chanel config float layout mapped, .set file format analyized.

docs: updated

docs/instantel_protocol_session_summary_2-26_3-1.md

@@ -0,0 +1,139 @@
+# Instantel MiniMate Plus — RS-232 Protocol RE
+**Session Summary: Chat Compacted 2026-03-01**  
+Device: MiniMate Plus S/N BE18189  
+FW S338.17 / DSP 10.72  
+Capture: 38400 baud, COM4/COM5  
+
+---
+
+# Session 1 — Protocol Foundations & Write Command Discovery  
+**2026-02-27**
+
+## Frame Structure Confirmed
+- DLE framing: `ACK (0x41)` + `DLE+STX (0x10 0x02)` … payload … checksum … `DLE+ETX (0x10 0x03)`
+- DLE byte stuffing: `0x10` in payload → `0x10 0x10` on wire
+- Checksum: 8-bit sum of de-stuffed payload bytes, mod 256
+- Payload structure:  
+  `CMD | DLE | ADDR | FLAGS | SUB | OFFSET_HI | OFFSET_LO | data…`
+- All BW→S3 requests use `CMD=0x02`
+- All responses use CMD matching the DLE prefix
+- Response `SUB = 0xFF − Request SUB`
+
+## Session Startup Sequence
+Device boot prints ASCII **“Operating System”** before binary protocol mode.
+
+Blastware init sequence:
+1. POLL (SUB 5B)
+2. Channel config (06)
+3. Serial (15)
+4. Full config (01)
+5. Event index (08)
+6. Event headers (1E)
+7. Waveform records (0C)
+8. Bulk stream (5A)
+
+## Write Commands Discovered
+
+| SUB (Req) | SUB (Resp) | Function |
+|---|---|---|
+| 0x71 | 0x8E | Trigger config write |
+| 0x72 | 0x8D | Trigger config page 2 |
+| 0x73 | 0x8C | Unknown write |
+| 0x74 | 0x8B | Unknown write |
+| 0x82 | 0x7D | Unknown write (post config) |
+| 0x83 | 0x7C | Unknown write (terminal) |
+| 0x68 | 0x97 | Event index write? |
+| 0x09 | 0xF6 | Unknown read |
+| 0x1A | 0xE5 | Unknown multi-page read |
+| 0x2E | 0xD1 | Unknown short read |
+
+---
+
+# Session 2 — Trigger & Alarm Level Floats  
+**2026-03-01 ~20:51**
+
+## Key Findings
+- Trigger & alarm levels are IEEE‑754 single‑precision **big‑endian floats**
+- Trigger level change verified (0.5 → 0.2 in/s)
+- Alarm level verified (1.0 → 2.0 in/s)
+- Unit strings embedded inline (`"psi"`, `"in./s"`)
+- `0x082A` ruled out as trigger candidate
+
+## SUB 71 Float Offsets
+
+| Offset | Field | Value | Encoding |
+|---|---|---|---|
+| d[32..35] | MicL trigger | 0.0450 psi | IEEE754 BE |
+| d[38..41] | MicL low thresh | 0.0100 psi | IEEE754 BE |
+| d[46..49] | MicL alarm | 0.0210 psi | IEEE754 BE |
+| d[42..44] | Units | psi\0 | ASCII |
+
+---
+
+# Session 3 — Multi‑Parameter Capture  
+**2026-03-01 ~20:53**
+
+| Parameter | Change | Result |
+|---|---|---|
+| Alarm level | 2.0 in/s | Confirmed |
+| Trigger level | 0.6 in/s | Confirmed |
+| Record time | 3s | Confirmed |
+| Sentinels | FF FF FF FF | Write boundaries confirmed |
+
+---
+
+# Session 4 — .set File Decode  
+**2026-03-01 ~20:55**
+
+## .set Format
+- Binary per‑channel structs
+- Backlight field at **+0x0C**
+- MicL units confirmed as **psi**
+- Record time offset confirmed
+
+Unknown uint16 fields:
+- +0x0A = 80
+- +0x0E = 40
+- +0x10 = 21
+
+## Backlight / Power Saving Tests
+Changes tested:
+- Backlight 15 → 30
+- Power save 2 → 5
+- Mic dB toggle
+
+Result:
+- SUB 71 frames identical
+- No new writes after sentinels
+- Device confirmed to support settings → offsets unknown
+
+---
+
+# Current State — Pending Capture
+
+Next capture targets:
+- Backlight = 250 → search `0xFA`
+- Power saving = 10 → search `0x0A`
+- Possible encodings:
+  - uint16 BE
+  - uint32 BE
+  - Little‑endian variants
+
+---
+
+# Open Questions
+
+| Question | Priority | Status |
+|---|---|---|
+| Timestamp byte 3 | MEDIUM | Open |
+| Serial response trailing bytes | MEDIUM | Open |
+| Channel ID mapping | MEDIUM | Open |
+| Write config coverage | MEDIUM | Partial |
+| Backlight offsets | HIGH | Active |
+| MicL units | LOW | Resolved |
+| SUB 24/25 vs 5A | LOW | Open |
+| 0x07E7 config field | LOW | Open |
+
+---
+
+All findings reverse‑engineered from RS‑232 captures. No vendor docs used.