From 75de3fb2fcc45dd802c050b1016335a9e47a99cd Mon Sep 17 00:00:00 2001 From: serversdwn Date: Thu, 26 Feb 2026 23:10:11 -0500 Subject: [PATCH] doc: confirmed DLE stuffing, geophone trigger/alarm level, etc --- docs/instantel_protocol_reference.md | 38 +++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 6 deletions(-) diff --git a/docs/instantel_protocol_reference.md b/docs/instantel_protocol_reference.md index 7c25695..4edcdc8 100644 --- a/docs/instantel_protocol_reference.md +++ b/docs/instantel_protocol_reference.md @@ -11,10 +11,10 @@ | Date | Section | Change | |---|---|---| -| 2026-02-26 | Initial | Document created from first hex dump analysis | -| 2026-02-26 | ยง2 Frame Structure | **CORRECTED:** Frame uses DLE-STX (`0x10 0x02`) and DLE-ETX (`0x10 0x03`), not bare `0x02`/`0x03`. `0x41` confirmed as ACK not STX. DLE stuffing rule added. | -| 2026-02-26 | ยง8 Timestamp | **UPDATED:** Year `0x07CB = 1995` confirmed as MiniMate hardware default date when RTC battery is disconnected. Not an encoding error. Confidence upgraded from โ“ to ๐Ÿ”ถ. | -| 2026-02-26 | ยง10 DLE Stuffing | **UPGRADED:** Section upgraded from โ“ SPECULATIVE to โœ… CONFIRMED. Full stuffing rules and parser state machine documented. | +| 2026-02-25 | Initial | Document created from first hex dump analysis | +| 2026-02-25 | ยง2 Frame Structure | **CORRECTED:** Frame uses DLE-STX (`0x10 0x02`) and DLE-ETX (`0x10 0x03`), not bare `0x02`/`0x03`. `0x41` confirmed as ACK not STX. DLE stuffing rule added. | +| 2026-02-25 | ยง8 Timestamp | **UPDATED:** Year `0x07CB = 1995` confirmed as MiniMate hardware default date when RTC battery is disconnected. Not an encoding error. Confidence upgraded from โ“ to ๐Ÿ”ถ. | +| 2026-02-25 | ยง10 DLE Stuffing | **UPGRADED:** Section upgraded from โ“ SPECULATIVE to โœ… CONFIRMED. Full stuffing rules and parser state machine documented. | | 2026-02-26 | ยง11 Checksum | **UPDATED:** Frame builder and parser rewritten to handle DLE framing and byte stuffing correctly. | | 2026-02-26 | ยง14 Open Questions | DLE question removed (resolved). Timestamp year question removed (resolved). | | 2026-02-26 | ยง7.2 Serial Number Response | **CORRECTED:** Trailing bytes are `0x79 0x11` only (2 bytes, not 3). `0x20` was misidentified as a trailing byte โ€” it is the frame checksum. | @@ -29,6 +29,7 @@ | 2026-02-26 | ยง5.2 Response SUBs | **STRENGTHENED:** `0xFF - SUB` rule wording clarified โ€” high confidence, no counterexample, not yet formally proven. | | 2026-02-26 | ยง15 โ†’ Appendix A | **RENAMED:** Binary log format section moved to Appendix A with explicit note that it describes tooling behavior, not protocol. | | 2026-02-26 | Header | **ADDED:** Certainty legend clarification โ€” ratings apply to protocol semantics only, not tooling behavior. | +| 2026-02-26 | ยง7.6 Channel Config Float Layout | **NEW SECTION:** Trigger level confirmed as IEEE 754 BE float in in/s. Alarm level identified as adjacent float = 1.0 in/s. Unit string `"in./s"` embedded inline. `0x082A` removed as trigger level candidate. | --- @@ -183,7 +184,7 @@ Step 4 โ€” Device sends actual data payload: | `25` | **WAVEFORM PAGE B?** | Paged waveform read, possibly channel group B. | ๐Ÿ”ถ INFERRED | | `1F` | **EVENT ADVANCE / CLOSE** | Sent after waveform download completes. Likely advances internal record pointer. | ๐Ÿ”ถ INFERRED | | `09` | **UNKNOWN READ A** | Read command, response (`F6`) returns 0xCA (202) bytes. Purpose unknown. | ๐Ÿ”ถ INFERRED | -| `1A` | **CHANNEL SCALING / COMPLIANCE CONFIG READ** | Read command, response (`E5`) returns large block containing IEEE 754 floats and `0x082A` (โ‰ˆ 0.209 in/s trigger threshold candidate). Bidirectional during compliance setup. | ๐Ÿ”ถ INFERRED | +| `1A` | **CHANNEL SCALING / COMPLIANCE CONFIG READ** | Read command, response (`E5`) returns large block containing IEEE 754 floats including trigger level, alarm level, max range, and unit strings. Contains `0x082A` โ€” purpose unknown, possibly alarm threshold or record config. | ๐Ÿ”ถ INFERRED | | `2E` | **UNKNOWN READ B** | Read command, response (`D1`) returns 0x1A (26) bytes. Purpose unknown. | ๐Ÿ”ถ INFERRED | All requests use CMD byte `0x02`. All responses use CMD byte `0x10 0x02` (which, after de-stuffing, is just the DLE+CMD combination โ€” see ยง3). @@ -379,7 +380,29 @@ Confirmed ASCII strings extracted from payload: "MicL" โ† Microphone / air overpressure ``` -Peak values as IEEE 754 big-endian floats โ€” event 1: +### 7.6 Channel Config Float Layout (SUB E5 / SUB 71) + +> โœ… **CONFIRMED โ€” 2026-02-26** from trigger level change capture (session `193237`). Trigger changed `0.500 โ†’ 0.200 in/s`, alarm level independently read as `1.0 in/s`. + +The SUB `1A` read response (`E5`) and SUB `71` write block contain per-channel threshold and scaling values packed as **IEEE 754 big-endian floats**, with an inline unit string: + +``` +[max_range float] [trigger float] ["in.\0"] [alarm float] ["/s\0\0"] + 40 C6 97 FD 3E 4C CC CD 69 6E 2E 3F 80 00 00 2F 73 00 00 + = 6.206 = 0.200 in/s "in." = 1.000 in/s "/s" +``` + +| Float | Value observed | Meaning | Certainty | +|---|---|---|---| +| `40 C6 97 FD` | 6.206 | Maximum range (likely full-scale ADC range in in/s) | ๐Ÿ”ถ INFERRED | +| `3E 4C CC CD` | 0.200 | **Geophone trigger level** โ€” changed `0.500 โ†’ 0.200` in capture | โœ… CONFIRMED | +| `3F 80 00 00` | 1.000 | **Geophone alarm level** โ€” matched UI value of 1.0 in/s | โœ… CONFIRMED | + +Unit strings `"in.\0"` and `"/s\0\0"` are embedded inline between the floats, confirming values are stored natively in **imperial units (in/s)** regardless of display locale. + +> โ“ **`0x082A` (= 2090)** โ€” appears in the same block but did not change when trigger or alarm level was adjusted. Previous hypothesis that it was the trigger level is incorrect. Possibly record time, sample count, or a different threshold. Needs a targeted capture changing a known integer field to identify. + +> ๐Ÿ”ถ **Pending confirmation:** Alarm level identification is based on value match (`3F 80 00 00` = 1.0 = UI value). A capture changing the alarm level will confirm the exact byte offset. ``` Tran: 3D BB 45 7A = 0.0916 (in/s โ€” unit config dependent) Vert: 3D B9 56 E1 = 0.0907 @@ -646,6 +669,9 @@ The `.bin` files produced by `s3_bridge` are **not raw wire bytes**. The logger | Purpose of SUB `09` / response `F6` โ€” 202-byte read block | MEDIUM | 2026-02-26 | | Purpose of SUB `2E` / response `D1` โ€” 26-byte read block | MEDIUM | 2026-02-26 | | Full field mapping of SUB `1A` / response `E5` โ€” channel scaling / compliance config block | MEDIUM | 2026-02-26 | +| `0x082A` in channel config block โ€” not trigger or alarm level. Possibly record time, sample count, or secondary threshold. Needs targeted capture. | MEDIUM | 2026-02-26 | +| Geophone alarm level float offset confirmation โ€” value match suggests `3F 80 00 00` at known position, needs change capture to confirm. | LOW | 2026-02-26 | +| Max range float `40 C6 97 FD` = 6.206 โ€” meaning unclear. Screenshot shows "Normal 10.000 in/s" range setting. | LOW | 2026-02-26 | | Full trigger configuration field mapping (SUB `1C` / write `82`) | LOW | 2026-02-26 | | Whether SUB `24`/`25` are distinct from SUB `5A` or redundant | LOW | 2026-02-26 | | Meaning of `0x07 E7` field in config block | LOW | 2026-02-26 |