Welcome to this Geodimeter reversing repository

[robots]

Welcome!

If you have any ideas or questions ask here!

If you have any material documentation worth sharing ... share it here :-)

Lets make this repository great resource for geodimeter total station repair.

[Middim]

First off, thank you for your work on this!

Two questions:

1. Did you have firmware for the CU version "668-01.01"? If so, have you tested it to see if it can upload OK to a different CU? I have one I wanted to get working after replacing the batteries.
2. Have you found any specification for the Trimble Remote Target LED modulation (SLR,602,606,etc), or reversed it yet? If you don't have anything on it, or have one of the remote targets to do the testing on, I had considered picking one up (I have the equipment to reverse it). But if you have already done it, then it would be redundant for me to duplicate your work. In the case that you don't have that info, I can forward what I discover here if you are interested. I figure it wouldn't be that hard for people to program an Arduino/AVR with whatever the "channel" encoding scheme is, and 3D print an enclosure that mimics the simpler RMT spacing for prism and LED position - that would open it up to people making their own pretty easily.

Thanks!

[robots]

Hi,

1. I have this firmware, but only in german language. I also have firmware for 648-02.00 - german and (broken) english. I have very little time to play with it, but i have not yet decided to put those firmwares into wild. The upload works (look there is already tool for it).

I would like to have firmware for the older model of CU, the one with 4line character lcd (board named MAP, rom soldere to pcb, 618-06.00 version)

2. Target is described in the maintnance manual ... There are 5 frequencies of blinking. One is for 4000target 1.95kHz and there are 4 channels for 600 target 6.25kHz, 6.9kHz, 7.8kHz and 8.9kHz. They have the exact frequencies writen in the manual. You only need the dimensions.

[Middim]

Thanks for the response!

Actually, finding out your CU upload tool existed is what originally interested me to see if it was possible. I would assume the firmware is not customized to a specific CU (the way it stores configuration/calibration data for the GDM), but I figured I would ask. When the CU is connected to the GDM, does your firmware download tool pull the CU firmware, or is it available by direct connection? I already used it to download the GDM firmware for my 5603 (for backup), and it all seems OK, from what I can tell.

I wish I could help on the 4-line CU but I only have the one missing firmware, hopefully someone has one they would be willing to download. Do you have a 571 part number from the back maybe, or is it the same as the others?

On the CU firmware, just out of curiosity, do you know the checksum format to allow modifications?
If the there's space and the string table is separated into it's own section, possibly I could work on translating the firmware directly. I am not fluent in German, but I have a friend who is in both German and English. Or even just looking up what the screens should say in documentation would work, if it shows everything in the manuals. If it's mixed in with other data, or even with code, then possibly just overwriting the text in the existing space with something understandable may work OK after the checksum is updated? I checked the GDM firmware binary and it does appear there are areas where zero-terminated strings are stored consecutively, some even with printf formatting - maybe the CU firmware is similar?

That info worked perfectly for the Remote Target. Thanks!!
I decided to test it out so I made up a cardboard jig to hold the prism and Infrared LED (890nm) below it (6 cm) and supplied it a 50% duty square at 7,812.5hz (channel 4 - the default) and ran a search on the GDM and it picked it up instantly. Also, I tested to check what frequency error it can tolerate, it finds it correctly (in a new search) up to +-4.5hz off, although it seems to be able to track sometimes +-5hz off.
I had hoped that it would be a little more forgiving so it would be possible to just use a 555. But an AVR(w/crystal)/Arduino/etc should be able to stay within that ppm easy and allow channel selection and adjustment with one PWM channel setup. I would be curious to know what route you would take?

Thanks again!!

[robots]

About the cu:
Problem is that, .... for station there is a command to dump whole memory. It is in bootloader, and it is triggered by unlocking access to all labels and executing, station will then dump the content to serial port. There is checksum, and station will not run when memory is corrupt. Good design.

Now for the CU part. There is only one magic word in the memory, this is telling the CU that it has been "configured". There is absolutely no checksum in the CU firmware. The memory corrupts just by using weak powersupply (yes i killed one).

And there is no dump in this firmware, at least i have not found it. There is "variable" dump, but it dumps only few kB of memory.
What i have done, i have dumped the ROM from CU, changed the dumping routine to run over whole memory - now my variable dump will dump whole 1MB of memory space. But it needs rom replacement (old CUs have ROM soldered to board).
I have spend lot of time crunching through the CU firmware, looking for "hidden" commands, i was not able to find it yet. I can not dump CU without replacing rom.

On station firmware you can change texts just by writing them to memory (to correct location, that Firmware gives you - there are labels that return address and size) On cu, this is missing and I think there are firmwares compiled for each language.

About target: There is guy who 3d printed the target with screw hole to screw in the GDM prism. I asked him to provide the STL, waiting for answer.

[jafarhamdannimer]

i need firmwaer 668-01.01 geodimeter cu

[goodlckkk]

Hi, I've been checking out your work and it's great. I'm having a problem with my Geodimiter 600 station. Do you happen to have firmware version 696-03.05 (or later)? I'd really appreciate it!

[sebastize-arch]

potrei avere il firmware, in inglese il 648-02.00 ..?

[ritterfabian]

Hi!
Not sure if this is still active, but I sure hope so... I have a working 540 and would love to contribute by downloading and sharing the firmware for it, and also making a backup of calibration data. The previous owner made a printed mark on the side with the last backup battery change, I should have some years left.
The chance of bricking the device in any way is really scary, tbh... I really like measuring stuff with it for friends and family.

I am not really sure on the differences between the 500 and 600 models: Is the Backup Firmware Script also working for my 500 unit? Does this also contain the calibration data somehow? Or is all this only possible on the 600 units? Sorry if the answers are somewhat obvious, I just could not figure it out.

If anyone knows of a repair possibility in germany that still handles these old stations, I would also appreciate it very much!

Best F

[robots]

Yes it is still the only GDM too that is available :) and i am still able to support it a bit. But no active development is ongoing now.

600 model is the latest one, it contains 8051 microcontroller and fpga (or bit older version contains lots of logic circuits) and large RAM. But this unit stores no measurement data, only program and calibration. (All the measurements are in the CU.) The microcontroller contains small ROM that contains loader for the ram, small routine to check the ram content and execute from RAM. RAM contains firmware, calibration data. RAM is backed up by Lithium primary battery (2x CR2450). If battery dies, ram is lost. And as Trimble decided not to support these machines anymore, you are out of luck. There might be some local guy, that serviced the same machine, and he will have copy of your calibration. When battery dies you have station that can turn using servo, but the digital boards are not working.

500 model very different. Its based on 8086 CPU IIRC. The software is stored in EPROM, calibration data is stored in RAM. Ram is backed up by lithium primary battery (Lithium thionyl). There is no bootloader over serial port. When battery dies, special values in RAM ale lost and you are presented with "Error 51". The software knows the calibration is gone. The software will communicate over the port in the base of the station. There are 2 interfaces: Serial port - standard 9600 RS232 (this will not work in error 51) and what we call GDM interface. Normally you would need specialized card and software for the computer to talk to the station.

This is where this project comes in! We have reverse-engineered the GDM interface, created some tools to manipulate the RAM of the station over this interface. But you need some hardware built. https://github.com/robots/gdm/tree/master/gdm-iface Read this page. You can build the interface using very cheap boards from china using few wires or you can have the base board manufactured and place those cheap boards from china on this board. I prefer the second option, because i have nice board that will not break every time i move it.
I have some spare boards, depends on where in the world you are.

With the GDM interface + python scripts provided you can talk to the station on lowest level. You can read/write whole RAM, upload texts in different language (if you have them). Basically reading whole RAM is the backup.

I hope this is not very confusing for you :))

[ritterfabian]

Thanks for the reply!
I checked the schematics and tried to fill my knowledge with the repo and also the thread over on RPLS. Lots of info on the 600 units, but I understand the difference to my 500 unit, thanks for making it clear. So if the backup battery fails, mine "only" forgets the calibration data in RAM, but not firmware (different brick style 🧱 ).

Are these findings correct:

• GDM interface sits on the RS232 port of the unit, no need to access some bus inside.
• GDM uses 3 wires, all are attached to the bluepill with bi-directional level-shifters.
• GDM has RX, TX, CLK but the protocol seems not to be documented somewhere officially, I have only seen the pinout in the workshop notes. (indirectly in the code, of course)
• RS232 is piped through at the same time, so the gdm-iface can be a permanent attachment, if the MUX is populated. In your image it goes from RS232 iface to bluepill.
• For the backup, I only need bluepill, level converter and GDMIFACE plus some power populated.
• After I solder the board and program the bluepill I can connect it to the Station (GDM to Serial Port on Station) and to the PC (USB that provides a virtual serial port)
• Now gdm-iface-tool connects and allows me to do the magic. 🙌

Are these findings correct so far? Sorry if this feels a bit d'uh... 😅

[robots]

yes, you only need bluepill, level translator and connector. Plus i like to use dsub-9 extension cable to connect the interface to the station. It is much more sturdy and such cable costs less than to solder one. Be sure to get one that is trully 1:1 not just rx,tx,gnd.

Here is a picture of what you need to populate:

• bluepull (stm32! as it uses usb peripheral, some clones dont have the same usb peripheral inside)
• level translator
• dsub connector
• dcdc psu and few capacitors

You dont need that 3v3 ldo on bottom, or the 12-> -12 DCDC.

The radio was experimental addition, never made code for that.

"only" calibration data is very subtle saying :) Without calibration data there is no angle data, no servo control. They made sure, the station is serviced in timely manner. Also the calibration data does not change throughout the life of the station, IT could have been stored in ROM, but that was against the business model.

I personally was able to revive one 400 station with recreated angular sensor calibration. This was done by using RC servos to move the manual screws using 3d printed parts. It ran for hours just to sample the data, and then some math was applied to get the coefficients. My absolute goal is that station with build in servo is able to calibrate itself. The math is already reverse engineered, servo board control is reverse engineered, it just needs to be put together. Maybe someday :)