web-u2
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
web-u2 [2019/09/09 10:56] – add WITRN U2 V2.0 kingkevin | web-u2 [2019/09/25 09:14] – [Bluetooth Serial] kingkevin | ||
---|---|---|---|
Line 1: | Line 1: | ||
The U2 is a USB power meter and tester. | The U2 is a USB power meter and tester. | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
===== Overview ===== | ===== Overview ===== | ||
Line 23: | Line 26: | ||
The [[http:// | The [[http:// | ||
- | It only point to the user guide and software (with broken link).\\ | + | It only points |
Instead they recommend to follow the QQ group 313755927. | Instead they recommend to follow the QQ group 313755927. | ||
Line 32: | Line 35: | ||
* [[http:// | * [[http:// | ||
- | There is also this thorough [[https:// | + | There is also this thorough |
===== Hardware ===== | ===== Hardware ===== | ||
Line 52: | Line 55: | ||
Software version 4.0 or later also do not work with this device. You need to use version 3.0.\\ | Software version 4.0 or later also do not work with this device. You need to use version 3.0.\\ | ||
This device can still be used to measure voltage and current, but since there is no update anymore it will not be able to be used to detect charger profiles. | This device can still be used to measure voltage and current, but since there is no update anymore it will not be able to be used to detect charger profiles. | ||
+ | |||
+ | There is also a footprint for an Bluetooth adapter behind the screen, but it was not placed yet (the software was probably not ready). | ||
+ | |||
+ | {{: | ||
I read out the FRAM (where the settings are stored) but did not find the serial number in there. | I read out the FRAM (where the settings are stored) but did not find the serial number in there. | ||
Line 57: | Line 64: | ||
Sadly the firmware is read protected. | Sadly the firmware is read protected. | ||
- | There is also a footprint for an Bluetooth adapter behind the screen, but it was not placed yet (the software was probably not ready). | + | Debug header pinout: |
+ | < | ||
+ | _________ | ||
+ | __|8 6 4 2| | ||
+ | |9 7 5 3 1| | ||
+ | ----------- | ||
+ | </ | ||
- | {{: | ||
+ | - SWDIO (SWD, STM32F072 pin 34/PA13) | ||
+ | - SDA (I²C, with FRAM at 0x50) | ||
+ | - SWCLK (SWD, STM32F072 pin 37/PA14) | ||
+ | - GND | ||
+ | - GND | ||
+ | - VDD | ||
+ | - VDD | ||
+ | - SCL (I²C, with FRAM at 0x50) | ||
+ | - nRST (SWD, STM32F072 pin 7/NRST, you must connect under reset since SWD is disable after boot) | ||
==== WITRN U2 V2.0 ==== | ==== WITRN U2 V2.0 ==== | ||
- | Because the clone was bricked, I got a genuine replacement. | + | Because the clone got bricked, I got a genuine replacement. |
{{: | {{: | ||
Line 75: | Line 96: | ||
{{: | {{: | ||
+ | ==== Qway U2p ==== | ||
+ | |||
+ | The U2p version is a variant of the U2 with 4 button instead of 2, and a switch to enable Power Delivery probing | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | Finally it was also possible to get a version with Bluetooth and some light next to the USB input (not sure when it is on though) | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | ==== Board ==== | ||
+ | |||
+ | {{: | ||
+ | {{: | ||
+ | |||
+ | Here a list of the components present on the Qway U2p V1.1 board: | ||
+ | - input USB 3.0 type A plug | ||
+ | - input USB type C socket | ||
+ | - input USB type micro-B socket | ||
+ | - output USB 3.0 type A socket | ||
+ | - output USB type C socket | ||
+ | - data USB type micro-B socket, USB HID connection to the computer to read the measurements and flash the firmware | ||
+ | - 4 button to interact with the interface (back, ok, previous, next) | ||
+ | - PD switch to enable USB-C Power Delivery triggering | ||
+ | - [[http:// | ||
+ | - input diode protection: not in-line, but shorting GND to VBUS when GND > VBUS | ||
+ | - R012F shunt resistor (12 mOhm): to measure the current | ||
+ | - 5R10 shunt resistor (5.1 Ohm): which can be switched in line to measure low currents | ||
+ | - [[https:// | ||
+ | - [[https:// | ||
+ | - [[https:// | ||
+ | - [[https:// | ||
+ | - [[https:// | ||
+ | - UART pins: to connect to the AT-09/HM-10 Bluetooth module (with TI CC2541 chip). pinout, beginning with square pin: 3.8V GND RX TX | ||
===== Software ===== | ===== Software ===== | ||
- | ===== Support ===== | + | {{ : |
+ | |||
+ | Here a couple of notes about the [[http:// | ||
+ | |||
+ | The software is in Chinese, but you can change it by translating the words in the '' | ||
+ | Here the {{ : | ||
+ | |||
+ | When started, the software will query [[http:// | ||
+ | This is not a pdf. I think this is just to pass firewall (just like they use HTTP without SSL).\\ | ||
+ | This URL will return a short binary string, for example '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | * '' | ||
+ | |||
+ | If will also query [[http:// | ||
+ | Using the Network upgrade it will also download the Firmware for the U2 at [[http:// | ||
===== Communication ===== | ===== Communication ===== | ||
Line 83: | Line 161: | ||
==== USB HID ==== | ==== USB HID ==== | ||
+ | When connected to USB, it appears as an {{ : | ||
+ | When powered while pressing on the OK button, it will boot in the DFU (Device Firmware Upgrade) mode, which allows flashing the firmware. | ||
+ | But it is still an {{ : | ||
+ | |||
+ | I've partially reversed the HID communication: | ||
+ | * the messages exchanged are 64 bytes long | ||
+ | * the host (e.g. software) starts by sending a message. Here an example of message sent (captured from the software): | ||
+ | < | ||
+ | " | ||
+ | " | ||
+ | " | ||
+ | " | ||
+ | </ | ||
+ | * this will cause the device (e.g. U2) to send measurements. Since it will only send a couple of messages, keep sending the message every couple of milliseconds (can be the same). Here an example measurement reply: | ||
+ | < | ||
+ | ff 55 13 b4 7f bf 50 ef 1a 2c d7 63 a0 40 0e 74 da 39 0e 74 da 39 0e 74 da 39 bb dd 08 3b 33 33 53 40 74 a8 6d 3c fe 98 f7 41 d2 34 91 c2 14 ae a0 40 0e 74 da 39 00 00 00 00 00 00 00 00 16 ae | ||
+ | </ | ||
+ | |||
+ | here how to decode the measurements: | ||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2 | '' | ||
+ | | 3 | '' | ||
+ | | 4 | '' | ||
+ | | 5 | '' | ||
+ | | 6 | '' | ||
+ | | 7 | '' | ||
+ | | 8-9 | '' | ||
+ | | 10-13 | '' | ||
+ | | 14-17 | '' | ||
+ | | 18-21 | '' | ||
+ | | 22-25 | '' | ||
+ | | 26-29 | '' | ||
+ | | 30-33 | '' | ||
+ | | 34-37 | '' | ||
+ | | 38-41 | '' | ||
+ | | 42-45 | '' | ||
+ | | 46-49 | '' | ||
+ | | 50-53 | '' | ||
+ | | 54-61 | '' | ||
+ | | 62 | '' | ||
+ | | 63 | '' | ||
+ | |||
+ | There are other messages to get the device' | ||
==== Bluetooth Serial ==== | ==== Bluetooth Serial ==== | ||
+ | |||
+ | The Qway has an optional Bluetooth module. | ||
+ | This allows getting the measurement without physical connection (e.g. the USB HID port). | ||
+ | You can use the [[# | ||
+ | |||
+ | I reversed the protocol so I can get the raw data myself. | ||
+ | Scan for Bluetooth (Low Energy) devices and look for one named '' | ||
+ | There is no need to pair with the device. | ||
+ | You can directly connect to it. | ||
+ | Data is then exchanged using the GATT characteristic '' | ||
+ | |||
+ | On the [[# | ||
+ | The main board is connected to the Bluetooth board using spring contacts and uses UART to communicate with the module (at 115200 bps). | ||
+ | |||
+ | First send the message '' | ||
+ | The device will reply with a message using the following format (the bytes use little endian order): | ||
+ | |||
+ | < | ||
+ | 0xf1 0x01 0x30 0x31 0x31 0x33 0x33 0x37 0x67 0x14 0x00 0x00 0x00 0x32 0x00 0x00 0x00 0x00 0x03 0x00 | ||
+ | </ | ||
+ | |||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2-7 | '' | ||
+ | | 8 | '' | ||
+ | | 9-12 | '' | ||
+ | | 13-14 | '' | ||
+ | | 14-17 | '' | ||
+ | | 18 | '' | ||
+ | | 19 | '' | ||
+ | |||
+ | The device then sends measurements for a bit of time. | ||
+ | To keep the device sending measurements, | ||
+ | |||
+ | < | ||
+ | 0xf1 0x02 0x00 0x00 0x00 0xfe | ||
+ | </ | ||
+ | |||
+ | A complete measruement set is comprised of 5 messages. | ||
+ | But each message includes the voltage and current measurements, | ||
+ | |||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2-5 | | float | VBUS voltage, in V | | ||
+ | | 6-9 | | float | VBUS current, in A | | ||
+ | | 10-13 | | float | D+ voltage, in V | | ||
+ | | 14-17 | | float | D- voltage, in V | | ||
+ | | 18 | | uint8 | current recording group number, add 1 | | ||
+ | | 19 | '' | ||
+ | |||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2-5 | | float | VBUS voltage, in V | | ||
+ | | 6-9 | | float | VBUS current, in A | | ||
+ | | 10-13 | | float | internal temperature, | ||
+ | | 14-17 | | float | external temperature (from USB probe), in °C | | ||
+ | | 18 | | uint8 | current recording group number, add 1 | | ||
+ | | 19 | '' | ||
+ | |||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2-5 | | float | VBUS voltage, in V | | ||
+ | | 6-9 | | float | VBUS current, in A | | ||
+ | | 10-13 | | uint32 | on time, in s | | ||
+ | | 14-17 | | uint32 | recording time, in s | | ||
+ | | 18 | | uint8 | current recording group number, add 1 | | ||
+ | | 19 | '' | ||
+ | |||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2-5 | | float | VBUS voltage, in V | | ||
+ | | 6-9 | | float | VBUS current, in A | | ||
+ | | 10 | | int8 | acceleration value, X-axis | | ||
+ | | 11 | | int8 | acceleration value, Y-axis | | ||
+ | | 12 | | int8 | acceleration value, Z-axis | | ||
+ | | 14-17 | | uint32 | recording time, in s | | ||
+ | | 18 | | uint8 | current recording group number, add 1 | | ||
+ | | 19 | '' | ||
+ | |||
+ | ^ index ^ byte(s) ^ format ^ meaning ^ | ||
+ | | 0-1 | '' | ||
+ | | 2-5 | | float | VBUS voltage, in V | | ||
+ | | 6-9 | | float | VBUS current, in A | | ||
+ | | 10-13 | | float | recorded charge, in Ah | | ||
+ | | 14-17 | | float | recorded energy, in Wh | | ||
+ | | 18 | | uint8 | current recording group number, add 1 | | ||
+ | | 19 | '' | ||
+ | |||
+ | when the device is unresponsive, | ||
+ | |||
+ | < | ||
+ | 0xf1 0x03 0x00 0x00 0x00 0xfe | ||
+ | </ | ||
+ | |||
+ | I did not take time to reverse this since I got the measurements I was looking for. |
web-u2.txt · Last modified: 2024/01/07 17:49 by 127.0.0.1