Hacking the Bosch GLM 20 Laser Measuring Tape

[artag]

Artag,
If your Android device doesn't have access to the file, try with an older device. In my case, I used a Tablet S2 Samsung Android 7.0. And it worked.

Good point, I'll try an older phone. If it's got that log capability at all .
The bugreport thing is OK though, just seems silly offloading everything for just one file. They've optimised it for filing bug reports rather than unpicking protocols

[jgustavoam]

I finally got USB/Serial communication with the Bosch GLM20 !! I will post shortly.
I used a CP2102 USB/Serial interface (module) with some resistors, 74HC00 and schotky diode.
Tested with Realterm program (9600 Bps 8N1) - Windows 10

pins of STM32F051 in the circuit - connected to interface USB/Serial

P58 = STM32F051 - USART1-TX
P59 = STM32F051 - USART1-RX

Some tests:

Measuring (mm) :       /20 or x 0.05 (same)
C0 40 00 EE => 00 04 45 C9 00 00 84    0xC945 = 51525 / 20 = 2576.25 mm

C0 40 00 EE  =>  00 04 6C 1F 00 00 AA   0x1F6C = 8044 x 0.05 = 402.2 mm

0xC0 0x06 0X00 0X4A = Get Serial Number (best test to verify results)
C0 06 00 4A  => 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3E  (Hexadecimal)
ÀJ603/3601K72EG0>   (ANSI) Bingo !!!! that is correct!

0xC0 0x41 0X00 0X96 = Laser ON
C0 41 00 96  =>  00 00 82

0xC0 0x42 0X00 0X1E = Laser OFF
C0 42 00 1E   => 00 00 82

0xC0 0x47 0X00 0X20 =    Backlight ON
C0 47 00 20   => 00 00 82

0xC0 0x48 0X00 0X62 =    Backlight OFF
C0 48 00 62 => 00 00 82


Thanks to everyone who contributed here on the forum.

[jgustavoam]

GLM20 - Interface USB/Serial

Following the forum instructions, I've done several communication tests in the past with the GLM20. But my tests failed. I got frustrated and stopped.
Rereading all the threads, I realized that the PRL15 circuit board was identical to the GLM20. (Thanks RTV). I thought - it has to work!
If the RTV colleague did it, I think I can too.

Yesterday, doing more tests using an oscilloscope to monitor the waveform of the serial signal on pin P58/P59, I received a response to a command. But the received signal was truncated. I realized that the low level of the signal was at 1V, inadequate for reception.

After that, I built a circuit using resistors, schottky diode, a 74HC00 chip and managed to correctly read the received data.

Today thinking happily about being able to read the data, I built another simpler circuit, with a 74HC07 chip. Why HC chip? Because it works with 3.3V! Do not use an ordinary 7407.

This is the circuit built by me. It's the first one that worked with my tests. I checked with the oscilloscope and the signal is fine. We can then make other improvements if necessary.

Usage sequence:
1) press the power button on the GLM20
2) Press the reset button SW2 (display turns off)
3) Press the SW1 button to activate the communication (backlight on)
4) Run a terminal program connected to the USB of the CP2102 module - 9600 Bps 8N1.
5) Send the command and you will see the results.

To do later
- Connect with an Arduino, Raspberry PICO or ESP32
- Make a Golang program to run on a Windows/Linux/MAC


Thanks RTV - instructions to use Realterm:

https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/msg1450020/#msg1450020

Display as = HEX SPACE OR ANSI

[kosnick]

Hi all again,

with your help, some time and some research I am able to ask the GLM 50-27 to take a measurement, and I can read it back (python).
However, I noticed one thing i need your help with:
in order to be able to read the indications of the characteristic (which inculde the measurement) the device has to be FIRST connected to the official app (android).
Then, one can read the indicaitons.
If the laser tape does not get connected to the official app initially, the indications are not there.
So to clarify things, this is how it works: i connect the lase tape to the official android app. I then disconnect it. And afterwards I am able to use the python script to read measurements.
Does this ring any bells?
Thank you in avdvance.

[jgustavoam]

Hi Kosnick,
Congratulations on achieving Bluetooth communication with your Bosch laser tape.
I have been looking into Bluetooth BLE communication as I am involved in a project at work.
The normal sequence of a BLE communication with Android is this:
https://punchthrough.com/android-ble-guide/
- perform a BLE scan
- connect to the BLE server (Laser Tape)
- discover services and charactheristics
- subscribe to notifications or indications
- perform read or write operation

You can do all this with Python, C++, Golang or another language.
There is no need to connect the device with the original app.

[kosnick]

well it seems something is not quite right...
I do connect to the device and since i know the uuid of both the service and the characteristic, i subscribe to those.
And enable indications.
So at this point I can constantly receive some indications from the device, which I do not know how to interpret, but is of no importance (i think).
But these indications do not include any measurement values.
As soon as i connect the device to the official app, and disconnect it immediately, I am able to receive new indications which include the measurement value  (by the way, on the same handle as previously).
It seems to me that the "connection to the official app" does a little extra on the indications and hence I am able to receive the measurement data when I include this part in my tests.
But i can not figure it out - I have sniffed with my android smartphone and checked on the wireshark and also used the nRF connect app on the phone too. But with no results.
Once again, thanks for your help.

[jgustavoam]

Kosnik,

There is a very interesting tool for you to discover services and characteristics of an Android device. Use the NRF connect app to connect the laser tape and browse and test services and features.
Try to identify which characteristic is used for the measurement.

nRF Connect for Mobile
https://www.nordicsemi.com/Products/Development-tools/nrf-connect-for-mobile

https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp&hl=pt_BR&gl=US

Recommendations for study:

https://github.com/prudhvirajstark/BoschGLM50C

https://github.com/Scarfsail/BoschGLM50

https://github.com/piannucci/pymtprotocol

https://github.com/philipptrenz/BOSCH-GLM-rangefinder

https://github.com/fantom3ds/LaserBluetooth

[kosnick]

JG,

I already have. But I am somehow stuck at the moment.
Both nRF connect , and bluetooth sniffing with the android phone have the same results.
I tried investigating the log from the sniffing, but this is where I am stuck.
I need to investigate a little more.
There is one thing I noticed, that happens just after the enable of the indications and this I want to check.
Let's see.

[jgustavoam]

Kosnick,

Post the logs of your tests and then I can try to help you.
See that the commands are the same as the ones I used on the USB/Serial interface.


https://github.com/philipptrenz/BOSCH-GLM-rangefinder/blob/master/glm100c.py

 cmds = {
        'measure':          b'\xC0\x40\x00\xEE',
        'laser_on':         b'\xC0\x41\x00\x96',
        'laser_off':        b'\xC0\x42\x00\x1E',
        'backlight_on':     b'\xC0\x47\x00\x20',
        'backlight_off':    b'\xC0\x48\x00\x62'
    }

[kosnick]

Hi Gustavo!

First of all, once more, thank you for taking the time to take a look at it.
I have been working on the project based on this post: https://devzone.nordicsemi.com/f/nordic-q-a/80589/sniffing-a-bosch-laser-tape-2
As you may see, on some devices the protocol is different to the one you are mentioning.
I have also posted on that forum asking for help.
Anyway, pcap files are not allowed to be sent here, so I sent you a pm with a link.

[jgustavoam]

Kosnick, I think it's best to continue your project on the other forum. As soon as possible I will answer it.

[kosnick]

ok, thanks again

[Njk]

It's still remains, how do they do it. The speed of light is so high, the time difference is hard to measure for short ranges. OTOH, the mentioned triangulation technique (with pixels or whatever) does not work well for a long distances. Some devices, like aviation altimeters, measures the modulated signal phase difference, not directly the TOA difference. Related geodetic instruments like Tellurometer also measures the phase difference. E.g. the CA 1000 model

https://vm.civeng.unsw.edu.au/surveying/f_pall/html/e9.html

"Both units radiate an X-band microwave carrier tuneable between 10.10 and 10.45 GHz which is frequency modulated in the 19 to 25 MHz range. The Remote unit receives the transmission and re-transmits it to the Master, which measures the phase difference between the transmitted and received signals."

Quite complex arrangement, with Master and Slave units. Acoustic engineers knows about the ringing phenomenon, when the loudspeaker signal is picked up by the mic resulting in the sound of ringing frequency. If one can set up such ringing over an RF link, then the distance between the transmitters can be calculated through measurement of the ringing frequency, that's very simple. Just thinking

[jgustavoam]

Hi NJK,
Searching for an answer in ChatGPT - artificial intelligence:     https://chat.openai.com/

Do you trust this answer?

How does the bosch measuring tape laser distance sensor work?

The Bosch measuring tape with laser distance sensor is a measuring tool that uses a laser distance sensor to measure the distance between two points with high precision. The laser distance sensor emits a short-duration laser beam and measures the time it takes for the laser beam to reflect off an object and return to the sensor. Based on the laser's travel time and the speed of light, the sensor is able to calculate the distance accurately.

Here are the main steps on how the Bosch measuring tape laser distance sensor works:

1.Laser beam emission: When you press the measurement button on the Bosch measuring tape, the laser distance sensor emits a short-duration laser beam towards the object you want to measure.

2.Laser beam reflection: The laser beam hits the object and is reflected back towards the sensor.

3.Laser beam detection: The laser distance sensor in the Bosch measuring tape detects the reflected laser beam using a light-sensitive receiver.

4.Measurement of travel time: The laser distance sensor measures the time it takes for the laser beam to travel from the sensor to the object and back, based on the time difference between the laser emission and the detection of the reflected beam.

5.Distance calculation: Based on the laser's travel time and the speed of light (which is constant), the Bosch measuring tape laser distance sensor calculates the distance between the sensor and the object with high precision.

6.Display of the result: The measurement result of the distance is displayed on the Bosch measuring tape's display, usually in units of measurement such as meters, centimeters, feet, or inches, depending on the tape's settings.

It is important to follow the manufacturer's instructions and take safety precautions when using the Bosch measuring tape laser distance sensor or any other laser measuring tool. Make sure to read and understand the user manual and use appropriate safety goggles when operating the Bosch measuring tape or any other laser tool.

[jgustavoam]

Searching for an answer in ChatGPT - artificial intelligence:     https://chat.openai.com/

How long does it take a laser beam to travel a distance of 1 meter?

The speed of light in a vacuum is approximately 299,792,458 meters per second (m/s), which is the fastest speed that any information or signal can travel in the universe. Therefore, it takes approximately 3.34 nanoseconds (ns) for a laser beam to travel a distance of 1 meter in a vacuum.

It's important to note that the speed of light can vary slightly depending on the medium through which it is traveling. For example, light travels slightly slower in air, glass, or other materials compared to a vacuum, due to the refractive index of the material. However, for practical purposes, the speed of light in a vacuum is often used as a constant value in most calculations and measurements involving laser distance sensors or other laser-based technologies.

-----------------------------------------------------------------------

Based on these statements, we can conclude that the time taken for the laser to be reflected is twice that time, therefore

2 x 3.34 nanoseconds = 6.69 ns

If the timer is based on pico seconds resolution, good accuracy can be achieved.

1 nano second = 1000 pico seconds (10⁻¹²)

6.69 ns = 6690 ps


Links suggested by me in 2018:

Device and method for optical distance measurement
https://patents.google.com/patent/US6801305B2/en

Device and method for optical distance measurement
https://patents.google.com/patent/US7728957B2/en

[Njk]

Searching for an answer in ChatGPT - artificial intelligence:     https://chat.openai.com/

Hi jgustavoam

Automated script reading machines are not only funny. Good occupation area for the crowds of developers and sellers is even more important achievement. As for average Joe, he's not yet legally obliged to consume that BS. I'm sure they're working on that tirelessly, but for now I'm happy to exercise my freedom.

Links suggested by me in 2018:

Device and method for optical distance measurement
https://patents.google.com/patent/US6801305B2/en

Device and method for optical distance measurement
https://patents.google.com/patent/US7728957B2/en

Thanks for the Bosch patents, very interesting.

[hdlbq]

Hi,
First, thanks for all the valuable information you shared.
I'm trying to measure the altitude of a mid-size drone with a Bosch PLR15. I realize that I have to be careful with the laser beam.
My first attempt to simply communicate with the PLR15 failed completely.
I connected a VNC2 FTDI to the Ground, VCC and Rx/TX pads like described earlier by rtv:

I am using FTDI VNC2 debug module as usb to single wire serial adapter.
Serial commands are only tested with PLR15.
There are firmware update commands so be careful when using random commands they could erase flash.

Unfortunately, I can't receive any answer to my commands, sent using a Terminal emulator on my PC (9600 bauds, 1 Bit Stop, No Parity, no Handshake)
I soldered the wires to the PCB to be able to use the PLR15 almost normally (see pictures joined)
Thanks for your help

[jgustavoam]

HDLBQ,

I recommend using the circuit I posted. This circuit was tested with the GLM20 tape, but it looks similar to the PLR15 tape.

GLM20 - Interface USB/Serial

Following the forum instructions, I've done several communication tests in the past with the GLM20. But my tests failed. I got frustrated and stopped.
Rereading all the threads, I realized that the PRL15 circuit board was identical to the GLM20. (Thanks RTV). I thought - it has to work!
If the RTV colleague did it, I think I can too.

Yesterday, doing more tests using an oscilloscope to monitor the waveform of the serial signal on pin P58/P59, I received a response to a command. But the received signal was truncated. I realized that the low level of the signal was at 1V, inadequate for reception.

After that, I built a circuit using resistors, schottky diode, a 74HC00 chip and managed to correctly read the received data.

Today thinking happily about being able to read the data, I built another simpler circuit, with a 74HC07 chip. Why HC chip? Because it works with 3.3V! Do not use an ordinary 7407.

This is the circuit built by me. It's the first one that worked with my tests. I checked with the oscilloscope and the signal is fine. We can then make other improvements if necessary.

Usage sequence:
1) press the power button on the GLM20
2) Press the reset button SW2 (display turns off)
3) Press the SW1 button to activate the communication (backlight on)
4) Run a terminal program connected to the USB of the CP2102 module - 9600 Bps 8N1.
5) Send the command and you will see the results.

To do later
- Connect with an Arduino, Raspberry PICO or ESP32
- Make a Golang program to run on a Windows/Linux/MAC


Thanks RTV - instructions to use Realterm:

https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/msg1450020/#msg1450020

Display as = HEX SPACE OR ANSI