140 lines
3.6 KiB
Markdown
140 lines
3.6 KiB
Markdown
# Instantel MiniMate Plus — RS-232 Protocol RE
|
||
**Session Summary: Chat Compacted 2026-03-01**
|
||
Device: MiniMate Plus S/N BE18189
|
||
FW S338.17 / DSP 10.72
|
||
Capture: 38400 baud, COM4/COM5
|
||
|
||
---
|
||
|
||
# Session 1 — Protocol Foundations & Write Command Discovery
|
||
**2026-02-27**
|
||
|
||
## Frame Structure Confirmed
|
||
- DLE framing: `ACK (0x41)` + `DLE+STX (0x10 0x02)` … payload … checksum … `DLE+ETX (0x10 0x03)`
|
||
- DLE byte stuffing: `0x10` in payload → `0x10 0x10` on wire
|
||
- Checksum: 8-bit sum of de-stuffed payload bytes, mod 256
|
||
- Payload structure:
|
||
`CMD | DLE | ADDR | FLAGS | SUB | OFFSET_HI | OFFSET_LO | data…`
|
||
- All BW→S3 requests use `CMD=0x02`
|
||
- All responses use CMD matching the DLE prefix
|
||
- Response `SUB = 0xFF − Request SUB`
|
||
|
||
## Session Startup Sequence
|
||
Device boot prints ASCII **“Operating System”** before binary protocol mode.
|
||
|
||
Blastware init sequence:
|
||
1. POLL (SUB 5B)
|
||
2. Channel config (06)
|
||
3. Serial (15)
|
||
4. Full config (01)
|
||
5. Event index (08)
|
||
6. Event headers (1E)
|
||
7. Waveform records (0C)
|
||
8. Bulk stream (5A)
|
||
|
||
## Write Commands Discovered
|
||
|
||
| SUB (Req) | SUB (Resp) | Function |
|
||
|---|---|---|
|
||
| 0x71 | 0x8E | Trigger config write |
|
||
| 0x72 | 0x8D | Trigger config page 2 |
|
||
| 0x73 | 0x8C | Unknown write |
|
||
| 0x74 | 0x8B | Unknown write |
|
||
| 0x82 | 0x7D | Unknown write (post config) |
|
||
| 0x83 | 0x7C | Unknown write (terminal) |
|
||
| 0x68 | 0x97 | Event index write? |
|
||
| 0x09 | 0xF6 | Unknown read |
|
||
| 0x1A | 0xE5 | Unknown multi-page read |
|
||
| 0x2E | 0xD1 | Unknown short read |
|
||
|
||
---
|
||
|
||
# Session 2 — Trigger & Alarm Level Floats
|
||
**2026-03-01 ~20:51**
|
||
|
||
## Key Findings
|
||
- Trigger & alarm levels are IEEE‑754 single‑precision **big‑endian floats**
|
||
- Trigger level change verified (0.5 → 0.2 in/s)
|
||
- Alarm level verified (1.0 → 2.0 in/s)
|
||
- Unit strings embedded inline (`"psi"`, `"in./s"`)
|
||
- `0x082A` ruled out as trigger candidate
|
||
|
||
## SUB 71 Float Offsets
|
||
|
||
| Offset | Field | Value | Encoding |
|
||
|---|---|---|---|
|
||
| d[32..35] | MicL trigger | 0.0450 psi | IEEE754 BE |
|
||
| d[38..41] | MicL low thresh | 0.0100 psi | IEEE754 BE |
|
||
| d[46..49] | MicL alarm | 0.0210 psi | IEEE754 BE |
|
||
| d[42..44] | Units | psi\0 | ASCII |
|
||
|
||
---
|
||
|
||
# Session 3 — Multi‑Parameter Capture
|
||
**2026-03-01 ~20:53**
|
||
|
||
| Parameter | Change | Result |
|
||
|---|---|---|
|
||
| Alarm level | 2.0 in/s | Confirmed |
|
||
| Trigger level | 0.6 in/s | Confirmed |
|
||
| Record time | 3s | Confirmed |
|
||
| Sentinels | FF FF FF FF | Write boundaries confirmed |
|
||
|
||
---
|
||
|
||
# Session 4 — .set File Decode
|
||
**2026-03-01 ~20:55**
|
||
|
||
## .set Format
|
||
- Binary per‑channel structs
|
||
- Backlight field at **+0x0C**
|
||
- MicL units confirmed as **psi**
|
||
- Record time offset confirmed
|
||
|
||
Unknown uint16 fields:
|
||
- +0x0A = 80
|
||
- +0x0E = 40
|
||
- +0x10 = 21
|
||
|
||
## Backlight / Power Saving Tests
|
||
Changes tested:
|
||
- Backlight 15 → 30
|
||
- Power save 2 → 5
|
||
- Mic dB toggle
|
||
|
||
Result:
|
||
- SUB 71 frames identical
|
||
- No new writes after sentinels
|
||
- Device confirmed to support settings → offsets unknown
|
||
|
||
---
|
||
|
||
# Current State — Pending Capture
|
||
|
||
Next capture targets:
|
||
- Backlight = 250 → search `0xFA`
|
||
- Power saving = 10 → search `0x0A`
|
||
- Possible encodings:
|
||
- uint16 BE
|
||
- uint32 BE
|
||
- Little‑endian variants
|
||
|
||
---
|
||
|
||
# Open Questions
|
||
|
||
| Question | Priority | Status |
|
||
|---|---|---|
|
||
| Timestamp byte 3 | MEDIUM | Open |
|
||
| Serial response trailing bytes | MEDIUM | Open |
|
||
| Channel ID mapping | MEDIUM | Open |
|
||
| Write config coverage | MEDIUM | Partial |
|
||
| Backlight offsets | HIGH | Active |
|
||
| MicL units | LOW | Resolved |
|
||
| SUB 24/25 vs 5A | LOW | Open |
|
||
| 0x07E7 config field | LOW | Open |
|
||
|
||
---
|
||
|
||
All findings reverse‑engineered from RS‑232 captures. No vendor docs used.
|