Differences

This shows you the differences between two versions of the page.

--- web-u2 [2019/09/09 13:37] – [Board] kingkevin
+++ web-u2 [2019/09/11 20:35] – [Board] add HM-10 kingkevin
@@ Line 55: / Line 55: @@
 Software version 4.0 or later also do not work with this device. You need to use version 3.0.\\
 This device can still be used to measure voltage and current, but since there is no update anymore it will not be able to be used to detect charger profiles.
+There is also a footprint for an Bluetooth adapter behind the screen, but it was not placed yet (the software was probably not ready).
+{{:u2:web-u2_middle_top.jpg?0x150|}}
 I read out the FRAM (where the settings are stored) but did not find the serial number in there.
@@ Line 60: / Line 64: @@
 Sadly the firmware is read protected.
-There is also a footprint for an Bluetooth adapter behind the screen, but it was not placed yet (the software was probably not ready).
+Debug header pinout:
+<code>
+  _________
+__|8 6 4 2|
+|9 7 5 3 1|
+-----------
+</code>
-{{:u2:web-u2_middle_top.jpg?0x150|}}
+  - SWDIO (SWD, STM32F072 pin 34/PA13)
+  - SDA (I²C, with FRAM at 0x50)
+  - SWCLK (SWD, STM32F072 pin 37/PA14)
+  - GND
+  - GND
+  - VDD
+  - VDD
+  - SCL (I²C, with FRAM at 0x50)
+  - nRST (SWD, STM32F072 pin 7/NRST, you must connect under reset since SWD is disable after boot)
 ==== WITRN U2 V2.0 ====
@@ Line 114: / Line 132: @@
   - [[https://www.fujitsu.com/downloads/MICRO/fsa/pdf/products/memory/fram/MB85RC16-DS501-00001-8v0-E.pdf|Fujitsu MB85RC16]] I²C FRAM: to store the settings and energy measurements
   - [[https://www.st.com/en/microcontrollers-microprocessors/stm32f072cb.html|ST STM32F072CBT6]] ARM Cortex-M0 micro-controller: the brain of the device
-  - UART pins: to connect to the AT-09 Bluetooth module (with TI CC2541 chip). pinout, beginning with square pin: 3.8V GND RX TX
+  - UART pins: to connect to the AT-09/HM-10 Bluetooth module (with TI CC2541 chip). pinout, beginning with square pin: 3.8V GND RX TX
 ===== Software =====
-===== Support =====
+{{  :u2:software-screenshot.png?400|}}
+Here a couple of notes about the [[http://www.witrn.com/witrn/u2/WITRN_Software.zip|PC software]] (for Windows).
+The software is in Chinese, but you can change it by translating the words in the ''lang.ini'' file.
+Here the {{ :u2:lang.ini.zip |english lang.ini}} (works for versions 4.0, 4.1, 4.4).
+When started, the software will query [[http://www.witrn.com/updata/U2_NewVersion.pdf]] to get the latest version information.
+This is not a pdf. I think this is just to pass firewall (just like they use HTTP without SSL).\\
+This URL will return a short binary string, for example ''0x44 0x67 0x25 0x11 0x12 0x12 0x13 0x21'':
+  * ''0x44'': Software version 4.4
+  * ''0x67'': U2 Firmware version 6.7
+  * ''0x25'': X Firmware version 2.5
+  * ''0x11'': C3 Firmware version 1.1
+  * ''0x12'': C1 Firmware version 1.2
+  * ''0x12'': C0 Firmware version 1.2
+  * ''0x13'': C0s Firmware version 1.3
+  * ''0x21'': A0  Firmware version 2.1
+If will also query [[http://www.witrn.com/updata/U2_ad.pdf]], which is again not a pdf, but the text to display on the left side.\\
+Using the Network upgrade it will also download the Firmware for the U2 at [[http://www.witrn.com/updata/U2_FW_NEW.pdf]] and U2p at [[http://www.witrn.com/updata/U2_4KEYS_FW_NEW.pdf]] (raw binaries)
 ===== Communication =====
@@ Line 123: / Line 161: @@
 ==== USB HID ====
+When connected to USB, it appears as an {{ :u2:usb_hid.txt |HID}} (Human Interface Device).\\
+When powered while pressing on the OK button, it will boot in the DFU (Device Firmware Upgrade) mode, which allows flashing the firmware.
+But it is still an {{ :u2:usb_dfu.txt |HID}}, and does not use the DFU profile specified by USB.
+I've partially reversed the HID communication:
+  * the messages exchanged are 64 bytes long
+  * the host (e.g. software) starts by sending a message. Here an example of message sent (captured from the software):
+<code>
+"\xff\x55\x58\x8a\x13\x79\x06\x57\x1a\x01\x0a\x02\x00\x00\x00\x00" \
+"\x5e\x00\x00\x00\xff\x55\x2f\xb2\x8b\xdc\x5a\xd4\x1a\x2c\xa4\x00" \
+"\xa4\x40\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x74\x21\x4f\x40\x75" \
+"\x23\x19\x40\x75\xcc\x01\x01\x00\x02\x04\x00\x00\x5e\x00\xe7\x06";
+</code>
+  * this will cause the device (e.g. U2) to send measurements. Since it will only send a couple of messages, keep sending the message every couple of milliseconds (can be the same). Here an example measurement reply:
+<code>
+ff 55 13 b4 7f bf 50 ef 1a 2c d7 63 a0 40 0e 74 da 39 0e 74 da 39 0e 74 da 39 bb dd 08 3b 33 33 53 40 74 a8 6d 3c fe 98 f7 41 d2 34 91 c2 14 ae a0 40 0e 74 da 39 00 00 00 00 00 00 00 00 16 ae
+</code>
+here how to decode the measurements:
+^ index ^ byte(s) ^ format ^ meaning ^
+| 0-1 | ''ff 55'' | constant | probably a fixed header |
+| 2 | ''13'' | integer | number of second |
+| 3 | ''b4'' | integer | super fast incrementing number (but not related to other bytes) |
+| 4 | ''7f'' | integer | fast incrementing number (but not related to other bytes) |
+| 5 | ''bf'' | integer | incrementing number (but not related to other bytes) |
+| 6 | ''50'' | integer | 1/100th of byte 5 |
+| 7 | ''ef'' | integer | slow incrementing number (but not related to other bytes) |
+| 8-9 | ''1a 2c'' | constant | separates timing form measurement values |
+| 10-13 | ''d7 63 a0 40'' | float | VBUS voltage, in V (e.g. 5.0122 V) |
+| 14-17 | ''0e 74 da 39'' | float | VBUS current, in A (e.g. 0.0004 A) |
+| 18-21 | ''0e 74 da 39'' | float | VBUS current, in A (seems the same as previous current) |
+| 22-25 | ''0e 74 da 39'' | float | VBUS current, in A (sometimes slightly different for the other values, but I don't know why) |
+| 26-29 | ''bb dd 08 3b'' | float | VBUS power, in W (e.g. 0.0021 W ) |
+| 30-33 | ''33 33 53 40'' | float | D+ voltage, in V (e.g. 3.3000 V) |
+| 34-37 | ''74 a8 6d 3c'' | float | D- voltage, in V (e.g. 0.0145 V) |
+| 38-41 | ''fe 98 f7 41'' | float | In temperature (internal), in °C (e.g. 30.95 °C) |
+| 42-45 | ''d2 34 91 c2'' | float | Ex temperature (external, from IN Micro-USB probe), in °C (e.g. -72.60 °C, because not connected) |
+| 46-49 | ''14 ae a0 40'' | float | VBUS voltage (differs from first value, but I don't know how), in V (e.g. 5.0212 V) |
+| 50-53 | ''0e 74 da 39'' | float | VBUS current (sometimes slightly different for the other values, but I don't know why), in A (e.g. 0.0004 A) |
+| 54-61 | ''00 00 00 00 00 00 00 00'' | constant | seems always 0 |
+| 62 | ''16'' | integer | checksum (addition of bytes 8-61) |
+| 63 | ''ae'' | integer | checksum (addition of bytes 0-61) |
+There are other messages to get the device's serial number and firmware version, but I did not reverse those.
 ==== Bluetooth Serial ====