seismo-relay/docs/instantel_protocol_session_summary_2-26_3-1.md

Instantel MiniMate Plus — RS-232 Protocol RE

Session Summary: Chat Compacted 2026-03-01
Device: MiniMate Plus S/N BE18189
FW S338.17 / DSP 10.72
Capture: 38400 baud, COM4/COM5

---

Session 1 — Protocol Foundations & Write Command Discovery

2026-02-27

Frame Structure Confirmed

• DLE framing: ACK (0x41) + DLE+STX (0x10 0x02) … payload … checksum … DLE+ETX (0x10 0x03)
• DLE byte stuffing: 0x10 in payload → 0x10 0x10 on wire
• Checksum: 8-bit sum of de-stuffed payload bytes, mod 256
• Payload structure:
  CMD | DLE | ADDR | FLAGS | SUB | OFFSET_HI | OFFSET_LO | data…
• All BW→S3 requests use CMD=0x02
• All responses use CMD matching the DLE prefix
• Response SUB = 0xFF − Request SUB

Session Startup Sequence

Device boot prints ASCII “Operating System” before binary protocol mode.

Blastware init sequence:

1. POLL (SUB 5B)
2. Channel config (06)
3. Serial (15)
4. Full config (01)
5. Event index (08)
6. Event headers (1E)
7. Waveform records (0C)
8. Bulk stream (5A)

Write Commands Discovered

SUB (Req)	SUB (Resp)	Function
0x71	0x8E	Trigger config write
0x72	0x8D	Trigger config page 2
0x73	0x8C	Unknown write
0x74	0x8B	Unknown write
0x82	0x7D	Unknown write (post config)
0x83	0x7C	Unknown write (terminal)
0x68	0x97	Event index write?
0x09	0xF6	Unknown read
0x1A	0xE5	Unknown multi-page read
0x2E	0xD1	Unknown short read

---

Session 2 — Trigger & Alarm Level Floats

2026-03-01 ~20:51

Key Findings

• Trigger & alarm levels are IEEE‑754 single‑precision big‑endian floats
• Trigger level change verified (0.5 → 0.2 in/s)
• Alarm level verified (1.0 → 2.0 in/s)
• Unit strings embedded inline ("psi", "in./s")
• 0x082A ruled out as trigger candidate

SUB 71 Float Offsets

Offset	Field	Value	Encoding
d[32..35]	MicL trigger	0.0450 psi	IEEE754 BE
d[38..41]	MicL low thresh	0.0100 psi	IEEE754 BE
d[46..49]	MicL alarm	0.0210 psi	IEEE754 BE
d[42..44]	Units	psi\0	ASCII

---

Session 3 — Multi‑Parameter Capture

2026-03-01 ~20:53

Parameter	Change	Result
Alarm level	2.0 in/s	Confirmed
Trigger level	0.6 in/s	Confirmed
Record time	3s	Confirmed
Sentinels	FF FF FF FF	Write boundaries confirmed

---

Session 4 — .set File Decode

2026-03-01 ~20:55

.set Format

• Binary per‑channel structs
• Backlight field at +0x0C
• MicL units confirmed as psi
• Record time offset confirmed

Unknown uint16 fields:

• +0x0A = 80
• +0x0E = 40
• +0x10 = 21

Backlight / Power Saving Tests

Changes tested:

• Backlight 15 → 30
• Power save 2 → 5
• Mic dB toggle

Result:

• SUB 71 frames identical
• No new writes after sentinels
• Device confirmed to support settings → offsets unknown

---

Current State — Pending Capture

Next capture targets:

• Backlight = 250 → search 0xFA
• Power saving = 10 → search 0x0A
• Possible encodings:
  • uint16 BE
  • uint32 BE
  • Little‑endian variants

---

Open Questions

Question	Priority	Status
Timestamp byte 3	MEDIUM	Open
Serial response trailing bytes	MEDIUM	Open
Channel ID mapping	MEDIUM	Open
Write config coverage	MEDIUM	Partial
Backlight offsets	HIGH	Active
MicL units	LOW	Resolved
SUB 24/25 vs 5A	LOW	Open
0x07E7 config field	LOW	Open

---

All findings reverse‑engineered from RS‑232 captures. No vendor docs used.