Hacking the Bosch GLM 20 Laser Measuring Tape

[rtv]

Added logic analyzers file and spi data log
https://app.box.com/s/i45rlk1opg1cixjodq9610cojoxmzukh

[jgustavoam]

Hi RTV ,
As I saw earlier , Laser sensor SPI interface with my logic analyser, this is a large amount of data.
Too dificult to decifrate (yet...)  The MCU uses this large amount of data to calculate distance.  And if we try to comunicate with I2C interface ? Did you see pins that I found ?

[rtv]

I2C is not enabled after startup
only usart1,spi1,da and adc

Peripheral registers:

RCC_CFGR 0x40021004: 0001000a
RCC_CFGR2 0x4002102c: 00000000
USART1_CR1 0x40013800: 0000002d
USART1_BRR 0x4001380c: 000009c4
USART2_CR1 0x40004400: 00000000
SPI1_CR1 0x40013000: 00000347
SPI1_CR2 0x40013004: 00000f00
SPI2_CR1 0x40003800: 00000000
I2C1_CR1 0x40005400: 00000000
I2C2_CR1 0x40005800: 00000000
DAC_CR1 0x40007400: 00000001
SYCFG_CFGR1 0x40010000: 00000000
COMP12_CSR 0x4001001c: 00000000
ADC_CR 0x40012408: 00000001

[jgustavoam]

Wow ! How did You found those registers ?
Did You use the Serial wire debug port (SW-DP) ?

[rtv]

Debugging using swd is disabled (protection level 1)
 
But this works:
https://www.aisec.fraunhofer.de/en/FirmwareProtection.html
https://github.com/bikemike/swdFirmwareExtractor

It is possible to extract firmware and burn it back with debugging enabled.
I have done this and the device is still functional.

P58/P59 pin in this picture can be used as a power switch, that is needed in the extractor. +3V power on, 0V power off

https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/?action=dlattach;attach=378292

[rtv]

It seems that there are debug/admin commands in the serial port.

 

Code: [Select]

Send:  Start_measure_cmd
Parsed reply: Length=7509 ( =375.45mm )
Send:  Get_info_from_last_measurement_cmd
reply: 49001e00030017fc4407c406b1054d078f00a608ef07000039ab2a473920564772b6fb46004d5c47d28ab848f6772543e48139437a470b43a0bc38435f8af043491d0000401d00005e1d0000721d00000000000000000000
parse reply:
parsed value 1=7497
parsed value 2=7488
parsed value 3=7518
parsed value 4=7538
Displayed value is an average of 4 measurement. Rest of the bytes in reply are unknown.

[jgustavoam]

P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX

[rtv]

P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX
+DC-DC converter enable

It is quite multifunctional pad

[hsieber]

I found this thread after starting a project to make a cheap obstruction detector, hopefully using the inexpensive but accurate Bosch GLM20. Looks like a lot of work has been done already. However I am not clear about where STMartins project stands. Is the seventh pad on the board a single-wire serial interface? The fact that this pad is tied to both TX and RX ports of the micro indicates that it is some kind of simplex serial interface. This would require tri-stating, or setting to input mode, the TX pin while waiting for input data, a nuisance but easy enough to do (kind of an async spi interface without the clocks). Is this the port that uses the prototol commands described by rtv? I am hoping to be able to interface through the easily accessible 7th pad. An alternate might be connecting to the 8 pin SPI laser interface as described by jgustavoam. The last resort would be to read the display segment lines, but I really don't want to go there. So the immediate question is as above, is the mysterious 7th pc board pad a usable serial interface?

[woodchips]

I bought a distance sensor that looks like this one. There was some chat about it then, quite some time ago, where it was decided it is time of flight actually doing the measuring. Don't ask me how! It is impressive that you can get a distance, put a coin in the path and remeasure and it comes up at 1mm or so more.

The old Aga Telurometers used modulated light to measure to mm in km, they were clever. Perhaps that is what happens here?

I use mine to measure how tall trees are, and it is amazing that it can measure to a branch 70' up in the air with the rough bark. It is measuring because slightly moving the sensor gives an equal change in distance.

[rtv]

I am using FTDI VNC2 debug module as usb to single wire serial adapter.
Serial commands are only tested with PLR15.
There are firmware update commands so be careful when using random commands they could erase flash.

Adapter must be powered first because PLR15 starts in uart mode(display stay off) when serial line has pull-up resistor connected to +3V.

another version:
https://www.robotshop.com/letsmakerobots/laser-range-finder-hack?page=1

How to use sensor with SPI is still unknown for most parts.

[aounmc]

I am looking into integrating a laser "measuring tape" into a system that we make for the Flat Panel Display measurement industry. I have a GLM 50 which has bluetooth. After the bluetooth driver's are installed, I can communicate with the device using contributor rtv's commands. Does anyone know where he got these commands? With the commands shown, a measurement causes the laser to be turned off after the measurement. Our system will be "continuously" be measuring distance and this will cause the laser to "blink" which is not preferred. I was hoping to find a way to prevent this from happening and better understanding of the serial commands and how they were obtained would be helpful. I have a GLM 100 on order. I am hopeful that it will implement a virtual serial port over the USB interface that I can use instead of bluetooth. It may just be for charging though.

Thanks,
Mike

[IDEngineer]

they are Pixelized array detectors for calculating distance by Triangulation

I think we can be reasonably certain they are not using triangulation in this unit. For one thing, the baseline (distance between emitter and detector) is far too small relative to the distances this unit is intended to measure. For another, 32 pixels don't yield the kind of resolution this unit supposedly delivers over its intended measurement range. I know it's a 2D array, but the second axis doesn't really yield any useful additional data for triangulation.

I also don't think they are using the chromatic-based scheme mentioned in some of the cites above, since chromatic schemes rely on a spectrum of wavelengths and the LED emitter in this unit is likely quite monochromatic.

My guess is some adaptation of modulation. Given that this unit measures rather long distances, they could use time of flight for the coarse distance and then employ the array to measure the phase of the arriving reflections to obtain finer resolution.

[Siwastaja]

Continuous wave time-of-flight (modulation + demodulation phase difference measurement) suffers from multi-source mixing, creating so-called "flying result". For example, if the measurement pixel happens to be aimed so that half of the pixel receives light from a nearby object, half from faraway object. In this case, an imaginary average result appears (actually average weighed by the amplitudes of the signal, so the closer obstacle typically dominates the result).

In subtle cases, this can be very problematic to notice: think about a wall at 1000mm, another at 10000mm, and the pixel mostly sees the 1000mm wall, but gets a tiny bit of delayed light from the 10000mm wall, so the result could read as 1050mm, and it's impossible to see the result is plainly wrong.

I could imagine they use a 2D array to deal with this (or this is how I would do it): they have a 3D time of flight depthmap of 32x32=1024 pixels, which is quite a lot for this purpose; I guess the angular resolution is very high, as the full beam is narrow (a few degrees max?). Now, take the median of the 1024 distance values, and count the number of pixels that fall within, say, +/-50mm of that median. If the count is less than, say, 500, report an error (uneven surface; cannot measure). If more than 500, take the average of these near-median pixels to further improve the resolution and reduce noise.

[IDEngineer]

Agreed, your description of using a 2D array to improve performance for diffuse measurements is a good idea. But that's still time-of-flight, not triangulation. The distances and resolution just don't add up for triangulation in this particular device.

[Siwastaja]

Of course it isn't triangulation. If it was, they would use something like a 1000 or 2000 elements long linear sensor. Plenty of those exist, some specifically marketed for triangulation purposes.

Time of flight is cheap and accurate nowadays, even in multi-kilopixel arrays. In wide beams, it suffers from multipath and modulated stray light, but that's not an issue in an optically well designed narrow beam device.

[hsieber]

Update to my post of March 5, 2018. After a lot of research I thought I would take the high road and ask Bosch directly if there were any plans or possibilities to make the laser sensor of the GLM20 available as an OEM item. Answer was a resounding NO. After deciding that although this sensor would be ideal for my project, I would need to look elsewhere, I wasted weeks and weeks looking at other sensors such as the Parallax Ping)), Garmin Lidar-Lite, Mikro Click, and others. None of these approach the accuracy of the Bosch laser unit. I noticed a post on another thread stating that the user found a 'Chinese laser sensor' online, so I searched and found the almost-perfect sensor. Accuracy of +/- 1mm, very simple TTL ASCII interface, under 40 bucks. Downside is slow delivery, sketchy docs and tracking.
So unless you are hacking the Bosch GLM as an intellectual challenge, I would recommend looking on the Chinese market outlet site.

[IDEngineer]

I noticed a post on another thread stating that the user found a 'Chinese laser sensor' online, so I searched and found the almost-perfect sensor. Accuracy of +/- 1mm, very simple TTL ASCII interface, under 40 bucks. Downside is slow delivery, sketchy docs and tracking. I would recommend looking on the Chinese market outlet site.

Care to share a link to this "almost perfect" sensor for the rest of us? Thanks!

[hsieber]

The link to the 'almost perfect' sensor is: http://208.73.204.85/item/50m-164ft-Laser-Distance-Measuring-Sensor-Range-Finder-Module-Low-cost-Diastimeter-Single-Continuous-Measurement/32792768667.html. I was not being secretive, just not sure what forum policy is on commercial links.  There are many other makers of this type of laser sensor on Aliexpress. You can get complete tape measure units, kits, or just sensors.

To be clear, this sensor is 'almost perfect' for my particular application of package size measurement, YMMV. It will not be useful for robotics or drones, because it is slow- it takes 300 ms for a a measurement. However it is accurate and repeatable, as you would expect for the sensor at the heart of a laser tape measure. The 'almost' disclaimer is because of several factors:
1- connection, there is no simple header connector, you need to tack solder to the gold plated pads at the edge of the board. There are connectors but they are not documented and are very small.
2- It looks like each measurement must be triggered, there is no loop mode.
3- Not everyone will like the 3.3v serial interface. It works for me because I have lots of serial ports (xmega128A3U), and I can poll all 3 sensors simultaneously.
4- These come from China, with all the attendant communications, documentation, and delivery/customs issues. I am now waiting for 3 of these sensors that are stuck in customs at Fedex because of import problems (after paying $80 for air ship for $85 worth of sensors).
5- There is an audio beeper that sounds after each measurement. With a sensor for each axis (3), and multiple measurements for averaging/verification, this will sound like a field of crickets. Apparently there is no way to mute/disable it short of clipping it out. Query to maker so far unanswered (wish I spoke Cantonese...)

The interface needs 4 wires, 3.3V, Gnd, Tx, and Rx. Level is 3.3v for comms, at 19.2Kbps. Protocol is dead simple, send 'F', get a string like F: 0.767m, 0150[cr][lf]. Distance is in meters. Not sure what the other figure is, seems to vary even if distance is the same (undocumented, may be calculation time??). Easy to convert to inches:

Code: [Select]

float inches=39.3701*atof(&rxbuf[3]);
I plan to ask Sparkfun if they would add this sensor to their roster, to make getting this sensor easier for everyone.

[IDEngineer]

The link to the 'almost perfect' sensor is: http://208.73.204.85/item/50m-164ft-Laser-Distance-Measuring-Sensor-Range-Finder-Module-Low-cost-Diastimeter-Single-Continuous-Measurement/32792768667.html.

I feel this urge to buy one just to play with it. I'm sure I can come up with some application for it! "No, honey, of course Junior needs adaptive cruise control on his bicycle. How else will he maintain an accurate following distance proportional to his speed?"

[viruelaboy]

quick question. I bought the same measuring tape and I want to accomplish something much simpler. I want to bypass the timed turning off. I was able to get the values using a video ocr but now what I have remaining is for the device to stay on so long as I provide external power to it. any ideas?

[sifourquier]

Hello
Thanks you for your job
I have a PRL30C and the commande Start measure:C0 40 00 EE work realy fin but i try to make a software for direct input measure in computer (simulate a keyboard)
Then is need to read measure when user presse on the button of PLR30C
After snifing PLR measure&go (android app) i found if i send  0xC0 55 02 01 00 1a
Every time i presse the button i receive  C0 55 10 06 00 NN 01 XX XX XX XX 00 00 00 00 00 00 00 00 YY
where NN is a measure counter (+1 at eache measure)
XXXXXXXX increase with distance but is not linear is like a exponantial but segmented
and for YY I think is a crc

Do you have any information about how to go from this "exponantial value" to the distance?
I can found x linear equation 1 by segment but i thing maybe any body have allready make it.

My measurement (max 7.6m i need make measure at more)
http://cortexet.free.fr/autre/measure_auto.ods
http://cortexet.free.fr/autre/measure_auto.csv

[rtv]

XX XX XX XX is hexadecimal float.
1089625758==0x40F25E9E==7.57405f==7.6m

And this is how I think crc is calculated:
+ couple commands to test with bluetooth(I don't have BT device)

Code: [Select]

/* BOSCH laser serial data crc value computing */
/* Program prints out crc value of byte array */
/* [0xC0][command][length][data][crc] */


//#include "stdafx.h"
#include "stdio.h"
#include "stdint.h"

#define POLYNOMIAL 166;
#define SEED 170;

//http://www.ti.com/lit/an/slua363/slua363.pdf
int calc_crc(int data_byte, int crc)
{
int bit_mask = 0, carry_check = 0, temp_data = 0;
temp_data = data_byte;
for (bit_mask = 0; bit_mask <= 7; bit_mask++)
{
data_byte = data_byte ^ crc;
crc = crc << 1;
temp_data = temp_data << 1;
carry_check = data_byte & 0x80;
if (carry_check)
{
crc = crc ^ POLYNOMIAL;
}
data_byte = temp_data;
}
return (crc);
}

int main()
{ //test arrays
//received data:
uint8_t data[] = { 0x00, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x08, 0xC1, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; //serial number received from device last byte 0xD4 removed(crc)

//commands:
//uint8_t data[] = { 0xC0, 0x55, 0x02, 0x01, 0x00 }; //crc should be 0x1A. PRL30C Set device as BT master
// these commands might work after device is set as BT master
//uint8_t data[] = { 0xC0, 0x51, 0x02, 0xFF, 0xFF }; //crc should be 0x9C. Get how many measurements in device memory
//uint8_t data[] = { 0xC0, 0x51, 0x02, 0x01, 0x01 }; //crc should be 0x18. Get measurement 1
//uint8_t data[] = { 0xC0, 0x51, 0x02, 0x01, 0x0A }; //crc should be 0x80. Get measurement 10
uint8_t crc = 0;
uint8_t newseed = SEED;
uint32_t bytearraysize = sizeof(data) ;
uint32_t bytepos = 0;
//calculate crc
do
{
newseed = calc_crc(data[bytepos++], newseed);
}while (bytepos < bytearraysize);

crc = newseed;
printf("crc: 0x%X ", crc);
getchar();
return 0;
}



[sifourquier]

Realy thanks you
It is logic why i have no think to that?

[retroguf]

Hi

I' am  just harvesting the goods of your and everyone elses post here.
I am creating a c# lib for communicating with the bosch glm 50 c  bluetooth distometer.

I have one little problem thou;
i cant get the endian convertion to get the right result.

if i meassure 3729mm i get the result 0d1b hex, which i "reverse" to 1b0d which multiplied by 0,05 is 346,25 in decimal.

my next step would be to capture some more data points and compare with byte and bit wyse endian reversing.
I hope somene have som golden input.

Any input to what my mistake might be?

regards Frank