on: October 24, 2017, 02:44:49 pm »
These commands work with Bosch PLR15 serialport

send frame:    [startbyte][command][length]([data])[checksum]
receive frame: [status][length][...][checksum]

Get serialnumber: C006004A
Get "firmware" version:C00400BA
Backlight ON:C0470020
Backlight OFF:C0480062
Laser ON:C0410096
Laser OFF:C042001E
Start measure:C04000EE

Example measure:
send C04000EE ->reply 00 04 13 0E 00 00 32
Change endianness
distance in mm=0x00000E13*0,05=180mm

Max measurement rate is about 4 times per second


Unknown commands:
C0030074 reply->000100AE


First byte in reply is status:
0x00 -> OK
0x01 -> communication timeout
0x03 -> checksumerror
0x04 -> unknown command
0x05 -> invalid accesslevel
0x08 ->harware error
0x10 ->device not ready
(0D=invalid accesslevel + harware error)


Sensor SPI-bus data is interesting.
Sensor(SPAD) size is 2x32x32 pixels.
It is sending light intensity and something(phase/tof?) to spi bus data.
Capture.jpg image shows data packets collected from spi and visualized per pixel.
Other images are measurement values from serial port (Object is not moving)

« Last Edit: October 28, 2017, 01:39:27 pm by rtv »
 
The following users thanked this post: aounmc

Offline skipjackrc4

  • Regular Contributor
  • *
  • Posts: 239
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #5 on: October 28, 2017, 09:26:59 pm »
Sensor SPI-bus data is interesting.
Sensor(SPAD) size is 2x32x32 pixels.

Interesting.  So you're saying that that optical sensor is 32x32 resolution?  I would have thought that it would be a single "pixel" to provide time of arrival data with no spatial awareness.  Do you know how they use this spatial data?
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #6 on: October 29, 2017, 01:33:40 pm »
Array size is quess based on image.

I was able to see external laser pointers dot in intensity part of dataflow, which matched array horizontal positions.
Laser pointer didn't interference with measurement.

I think distance is calculated from phase difference of transmitted and received modulated laser pulse.(+light intensity)
 
The following users thanked this post: Zero999, jgustavoam

Offline skipjackrc4

  • Regular Contributor
  • *
  • Posts: 239
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #7 on: October 29, 2017, 05:14:45 pm »
Very cool to see a closeup of the sensor; thanks!
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #8 on: December 07, 2017, 01:53:38 am »
Hi Guys,
I´m trying to decifrate how to read data in the GLM20 , too.
I found some interesting things.
I discover that laser sensor uses SPI interface .  Counting pins from right to left (corner solder pins - rear view)

Pin 1 = +3,28V
Pin 2= GND
Pin 3= +1,46V
Pin 4 = +2,18V
Pin 5 = 12 MHz Clock
Pin 6 = SPI- Clock
Pin 7 = SPI-MISO
Pin 8 = SPI-MOSI
Pin 9 = SPI- Enable

Configuration of Logic analyzer :  SPI Decoder

LSB First ( probably)
16 bits per transfer - OK
CPOL = 1 OK
CPHA = 1 OK
Enable Active High OK

Some screens of analyzer. But I cannot decifrate, yet !
See attached images.  Measure = 0.327 meters

Some pictures of GLM20 :
https://www.flickr.com/photos/jgustavoam/albums/72157673963890225


« Last Edit: December 07, 2017, 01:56:36 am by jgustavoam »
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3476
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #9 on: December 10, 2017, 02:05:18 am »
Try reading this:

https://www.acuitylaser.com/measurement-principles

I suspect that what's being done is forming an oscillator using the photodiode to modulate the laser and then measuring the frequency. That seems to me the most viable for US $40 retail pricing. However if it is using an array of photodiodes then it might well be using triangulation.  Though the lack of interference from a laser pointer suggests it is the oscillator method.  Pulse seems a stretch for $40.

I bought one recently and am quite amazed.  I've been interested in doing this for a very long time.
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #10 on: December 10, 2017, 12:04:24 pm »
Hi RTV ,
May you send to us  the high resolution picture of Laser circuit board ?
With this image, I can try to make circuit diagram using my photografic enginering reverse process
Thank you.

Example of my process:
https://www.flickr.com/photos/jgustavoam/albums/72157663264163678
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #11 on: December 10, 2017, 10:32:01 pm »
Some pcb images.
Sensor board desoldered.

https://app.box.com/s/ses65kecyer8hdrbm8wya31bwv04q62l

note: this is older V6 pcb
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #12 on: December 10, 2017, 11:45:23 pm »
RTV , Thank You very much ! Fantastic !
Here you can see and download my pictures (more high resolution photos) :
https://www.flickr.com/photos/jgustavoam/albums/72157673963890225
« Last Edit: December 10, 2017, 11:52:57 pm by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #13 on: December 11, 2017, 02:48:55 am »
Using pictures of RTV , I confirmed that interface is SPI ! Thanks RTV .

Counting pins from right to left (corner solder pins - rear view)

GLM 20 Pin 1 = +3,28V  (VCC)
GLM20 Pin 2= GND
Pin 3= +1,46V ??
Pin 4 = +2,18V ??
Pin 5 = 12 MHz Clock
Pin 6 = SPI1- Clock (STM32F051 - pin 55 - PB3)
Pin 7 = SPI1-MISO (STM32F051 - pin 56 - PB4)
Pin 8 = SPI1-MOSI (STM32F051 - pin 57 - PB5)
Pin 9 = SPI1- NSS (STM32F051 - pin 50 - PA15)

See edited images on link :
https://www.flickr.com/photos/jgustavoam/albums/72157673963890225

32F051 Data sheet Link:
http://www.st.com/content/ccc/resource/technical/document/datasheet/55/53/3e/86/29/61/41/d9/DM00039193.pdf/files/DM00039193.pdf/jcr:content/translations/en.DM00039193.pdf
« Last Edit: December 11, 2017, 02:55:08 am by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #14 on: December 11, 2017, 09:34:08 pm »
Today, more advances.
Editing and verifying images , I found those pins of STM32F051 in the circuit.

P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX


Serial wire debug port (SW-DP)
An ARM SW-DP interface is provided to allow a serial wire debugging tool to be connected to the MCU.

P46 = STM32F051 - SW DIO
P49 = STM32F051 - SW CLK
P07 = STM32F051 - NRST

Note 6. After reset, these pins are configured as SWDIO and SWCLK alternate functions, and the internal pull-up on the SWDIO pin
and the internal pull-down on the SWCLK pin are activated.

I2C Interface !!   (probably -  to be tested)
P61 = STM32F051 - I2C1- SCL
P62 = STM32F051 - I2C1- SDA 


 
The following users thanked this post: A32

Offline chris_leyson

  • Super Contributor
  • ***
  • Posts: 1541
  • Country: wales
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #15 on: December 11, 2017, 10:20:03 pm »
Distance has to be calculated by triangulation and not time of flight or phase detection for modulated lasers. Why would you need all of those pixels, also nothing on that laser board looks remotely high speed. You should really be reverse engineering the plastic optics between the laser the sensor and the target.
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #16 on: December 11, 2017, 10:23:28 pm »
Image of SPI Interface pins of STM32F051 MCU.

Pin 1 = +3,3V  (+VCC)
Pin 2= GND
Pin 3= STM32F051 P08 ? = ADC_IN10
Pin 4 = Emitter of Transistor 3F ?
Pin 5 = 12 MHz Clock
Pin 6 = SPI1- Clock (STM32F051 - pin 55 - PB3)
Pin 7 = SPI1-MISO (STM32F051 - pin 56 - PB4)
Pin 8 = SPI1-MOSI (STM32F051 - pin 57 - PB5)
Pin 9 = SPI1- NSS (STM32F051 - pin 50 - PA15)
« Last Edit: December 11, 2017, 10:27:56 pm by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #17 on: December 12, 2017, 12:46:36 am »
I´m studying Laser sensors, and I Think they are Pixelized array detectors for calculating distance by Triangulation.
As RTV reported - two sensors of 32 x 32 pixels (total 1024 pixels each).

Reference material :
http://archives.sensorsmag.com/articles/0598/tri0598/
« Last Edit: December 12, 2017, 01:08:36 am by jgustavoam »
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #18 on: December 16, 2017, 12:14:08 pm »
Tinkering with firmware  ;)
RS232 text was never visible. But it is in the firmware.

 

Offline chris_leyson

  • Super Contributor
  • ***
  • Posts: 1541
  • Country: wales
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #19 on: December 16, 2017, 12:22:51 pm »
Quote
I´m studying Laser sensors, and I Think they are Pixelized array detectors for calculating distance by Triangulation.
I'm quite sure that's the way they do it but they are getting very good results for such a small 32x32 detector.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3476
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #20 on: December 16, 2017, 03:13:26 pm »
They *might*  be using compressive sensing to increase the spatial resolution.  That would entail reading random sets of pixels multiple times and then solving a linear programming problem. 

That said, I'm rather doubtful that they have the CPU needed to do the math, but they might.  I've never tried solving a comparable problem on a PC and never tried solving *any* linear program on an MCU.

Compressive sensing would give about 5-10x the spatial resolution.  There's a 256x example in the paper, but it's pushing things a bit and required 1300 samples.

www.wisdom.weizmann.ac.il/~vision/courses/2010_2/.../csCamera-SPMag-web.pdf
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #21 on: December 17, 2017, 11:59:42 am »
Link not found .
Thanks.
 


Offline chris_leyson

  • Super Contributor
  • ***
  • Posts: 1541
  • Country: wales
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #23 on: December 17, 2017, 01:09:17 pm »
Quote
They *might*  be using compressive sensing to increase the spatial resolution.
Or maybe just averaging, I don't know but a dump of the image data would give some more insight.
 

Offline rhb

  • Super Contributor
  • ***
  • Posts: 3476
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #24 on: December 17, 2017, 03:00:36 pm »
Averaging won't increase the resolution.  All it does is suppress random noise.

In this instance, the selection of which pixels to use for each time sample would be done in the MCU, so there would not be any significant change in the data coming from the sensor.

Compressive sensing of images has become very highly developed in the last few years.  I've come across some astonishing images.  Unfortunately I've read too many papers to remember what is in any particular paper.  This one is an exception only because it was the first proof of concept.
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #25 on: December 17, 2017, 06:24:23 pm »
Added logic analyzers file and spi data log
https://app.box.com/s/i45rlk1opg1cixjodq9610cojoxmzukh
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #26 on: December 17, 2017, 10:09:35 pm »
Hi RTV ,
As I saw earlier , Laser sensor SPI interface with my logic analyser, this is a large amount of data.
Too dificult to decifrate (yet...)  The MCU uses this large amount of data to calculate distance.  And if we try to comunicate with I2C interface ? Did you see pins that I found ?
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #27 on: December 19, 2017, 03:50:20 pm »
I2C is not enabled after startup
only usart1,spi1,da and adc

Peripheral registers:

RCC_CFGR 0x40021004: 0001000a
RCC_CFGR2 0x4002102c: 00000000
USART1_CR1 0x40013800: 0000002d
USART1_BRR 0x4001380c: 000009c4
USART2_CR1 0x40004400: 00000000
SPI1_CR1 0x40013000: 00000347
SPI1_CR2 0x40013004: 00000f00
SPI2_CR1 0x40003800: 00000000
I2C1_CR1 0x40005400: 00000000
I2C2_CR1 0x40005800: 00000000
DAC_CR1 0x40007400: 00000001
SYCFG_CFGR1 0x40010000: 00000000
COMP12_CSR 0x4001001c: 00000000
ADC_CR 0x40012408: 00000001
« Last Edit: December 19, 2017, 04:21:07 pm by rtv »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #28 on: December 19, 2017, 08:00:16 pm »
Wow ! How did You found those registers ?
Did You use the Serial wire debug port (SW-DP) ?
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #29 on: December 27, 2017, 04:57:01 pm »
Debugging using swd is disabled (protection level 1)
 
But this works:
https://www.aisec.fraunhofer.de/en/FirmwareProtection.html
https://github.com/bikemike/swdFirmwareExtractor

It is possible to extract firmware and burn it back with debugging enabled.
I have done this and the device is still functional.

P58/P59 pin in this picture can be used as a power switch, that is needed in the extractor. +3V power on, 0V power off

https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/?action=dlattach;attach=378292

« Last Edit: December 27, 2017, 05:32:13 pm by rtv »
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #30 on: December 27, 2017, 05:16:06 pm »
It seems that there are debug/admin commands in the serial port.

 
Code: [Select]
Send:  Start_measure_cmd
Parsed reply: Length=7509 ( =375.45mm )
Send:  Get_info_from_last_measurement_cmd
reply: 49001e00030017fc4407c406b1054d078f00a608ef07000039ab2a473920564772b6fb46004d5c47d28ab848f6772543e48139437a470b43a0bc38435f8af043491d0000401d00005e1d0000721d00000000000000000000
parse reply:
parsed value 1=7497
parsed value 2=7488
parsed value 3=7518
parsed value 4=7538

Displayed value is an average of 4 measurement. Rest of the bytes in reply are unknown.


« Last Edit: December 27, 2017, 05:19:35 pm by rtv »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #31 on: December 27, 2017, 06:03:43 pm »
P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #32 on: December 27, 2017, 06:19:00 pm »
P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX
+DC-DC converter enable

It is quite multifunctional pad
 

Offline hsieber

  • Newbie
  • Posts: 3
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #33 on: March 05, 2018, 02:39:16 pm »
I found this thread after starting a project to make a cheap obstruction detector, hopefully using the inexpensive but accurate Bosch GLM20. Looks like a lot of work has been done already. However I am not clear about where STMartins project stands. Is the seventh pad on the board a single-wire serial interface? The fact that this pad is tied to both TX and RX ports of the micro indicates that it is some kind of simplex serial interface. This would require tri-stating, or setting to input mode, the TX pin while waiting for input data, a nuisance but easy enough to do (kind of an async spi interface without the clocks). Is this the port that uses the prototol commands described by rtv? I am hoping to be able to interface through the easily accessible 7th pad. An alternate might be connecting to the 8 pin SPI laser interface as described by jgustavoam. The last resort would be to read the display segment lines, but I really don't want to go there. So the immediate question is as above, is the mysterious 7th pc board pad a usable serial interface?
 

Offline woodchips

  • Frequent Contributor
  • **
  • Posts: 590
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #34 on: March 05, 2018, 05:01:23 pm »
I bought a distance sensor that looks like this one. There was some chat about it then, quite some time ago, where it was decided it is time of flight actually doing the measuring. Don't ask me how! It is impressive that you can get a distance, put a coin in the path and remeasure and it comes up at 1mm or so more.

The old Aga Telurometers used modulated light to measure to mm in km, they were clever. Perhaps that is what happens here?

I use mine to measure how tall trees are, and it is amazing that it can measure to a branch 70' up in the air with the rough bark. It is measuring because slightly moving the sensor gives an equal change in distance.
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #35 on: March 12, 2018, 11:18:08 am »
I am using FTDI VNC2 debug module as usb to single wire serial adapter.
Serial commands are only tested with PLR15.
There are firmware update commands so be careful when using random commands they could erase flash.

Adapter must be powered first because PLR15 starts in uart mode(display stay off) when serial line has pull-up resistor connected to +3V.

another version:
https://www.robotshop.com/letsmakerobots/laser-range-finder-hack?page=1

How to use sensor with SPI is still unknown for most parts.
 

Offline aounmc

  • Newbie
  • Posts: 1
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #36 on: May 02, 2018, 03:20:36 pm »
I am looking into integrating a laser "measuring tape" into a system that we make for the Flat Panel Display measurement industry. I have a GLM 50 which has bluetooth. After the bluetooth driver's are installed, I can communicate with the device using contributor rtv's commands. Does anyone know where he got these commands? With the commands shown, a measurement causes the laser to be turned off after the measurement. Our system will be "continuously" be measuring distance and this will cause the laser to "blink" which is not preferred. I was hoping to find a way to prevent this from happening and better understanding of the serial commands and how they were obtained would be helpful. I have a GLM 100 on order. I am hopeful that it will implement a virtual serial port over the USB interface that I can use instead of bluetooth. It may just be for charging though.

Thanks,
Mike
« Last Edit: May 02, 2018, 03:44:43 pm by aounmc »
 

Offline IDEngineer

  • Super Contributor
  • ***
  • Posts: 1924
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #37 on: May 03, 2018, 03:14:24 pm »
they are Pixelized array detectors for calculating distance by Triangulation
I think we can be reasonably certain they are not using triangulation in this unit. For one thing, the baseline (distance between emitter and detector) is far too small relative to the distances this unit is intended to measure. For another, 32 pixels don't yield the kind of resolution this unit supposedly delivers over its intended measurement range. I know it's a 2D array, but the second axis doesn't really yield any useful additional data for triangulation.

I also don't think they are using the chromatic-based scheme mentioned in some of the cites above, since chromatic schemes rely on a spectrum of wavelengths and the LED emitter in this unit is likely quite monochromatic.

My guess is some adaptation of modulation. Given that this unit measures rather long distances, they could use time of flight for the coarse distance and then employ the array to measure the phase of the arriving reflections to obtain finer resolution.
 

Offline Siwastaja

  • Super Contributor
  • ***
  • Posts: 8110
  • Country: fi
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #38 on: May 03, 2018, 07:04:47 pm »
Continuous wave time-of-flight (modulation + demodulation phase difference measurement) suffers from multi-source mixing, creating so-called "flying result". For example, if the measurement pixel happens to be aimed so that half of the pixel receives light from a nearby object, half from faraway object. In this case, an imaginary average result appears (actually average weighed by the amplitudes of the signal, so the closer obstacle typically dominates the result).

In subtle cases, this can be very problematic to notice: think about a wall at 1000mm, another at 10000mm, and the pixel mostly sees the 1000mm wall, but gets a tiny bit of delayed light from the 10000mm wall, so the result could read as 1050mm, and it's impossible to see the result is plainly wrong.

I could imagine they use a 2D array to deal with this (or this is how I would do it): they have a 3D time of flight depthmap of 32x32=1024 pixels, which is quite a lot for this purpose; I guess the angular resolution is very high, as the full beam is narrow (a few degrees max?). Now, take the median of the 1024 distance values, and count the number of pixels that fall within, say, +/-50mm of that median. If the count is less than, say, 500, report an error (uneven surface; cannot measure). If more than 500, take the average of these near-median pixels to further improve the resolution and reduce noise.
 

Offline IDEngineer

  • Super Contributor
  • ***
  • Posts: 1924
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #39 on: May 03, 2018, 07:14:57 pm »
Agreed, your description of using a 2D array to improve performance for diffuse measurements is a good idea. But that's still time-of-flight, not triangulation. The distances and resolution just don't add up for triangulation in this particular device.
 

Offline Siwastaja

  • Super Contributor
  • ***
  • Posts: 8110
  • Country: fi
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #40 on: May 03, 2018, 07:32:22 pm »
Of course it isn't triangulation. If it was, they would use something like a 1000 or 2000 elements long linear sensor. Plenty of those exist, some specifically marketed for triangulation purposes.

Time of flight is cheap and accurate nowadays, even in multi-kilopixel arrays. In wide beams, it suffers from multipath and modulated stray light, but that's not an issue in an optically well designed narrow beam device.
 

Offline hsieber

  • Newbie
  • Posts: 3
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #41 on: May 18, 2018, 06:48:47 pm »
Update to my post of March 5, 2018. After a lot of research I thought I would take the high road and ask Bosch directly if there were any plans or possibilities to make the laser sensor of the GLM20 available as an OEM item. Answer was a resounding NO. After deciding that although this sensor would be ideal for my project, I would need to look elsewhere, I wasted weeks and weeks looking at other sensors such as the Parallax Ping)), Garmin Lidar-Lite, Mikro Click, and others. None of these approach the accuracy of the Bosch laser unit. I noticed a post on another thread stating that the user found a 'Chinese laser sensor' online, so I searched and found the almost-perfect sensor. Accuracy of +/- 1mm, very simple TTL ASCII interface, under 40 bucks. Downside is slow delivery, sketchy docs and tracking.
So unless you are hacking the Bosch GLM as an intellectual challenge, I would recommend looking on the Chinese market outlet site.
 

Offline IDEngineer

  • Super Contributor
  • ***
  • Posts: 1924
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #42 on: May 18, 2018, 09:02:07 pm »
I noticed a post on another thread stating that the user found a 'Chinese laser sensor' online, so I searched and found the almost-perfect sensor. Accuracy of +/- 1mm, very simple TTL ASCII interface, under 40 bucks. Downside is slow delivery, sketchy docs and tracking. I would recommend looking on the Chinese market outlet site.
Care to share a link to this "almost perfect" sensor for the rest of us? Thanks!
 

Offline hsieber

  • Newbie
  • Posts: 3
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #43 on: May 24, 2018, 01:05:05 pm »
The link to the 'almost perfect' sensor is: http://208.73.204.85/item/50m-164ft-Laser-Distance-Measuring-Sensor-Range-Finder-Module-Low-cost-Diastimeter-Single-Continuous-Measurement/32792768667.html. I was not being secretive, just not sure what forum policy is on commercial links.  There are many other makers of this type of laser sensor on Aliexpress. You can get complete tape measure units, kits, or just sensors.

To be clear, this sensor is 'almost perfect' for my particular application of package size measurement, YMMV. It will not be useful for robotics or drones, because it is slow- it takes 300 ms for a a measurement. However it is accurate and repeatable, as you would expect for the sensor at the heart of a laser tape measure. The 'almost' disclaimer is because of several factors:
1- connection, there is no simple header connector, you need to tack solder to the gold plated pads at the edge of the board. There are connectors but they are not documented and are very small.
2- It looks like each measurement must be triggered, there is no loop mode.
3- Not everyone will like the 3.3v serial interface. It works for me because I have lots of serial ports (xmega128A3U), and I can poll all 3 sensors simultaneously.
4- These come from China, with all the attendant communications, documentation, and delivery/customs issues. I am now waiting for 3 of these sensors that are stuck in customs at Fedex because of import problems (after paying $80 for air ship for $85 worth of sensors).
5- There is an audio beeper that sounds after each measurement. With a sensor for each axis (3), and multiple measurements for averaging/verification, this will sound like a field of crickets. Apparently there is no way to mute/disable it short of clipping it out. Query to maker so far unanswered (wish I spoke Cantonese...)

The interface needs 4 wires, 3.3V, Gnd, Tx, and Rx. Level is 3.3v for comms, at 19.2Kbps. Protocol is dead simple, send 'F', get a string like F: 0.767m, 0150[cr][lf]. Distance is in meters. Not sure what the other figure is, seems to vary even if distance is the same (undocumented, may be calculation time??). Easy to convert to inches:
Code: [Select]
float inches=39.3701*atof(&rxbuf[3]);
I plan to ask Sparkfun if they would add this sensor to their roster, to make getting this sensor easier for everyone.
 

Offline IDEngineer

  • Super Contributor
  • ***
  • Posts: 1924
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #44 on: May 24, 2018, 04:10:06 pm »
The link to the 'almost perfect' sensor is: http://208.73.204.85/item/50m-164ft-Laser-Distance-Measuring-Sensor-Range-Finder-Module-Low-cost-Diastimeter-Single-Continuous-Measurement/32792768667.html.
I feel this urge to buy one just to play with it. I'm sure I can come up with some application for it! "No, honey, of course Junior needs adaptive cruise control on his bicycle. How else will he maintain an accurate following distance proportional to his speed?"
 

Offline viruelaboy

  • Newbie
  • Posts: 1
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #45 on: August 15, 2018, 08:09:56 pm »
quick question. I bought the same measuring tape and I want to accomplish something much simpler. I want to bypass the timed turning off. I was able to get the values using a video ocr but now what I have remaining is for the device to stay on so long as I provide external power to it. any ideas?
 

Offline sifourquier

  • Newbie
  • Posts: 2
  • Country: fr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #46 on: September 08, 2018, 12:52:24 pm »
Hello
Thanks you for your job
I have a PRL30C and the commande Start measure:C0 40 00 EE work realy fin but i try to make a software for direct input measure in computer (simulate a keyboard)
Then is need to read measure when user presse on the button of PLR30C
After snifing PLR measure&go (android app) i found if i send  0xC0 55 02 01 00 1a
Every time i presse the button i receive  C0 55 10 06 00 NN 01 XX XX XX XX 00 00 00 00 00 00 00 00 YY
where NN is a measure counter (+1 at eache measure)
XXXXXXXX increase with distance but is not linear is like a exponantial but segmented
and for YY I think is a crc

Do you have any information about how to go from this "exponantial value" to the distance?
I can found x linear equation 1 by segment but i thing maybe any body have allready make it.

My measurement (max 7.6m i need make measure at more)
http://cortexet.free.fr/autre/measure_auto.ods
http://cortexet.free.fr/autre/measure_auto.csv
 

Offline rtv

  • Contributor
  • Posts: 16
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #47 on: September 12, 2018, 04:26:31 pm »
XX XX XX XX is hexadecimal float.
1089625758==0x40F25E9E==7.57405f==7.6m

And this is how I think crc is calculated:
+ couple commands to test with bluetooth(I don't have BT device)
Code: [Select]
/* BOSCH laser serial data crc value computing */
/* Program prints out crc value of byte array */
/* [0xC0][command][length][data][crc] */


//#include "stdafx.h"
#include "stdio.h"
#include "stdint.h"

#define POLYNOMIAL 166;
#define SEED 170;

//http://www.ti.com/lit/an/slua363/slua363.pdf
int calc_crc(int data_byte, int crc)
{
int bit_mask = 0, carry_check = 0, temp_data = 0;
temp_data = data_byte;
for (bit_mask = 0; bit_mask <= 7; bit_mask++)
{
data_byte = data_byte ^ crc;
crc = crc << 1;
temp_data = temp_data << 1;
carry_check = data_byte & 0x80;
if (carry_check)
{
crc = crc ^ POLYNOMIAL;
}
data_byte = temp_data;
}
return (crc);
}

int main()
{ //test arrays
//received data:
uint8_t data[] = { 0x00, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x08, 0xC1, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; //serial number received from device last byte 0xD4 removed(crc)

//commands:
//uint8_t data[] = { 0xC0, 0x55, 0x02, 0x01, 0x00 }; //crc should be 0x1A. PRL30C Set device as BT master
// these commands might work after device is set as BT master
//uint8_t data[] = { 0xC0, 0x51, 0x02, 0xFF, 0xFF }; //crc should be 0x9C. Get how many measurements in device memory
//uint8_t data[] = { 0xC0, 0x51, 0x02, 0x01, 0x01 }; //crc should be 0x18. Get measurement 1
//uint8_t data[] = { 0xC0, 0x51, 0x02, 0x01, 0x0A }; //crc should be 0x80. Get measurement 10
uint8_t crc = 0;
uint8_t newseed = SEED;
uint32_t bytearraysize = sizeof(data) ;
uint32_t bytepos = 0;
//calculate crc
do
{
newseed = calc_crc(data[bytepos++], newseed);
}while (bytepos < bytearraysize);

crc = newseed;
printf("crc: 0x%X ", crc);
getchar();
return 0;
}

« Last Edit: September 13, 2018, 02:08:26 pm by rtv »
 

Offline sifourquier

  • Newbie
  • Posts: 2
  • Country: fr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #48 on: September 12, 2018, 06:23:58 pm »
Realy thanks you
It is logic why i have no think to that?
 

Offline retroguf

  • Newbie
  • Posts: 1
  • Country: dk
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #49 on: October 16, 2018, 08:35:22 pm »
Hi

I' am  just harvesting the goods of your and everyone elses post here.
I am creating a c# lib for communicating with the bosch glm 50 c  bluetooth distometer.

I have one little problem thou;
i cant get the endian convertion to get the right result.

if i meassure 3729mm i get the result 0d1b hex, which i "reverse" to 1b0d which multiplied by 0,05 is 346,25 in decimal.

my next step would be to capture some more data points and compare with byte and bit wyse endian reversing.
I hope somene have som golden input.

Any input to what my mistake might be?

regards Frank



 

Offline TrickyNekro

  • Regular Contributor
  • *
  • Posts: 246
  • Country: gr
  • Drinking Frappé on the way to Isomnia!
    • Youtube channel, electronics and more ;-)
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #50 on: October 17, 2018, 12:09:51 am »
I haven´t seen if that is actually posted by someone else but...

The photosensor seems to have two seperate arrays, one could be used for ambient detection and dynamic range, the other for that price range would be used for triangulation.

You say the device was unaffected by another laser but... Have you seen if there are any filters in the optics or not? Are you sure your interference laser is of the same wavelength as the sensor laser?
And it could be using a form of modulation to distinct between laser sources, but that would be rather low freq. modulation. You only need to test the laser with a current probe and a scope.
A normal voltage prob even when AC coupled might not bring much, but try it first.
If you are an engineer and you are not tired...
You are doing it wrong!
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #51 on: December 30, 2018, 01:30:17 pm »
Some interesting Patents of Robert Bosch manufacturer, about Laser distance meters :

Laser distance measuring device
https://patents.google.com/patent/US7075626B2

Device for measuring distance using a semiconductor laser in the visible wavelength range
https://patents.google.com/patent/US6369880B1

Measuring Apparatus and Referencing Method for a Digital Laser Distance Meter
https://patents.google.com/patent/US20140168632

Multi-Target Laser Distance Meter
https://patents.google.com/patent/US20170074975A1

Device and method for optical distance measurement
https://patents.google.com/patent/US6801305B2/en

Device and method for optical distance measurement
https://patents.google.com/patent/US7728957B2/en

« Last Edit: December 30, 2018, 01:53:06 pm by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #52 on: December 30, 2018, 02:00:30 pm »
Array size is quess based on image.

I was able to see external laser pointers dot in intensity part of dataflow, which matched array horizontal positions.
Laser pointer didn't interference with measurement.

I think distance is calculated from phase difference of transmitted and received modulated laser pulse.(+light intensity)

I guess you are correct !


Device and method for optical distance measurement
https://patents.google.com/patent/US6801305B2/en

Device and method for optical distance measurement
https://patents.google.com/patent/US7728957B2/en

"In addition to the embodiment that has been described up to this point, which is used essentially to determine the time delay of the measurement signal between the measurement device 10 and the target object 20, an in particular to determine such a time delay by means of a phase measurement, the device 10 according to the present invention also has an additional reception unit 19 equipped with a triangulation sensor 66. This additional reception unit 19 is essentially comprised of a projection lens 51 for the triangulation and a position-sensitive detector 55. In lieu of the projection lens, it is possible to alternatively provide, or to additionally provide along with the projection lens, a circular aperture 53 as a projection aperture, which assures the required depth of field"
« Last Edit: December 30, 2018, 02:10:39 pm by jgustavoam »
 

Offline voltsandjolts

  • Supporter
  • ****
  • Posts: 2281
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #53 on: December 30, 2018, 02:06:43 pm »
if i meassure 3729mm i get the result 0d1b hex

Two bytes doesn't seem enough, maybe should be four bytes like user 'rtv' post above.
IEEE754 floating point format converter:
https://babbage.cs.qc.cuny.edu/ieee-754.old/32bit.html
 

Offline A32

  • Newbie
  • Posts: 1
  • Country: ru
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #54 on: November 21, 2020, 05:39:52 pm »
Hi. What are the components on your picture? I need to  replace them but cant recognize
« Last Edit: November 21, 2020, 05:59:11 pm by A32 »
 

Offline mcb

  • Newbie
  • Posts: 1
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #55 on: February 23, 2021, 01:06:13 pm »
I think that the sensor array is not for triangulation but for laser interferometer.
It seems  plr15 uses laser interferometry with a sweeping laser diode or at least the laser's frequency could be adjustable to measure the distance.
That sensor array is used to get fringe patterns.
 

Offline gjakobsche

  • Newbie
  • Posts: 1
  • Country: us
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #56 on: September 21, 2021, 08:20:43 pm »
Has anyone investigated the pads on the front of the PCB for additional function buttons? The GLM 20 has only one button, but according to the pictures, it has pads for four additional buttons. Do any of them do anything? Or, does Bosch use the same PCB for several models of LDMs, perhaps with different microcode and/or different microcontrollers?
-George
 

Offline Razor512

  • Regular Contributor
  • *
  • Posts: 156
  • Country: 00
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #57 on: September 24, 2021, 06:12:07 am »
Sorry if off topic, I was wondering do any of the common laser distance measuring devices have a simple way to increase the laser's output power? Most tend to do a fraction of a milliwatt, but often have laser modules that can easily do 5 milliwatts+


One of the biggest issues especially with lower cost devices, is measurements and accuracy when light levels are high or when outdoors. The more expensive devices will have a brighter laser that allows them to do things like measure 40-50 meters outdoors, while some cheaper ones (rated for 60+ meters) will have the laser become invisible after around 15-20 meters outdoors, thus causing the unit to fail to measure the distance. It would also be interesting considering how it is common to see 3 or so different models of a cheap laser distance measure where they look the same but for the max range and laser intensity. It makes me thing they are just increasing the upper limit on what numbers it will display in firmware, and then increasing the laser output to cover that distance.

It would be awesome if  the laser output could be tweaked for a little higher output while still maintaining accuracy.
« Last Edit: September 24, 2021, 06:25:00 am by Razor512 »
 

Offline iliasam

  • Newbie
  • Posts: 1
  • Country: ru
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #58 on: October 13, 2021, 08:07:56 am »
Also sorry for offtopic, maybe my research would we interested to someone here: https://github.com/iliasam/Laser_tape_reverse_engineering
I successfully completed reverse engineering hardware of a cheap chinese laser tape measure and write my own code for its MCU.
I was more concentrated at measurements speed instead of accuracy.

Back to topic: I tried to make reverse engineering of my BOSCH PLR15 laser tape measure a long time ago - nearly in 2015. It has the same SOC sensor as was mentioned here.
I suppose that this integrated sensor is containing two SiPM photosensors: https://en.wikipedia.org/wiki/Silicon_photomultiplier
SiPM sensors are containing a lot of SPAD diodes, connected in parallel, so it is not possible to say that BOSCH sensor can detect and analyze image. 
Probably this laser tape measure is using phase method for distance measurement - one photosensor is used for measuring distance, another one is used as a reference channel.
I tried to analyze SPI data and (as I can remember) - resulting data was looking as sinusoidal signals.
Also there was some strange data that I can't process.
 

Offline Dainius_UK

  • Newbie
  • Posts: 1
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #59 on: October 18, 2021, 11:24:48 pm »
Hi.
Thanks everyone for sharing your research.
Don't know if this will have any benefit to anyone or this research. But I have decompiled "Bosch MeasureON" android apk file using "JADX"https://github.com/skylot/jadx

https://www.dropbox.com/s/3xcvlzzflls3eky/Crc.PNG?dl=0
https://www.dropbox.com/s/x2gimzjl9at4388/MtBLE.PNG?dl=0
https://www.dropbox.com/s/x0x5j41wt9qxgzp/MtFrame.PNG?dl=0
https://www.dropbox.com/s/loe53yrf6579fnr/MtProtocol.PNG?dl=0

And there is tons of info on Bosch GLM100C measure tape connection protocols, crc calculation, both classic and BLE......
« Last Edit: October 18, 2021, 11:30:30 pm by Dainius_UK »
 

Offline elham

  • Newbie
  • Posts: 1
  • Country: ir
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #60 on: November 20, 2021, 11:35:50 am »
Dear Sir,
thank you for sharing information's about hacking PLR15 and GLM20.
I can read data from the connection of two board on the leaser, but I could not read the serial data of PLR15.
can you please help me?
I am waiting for your answer.
Best  regards
 

Offline anm

  • Newbie
  • Posts: 1
  • Country: ru
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #61 on: January 25, 2022, 09:40:13 am »
I read out firmware binary from BOSCH GLM 250 VF and disassembled it. Then I wrote python script for communicating with rangefinder by UART and read distance. But after this rangefinder doesn't works in normal mode with batteries - it beeps always when turned on (as if continuously press buttons). Think made some damages while soldered wires. Has anyone had the same problem?
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #62 on: November 13, 2022, 12:02:56 pm »
To colleagues who have Bosch measuring tapes with Bluetooth, I have this suggestion to make.
You will be able to help us a lot to decipher the serial communication with the tape.

Using Bosch's Measure ON Android app, use this procedure to capture the Bluetooth communication protocol.

Measure ON:

https://play.google.com/store/apps/details?id=com.bosch.ptmt.measrOn

Bluetooth Capture procedure:
https://support.honeywellaidc.com/s/article/How-to-capture-Bluetooth-traffic-from-and-to-an-Android-Device

On the applicable Android devices, it is possible to capture Bluetooth traffic as follows:
- Go to Settings
  If developer options is not enabled, enable it now.
https://www.digitaltrends.com/mobile/how-to-get-developer-options-on-android/

- Go into developer options
  Enable the option Enable Bluetooth HCI snoop log
   Enable the Bluetooth option and Connected to the device.
- Perform the actions which need to be captured. Run Measure ON app.
- Turn off the Bluetooth on the device.
- Disable the option Enable Bluetooth HCI snoop log
- Make sure the device is connected to the PC.

As the relevant files might not be shown in a PC's file browser in 'Internal Storage', copy the file to a PC by means of the Android Debug Bridge:  adb pull /sdcard
The files of interest are btsnoop_hci.log and all files with the extension .cfa
These are binary files, which can be opened with Wireshark.
https://www.wireshark.org/

How To Reverse Engineer A Bluetooth Device
https://youtu.be/NIBmiPtCDdM


With this other application you will be able to obtain a lot of important information about Bluetooth communication.
nRF Connect for Mobile:
https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp

Any questions about the apps, contact me
Thanks in advance.


« Last Edit: November 13, 2022, 12:10:23 pm by jgustavoam »
 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #63 on: March 15, 2023, 04:52:50 pm »
Hi all,

i have a BOSCH GLM 50-27 cg.
i try to connect it to my ubuntu machine.
when using bluetoothctl i am able to connect to it, but when i try to pair with it, the connection is lost.
when using some python script (or c even) the device is not even discovered.
Any help would be much appreciated.
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #64 on: March 15, 2023, 11:57:31 pm »
Hi Kosnik,

Normally, measuring devices use Bluetooth Low energy, which has a different protocol than Bluetooth Classic. Probably the GLM50 uses BLE.
Reading suggestion:
https://punchthrough.com/category/ble/
 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #65 on: March 20, 2023, 06:18:03 pm »
Hi JG!
I think you  were right!
As soon as I tried to connect (no pairing for BLE) then it seems that I am able to connect
and receive some info about the device (services and UUIDs for example).
So thank you for the tip, it was a breakthrough!
Now, I am trying to snif some bluetooth messages with my android smartphone as suggested in your previous post.
However I was not able to find any service or uuid in the wireshark log file.
On the other hand, googling some of the UUIDs I found this page:

https://devzone.nordicsemi.com/f/nordic-q-a/80589/sniffing-a-bosch-laser-tape-2

so I am "assuming" (yes, I know...) that it is the correct UUID.
I'll look into it again.
Once again, thanks!
 

Offline artag

  • Super Contributor
  • ***
  • Posts: 1061
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #66 on: March 20, 2023, 08:04:14 pm »
As the relevant files might not be shown in a PC's file browser in 'Internal Storage', copy the file to a PC by means of the Android Debug Bridge:  adb pull /sdcard
The files of interest are btsnoop_hci.log and all files with the extension .cfa

I have a PLR 40 C and a moto g(50) running android 12

I've done the procedure above and briefly tried it :

- enabled log
- make a measurement, which spoke the measurement on the phone
- disable log
adb
adb pull /sdcard

This gives me all of sdcard but I can't see any logfiles in it
Do I need to do anything else ? Or is the switching of bluetooth on the Bosch critical ? I'm not practised with adb.
« Last Edit: March 20, 2023, 08:05:52 pm by artag »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #67 on: March 20, 2023, 08:51:28 pm »
Hi Artag,
Look for the file in the Android/data folder.
The file of interest is btsnoop_hci.log.
This is a binary file, which can be opened with Wireshark.
 

Offline artag

  • Super Contributor
  • ***
  • Posts: 1061
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #68 on: March 20, 2023, 09:02:03 pm »
No such file, at least within the /sdcard copy pulled from adb
Most of them start com.motorola or com.google. Nothing with bt in at all.
Maybe I need to do more to get the file flushed beforte it ends ?

I did try to look in the root device while adb was connected and I had no permission to look in data
(bastards ! whose phone is it anyway !)

oh, just noticed that I have to toggle bluetooth after enabling logging

.. but still not there

Looking at some suggestions in https://stackoverflow.com/questions/23877761/sniffing-logging-your-own-android-bluetooth-traffic
There's no 'FileName' in  the config file

« Last Edit: March 20, 2023, 09:54:40 pm by artag »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #69 on: March 20, 2023, 09:15:37 pm »
This file is in the root of Android device, not  the SD card.
Look for the file in the Android/data folder.
The file of interest is btsnoop_hci.log.
You can then share the file via your email. It was the simplest way I found to transfer.
This is a binary file, which can be opened with Wireshark.
 

Offline artag

  • Super Contributor
  • ***
  • Posts: 1061
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #70 on: March 20, 2023, 10:00:30 pm »
https://stackoverflow.com/questions/28445552/bluetooth-hci-snoop-log-not-generated/30352487#30352487

It seems like it could be in a number of places. I'm trying the bugreport route

I also have hardware sniffing devices - nrf8240 etc. haven't really tried those but I could do with workling them out, I need to do some ble debugging for another project


The bugreport file contains it here :

$ ls -l ~/FS/data/misc/bluetooth/logs/
total 168
-rw-r--r-- 1 adrian adrian     16 Mar 20 21:07 btsnoop_hci.log
-rw-r--r-- 1 adrian adrian 166989 Mar 20 21:59 hci_snoop20230320210739.cfa

So I guess I need to root it to get that easily. The logfile contains very little :

00000000  62 74 73 6e 6f 6f 70 00  00 00 00 01 00 00 03 ea  |btsnoop.........|
00000010

The cfa is rather bigger, and wireshark can read it
Maybe it's more useful to try to get a smaller number of transactions in each log
« Last Edit: March 20, 2023, 10:09:08 pm by artag »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #71 on: March 20, 2023, 10:12:19 pm »
Review the procedures.
Something is wrong.
 

Offline artag

  • Super Contributor
  • ***
  • Posts: 1061
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #72 on: March 20, 2023, 10:14:07 pm »
It seems to follow the scheme written in that last stackoverflow entry

https://stackoverflow.com/questions/28445552/bluetooth-hci-snoop-log-not-generated/30352487#30352487

UPDATE: The btsnoop hci log seems to be getting phased out of the user-accessible areas on a lot of phones. Assuming you have hci logging enabled, you can get a bugreport

adb bugreport anewbugreportfolder
Then decompress the folder. If you're lucky there is an 'FS' folder that contains the btsnoop_hci.log log several layers down (not sure why some phones have this and some don't.) If you don`t have it, grab the bug report text file that looks like this

bugreport-2018-08-01-15-08-01.txt


 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #73 on: March 21, 2023, 11:48:12 am »
Artag,
If your Android device doesn't have access to the file, try with an older device. In my case, I used a Tablet S2 Samsung Android 7.0. And it worked.
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
« Last Edit: March 21, 2023, 12:21:45 pm by jgustavoam »
 
The following users thanked this post: artag

Offline artag

  • Super Contributor
  • ***
  • Posts: 1061
  • Country: gb
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #75 on: March 22, 2023, 02:36:42 am »
Artag,
If your Android device doesn't have access to the file, try with an older device. In my case, I used a Tablet S2 Samsung Android 7.0. And it worked.

Good point, I'll try an older phone. If it's got that log capability at all :).
The bugreport thing is OK though, just seems silly offloading everything for just one file. They've optimised it for filing bug reports rather than unpicking protocols :)

 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #76 on: March 22, 2023, 04:21:48 am »
I finally got USB/Serial communication with the Bosch GLM20 !! I will post shortly.
I used a CP2102 USB/Serial interface (module) with some resistors, 74HC00 and schotky diode.
Tested with Realterm program (9600 Bps 8N1) - Windows 10

pins of STM32F051 in the circuit - connected to interface USB/Serial

P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX

Some tests:

Measuring (mm) :       /20 or x 0.05 (same)
C0 40 00 EE => 00 04 45 C9 00 00 84    0xC945 = 51525 / 20 = 2576.25 mm

C0 40 00 EE  =>  00 04 6C 1F 00 00 AA   0x1F6C = 8044 x 0.05 = 402.2 mm

0xC0 0x06 0X00 0X4A = Get Serial Number (best test to verify results)
C0 06 00 4A  => 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3E  (Hexadecimal)
ÀJ603/3601K72EG0>   (ANSI) Bingo !!!! that is correct!

0xC0 0x41 0X00 0X96 = Laser ON
C0 41 00 96  =>  00 00 82

0xC0 0x42 0X00 0X1E = Laser OFF
C0 42 00 1E   => 00 00 82

0xC0 0x47 0X00 0X20 =    Backlight ON
C0 47 00 20   => 00 00 82

0xC0 0x48 0X00 0X62 =    Backlight OFF
C0 48 00 62 => 00 00 82


Thanks to everyone who contributed here on the forum.


« Last Edit: March 22, 2023, 04:48:12 am by jgustavoam »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #77 on: March 22, 2023, 05:47:32 pm »
GLM20 - Interface USB/Serial

Following the forum instructions, I've done several communication tests in the past with the GLM20. But my tests failed. I got frustrated and stopped.
Rereading all the threads, I realized that the PRL15 circuit board was identical to the GLM20. (Thanks RTV). I thought - it has to work!
If the RTV colleague did it, I think I can too.

Yesterday, doing more tests using an oscilloscope to monitor the waveform of the serial signal on pin P58/P59, I received a response to a command. But the received signal was truncated. I realized that the low level of the signal was at 1V, inadequate for reception.

After that, I built a circuit using resistors, schottky diode, a 74HC00 chip and managed to correctly read the received data.

Today thinking happily about being able to read the data, I built another simpler circuit, with a 74HC07 chip. Why HC chip? Because it works with 3.3V! Do not use an ordinary 7407.

This is the circuit built by me. It's the first one that worked with my tests. I checked with the oscilloscope and the signal is fine. We can then make other improvements if necessary.

Usage sequence:
1) press the power button on the GLM20
2) Press the reset button SW2 (display turns off)
3) Press the SW1 button to activate the communication (backlight on)
4) Run a terminal program connected to the USB of the CP2102 module - 9600 Bps 8N1.
5) Send the command and you will see the results.

To do later
- Connect with an Arduino, Raspberry PICO or ESP32
- Make a Golang program to run on a Windows/Linux/MAC


Thanks RTV - instructions to use Realterm:

https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/msg1450020/#msg1450020

Display as = HEX SPACE OR ANSI


« Last Edit: March 22, 2023, 06:34:43 pm by jgustavoam »
 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #78 on: April 16, 2023, 09:23:16 pm »
Hi all again,

with your help, some time and some research I am able to ask the GLM 50-27 to take a measurement, and I can read it back (python).
However, I noticed one thing i need your help with:
in order to be able to read the indications of the characteristic (which inculde the measurement) the device has to be FIRST connected to the official app (android).
Then, one can read the indicaitons.
If the laser tape does not get connected to the official app initially, the indications are not there.
So to clarify things, this is how it works: i connect the lase tape to the official android app. I then disconnect it. And afterwards I am able to use the python script to read measurements.
Does this ring any bells?
Thank you in avdvance.
« Last Edit: April 16, 2023, 09:25:54 pm by kosnick »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #79 on: April 16, 2023, 11:18:04 pm »
Hi Kosnick,
Congratulations on achieving Bluetooth communication with your Bosch laser tape.
I have been looking into Bluetooth BLE communication as I am involved in a project at work.
The normal sequence of a BLE communication with Android is this:
https://punchthrough.com/android-ble-guide/
- perform a BLE scan
- connect to the BLE server (Laser Tape)
- discover services and charactheristics
- subscribe to notifications or indications
- perform read or write operation

You can do all this with Python, C++, Golang or another language.
There is no need to connect the device with the original app.






 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #80 on: April 17, 2023, 08:52:42 am »
well it seems something is not quite right...
I do connect to the device and since i know the uuid of both the service and the characteristic, i subscribe to those.
And enable indications.
So at this point I can constantly receive some indications from the device, which I do not know how to interpret, but is of no importance (i think).
But these indications do not include any measurement values.
As soon as i connect the device to the official app, and disconnect it immediately, I am able to receive new indications which include the measurement value  (by the way, on the same handle as previously).
It seems to me that the "connection to the official app" does a little extra on the indications and hence I am able to receive the measurement data when I include this part in my tests.
But i can not figure it out - I have sniffed with my android smartphone and checked on the wireshark and also used the nRF connect app on the phone too. But with no results.
Once again, thanks for your help.
« Last Edit: April 17, 2023, 08:54:13 am by kosnick »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #81 on: April 17, 2023, 05:49:32 pm »
Kosnik,

There is a very interesting tool for you to discover services and characteristics of an Android device. Use the NRF connect app to connect the laser tape and browse and test services and features.
Try to identify which characteristic is used for the measurement.

nRF Connect for Mobile
https://www.nordicsemi.com/Products/Development-tools/nrf-connect-for-mobile

https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp&hl=pt_BR&gl=US

Recommendations for study:


https://github.com/prudhvirajstark/BoschGLM50C

https://github.com/Scarfsail/BoschGLM50

https://github.com/piannucci/pymtprotocol

https://github.com/philipptrenz/BOSCH-GLM-rangefinder

https://github.com/fantom3ds/LaserBluetooth



« Last Edit: April 17, 2023, 05:55:41 pm by jgustavoam »
 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #82 on: April 17, 2023, 06:52:39 pm »
JG,

I already have. But I am somehow stuck at the moment.
Both nRF connect , and bluetooth sniffing with the android phone have the same results.
I tried investigating the log from the sniffing, but this is where I am stuck.
I need to investigate a little more.
There is one thing I noticed, that happens just after the enable of the indications and this I want to check.
Let's see.
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #83 on: April 17, 2023, 09:25:13 pm »
Kosnick,

Post the logs of your tests and then I can try to help you.
See that the commands are the same as the ones I used on the USB/Serial interface.


https://github.com/philipptrenz/BOSCH-GLM-rangefinder/blob/master/glm100c.py

 cmds = {
        'measure':          b'\xC0\x40\x00\xEE',
        'laser_on':         b'\xC0\x41\x00\x96',
        'laser_off':        b'\xC0\x42\x00\x1E',
        'backlight_on':     b'\xC0\x47\x00\x20',
        'backlight_off':    b'\xC0\x48\x00\x62'
    }
« Last Edit: April 17, 2023, 09:27:40 pm by jgustavoam »
 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #84 on: April 25, 2023, 06:06:00 am »
Hi Gustavo!

First of all, once more, thank you for taking the time to take a look at it.
I have been working on the project based on this post: https://devzone.nordicsemi.com/f/nordic-q-a/80589/sniffing-a-bosch-laser-tape-2
As you may see, on some devices the protocol is different to the one you are mentioning.
I have also posted on that forum asking for help.
Anyway, pcap files are not allowed to be sent here, so I sent you a pm with a link.

 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #85 on: April 25, 2023, 01:25:38 pm »
Kosnick, I think it's best to continue your project on the other forum. As soon as possible I will answer it.
 

Offline kosnick

  • Newbie
  • Posts: 7
  • Country: gr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #86 on: April 25, 2023, 04:19:13 pm »
ok, thanks again
 

Offline Njk

  • Regular Contributor
  • *
  • Posts: 193
  • Country: ru
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #87 on: April 25, 2023, 08:40:48 pm »
It's still remains, how do they do it. The speed of light is so high, the time difference is hard to measure for short ranges. OTOH, the mentioned triangulation technique (with pixels or whatever) does not work well for a long distances. Some devices, like aviation altimeters, measures the modulated signal phase difference, not directly the TOA difference. Related geodetic instruments like Tellurometer also measures the phase difference. E.g. the CA 1000 model

https://vm.civeng.unsw.edu.au/surveying/f_pall/html/e9.html

"Both units radiate an X-band microwave carrier tuneable between 10.10 and 10.45 GHz which is frequency modulated in the 19 to 25 MHz range. The Remote unit receives the transmission and re-transmits it to the Master, which measures the phase difference between the transmitted and received signals."

Quite complex arrangement, with Master and Slave units. Acoustic engineers knows about the ringing phenomenon, when the loudspeaker signal is picked up by the mic resulting in the sound of ringing frequency. If one can set up such ringing over an RF link, then the distance between the transmitters can be calculated through measurement of the ringing frequency, that's very simple. Just thinking
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #88 on: April 26, 2023, 10:50:21 am »
Hi NJK,
Searching for an answer in ChatGPT - artificial intelligence:     https://chat.openai.com/

Do you trust this answer?

How does the bosch measuring tape laser distance sensor work?

The Bosch measuring tape with laser distance sensor is a measuring tool that uses a laser distance sensor to measure the distance between two points with high precision. The laser distance sensor emits a short-duration laser beam and measures the time it takes for the laser beam to reflect off an object and return to the sensor. Based on the laser's travel time and the speed of light, the sensor is able to calculate the distance accurately.

Here are the main steps on how the Bosch measuring tape laser distance sensor works:

1.Laser beam emission: When you press the measurement button on the Bosch measuring tape, the laser distance sensor emits a short-duration laser beam towards the object you want to measure.

2.Laser beam reflection: The laser beam hits the object and is reflected back towards the sensor.

3.Laser beam detection: The laser distance sensor in the Bosch measuring tape detects the reflected laser beam using a light-sensitive receiver.

4.Measurement of travel time: The laser distance sensor measures the time it takes for the laser beam to travel from the sensor to the object and back, based on the time difference between the laser emission and the detection of the reflected beam.

5.Distance calculation: Based on the laser's travel time and the speed of light (which is constant), the Bosch measuring tape laser distance sensor calculates the distance between the sensor and the object with high precision.

6.Display of the result: The measurement result of the distance is displayed on the Bosch measuring tape's display, usually in units of measurement such as meters, centimeters, feet, or inches, depending on the tape's settings.

It is important to follow the manufacturer's instructions and take safety precautions when using the Bosch measuring tape laser distance sensor or any other laser measuring tool. Make sure to read and understand the user manual and use appropriate safety goggles when operating the Bosch measuring tape or any other laser tool.
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #89 on: April 26, 2023, 11:01:06 am »
Searching for an answer in ChatGPT - artificial intelligence:     https://chat.openai.com/

How long does it take a laser beam to travel a distance of 1 meter?

The speed of light in a vacuum is approximately 299,792,458 meters per second (m/s), which is the fastest speed that any information or signal can travel in the universe. Therefore, it takes approximately 3.34 nanoseconds (ns) for a laser beam to travel a distance of 1 meter in a vacuum.

It's important to note that the speed of light can vary slightly depending on the medium through which it is traveling. For example, light travels slightly slower in air, glass, or other materials compared to a vacuum, due to the refractive index of the material. However, for practical purposes, the speed of light in a vacuum is often used as a constant value in most calculations and measurements involving laser distance sensors or other laser-based technologies.

-----------------------------------------------------------------------

Based on these statements, we can conclude that the time taken for the laser to be reflected is twice that time, therefore

2 x 3.34 nanoseconds = 6.69 ns

If the timer is based on pico seconds resolution, good accuracy can be achieved.

1 nano second = 1000 pico seconds (10⁻¹²)

6.69 ns = 6690 ps


Links suggested by me in 2018:

Device and method for optical distance measurement
https://patents.google.com/patent/US6801305B2/en

Device and method for optical distance measurement
https://patents.google.com/patent/US7728957B2/en
« Last Edit: April 26, 2023, 11:09:44 am by jgustavoam »
 

Offline Njk

  • Regular Contributor
  • *
  • Posts: 193
  • Country: ru
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #90 on: April 26, 2023, 08:07:31 pm »
Searching for an answer in ChatGPT - artificial intelligence:     https://chat.openai.com/

Hi jgustavoam

Automated script reading machines are not only funny. Good occupation area for the crowds of developers and sellers is even more important achievement. As for average Joe, he's not yet legally obliged to consume that BS. I'm sure they're working on that tirelessly, but for now I'm happy to exercise my freedom.

Links suggested by me in 2018:

Device and method for optical distance measurement
https://patents.google.com/patent/US6801305B2/en

Device and method for optical distance measurement
https://patents.google.com/patent/US7728957B2/en

Thanks for the Bosch patents, very interesting.
 

Offline hdlbq

  • Newbie
  • Posts: 1
  • Country: fr
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #91 on: August 16, 2023, 09:23:56 am »
Hi,
First, thanks for all the valuable information you shared.
I'm trying to measure the altitude of a mid-size drone with a Bosch PLR15. I realize that I have to be careful with the laser beam.
My first attempt to simply communicate with the PLR15 failed completely.
I connected a VNC2 FTDI to the Ground, VCC and Rx/TX pads like described earlier by rtv:
I am using FTDI VNC2 debug module as usb to single wire serial adapter.
Serial commands are only tested with PLR15.
There are firmware update commands so be careful when using random commands they could erase flash.
Unfortunately, I can't receive any answer to my commands, sent using a Terminal emulator on my PC (9600 bauds, 1 Bit Stop, No Parity, no Handshake)
I soldered the wires to the PCB to be able to use the PLR15 almost normally (see pictures joined)
Thanks for your help
« Last Edit: August 16, 2023, 09:26:34 am by hdlbq »
 

Offline jgustavoam

  • Contributor
  • Posts: 32
  • Country: br
  • Retired IBM
    • Gustavo Murta Blog
Re: Hacking the Bosch GLM 20 Laser Measuring Tape
« Reply #92 on: August 16, 2023, 02:27:09 pm »
HDLBQ,

I recommend using the circuit I posted. This circuit was tested with the GLM20 tape, but it looks similar to the PLR15 tape.



GLM20 - Interface USB/Serial

Following the forum instructions, I've done several communication tests in the past with the GLM20. But my tests failed. I got frustrated and stopped.
Rereading all the threads, I realized that the PRL15 circuit board was identical to the GLM20. (Thanks RTV). I thought - it has to work!
If the RTV colleague did it, I think I can too.

Yesterday, doing more tests using an oscilloscope to monitor the waveform of the serial signal on pin P58/P59, I received a response to a command. But the received signal was truncated. I realized that the low level of the signal was at 1V, inadequate for reception.

After that, I built a circuit using resistors, schottky diode, a 74HC00 chip and managed to correctly read the received data.

Today thinking happily about being able to read the data, I built another simpler circuit, with a 74HC07 chip. Why HC chip? Because it works with 3.3V! Do not use an ordinary 7407.

This is the circuit built by me. It's the first one that worked with my tests. I checked with the oscilloscope and the signal is fine. We can then make other improvements if necessary.

Usage sequence:
1) press the power button on the GLM20
2) Press the reset button SW2 (display turns off)
3) Press the SW1 button to activate the communication (backlight on)
4) Run a terminal program connected to the USB of the CP2102 module - 9600 Bps 8N1.
5) Send the command and you will see the results.

To do later
- Connect with an Arduino, Raspberry PICO or ESP32
- Make a Golang program to run on a Windows/Linux/MAC


Thanks RTV - instructions to use Realterm:

https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/msg1450020/#msg1450020

Display as = HEX SPACE OR ANSI
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf