Hacking the Bosch GLM 20 Laser Measuring Tape - Page 1
Forum section: electronics / projects

author: STMartin
author_rank: Contributor
timestamp: September 29, 2017, 03:36:19 am
content: MOSTLY IRRELEVANT BACKGROUNDSo, I've decided to hack a laser measuring tape (laser distance finder) for a project I've started. My siblings and I have decided to build my dad a cornhole set for his birthday, and my contribution will be an electronic scoring device, which will probably be expanded on in another post. I wanted to incorporate a distance finder so we can set the distance of the boards properly without having to break out the tape measure. I bought the cheapest model I could find; about $50 USD at a home improvement store.RELATED WORKSThis has been done before. Someone has attempted to hack a model very similar to this one, but it doesn't seem like they figured it out:http://robotshop.com/letsmakerobots/laser-range-finder-hackThere was/is a Uni-T tape measure that was hacked some years ago and became quite popular among the drone and robotics communities. Although, since then most vendors seem to have caught on, and the price went from about $60 to $100 or more. Sparkfun also has a LADAR module for about $150 that does just what I need. I could go for either of those solutions, but this is more fun and gave me an excuse to buy a logic analyzer. Plus, the Bosch is smaller and lighter than the Uni-T, and cheaper than the Sparkfun module. If I can hack this out, it'd be nice if everyone had another option for their distance measurement needs.POST PURPOSEI'll be documenting my progress here. Mostly with the hope that the hack is successful and others can refer here for information. Also I'll inevitably get stuck somewhere, and since I barely know what I'm doing, forum feedback will be invaluable. I'll pretty much be writing this post as I go along.ON WITH IT THENThis is our subject, the Bosch GLM 20.The back cover is held on with 6 Torx T-6 screws. Two of them are under a sticker, which I've already removed.Taking off the back cover shows us the good stuff. To get the board out entirely, there are two more Torx T-8 screws that hold the board to the front cover.Now we've got the board itself. First the back......and the front.The first thing I notice are seven test pads on the back of the board. I'll have a poke at those in a minute; first I want to see what else is going on. I can barely see a microcontroller under the optics module. Removing two more Torx T-8 screws should let me take it off.It doesn't come off easily, so after unclipping the LCD, I can see two pegs holding it to the PCB.The pegs have nothing to do with it. It seems the laser riser board is glued to the optics module. I'll just desolder the riser board for now so I can get a look at that microcontroller.Turns out it wasn't glued at all. Mostly desoldering the riser board let me tilt it back very carefully; enough so the optics module came out. The microcontroller is an ARM STM32F051R6:Datasheet ->http://www.st.com/content/ccc/resource/technical/document/datasheet/55/53/3e/86/29/61/41/d9/DM00039193.pdf/files/DM00039193.pdf/jcr:content/translations/en.DM00039193.pdfNeat!There doesn't seem to be any kind of display driver chip, so I assume the micro is controlling the LCD directly, unless there's a chip under the LCD that I can't see. In any case, if I can't get anything out of the debug pads, I'll have to resort to sniffing the LCD signals. Not ideal, but hey.I buzzed out the debug pads, and found where they go. Going by my picture, from top to bottom (Pad 1 to 7):1: Pin 7 - Reset2: Pin 46 - SWDIO (Serial Wire Debug In/Out)3: Pin 49 - SWCLK (Serial Wire Clock)4: Battery -5: Battery -6: Battery +7: Through two 5k resistors to Pins 58 and 59 (I2C SCD/SCL, USART TX/RX, Timer 16/17, or touch sensor IO 3/4)This agrees with other people's work, so it seems I have a good place to start. I'm not going to need access to the microcontroller anymore, so I out everything back together and made sure I didn't ruin it already.Yay!That's all the time I have for today, and I'll be gone for the weekend, but I'll keep this post updated as I go along.

author: alterbaron
author_rank: Contributor
timestamp: September 30, 2017, 07:12:54 pm
content: Was this cap in your images originally part of the unit?

author: STMartin
author_rank: Contributor
timestamp: October 01, 2017, 03:11:47 pm
content: Uh oh, I hope not.When I get home I'll compare to the original pictures.Good eye, though!

author: STMartin
author_rank: Contributor
timestamp: October 08, 2017, 12:11:56 am
content: PART 2POPPIN CAPSSo, as alterbaron pointed out, there's a chance I popped out a capacitor while working on the laser. You can see the desoldered cap in at least two of the pictures. I looked through the pictures I took, and couldn't find anything different, nor could I find the cap (which I was foolish enough to look for). I looked at the unit itself, and found where it possibly went on the laser riser board:Oops!It may or may not belong there; but it doesn't seem to matter much; it still seems to work. It does display 'Err' every once in awhile, but that can be cleared by pressing the button again. I can still try and interface with it. If it winds up being an issue, I can slap in a random cap from something in the junk pile, or just get another laser.In any case, now it's time to start sending some serial commands to this thing!INITIAL OBSERVATIONSOn the debug pads I found before, I have a choice of Serial Wire Debug (SWD), I2C, or USART. SWD might work for my purposes. I'm not familiar with it at all, but it turns out ARM has a whole suite of tools that would work with SWD; their DS-5 software. Seems like it lets me read data, write data, dump memory, and tons of other useful things. The community (free) edition doesn't support the Cortex-M0, and I have to request a price for any of the other editions. I hate having to contact companies to request pricing, so screw SWD for now, and screw DS-5 in particular.That leaves I2C and USART. I don't know for sure, but I believe I2C needs at least two wires; I don't think I can do the clock and data from the same wire. All that's left is USART, which is what I'm going to assume the manufacturer intended that pad for. I soldered in some wires to all the pertinent debug pads to see what might be there.After connecting to the logic analyzer, I fired up the laser.I don't have the other pads shown here, but trust me: there was nothing. I do get one 11.37 ms pulse on startup from pad 7; nothing more. Lame. I suppose it's time to interface with the Arduino.ARDUINO INTERFACING...My computer isn't convenient to use at the bench, so I'm going to try and power this from the Arduino. I ran the power supply through my bench meter set to min/max to measure the current the laser draws. It seems to draw about 100 mA maximum. I have an Arduino Due which can supply up to 800 mA through the 3.3V pin, which should be plenty. The Due uses 3.3 volt logic, and according to the logic analyzer the laser's pulse is about 2.7V. The micro on the laser is 5V tolerant on those pins anyway. All of which is to say, the Arduino should be just fine running the whole show.This is the test setup:Since the laser has both Tx and Rx on the same wire, and the Arduino can't do that, the one wire coming out of the laser is going to two pins on the Arduino. The logic analyzer just has to watch that one pin (glad I got the 16 channel version...). I captured the startup again to make sure everything was working as before.Huh? I get two pulses now? I don't know why this is but it seems to happen randomly. I'm turning the laser on by dragging a wire across the button contacts; which is probably pretty electrically noisy. Maybe that has something to do with it? Anyway, let's start sending some commands....DOESN'T WORK THAT WAYI have found that just connecting the Rx and Tx pins together on the Arduino is not going to work. UART protocol requires the Tx pin to idle high, so everything on the bus stays at logic high. I did some searching for single-wire serial and someone, somewhere suggested a resistor be placed between the Rx and Tx pins, then connect the wire to the Rx side. This didn't work wither, although I may have got the resistance value wrong: I tried using a 2k with no luck. At this point, the logic analyzer isn't seeing the initial 11 ms pulse from the laser anymore.So I disconnected the laser, and tried to just see the data coming from the Arduino. That doesn't come up either; or maybe the LA triggering isn't properly set. This is probably because I'm triggering on a rising edge, and the Arduino starts out high and stays that way. I also tried looking for a single wire UART library I could slap in, but the only one available comes from Arduino's SoftwareSerial library. This library is only for AVR based boards, which the Due is not. Unlike many Arduino boards, the Due has four hardware UART ports, so I guess nobody thought it was necessary. I may have to bit-bang.I then tried to just get data coming from the Tx port of the Arduino, and the LA did pick it up sometimes. There were always some kind of framing errors, and sometimes I didn't get anything at all. At this point, I'm not sure if I programmed the Arduino wrong (I'm trying to bit-bang), or if I have the LA triggered wrong, or some of both.OKAY, START AGAIN FROM THE TOPAll of this so far took place in a few hours here and there during the week. After mulling it over the last few days, I've decided I need to start at the beginning and make sure I can get data out of the Arduino and properly framed on the Analyzer. For that I need to choose between hardware UART or bit-banging my own single wire solution. Once I'm sure I can get data out, and the LA properly triggered, I can move on to sending commands. First thing I'm going to try is two 5k resistors on the Arduino's Rx and Tx lines, just like the laser, and see if that lets me see the 11 ms pulse again.The 5k resistors don't seem to work, I think. Applying logic high to the laser's serial pin results in the laser turning on with a blank display (although it is illuminated), and no laser. Perhaps this is how they did the testing? When testing the laser and connecting it to a debugger, the Tx line would idle high, turning on the laser. Maybe it's waiting for some commands anyway, and the 11 ms pulse is a red herring? I think I'll try connecting the laser to just the Arduino's Tx pin, sending some commands, and see what happens.I just sent a blank terminated string, and didn't get anything. At least I know the LA is triggering properly, and the laser is definitely receiving commands, even if it isn't responding. Next, I think I'll start sending some characters and see if anything bites.On second thought, it may be trying to send something, but I can't see it since the Arduino's Tx line is pulling the bus up. Looks like I'm going to have to bit-bang something to make a single pin workable for serial. Alright, lets make up a quick Single-Wire serial function. I think I'll be ditching the resistor idea too.A little bit of programming later, I have a workable write function:It looks pretty much the same as the hardware UART output from the last image; which is good. Now I can have Tx and Rx on the same pin.I also poked around a little more, and found when the laser is in the blank display mode, it's actually thelaserthat's pulling up the bus. So perhaps it's time to just go through all the combinations of states for the reset and serial pins, and see exactly what the laser does under all the possible combinations.Arduino ResetArduino SerialLaser ResetLaser SerialFloatingFloatingLowLowLowFloatingLowLowHighFloatingHigh11.24 ms pulse @ ~4.8 HzFloatingLowLowLowFloatingHighLowHigh (Blank Display Mode)LowFloatingLowLowLowHighLowHighHighFloatingHighLowHighHighHighHigh (Blank Display Mode)LowHigh-ZLowLowHighHigh-ZHigh11.24 ms pulse @ ~4.8 HzHigh-ZLowLowLowHigh-ZHighLowHigh (Blank Display Mode)NOW WE'RE GETTING SOMEWHERE!In the process of making that table, I found a few interesting things. For one, the blank display mode happens if the serial pin is high, and the reset is floating or high. It does not happen if the reset pin is low. This makes sense, since the micro's reset is active low. In this condition, the reset pin and serial pin are both latched high when disconnected from the Arduino. It does not enter this mode reliably though. Sometimes it does, sometimes not. I can find no rhyme or reason to it.Also, if the reset pin is high and the serial pin is floating/high-impedance we get an 11.2 ms pulse at a rate of about 4.8 Hz.Some kind of heartbeat? Is it waiting for a command? It's obviously similar to the pulse I had on startup. I'm not sure, and I don't know if I'll pursue that thought because...RS-232!! I don't think it's actual RS-232, as the micro isn't capable of driving negative voltage, and I don't see any converter chips. This came up when I accidentally brushed the serial line against logic high while the reset was floating. It doesn't come up every time, but if reset is floating/high-Z and you brush the serial line against logic high, it comes up fairly frequently. This makes me think I just need to put the right width pulse on the serial line, and I can enter the fabled RS-232 mode. I tried putting my function generator on it, and scrolling through different pulse widths, but all that got me was blank screen mode at about a 150 ms pulse. So, I'm going to see if I can get it in RS-232 mode while the LA is running, and get an idea for what size pulse I'll need.But before that, I'm going to get something to eat; I'm starving. I'll continue this later tonight, and probably make another post with further progress.

author: rtv
author_rank: Contributor
timestamp: October 24, 2017, 02:44:49 pm
content: These commands work with Bosch PLR15 serialportsend frame: ()receive frame: [...]Get serialnumber: C006004AGet "firmware" version:C00400BABacklight ON:C0470020Backlight OFF:C0480062Laser ON:C0410096Laser OFF:C042001EStart measure:C04000EEExample measure:send C04000EE ->reply 00 04 13 0E 00 00 32Change endiannessdistance in mm=0x00000E13*0,05=180mmMax measurement rate is about 4 times per secondUnknown commands:C0030074 reply->000100AEFirst byte in reply is status:0x00 -> OK0x01 -> communication timeout0x03 -> checksumerror0x04 -> unknown command0x05 -> invalid accesslevel0x08 ->harware error0x10 ->device not ready(0D=invalid accesslevel + harware error)Sensor SPI-bus data is interesting.Sensor(SPAD) size is 2x32x32 pixels.It is sending light intensity and something(phase/tof?) to spi bus data.Capture.jpg image shows data packets collected from spi and visualized per pixel.Other images are measurement values from serial port (Object is not moving)

author: skipjackrc4
author_rank: Regular Contributor
timestamp: October 28, 2017, 09:26:59 pm
content: Quote from: rtv on October 24, 2017, 02:44:49 pmInteresting. So you're saying that that optical sensor is 32x32 resolution? I would have thought that it would be a single "pixel" to provide time of arrival data with no spatial awareness. Do you know how they use this spatial data?

author: rtv
author_rank: Contributor
timestamp: October 29, 2017, 01:33:40 pm
content: Array size is quess based on image.I was able to see external laser pointers dot in intensity part of dataflow, which matched array horizontal positions.Laser pointer didn't interference with measurement.I think distance is calculated from phase difference of transmitted and received modulated laser pulse.(+light intensity)

author: skipjackrc4
author_rank: Regular Contributor
timestamp: October 29, 2017, 05:14:45 pm
content: Very cool to see a closeup of the sensor; thanks!

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 07, 2017, 01:53:38 am
content: Hi Guys,I´m trying to decifrate how to read data in the GLM20 , too.I found some interesting things.I discover that laser sensor uses SPI interface . Counting pins from right to left (corner solder pins - rear view)Pin 1 = +3,28VPin 2= GNDPin 3= +1,46VPin 4 = +2,18VPin 5 = 12 MHz ClockPin 6 = SPI- ClockPin 7 = SPI-MISOPin 8 = SPI-MOSIPin 9 = SPI- EnableConfiguration of Logic analyzer : SPI DecoderLSB First ( probably)16 bits per transfer - OKCPOL = 1 OKCPHA = 1 OKEnable Active High OKSome screens of analyzer. But I cannot decifrate, yet !See attached images. Measure = 0.327 metersSome pictures of GLM20 :https://www.flickr.com/photos/jgustavoam/albums/72157673963890225

author: rhb
author_rank: Super Contributor
timestamp: December 10, 2017, 02:05:18 am
content: Try reading this:https://www.acuitylaser.com/measurement-principlesI suspect that what's being done is forming an oscillator using the photodiode to modulate the laser and then measuring the frequency. That seems to me the most viable for US $40 retail pricing. However if it is using an array of photodiodes then it might well be using triangulation. Though the lack of interference from a laser pointer suggests it is the oscillator method. Pulse seems a stretch for $40.I bought one recently and am quite amazed. I've been interested in doing this for a very long time.

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 10, 2017, 12:04:24 pm
content: Hi RTV ,May you send to us the high resolution picture of Laser circuit board ?With this image, I can try to make circuit diagram using my photografic enginering reverse processThank you.Example of my process:https://www.flickr.com/photos/jgustavoam/albums/72157663264163678

author: rtv
author_rank: Contributor
timestamp: December 10, 2017, 10:32:01 pm
content: Some pcb images.Sensor board desoldered.https://app.box.com/s/ses65kecyer8hdrbm8wya31bwv04q62lnote: this is older V6 pcb

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 10, 2017, 11:45:23 pm
content: RTV , Thank You very much ! Fantastic !Here you can see and download my pictures (more high resolution photos) :https://www.flickr.com/photos/jgustavoam/albums/72157673963890225

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 11, 2017, 02:48:55 am
content: Using pictures of RTV , I confirmed that interface is SPI ! Thanks RTV .Counting pins from right to left (corner solder pins - rear view)GLM 20 Pin 1 = +3,28V (VCC)GLM20 Pin 2= GNDPin 3= +1,46V ??Pin 4 = +2,18V ??Pin 5 = 12 MHz ClockPin 6 = SPI1- Clock (STM32F051 - pin 55 - PB3)Pin 7 = SPI1-MISO (STM32F051 - pin 56 - PB4)Pin 8 = SPI1-MOSI (STM32F051 - pin 57 - PB5)Pin 9 = SPI1- NSS (STM32F051 - pin 50 - PA15)See edited images on link :https://www.flickr.com/photos/jgustavoam/albums/7215767396389022532F051 Data sheet Link:http://www.st.com/content/ccc/resource/technical/document/datasheet/55/53/3e/86/29/61/41/d9/DM00039193.pdf/files/DM00039193.pdf/jcr:content/translations/en.DM00039193.pdf

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 11, 2017, 09:34:08 pm
content: Today, more advances.Editing and verifying images , I found those pins of STM32F051 in the circuit.P58 = STM32F051 - USART1-TXP59 = STM32F051 - USART1-RXSerial wire debug port (SW-DP)An ARM SW-DP interface is provided to allow a serial wire debugging tool to be connected to the MCU.P46 = STM32F051 - SW DIOP49 = STM32F051 - SW CLKP07 = STM32F051 - NRSTNote 6. After reset, these pins are configured as SWDIO and SWCLK alternate functions, and the internal pull-up on the SWDIO pinand the internal pull-down on the SWCLK pin are activated.I2C Interface !!(probably - to be tested)P61 = STM32F051 - I2C1- SCLP62 = STM32F051 - I2C1- SDA

author: chris_leyson
author_rank: Super Contributor
timestamp: December 11, 2017, 10:20:03 pm
content: Distance has to be calculated by triangulation and not time of flight or phase detection for modulated lasers. Why would you need all of those pixels, also nothing on that laser board looks remotely high speed. You should really be reverse engineering the plastic optics between the laser the sensor and the target.

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 11, 2017, 10:23:28 pm
content: Image of SPI Interface pins of STM32F051 MCU.Pin 1 = +3,3V (+VCC)Pin 2= GNDPin 3= STM32F051 P08 ? = ADC_IN10Pin 4 = Emitter of Transistor 3F ?Pin 5 = 12 MHz ClockPin 6 = SPI1- Clock (STM32F051 - pin 55 - PB3)Pin 7 = SPI1-MISO (STM32F051 - pin 56 - PB4)Pin 8 = SPI1-MOSI (STM32F051 - pin 57 - PB5)Pin 9 = SPI1- NSS (STM32F051 - pin 50 - PA15)

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 12, 2017, 12:46:36 am
content: I´m studying Laser sensors, and I Think they are Pixelized array detectors for calculating distance by Triangulation.As RTV reported - two sensors of 32 x 32 pixels (total 1024 pixels each).Reference material :http://archives.sensorsmag.com/articles/0598/tri0598/

author: rtv
author_rank: Contributor
timestamp: December 16, 2017, 12:14:08 pm
content: Tinkering with firmwareRS232 text was never visible. But it is in the firmware.

author: chris_leyson
author_rank: Super Contributor
timestamp: December 16, 2017, 12:22:51 pm
content: QuoteI'm quite sure that's the way they do it but they are getting very good results for such a small 32x32 detector.

author: rhb
author_rank: Super Contributor
timestamp: December 16, 2017, 03:13:26 pm
content: They *might* be using compressive sensing to increase the spatial resolution. That would entail reading random sets of pixels multiple times and then solving a linear programming problem.That said, I'm rather doubtful that they have the CPU needed to do the math, but they might. I've never tried solving a comparable problem on a PC and never tried solving *any* linear program on an MCU.Compressive sensing would give about 5-10x the spatial resolution. There's a 256x example in the paper, but it's pushing things a bit and required 1300 samples.www.wisdom.weizmann.ac.il/~vision/courses/2010_2/.../csCamera-SPMag-web.pdf

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 17, 2017, 11:59:42 am
content: Link not found .Thanks.

author: voltsandjolts
author_rank: Unknown
timestamp: December 17, 2017, 12:25:31 pm
content: http://www.wisdom.weizmann.ac.il/~vision/courses/2010_2/papers/csCamera-SPMag-web.pdf

author: chris_leyson
author_rank: Super Contributor
timestamp: December 17, 2017, 01:09:17 pm
content: QuoteOr maybe just averaging, I don't know but a dump of the image data would give some more insight.

author: rhb
author_rank: Super Contributor
timestamp: December 17, 2017, 03:00:36 pm
content: Averaging won't increase the resolution. All it does is suppress random noise.In this instance, the selection of which pixels to use for each time sample would be done in the MCU, so there would not be any significant change in the data coming from the sensor.Compressive sensing of images has become very highly developed in the last few years. I've come across some astonishing images. Unfortunately I've read too many papers to remember what is in any particular paper. This one is an exception only because it was the first proof of concept.

author: rtv
author_rank: Contributor
timestamp: December 17, 2017, 06:24:23 pm
content: Added logic analyzers file and spi data loghttps://app.box.com/s/i45rlk1opg1cixjodq9610cojoxmzukh

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 17, 2017, 10:09:35 pm
content: Hi RTV ,As I saw earlier , Laser sensor SPI interface with my logic analyser, this is a large amount of data.Too dificult to decifrate (yet...) The MCU uses this large amount of data to calculate distance. And if we try to comunicate with I2C interface ? Did you see pins that I found ?

author: rtv
author_rank: Contributor
timestamp: December 19, 2017, 03:50:20 pm
content: I2C is not enabled after startuponly usart1,spi1,da and adcPeripheral registers:RCC_CFGR 0x40021004: 0001000aRCC_CFGR2 0x4002102c: 00000000USART1_CR1 0x40013800: 0000002dUSART1_BRR 0x4001380c: 000009c4USART2_CR1 0x40004400: 00000000SPI1_CR1 0x40013000: 00000347SPI1_CR2 0x40013004: 00000f00SPI2_CR1 0x40003800: 00000000I2C1_CR1 0x40005400: 00000000I2C2_CR1 0x40005800: 00000000DAC_CR1 0x40007400: 00000001SYCFG_CFGR1 0x40010000: 00000000COMP12_CSR 0x4001001c: 00000000ADC_CR 0x40012408: 00000001

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 19, 2017, 08:00:16 pm
content: Wow ! How did You found those registers ?Did You use the Serial wire debug port (SW-DP) ?

author: rtv
author_rank: Contributor
timestamp: December 27, 2017, 04:57:01 pm
content: Debugging using swd is disabled (protection level 1)But this works:https://www.aisec.fraunhofer.de/en/FirmwareProtection.htmlhttps://github.com/bikemike/swdFirmwareExtractorIt is possible to extract firmware and burn it back with debugging enabled.I have done this and the device is still functional.P58/P59 pin in this picture can be used as a power switch, that is needed in the extractor. +3V power on, 0V power offhttps://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/?action=dlattach;attach=378292

author: rtv
author_rank: Contributor
timestamp: December 27, 2017, 05:16:06 pm
content: It seems that there are debug/admin commands in the serial port.Code:Send: Start_measure_cmdParsed reply: Length=7509 ( =375.45mm )Send: Get_info_from_last_measurement_cmdreply: 49001e00030017fc4407c406b1054d078f00a608ef07000039ab2a473920564772b6fb46004d5c47d28ab848f6772543e48139437a470b43a0bc38435f8af043491d0000401d00005e1d0000721d00000000000000000000parse reply:parsed value 1=7497parsed value 2=7488parsed value 3=7518parsed value 4=7538Displayed value is an average of 4 measurement. Rest of the bytes in reply are unknown.

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 27, 2017, 06:03:43 pm
content: P58 = STM32F051 - USART1-TXP59 = STM32F051 - USART1-RX

author: rtv
author_rank: Contributor
timestamp: December 27, 2017, 06:19:00 pm
content: P58 = STM32F051 - USART1-TXP59 = STM32F051 - USART1-RX+DC-DC converter enableIt is quite multifunctional pad

author: hsieber
author_rank: Newbie
timestamp: March 05, 2018, 02:39:16 pm
content: I found this thread after starting a project to make a cheap obstruction detector, hopefully using the inexpensive but accurate Bosch GLM20. Looks like a lot of work has been done already. However I am not clear about where STMartins project stands. Is the seventh pad on the board a single-wire serial interface? The fact that this pad is tied to both TX and RX ports of the micro indicates that it is some kind of simplex serial interface. This would require tri-stating, or setting to input mode, the TX pin while waiting for input data, a nuisance but easy enough to do (kind of an async spi interface without the clocks). Is this the port that uses the prototol commands described by rtv? I am hoping to be able to interface through the easily accessible 7th pad. An alternate might be connecting to the 8 pin SPI laser interface as described by jgustavoam. The last resort would be to read the display segment lines, but I really don't want to go there. So the immediate question is as above, is the mysterious 7th pc board pad a usable serial interface?

author: woodchips
author_rank: Frequent Contributor
timestamp: March 05, 2018, 05:01:23 pm
content: I bought a distance sensor that looks like this one. There was some chat about it then, quite some time ago, where it was decided it is time of flight actually doing the measuring. Don't ask me how! It is impressive that you can get a distance, put a coin in the path and remeasure and it comes up at 1mm or so more.The old Aga Telurometers used modulated light to measure to mm in km, they were clever. Perhaps that is what happens here?I use mine to measure how tall trees are, and it is amazing that it can measure to a branch 70' up in the air with the rough bark. It is measuring because slightly moving the sensor gives an equal change in distance.

author: rtv
author_rank: Contributor
timestamp: March 12, 2018, 11:18:08 am
content: I am using FTDI VNC2 debug module as usb to single wire serial adapter.Serial commands are only tested with PLR15.There are firmware update commands so be careful when using random commands they could erase flash.Adapter must be powered first because PLR15 starts in uart mode(display stay off) when serial line has pull-up resistor connected to +3V.another version:https://www.robotshop.com/letsmakerobots/laser-range-finder-hack?page=1How to use sensor with SPI is still unknown for most parts.

author: aounmc
author_rank: Newbie
timestamp: May 02, 2018, 03:20:36 pm
content: I am looking into integrating a laser "measuring tape" into a system that we make for the Flat Panel Display measurement industry. I have a GLM 50 which has bluetooth. After the bluetooth driver's are installed, I can communicate with the device using contributor rtv's commands. Does anyone know where he got these commands? With the commands shown, a measurement causes the laser to be turned off after the measurement. Our system will be "continuously" be measuring distance and this will cause the laser to "blink" which is not preferred. I was hoping to find a way to prevent this from happening and better understanding of the serial commands and how they were obtained would be helpful. I have a GLM 100 on order. I am hopeful that it will implement a virtual serial port over the USB interface that I can use instead of bluetooth. It may just be for charging though.Thanks,Mike

author: IDEngineer
author_rank: Super Contributor
timestamp: May 03, 2018, 03:14:24 pm
content: Quote from: jgustavoam on December 12, 2017, 12:46:36 amI think we can be reasonably certain they are not using triangulation in this unit. For one thing, the baseline (distance between emitter and detector) is far too small relative to the distances this unit is intended to measure. For another, 32 pixels don't yield the kind of resolution this unit supposedly delivers over its intended measurement range. I know it's a 2D array, but the second axis doesn't really yield any useful additional data for triangulation.I also don't think they are using the chromatic-based scheme mentioned in some of the cites above, since chromatic schemes rely on a spectrum of wavelengths and the LED emitter in this unit is likely quite monochromatic.My guess is some adaptation of modulation. Given that this unit measures rather long distances, they could use time of flight for the coarse distance and then employ the array to measure the phase of the arriving reflections to obtain finer resolution.

author: Siwastaja
author_rank: Super Contributor
timestamp: May 03, 2018, 07:04:47 pm
content: Continuous wave time-of-flight (modulation + demodulation phase difference measurement) suffers from multi-source mixing, creating so-called "flying result". For example, if the measurement pixel happens to be aimed so that half of the pixel receives light from a nearby object, half from faraway object. In this case, an imaginary average result appears (actually average weighed by the amplitudes of the signal, so the closer obstacle typically dominates the result).In subtle cases, this can be very problematic to notice: think about a wall at 1000mm, another at 10000mm, and the pixel mostly sees the 1000mm wall, but gets a tiny bit of delayed light from the 10000mm wall, so the result could read as 1050mm, and it's impossible to see the result is plainly wrong.I could imagine they use a 2D array to deal with this (or this is how I would do it): they have a 3D time of flight depthmap of 32x32=1024 pixels, which is quite a lot for this purpose; I guess the angular resolution is very high, as the full beam is narrow (a few degrees max?). Now, take the median of the 1024 distance values, and count the number of pixels that fall within, say, +/-50mm of that median. If the count is less than, say, 500, report an error (uneven surface; cannot measure). If more than 500, take the average of these near-median pixels to further improve the resolution and reduce noise.

author: IDEngineer
author_rank: Super Contributor
timestamp: May 03, 2018, 07:14:57 pm
content: Agreed, your description of using a 2D array to improve performance for diffuse measurements is a good idea. But that's still time-of-flight, not triangulation. The distances and resolution just don't add up for triangulation in this particular device.

author: Siwastaja
author_rank: Super Contributor
timestamp: May 03, 2018, 07:32:22 pm
content: Of course it isn't triangulation. If it was, they would use something like a 1000 or 2000 elements long linear sensor. Plenty of those exist, some specifically marketed for triangulation purposes.Time of flight is cheap and accurate nowadays, even in multi-kilopixel arrays. In wide beams, it suffers from multipath and modulated stray light, but that's not an issue in an optically well designed narrow beam device.

author: hsieber
author_rank: Newbie
timestamp: May 18, 2018, 06:48:47 pm
content: Update to my post of March 5, 2018. After a lot of research I thought I would take the high road and ask Bosch directly if there were any plans or possibilities to make the laser sensor of the GLM20 available as an OEM item. Answer was a resounding NO. After deciding that although this sensor would be ideal for my project, I would need to look elsewhere, I wasted weeks and weeks looking at other sensors such as the Parallax Ping)), Garmin Lidar-Lite, Mikro Click, and others. None of these approach the accuracy of the Bosch laser unit. I noticed a post on another thread stating that the user found a 'Chinese laser sensor' online, so I searched and found the almost-perfect sensor. Accuracy of +/- 1mm, very simple TTL ASCII interface, under 40 bucks. Downside is slow delivery, sketchy docs and tracking.So unless you are hacking the Bosch GLM as an intellectual challenge, I would recommend looking on the Chinese market outlet site.

author: IDEngineer
author_rank: Super Contributor
timestamp: May 18, 2018, 09:02:07 pm
content: Quote from: hsieber on May 18, 2018, 06:48:47 pmCare to share a link to this "almost perfect" sensor for the rest of us? Thanks!

author: hsieber
author_rank: Newbie
timestamp: May 24, 2018, 01:05:05 pm
content: The link to the 'almost perfect' sensor is:http://208.73.204.85/item/50m-164ft-Laser-Distance-Measuring-Sensor-Range-Finder-Module-Low-cost-Diastimeter-Single-Continuous-Measurement/32792768667.html. I was not being secretive, just not sure what forum policy is on commercial links. There are many other makers of this type of laser sensor on Aliexpress. You can get complete tape measure units, kits, or just sensors.To be clear, this sensor is 'almost perfect' for my particular application of package size measurement, YMMV. It will not be useful for robotics or drones, because it is slow- it takes 300 ms for a a measurement. However it is accurate and repeatable, as you would expect for the sensor at the heart of a laser tape measure. The 'almost' disclaimer is because of several factors:1- connection, there is no simple header connector, you need to tack solder to the gold plated pads at the edge of the board. There are connectors but they are not documented and are very small.2- It looks like each measurement must be triggered, there is no loop mode.3- Not everyone will like the 3.3v serial interface. It works for me because I have lots of serial ports (xmega128A3U), and I can poll all 3 sensors simultaneously.4- These come from China, with all the attendant communications, documentation, and delivery/customs issues. I am now waiting for 3 of these sensors that are stuck in customs at Fedex because of import problems (after paying $80 for air ship for $85 worth of sensors).5- There is an audio beeper that sounds after each measurement. With a sensor for each axis (3), and multiple measurements for averaging/verification, this will sound like a field of crickets. Apparently there is no way to mute/disable it short of clipping it out. Query to maker so far unanswered (wish I spoke Cantonese...)The interface needs 4 wires, 3.3V, Gnd, Tx, and Rx. Level is 3.3v for comms, at 19.2Kbps. Protocol is dead simple, send 'F', get a string likeF: 0.767m, 0150. Distance is in meters. Not sure what the other figure is, seems to vary even if distance is the same (undocumented, may be calculation time??). Easy to convert to inches:Code:float inches=39.3701*atof(&rxbuf);I plan to ask Sparkfun if they would add this sensor to their roster, to make getting this sensor easier for everyone.

author: IDEngineer
author_rank: Super Contributor
timestamp: May 24, 2018, 04:10:06 pm
content: Quote from: hsieber on May 24, 2018, 01:05:05 pmI feel this urge to buy one just to play with it. I'msureI can come up with some application for it! "No, honey, of course Junior needs adaptive cruise control on his bicycle. How else will he maintain an accurate following distance proportional to his speed?"

author: viruelaboy
author_rank: Newbie
timestamp: August 15, 2018, 08:09:56 pm
content: quick question. I bought the same measuring tape and I want to accomplish something much simpler. I want to bypass the timed turning off. I was able to get the values using a video ocr but now what I have remaining is for the device to stay on so long as I provide external power to it. any ideas?

author: sifourquier
author_rank: Newbie
timestamp: September 08, 2018, 12:52:24 pm
content: HelloThanks you for your jobI have a PRL30C and the commande Start measure:C0 40 00 EE work realy fin but i try to make a software for direct input measure in computer (simulate a keyboard)Then is need to read measure when user presse on the button of PLR30CAfter snifing PLR measure&go (android app) i found if i send 0xC0 55 02 01 00 1aEvery time i presse the button i receive C0 55 10 06 00 NN 01 XX XX XX XX 00 00 00 00 00 00 00 00 YYwhere NN is a measure counter (+1 at eache measure)XXXXXXXX increase with distance but is not linear is like a exponantial but segmentedand for YY I think is a crcDo you have any information about how to go from this "exponantial value" to the distance?I can found x linear equation 1 by segment but i thing maybe any body have allready make it.My measurement (max 7.6m i need make measure at more)http://cortexet.free.fr/autre/measure_auto.odshttp://cortexet.free.fr/autre/measure_auto.csv

author: rtv
author_rank: Contributor
timestamp: September 12, 2018, 04:26:31 pm
content: XX XX XX XX is hexadecimal float.1089625758==0x40F25E9E==7.57405f==7.6mAnd this is how I think crc is calculated:+ couple commands to test with bluetooth(I don't have BT device)Code:/* BOSCH laser serial data crc value computing*//* Program prints out crc value of byte array*//* *///#include "stdafx.h"#include "stdio.h"#include "stdint.h"#define POLYNOMIAL166;#define SEED170;//http://www.ti.com/lit/an/slua363/slua363.pdfint calc_crc(int data_byte, int crc){int bit_mask = 0, carry_check = 0, temp_data = 0;temp_data = data_byte;for (bit_mask = 0; bit_mask <= 7; bit_mask++){data_byte = data_byte ^ crc;crc = crc << 1;temp_data = temp_data << 1;carry_check = data_byte & 0x80;if (carry_check){crc = crc ^ POLYNOMIAL;}data_byte = temp_data;}return (crc);}int main(){//test arrays//received data:uint8_t data[] = { 0x00, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x08, 0xC1, 0x01, 0x00, 0x00, 0x00, 0x01, 0x01, 0x03, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; //serial number received from device last byte 0xD4 removed(crc)//commands://uint8_t data[] = { 0xC0, 0x55, 0x02, 0x01, 0x00 }; //crc should be 0x1A. PRL30C Set device as BT master// these commands might work after device is set as BT master//uint8_t data[] = { 0xC0, 0x51, 0x02, 0xFF, 0xFF }; //crc should be 0x9C. Get how many measurements in device memory//uint8_t data[] = { 0xC0, 0x51, 0x02, 0x01, 0x01 }; //crc should be 0x18. Get measurement 1//uint8_t data[] = { 0xC0, 0x51, 0x02, 0x01, 0x0A }; //crc should be 0x80. Get measurement 10uint8_t crc = 0;uint8_t newseed = SEED;uint32_t bytearraysize = sizeof(data) ;uint32_t bytepos = 0;//calculate crcdo{newseed = calc_crc(data[bytepos++], newseed);}while (bytepos < bytearraysize);crc = newseed;printf("crc: 0x%X ", crc);getchar();return 0;}

author: sifourquier
author_rank: Newbie
timestamp: September 12, 2018, 06:23:58 pm
content: Realy thanks youIt is logic why i have no think to that?

author: retroguf
author_rank: Newbie
timestamp: October 16, 2018, 08:35:22 pm
content: HiI' am just harvesting the goods of your and everyone elses post here.I am creating a c# lib for communicating with the bosch glm 50 c bluetooth distometer.I have one little problem thou;i cant get the endian convertion to get the right result.if i meassure 3729mm i get the result 0d1b hex, which i "reverse" to 1b0d which multiplied by 0,05 is 346,25 in decimal.my next step would be to capture some more data points and compare with byte and bit wyse endian reversing.I hope somene have som golden input.Any input to what my mistake might be?regards Frank

author: TrickyNekro
author_rank: Frequent Contributor
timestamp: October 17, 2018, 12:09:51 am
content: I haven´t seen if that is actually posted by someone else but...The photosensor seems to have two seperate arrays, one could be used for ambient detection and dynamic range, the other for that price range would be used for triangulation.You say the device was unaffected by another laser but... Have you seen if there are any filters in the optics or not? Are you sure your interference laser is of the same wavelength as the sensor laser?And it could be using a form of modulation to distinct between laser sources, but that would be rather low freq. modulation. You only need to test the laser with a current probe and a scope.A normal voltage prob even when AC coupled might not bring much, but try it first.

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 30, 2018, 01:30:17 pm
content: Some interesting Patents of Robert Bosch manufacturer, about Laser distance meters :Laser distance measuring devicehttps://patents.google.com/patent/US7075626B2Device for measuring distance using a semiconductor laser in the visible wavelength rangehttps://patents.google.com/patent/US6369880B1Measuring Apparatus and Referencing Method for a Digital Laser Distance Meterhttps://patents.google.com/patent/US20140168632Multi-Target Laser Distance Meterhttps://patents.google.com/patent/US20170074975A1Device and method for optical distance measurementhttps://patents.google.com/patent/US6801305B2/enDevice and method for optical distance measurementhttps://patents.google.com/patent/US7728957B2/en

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 30, 2018, 02:00:30 pm
content: Quote from: rtv on October 29, 2017, 01:33:40 pmI guess you are correct !Device and method for optical distance measurementhttps://patents.google.com/patent/US6801305B2/enDevice and method for optical distance measurementhttps://patents.google.com/patent/US7728957B2/en"In addition to the embodiment that has been described up to this point, which is used essentially to determine the time delay of the measurement signal between the measurement device 10 and the target object 20, an in particular to determine such a time delay by means of a phase measurement, the device 10 according to the present invention also has an additional reception unit 19 equipped with a triangulation sensor 66. This additional reception unit 19 is essentially comprised of a projection lens 51 for the triangulation and a position-sensitive detector 55. In lieu of the projection lens, it is possible to alternatively provide, or to additionally provide along with the projection lens, a circular aperture 53 as a projection aperture, which assures the required depth of field"

author: voltsandjolts
author_rank: Unknown
timestamp: December 30, 2018, 02:06:43 pm
content: Quote from: retroguf on October 16, 2018, 08:35:22 pmTwo bytes doesn't seem enough, maybe should be four bytes like user 'rtv' post above.IEEE754 floating point format converter:https://babbage.cs.qc.cuny.edu/ieee-754.old/32bit.html

author: A32
author_rank: Newbie
timestamp: November 21, 2020, 05:39:52 pm
content: Hi. What are the components on your picture? I need to replace them but cant recognize

author: mcb
author_rank: Newbie
timestamp: February 23, 2021, 01:06:13 pm
content: I think that the sensor array is not for triangulation but for laser interferometer.It seems plr15 uses laser interferometry with a sweeping laser diode or at least the laser's frequency could be adjustable to measure the distance.That sensor array is used to get fringe patterns.

author: gjakobsche
author_rank: Newbie
timestamp: September 21, 2021, 08:20:43 pm
content: Has anyone investigated the pads on the front of the PCB for additional function buttons? The GLM 20 has only one button, but according to the pictures, it has pads for four additional buttons. Do any of them do anything? Or, does Bosch use the same PCB for several models of LDMs, perhaps with different microcode and/or different microcontrollers?-George

author: Razor512
author_rank: Regular Contributor
timestamp: September 24, 2021, 06:12:07 am
content: Sorry if off topic, I was wondering do any of the common laser distance measuring devices have a simple way to increase the laser's output power? Most tend to do a fraction of a milliwatt, but often have laser modules that can easily do 5 milliwatts+One of the biggest issues especially with lower cost devices, is measurements and accuracy when light levels are high or when outdoors. The more expensive devices will have a brighter laser that allows them to do things like measure 40-50 meters outdoors, while some cheaper ones (rated for 60+ meters) will have the laser become invisible after around 15-20 meters outdoors, thus causing the unit to fail to measure the distance. It would also be interesting considering how it is common to see 3 or so different models of a cheap laser distance measure where they look the same but for the max range and laser intensity. It makes me thing they are just increasing the upper limit on what numbers it will display in firmware, and then increasing the laser output to cover that distance.It would be awesome if the laser output could be tweaked for a little higher output while still maintaining accuracy.

author: iliasam
author_rank: Newbie
timestamp: October 13, 2021, 08:07:56 am
content: Also sorry for offtopic, maybe my research would we interested to someone here:https://github.com/iliasam/Laser_tape_reverse_engineeringI successfully completed reverse engineering hardware of a cheap chinese laser tape measure and write my own code for its MCU.I was more concentrated at measurements speed instead of accuracy.Back to topic: I tried to make reverse engineering of my BOSCH PLR15 laser tape measure a long time ago - nearly in 2015. It has the same SOC sensor as was mentioned here.I suppose that this integrated sensor is containing two SiPM photosensors:https://en.wikipedia.org/wiki/Silicon_photomultiplierSiPM sensors are containing a lot of SPAD diodes, connected in parallel, so it is not possible to say that BOSCH sensor can detect and analyze image.Probably this laser tape measure is using phase method for distance measurement - one photosensor is used for measuring distance, another one is used as a reference channel.I tried to analyze SPI data and (as I can remember) - resulting data was looking as sinusoidal signals.Also there was some strange data that I can't process.

author: Dainius_UK
author_rank: Newbie
timestamp: October 18, 2021, 11:24:48 pm
content: Hi.Thanks everyone for sharing your research.Don't know if this will have any benefit to anyone or this research. But I have decompiled "Bosch MeasureON" android apk file using "JADX"https://github.com/skylot/jadxhttps://www.dropbox.com/s/3xcvlzzflls3eky/Crc.PNG?dl=0https://www.dropbox.com/s/x2gimzjl9at4388/MtBLE.PNG?dl=0https://www.dropbox.com/s/x0x5j41wt9qxgzp/MtFrame.PNG?dl=0https://www.dropbox.com/s/loe53yrf6579fnr/MtProtocol.PNG?dl=0And there is tons of info on Bosch GLM100C measure tape connection protocols, crc calculation, both classic and BLE......

author: elham
author_rank: Newbie
timestamp: November 20, 2021, 11:35:50 am
content: Dear Sir,thank you for sharing information's about hacking PLR15 and GLM20.I can read data from the connection of two board on the leaser, but I could not read the serial data of PLR15.can you please help me?I am waiting for your answer.Best regards

author: anm
author_rank: Newbie
timestamp: January 25, 2022, 09:40:13 am
content: I read out firmware binary from BOSCH GLM 250 VF and disassembled it. Then I wrote python script for communicating with rangefinder by UART and read distance. But after this rangefinder doesn't works in normal mode with batteries - it beeps always when turned on (as if continuously press buttons). Think made some damages while soldered wires. Has anyone had the same problem?

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 13, 2022, 12:02:56 pm
content: To colleagues who have Bosch measuring tapes with Bluetooth, I have this suggestion to make.You will be able to help us a lot to decipher the serial communication with the tape.Using Bosch'sMeasure ONAndroid app, use this procedure to capture the Bluetooth communication protocol.Measure ON:https://play.google.com/store/apps/details?id=com.bosch.ptmt.measrOnBluetooth Capture procedure:https://support.honeywellaidc.com/s/article/How-to-capture-Bluetooth-traffic-from-and-to-an-Android-DeviceOn the applicable Android devices, it is possible to capture Bluetooth traffic as follows:- Go to SettingsIf developer options is not enabled, enable it now.https://www.digitaltrends.com/mobile/how-to-get-developer-options-on-android/- Go into developer optionsEnable the optionEnable Bluetooth HCI snoop logEnable the Bluetooth option and Connected to the device.- Perform the actions which need to be captured. Run Measure ON app.- Turn off the Bluetooth on the device.- Disable the option Enable Bluetooth HCI snoop log- Make sure the device is connected to the PC.As the relevant files might not be shown in a PC's file browser in 'Internal Storage', copy the file to a PC by means of the Android Debug Bridge:adb pull /sdcardThe files of interest arebtsnoop_hci.logand all files with the extension .cfaThese are binary files, which can be opened withWireshark.https://www.wireshark.org/How To Reverse Engineer A Bluetooth Devicehttps://youtu.be/NIBmiPtCDdMWith this other application you will be able to obtain a lot of important information about Bluetooth communication.nRF Connect for Mobile:https://play.google.com/store/apps/details?id=no.nordicsemi.android.mcpAny questions about the apps, contact meThanks in advance.

author: kosnick
author_rank: Newbie
timestamp: March 15, 2023, 04:52:50 pm
content: Hi all,i have a BOSCH GLM 50-27 cg.i try to connect it to my ubuntu machine.when using bluetoothctl i am able to connect to it, but when i try to pair with it, the connection is lost.when using some python script (or c even) the device is not even discovered.Any help would be much appreciated.

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 15, 2023, 11:57:31 pm
content: Hi Kosnik,Normally, measuring devices use Bluetooth Low energy, which has a different protocol than Bluetooth Classic. Probably the GLM50 uses BLE.Reading suggestion:https://punchthrough.com/category/ble/

author: kosnick
author_rank: Newbie
timestamp: March 20, 2023, 06:18:03 pm
content: Hi JG!I think you were right!As soon as I tried to connect (no pairing for BLE) then it seems that I am able to connectand receive some info about the device (services and UUIDs for example).So thank you for the tip, it was a breakthrough!Now, I am trying to snif some bluetooth messages with my android smartphone as suggested in your previous post.However I was not able to find any service or uuid in the wireshark log file.On the other hand, googling some of the UUIDs I found this page:https://devzone.nordicsemi.com/f/nordic-q-a/80589/sniffing-a-bosch-laser-tape-2so I am "assuming" (yes, I know...) that it is the correct UUID.I'll look into it again.Once again, thanks!

author: artag
author_rank: Super Contributor
timestamp: March 20, 2023, 08:04:14 pm
content: Quote from: jgustavoam on November 13, 2022, 12:02:56 pmI have a PLR 40 C and a moto g(50) running android 12I've done the procedure above and briefly tried it :- enabled log- make a measurement, which spoke the measurement on the phone- disable logadbadb pull /sdcardThis gives me all of sdcard but I can't see any logfiles in itDo I need to do anything else ? Or is the switching of bluetooth on the Bosch critical ? I'm not practised with adb.

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 20, 2023, 08:51:28 pm
content: Hi Artag,Look for the file in the Android/data folder.The file of interest is btsnoop_hci.log.This is a binary file, which can be opened with Wireshark.

author: artag
author_rank: Super Contributor
timestamp: March 20, 2023, 09:02:03 pm
content: No such file, at least within the /sdcard copy pulled from adbMost of them start com.motorola or com.google. Nothing with bt in at all.Maybe I need to do more to get the file flushed beforte it ends ?I did try to look in the root device while adb was connected and I had no permission to look in data(bastards ! whose phone is it anyway !)oh, just noticed that I have to toggle bluetooth after enabling logging.. but still not thereLooking at some suggestions inhttps://stackoverflow.com/questions/23877761/sniffing-logging-your-own-android-bluetooth-trafficThere's no 'FileName' in the config file

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 20, 2023, 09:15:37 pm
content: This file is in the root of Android device, not the SD card.Look for the file in the Android/data folder.The file of interest is btsnoop_hci.log.You can then share the file via your email. It was the simplest way I found to transfer.This is a binary file, which can be opened with Wireshark.

author: artag
author_rank: Super Contributor
timestamp: March 20, 2023, 10:00:30 pm
content: https://stackoverflow.com/questions/28445552/bluetooth-hci-snoop-log-not-generated/30352487#30352487It seems like it could be in a number of places. I'm trying the bugreport routeI also have hardware sniffing devices - nrf8240 etc. haven't really tried those but I could do with workling them out, I need to do some ble debugging for another projectThe bugreport file contains it here :$ ls -l ~/FS/data/misc/bluetooth/logs/total 168-rw-r--r-- 1 adrian adrian 16 Mar 20 21:07 btsnoop_hci.log-rw-r--r-- 1 adrian adrian 166989 Mar 20 21:59 hci_snoop20230320210739.cfaSo I guess I need to root it to get that easily. The logfile contains very little :00000000 62 74 73 6e 6f 6f 70 00 00 00 00 01 00 00 03 ea |btsnoop.........|00000010The cfa is rather bigger, and wireshark can read itMaybe it's more useful to try to get a smaller number of transactions in each log

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 20, 2023, 10:12:19 pm
content: Review the procedures.Something is wrong.

author: artag
author_rank: Super Contributor
timestamp: March 20, 2023, 10:14:07 pm
content: It seems to follow the scheme written in that last stackoverflow entryhttps://stackoverflow.com/questions/28445552/bluetooth-hci-snoop-log-not-generated/30352487#30352487UPDATE: The btsnoop hci log seems to be getting phased out of the user-accessible areas on a lot of phones. Assuming you have hci logging enabled, you can get a bugreportadb bugreport anewbugreportfolderThen decompress the folder. If you're lucky there is an 'FS' folder that contains the btsnoop_hci.log log several layers down (not sure why some phones have this and some don't.) If you don`t have it, grab the bug report text file that looks like thisbugreport-2018-08-01-15-08-01.txt

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 21, 2023, 11:48:12 am
content: Artag,If your Android device doesn't have access to the file, try with an older device. In my case, I used a Tablet S2 Samsung Android 7.0. And it worked.

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 21, 2023, 12:06:39 pm
content: I always look for free codes on Github. Look what I found.https://github.com/prudhvirajstark/BoschGLM50Chttps://github.com/Scarfsail/BoschGLM50https://github.com/piannucci/pymtprotocolhttps://github.com/philipptrenz/BOSCH-GLM-rangefinderhttps://github.com/fantom3ds/LaserBluetooth

author: artag
author_rank: Super Contributor
timestamp: March 22, 2023, 02:36:42 am
content: Quote from: jgustavoam on March 21, 2023, 11:48:12 amGood point, I'll try an older phone. If it's got that log capability at all.The bugreport thing is OK though, just seems silly offloading everything for just one file. They've optimised it for filing bug reports rather than unpicking protocols

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 22, 2023, 04:21:48 am
content: I finally got USB/Serial communication with the Bosch GLM20 !! I will post shortly.I used a CP2102 USB/Serial interface (module) with some resistors, 74HC00 and schotky diode.Tested with Realterm program (9600 Bps 8N1) - Windows 10pins of STM32F051 in the circuit - connected to interface USB/SerialP58 = STM32F051 - USART1-TXP59 = STM32F051 - USART1-RXSome tests:Measuring (mm) :/20 or x 0.05 (same)C0 40 00 EE => 00 04 45 C9 00 00 84 0xC945 = 51525 / 20 = 2576.25 mmC0 40 00 EE => 00 04 6C 1F 00 00 AA 0x1F6C = 8044 x 0.05 = 402.2 mm0xC0 0x06 0X00 0X4A = Get Serial Number(best test to verify results)C0 06 00 4A => 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3E (Hexadecimal)ÀJ603/3601K72EG0> (ANSI) Bingo !!!! that is correct!0xC0 0x41 0X00 0X96 = Laser ONC0 41 00 96 => 00 00 820xC0 0x42 0X00 0X1E = Laser OFFC0 42 00 1E => 00 00 820xC0 0x47 0X00 0X20 = Backlight ONC0 47 00 20 => 00 00 820xC0 0x48 0X00 0X62 = Backlight OFFC0 48 00 62 => 00 00 82Thanks to everyone who contributed here on the forum.

author: jgustavoam
author_rank: Regular Contributor
timestamp: March 22, 2023, 05:47:32 pm
content: GLM20 - Interface USB/SerialFollowing the forum instructions, I've done several communication tests in the past with the GLM20. But my tests failed. I got frustrated and stopped.Rereading all the threads, I realized that the PRL15 circuit board was identical to the GLM20. (Thanks RTV). I thought - it has to work!If the RTV colleague did it, I think I can too.Yesterday, doing more tests using an oscilloscope to monitor the waveform of the serial signal on pin P58/P59, I received a response to a command. But the received signal was truncated. I realized that the low level of the signal was at 1V, inadequate for reception.After that, I built a circuit using resistors, schottky diode, a 74HC00 chip and managed to correctly read the received data.Today thinking happily about being able to read the data, I built another simpler circuit, with a 74HC07 chip. Why HC chip? Because it works with 3.3V! Do not use an ordinary 7407.This is the circuit built by me. It's the first one that worked with my tests. I checked with the oscilloscope and the signal is fine. We can then make other improvements if necessary.Usage sequence:1) press the power button on the GLM202) Press the reset button SW2 (display turns off)3) Press the SW1 button to activate the communication (backlight on)4) Run a terminal program connected to the USB of the CP2102 module - 9600 Bps 8N1.5) Send the command and you will see the results.To do later- Connect with an Arduino, Raspberry PICO or ESP32- Make a Golang program to run on a Windows/Linux/MACThanks RTV - instructions to use Realterm:https://www.eevblog.com/forum/projects/hacking-the-bosch-glm-20-laser-measuring-tape/msg1450020/#msg1450020Display as = HEX SPACE OR ANSI

author: kosnick
author_rank: Newbie
timestamp: April 16, 2023, 09:23:16 pm
content: Hi all again,with your help, some time and some research I am able to ask the GLM 50-27 to take a measurement, and I can read it back (python).However, I noticed one thing i need your help with:in order to be able to read the indications of the characteristic (which inculde the measurement) the device has to be FIRST connected to the official app (android).Then, one can read the indicaitons.If the laser tape does not get connected to the official app initially, the indications are not there.So to clarify things, this is how it works: i connect the lase tape to the official android app. I then disconnect it. And afterwards I am able to use the python script to read measurements.Does this ring any bells?Thank you in avdvance.

author: jgustavoam
author_rank: Regular Contributor
timestamp: April 16, 2023, 11:18:04 pm
content: Hi Kosnick,Congratulations on achieving Bluetooth communication with your Bosch laser tape.I have been looking into Bluetooth BLE communication as I am involved in a project at work.The normal sequence of a BLE communication with Android is this:https://punchthrough.com/android-ble-guide/- perform a BLE scan- connect to the BLE server (Laser Tape)- discover services and charactheristics- subscribe to notifications or indications- perform read or write operationYou can do all this with Python, C++, Golang or another language.There is no need to connect the device with the original app.

author: kosnick
author_rank: Newbie
timestamp: April 17, 2023, 08:52:42 am
content: well it seems something is not quite right...I do connect to the device and since i know the uuid of both the service and the characteristic, i subscribe to those.And enable indications.So at this point I can constantly receive some indications from the device, which I do not know how to interpret, but is of no importance (i think).But these indications do not include any measurement values.As soon as i connect the device to the official app, and disconnect it immediately, I am able to receive new indications which include the measurement value (by the way, on the same handle as previously).It seems to me that the "connection to the official app" does a little extra on the indications and hence I am able to receive the measurement data when I include this part in my tests.But i can not figure it out - I have sniffed with my android smartphone and checked on the wireshark and also used the nRF connect app on the phone too. But with no results.Once again, thanks for your help.

author: jgustavoam
author_rank: Regular Contributor
timestamp: April 17, 2023, 05:49:32 pm
content: Kosnik,There is a very interesting tool for you to discover services and characteristics of an Android device. Use the NRF connect app to connect the laser tape and browse and test services and features.Try to identify which characteristic is used for the measurement.nRF Connect for Mobilehttps://www.nordicsemi.com/Products/Development-tools/nrf-connect-for-mobilehttps://play.google.com/store/apps/details?id=no.nordicsemi.android.mcp&hl=pt_BR&gl=USRecommendations for study:https://github.com/prudhvirajstark/BoschGLM50Chttps://github.com/Scarfsail/BoschGLM50https://github.com/piannucci/pymtprotocolhttps://github.com/philipptrenz/BOSCH-GLM-rangefinderhttps://github.com/fantom3ds/LaserBluetooth

author: kosnick
author_rank: Newbie
timestamp: April 17, 2023, 06:52:39 pm
content: JG,I already have. But I am somehow stuck at the moment.Both nRF connect , and bluetooth sniffing with the android phone have the same results.I tried investigating the log from the sniffing, but this is where I am stuck.I need to investigate a little more.There is one thing I noticed, that happens just after the enable of the indications and this I want to check.Let's see.

author: jgustavoam
author_rank: Regular Contributor
timestamp: April 17, 2023, 09:25:13 pm
content: Kosnick,Post the logs of your tests and then I can try to help you.See that the commands are the same as the ones I used on the USB/Serial interface.https://github.com/philipptrenz/BOSCH-GLM-rangefinder/blob/master/glm100c.pycmds = {'measure': b'\xC0\x40\x00\xEE','laser_on': b'\xC0\x41\x00\x96','laser_off': b'\xC0\x42\x00\x1E','backlight_on': b'\xC0\x47\x00\x20','backlight_off': b'\xC0\x48\x00\x62'}

author: kosnick
author_rank: Newbie
timestamp: April 25, 2023, 06:06:00 am
content: Hi Gustavo!First of all, once more, thank you for taking the time to take a look at it.I have been working on the project based on this post:https://devzone.nordicsemi.com/f/nordic-q-a/80589/sniffing-a-bosch-laser-tape-2As you may see, on some devices the protocol is different to the one you are mentioning.I have also posted on that forum asking for help.Anyway, pcap files are not allowed to be sent here, so I sent you a pm with a link.

author: jgustavoam
author_rank: Regular Contributor
timestamp: April 25, 2023, 01:25:38 pm
content: Kosnick, I think it's best to continue your project on the other forum. As soon as possible I will answer it.

author: kosnick
author_rank: Newbie
timestamp: April 25, 2023, 04:19:13 pm
content: ok, thanks again

author: Njk
author_rank: Frequent Contributor
timestamp: April 25, 2023, 08:40:48 pm
content: It's still remains, how do they do it. The speed of light is so high, the time difference is hard to measure for short ranges. OTOH, the mentioned triangulation technique (with pixels or whatever) does not work well for a long distances. Some devices, like aviation altimeters, measures the modulated signal phase difference, not directly the TOA difference. Related geodetic instruments like Tellurometer also measures the phase difference. E.g. the CA 1000 modelhttps://vm.civeng.unsw.edu.au/surveying/f_pall/html/e9.html"Both units radiate an X-band microwave carrier tuneable between 10.10 and 10.45 GHz which is frequency modulated in the 19 to 25 MHz range. The Remote unit receives the transmission and re-transmits it to the Master, which measures the phase difference between the transmitted and received signals."Quite complex arrangement, with Master and Slave units. Acoustic engineers knows about the ringing phenomenon, when the loudspeaker signal is picked up by the mic resulting in the sound of ringing frequency. If one can set up such ringing over an RF link, then the distance between the transmitters can be calculated through measurement of the ringing frequency, that's very simple. Just thinking

author: jgustavoam
author_rank: Regular Contributor
timestamp: April 26, 2023, 10:50:21 am
content: Hi NJK,Searching for an answer in ChatGPT - artificial intelligence:https://chat.openai.com/Do you trust this answer?How does the bosch measuring tape laser distance sensor work?The Bosch measuring tape with laser distance sensor is a measuring tool that uses a laser distance sensor to measure the distance between two points with high precision. The laser distance sensor emits a short-duration laser beam and measures the time it takes for the laser beam to reflect off an object and return to the sensor. Based on the laser's travel time and the speed of light, the sensor is able to calculate the distance accurately.Here are the main steps on how the Bosch measuring tape laser distance sensor works:1.Laser beam emission: When you press the measurement button on the Bosch measuring tape, the laser distance sensor emits a short-duration laser beam towards the object you want to measure.2.Laser beam reflection: The laser beam hits the object and is reflected back towards the sensor.3.Laser beam detection: The laser distance sensor in the Bosch measuring tape detects the reflected laser beam using a light-sensitive receiver.4.Measurement of travel time: The laser distance sensor measures the time it takes for the laser beam to travel from the sensor to the object and back, based on the time difference between the laser emission and the detection of the reflected beam.5.Distance calculation: Based on the laser's travel time and the speed of light (which is constant), the Bosch measuring tape laser distance sensor calculates the distance between the sensor and the object with high precision.6.Display of the result: The measurement result of the distance is displayed on the Bosch measuring tape's display, usually in units of measurement such as meters, centimeters, feet, or inches, depending on the tape's settings.It is important to follow the manufacturer's instructions and take safety precautions when using the Bosch measuring tape laser distance sensor or any other laser measuring tool. Make sure to read and understand the user manual and use appropriate safety goggles when operating the Bosch measuring tape or any other laser tool.

author: jgustavoam
author_rank: Regular Contributor
timestamp: April 26, 2023, 11:01:06 am
content: Searching for an answer in ChatGPT - artificial intelligence:https://chat.openai.com/How long does it take a laser beam to travel a distance of 1 meter?The speed of light in a vacuum is approximately 299,792,458 meters per second (m/s), which is the fastest speed that any information or signal can travel in the universe. Therefore, it takes approximately 3.34 nanoseconds (ns) for a laser beam to travel a distance of 1 meter in a vacuum.It's important to note that the speed of light can vary slightly depending on the medium through which it is traveling. For example, light travels slightly slower in air, glass, or other materials compared to a vacuum, due to the refractive index of the material. However, for practical purposes, the speed of light in a vacuum is often used as a constant value in most calculations and measurements involving laser distance sensors or other laser-based technologies.-----------------------------------------------------------------------Based on these statements, we can conclude that the time taken for the laser to be reflected is twice that time, therefore2 x 3.34 nanoseconds = 6.69 nsIf the timer is based on pico seconds resolution, good accuracy can be achieved.1 nano second = 1000 pico seconds (10⁻¹²)6.69 ns = 6690 psLinks suggested by me in 2018:Device and method for optical distance measurementhttps://patents.google.com/patent/US6801305B2/enDevice and method for optical distance measurementhttps://patents.google.com/patent/US7728957B2/en

author: Njk
author_rank: Frequent Contributor
timestamp: April 26, 2023, 08:07:31 pm
content: Quote from: jgustavoam on April 26, 2023, 11:01:06 amHi jgustavoamAutomated script reading machines are not only funny. Good occupation area for the crowds of developers and sellers is even more important achievement. As for average Joe, he's not yet legally obliged to consume that BS. I'm sure they're working on that tirelessly, but for now I'm happy to exercise my freedom.Quote from: jgustavoam on April 26, 2023, 11:01:06 amThanks for the Bosch patents, very interesting.

author: hdlbq
author_rank: Newbie
timestamp: August 16, 2023, 09:23:56 am
content: Hi,First, thanks for all the valuable information you shared.I'm trying to measure the altitude of a mid-size drone with a Bosch PLR15. I realize that I have to be careful with the laser beam.My first attempt to simply communicate with the PLR15 failed completely.I connected a VNC2 FTDI to the Ground, VCC and Rx/TX pads like described earlier by rtv:Quote from: rtv on March 12, 2018, 11:18:08 amUnfortunately, I can't receive any answer to my commands, sent using a Terminal emulator on my PC (9600 bauds, 1 Bit Stop, No Parity, no Handshake)I soldered the wires to the PCB to be able to use the PLR15 almost normally (see pictures joined)Thanks for your help

author: jgustavoam
author_rank: Regular Contributor
timestamp: August 16, 2023, 02:27:09 pm
content: HDLBQ,I recommend using the circuit I posted. This circuit was tested with the GLM20 tape, but it looks similar to the PLR15 tape.Quote from: jgustavoam on March 22, 2023, 05:47:32 pm

author: Dainius_UK
author_rank: Newbie
timestamp: November 15, 2024, 09:42:14 am
content: Ok so it`s 2024 not sure if anyone is still interested in this topic. I was snooping around the internets and found that Mr Bosch has made their communication LRF SDK available on their devs forums. Looks like BLE and rs232 protocols are exposed.

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 15, 2024, 11:55:26 am
content: Hi Dainius,Can you please provide us with the link where you found this Bosch protocol? Thank you.

author: Dainius_UK
author_rank: Newbie
timestamp: November 15, 2024, 06:49:51 pm
content: https://developer.bosch.com/products-and-services/sdks/bosch-glm-plr-app-kitjust register for a free account

author: jgustavoam
author_rank: Regular Contributor
timestamp: November 16, 2024, 03:14:13 pm
content: Thanks Dainius,Very interesting!

author: jgustavoam
author_rank: Regular Contributor
timestamp: December 02, 2024, 12:12:30 am
content: Hi Dainius,Answering your question:"I am struggling to understand how to use particular command "0xC0, 0x40..........."Reviewing my notes from 2023. See if you can figure out how to decode the measurements.Code:https://github.com/philipptrenz/BOSCH-GLM-rangefinder/blob/master/glm100c.pycmds = {'measure': b'\xC0\x40\x00\xEE','laser_on': b'\xC0\x41\x00\x96','laser_off': b'\xC0\x42\x00\x1E','backlight_on': b'\xC0\x47\x00\x20','backlight_off': b'\xC0\x48\x00\x62'# distance to object from top of devicedistance = int(struct.unpack("<L", data[2:6]))*0.05#print(distance, 'mm')return distancedistancia 40 cm0xC0 0x40 0x00 0xEE = measureC0 40 00 EE => 00 04 3C 1F 00 00 9E 7 BytesC0 40 00 EE => 00 04 49 1F 00 00 00C0 40 00 EE => 00 04 41 1F 00 00 EEC0 40 00 EE => 00 04 3C 1F 00 00 9EC0 40 00 EE => 00 04 3E 1F 00 00 CCC0 40 00 EE => 00 04 58 1F 00 00 80C0 40 00 EE => 00 04 79 1F 00 00 8EC0 40 00 EE => 00 04 75 1F 00 00 C4C0 40 00 EE => 00 04 6C 1F 00 00 AA 0x1F6C = 8044 x 0.05 = 402,2 mmC0 40 00 EE 00 04 61 1F 00 00 1A 1F61C0 40 00 EE 00 04 66 1F 00 00 16C0 40 00 EE 00 04 5B 1F 00 00 282.580 mmC93E = 51518 x 0,05 = 2575,9 ou 51518/20C0 40 00 EE => 00 04 3E C9 00 00 02C0 40 00 EE => 00 04 45 C9 00 00 84 0xC945 = 51525 / 20 = 2576,25C0 40 00 EE => 00 04 3C C9 00 00 50 0xC93C = 51516 / 20 =C0 40 00 EE 00 04 3B C9 00 00 5C0xC0 0x06 0X00 0X4A = Get Serial NumberC0 06 00 4A get serial number 3601K72EG000 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3EC0 06 00 4A 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3EC0 06 00 4A 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3EC0 06 00 4A 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3EC0 06 00 4A 00 1D 36 30 33 00 2F 11 03 00 00 00 01 00 00 01 00 00 33 36 30 31 4B 37 32 45 47 30 00 00 00 3EÀJ603/3601K72EG0>0xC0 0x41 0X00 0X96 = Laser onC0 41 00 96 00 00 82C0 41 00 96 00 00 82C0 41 00 96 00 00 82C0 41 00 96 00 00 820xC0 0x42 0X00 0X1E = Laser OFFC0 42 00 1E 00 00 82C0 42 00 1E 00 00 82C0 42 00 1E 00 00 82C0 42 00 1E 00 00 820xC0 0x47 0X00 0X20 = Backlight ONC0 47 00 20 00 00 82C0 47 00 20 00 00 82C0 47 00 20 00 00 82C0 47 00 20 00 00 820xC0 0x48 0X00 0X62 = Backlight OFFC0 48 00 62 00 00 82C0 48 00 62 00 00 82C0 48 00 62 00 00 82C0 48 00 62 00 00 82And using Arduino Code on Raspberry Pico:(attached file: GLM20_PICO2.INO)Code:byte byte1 = receivedBytes;byte byte2 = receivedBytes;byte byte3 = receivedBytes;unsigned long valor = ((unsigned long)byte1 << 16) | ((unsigned long)byte2 << 8) | (unsigned long)byte3;float valor_decimal = float(valor);Serial.println((valor_decimal / 200), 2); // valor em cmSerial.println();Code:10:42:51.410 -> Comando enviado10:42:52.723 -> Received Serial Data is:10:42:52.723 -> C0 40 0 EE 0 4 42 22 0 0 92 010:42:52.723 -> 43.8510:42:52.723 ->10:42:53.989 -> Comando enviado10:42:55.301 -> Received Serial Data is:10:42:55.301 -> C0 40 0 EE 0 4 6 2A 0 0 D2 010:42:55.301 -> 53.7910:42:55.301 ->23:30:54.043 -> Comando enviado23:30:55.350 -> Received Serial Data is:23:30:55.350 -> C0 40 0 EE 0 4 9B D2 0 0 B4 2223:30:55.350 -> 269.5823:30:55.350 ->23:30:56.605 -> Comando enviado23:30:57.908 -> Received Serial Data is:23:30:57.908 -> C0 40 0 EE 0 4 9C D2 0 0 B8 2223:30:57.908 -> 269.58