TSIP on Trimble UCCM - Page 1
Forum section: electronics / projects

author: linotype
author_rank: Newbie
timestamp: June 24, 2023, 06:41:16 am
content: On an older thread here, there's some discussion about getting TSIP to work on the Trimble version of the UCCM GPSDO.I realized that the Trimble Resolution T came to market around the same time as the UCCM, and it has a lot in common with the UCCM; same RF ASIC, same TI TMS320VC5509A DSP. But the Resolution T has TSIP. So I tracked down a firmware image for the Resolution T, and was about to embark upon disassembling it, when my UCCM finally arrived in the mail.Playing around in the serial console, I noticed some interesting things...The command parser appears to do two passes. I imagine the first pass parses a command and breaks it up into tokens. If a command contains a token contains that it doesn't recognize, it fails with an "Undefined header" message. In this pass, all of these pass the testCode:UCCM-P >SYST:COMM:SER2:BAUD?+57600Command completeA scrambling of the first:Code:UCCM-P >COMM:SER2:BAUD:SYST?Command errorAnd a completely non-sensical soup salad:Code:UCCM-P >TRAC:SER2:BAUD:DIAG?Command errorBut if I put in garbage, I get the "Undefined header" messageCode:UCCM-P >TRAC:OINK:BAUD:DIAG?Undefined headerAs long as a token exists somewhere in the global dictionary of tokens, it will pass the first pass test.The parser then appears to assemble the tokens and look for a matching command, and if one can't be found, a "Command error" message is displayed.This means that it's quite easy to search the command namespace for interesting things, so I just started guessing at things:Code:UCCM-P >debugUndefined headerUCCM-P >aboutUndefined headerUCCM-P >dumpUndefined headerUCCM-P >tsipCommand errorUCCM-P >monitorCommand errorAfter a bit more trial and error, I found that both TSIP and MONITOR live under the DIAG heading, and both DIAG:TSIP and DIAG:MONITOR do something interesting.DIAG:TSIP switches the UCCM into TSIP mode. I've attached a screenshot of using a 57964-60 UCCM with Trimble's Visual Timing Studio using TSIP. The receiver reports as a generic "GPS Receiver", but everything otherwise appears normal. Power cycling the unit puts the unit back into UCCM mode. It has to be a power cycled, the reset button doesn't work in TSIP mode. (Yes I'm running XP, it's in a VM. And yes, my antenna power is reporting as open, I'm using an externally powered survey GPS antenna through a DC blocking capacitor.)DIAG:MONITOR appears to cause the receiver to stop responding to serial commands, but I strongly suspect it dumps the receiver into its ROM monitor.In almost all of the Trimble gear I've investigated, the PC based firmware upgrade tool uses a ROM monitor running on the device to do the installation. At a minimum, their monitors have commands to read and write memory, change the serial port baud rate, and sometimes they contain commands to do a jump to an address. In some receivers, their firmware upgrade tool uses the minimal built in ROM monitor to load a fancy ROM monitor into some unused RAM, then it jumps to that fancy monitor to do the firmware upgrade. The catch is that all of the ROM monitors I've investigated use the same packet structure (Trimble's Data Collector Format, similar but not the same as TSIP), but they use different command bytes. So what might be an innocuous READ command on one model might be a WRITE command on another.Once I figure out the ROM monitor, then I'll be able to dump the receiver firmware without having to de-solder the flash.