# Instantel MiniMate Plus — RS-232 Protocol RE
**Session Summary: Chat Compacted 2026-03-01**  
Device: MiniMate Plus S/N BE18189  
FW S338.17 / DSP 10.72  
Capture: 38400 baud, COM4/COM5  

---

# Session 1 — Protocol Foundations & Write Command Discovery  
**2026-02-27**

## Frame Structure Confirmed
- DLE framing: `ACK (0x41)` + `DLE+STX (0x10 0x02)` … payload … checksum … `DLE+ETX (0x10 0x03)`
- DLE byte stuffing: `0x10` in payload → `0x10 0x10` on wire
- Checksum: 8-bit sum of de-stuffed payload bytes, mod 256
- Payload structure:  
  `CMD | DLE | ADDR | FLAGS | SUB | OFFSET_HI | OFFSET_LO | data…`
- All BW→S3 requests use `CMD=0x02`
- All responses use CMD matching the DLE prefix
- Response `SUB = 0xFF − Request SUB`

## Session Startup Sequence
Device boot prints ASCII **“Operating System”** before binary protocol mode.

Blastware init sequence:
1. POLL (SUB 5B)
2. Channel config (06)
3. Serial (15)
4. Full config (01)
5. Event index (08)
6. Event headers (1E)
7. Waveform records (0C)
8. Bulk stream (5A)

## Write Commands Discovered

| SUB (Req) | SUB (Resp) | Function |
|---|---|---|
| 0x71 | 0x8E | Trigger config write |
| 0x72 | 0x8D | Trigger config page 2 |
| 0x73 | 0x8C | Unknown write |
| 0x74 | 0x8B | Unknown write |
| 0x82 | 0x7D | Unknown write (post config) |
| 0x83 | 0x7C | Unknown write (terminal) |
| 0x68 | 0x97 | Event index write? |
| 0x09 | 0xF6 | Unknown read |
| 0x1A | 0xE5 | Unknown multi-page read |
| 0x2E | 0xD1 | Unknown short read |

---

# Session 2 — Trigger & Alarm Level Floats  
**2026-03-01 ~20:51**

## Key Findings
- Trigger & alarm levels are IEEE‑754 single‑precision **big‑endian floats**
- Trigger level change verified (0.5 → 0.2 in/s)
- Alarm level verified (1.0 → 2.0 in/s)
- Unit strings embedded inline (`"psi"`, `"in./s"`)
- `0x082A` ruled out as trigger candidate

## SUB 71 Float Offsets

| Offset | Field | Value | Encoding |
|---|---|---|---|
| d[32..35] | MicL trigger | 0.0450 psi | IEEE754 BE |
| d[38..41] | MicL low thresh | 0.0100 psi | IEEE754 BE |
| d[46..49] | MicL alarm | 0.0210 psi | IEEE754 BE |
| d[42..44] | Units | psi\0 | ASCII |

---

# Session 3 — Multi‑Parameter Capture  
**2026-03-01 ~20:53**

| Parameter | Change | Result |
|---|---|---|
| Alarm level | 2.0 in/s | Confirmed |
| Trigger level | 0.6 in/s | Confirmed |
| Record time | 3s | Confirmed |
| Sentinels | FF FF FF FF | Write boundaries confirmed |

---

# Session 4 — .set File Decode  
**2026-03-01 ~20:55**

## .set Format
- Binary per‑channel structs
- Backlight field at **+0x0C**
- MicL units confirmed as **psi**
- Record time offset confirmed

Unknown uint16 fields:
- +0x0A = 80
- +0x0E = 40
- +0x10 = 21

## Backlight / Power Saving Tests
Changes tested:
- Backlight 15 → 30
- Power save 2 → 5
- Mic dB toggle

Result:
- SUB 71 frames identical
- No new writes after sentinels
- Device confirmed to support settings → offsets unknown

---

# Current State — Pending Capture

Next capture targets:
- Backlight = 250 → search `0xFA`
- Power saving = 10 → search `0x0A`
- Possible encodings:
  - uint16 BE
  - uint32 BE
  - Little‑endian variants

---

# Open Questions

| Question | Priority | Status |
|---|---|---|
| Timestamp byte 3 | MEDIUM | Open |
| Serial response trailing bytes | MEDIUM | Open |
| Channel ID mapping | MEDIUM | Open |
| Write config coverage | MEDIUM | Partial |
| Backlight offsets | HIGH | Active |
| MicL units | LOW | Resolved |
| SUB 24/25 vs 5A | LOW | Open |
| 0x07E7 config field | LOW | Open |

---

All findings reverse‑engineered from RS‑232 captures. No vendor docs used.