• Please review our updated Terms and Rules here

Pick and Place machine project

C

Conmega

Experienced Member
Joined
May 15, 2013
Messages
274
Location
Poughkeepsie, NY
Well I wasn't planning on posting about this here but I was asked by another member, who kindly offered to help me, to post the ROM dump I have here so I guess I'll make a quick post about what I'm doing.

I decided making a homemade Pick and Place machine could be fun but thought buying a cheap Chinese XYZ gantry or building my own would be cost prohibitive or too flimsy so I looked for an alternative.
I came across old bio-medical liquid handling robots which were basically XYZ gantrys with vacuum lines ran to the head for picking up liquids. Perfect! I need an XYZ gantry with vacuum lines as-well for picking up SMD components.
Now how much do these machines sell for? To my surprise the resell market for these machines aren't great, which is good for us! If you live in the USA they seem to go for a couple hundred bucks from recycling outfits across the country.
I got mine after some offering and counter-offering for 150 bucks, was about an hour and a half away from me. Not bad for a VERY well built machine with a HUGE work area for the price.
Some photos:
http://imgur.com/a/Oyl4D
The machine is a Qiagen Biorobot 8000 and my unit was built in 2004.
This thing wasn't fun to get in the basement being as large as it is (32" deep 55" wide 31" tall) and weighing in at 265 pounds!
But now that its down here this beast can start to be hacked!
Problem is I don't have any software to be-able to help me decode what the DB9 RS-232 port on the back takes.
Thus where I am stuck at. I would like to use as much as the in place electronics so I don't have to completely rebuilt it if possible.
This is especially considering it has DC motors with encoders, which while way nicer than steppers is more difficult to control needing a PID Controller to have any kind of nice accurate movement which is more difficult to implement than steppers.

Now this system has some vintage soul I guess you can say, its controlled entirely by 8052s which interesting each board has one with its own firmware and they are all interconnected over serial.
Very interesting way to do things instead of having one 8052 control the entire thing, but this machine probably cost tens of thousands of dollars when new so I'm sure the engineers didn't care much for it to be a little more expensive to produce. (For example there was an add-on on the main table for a vibrating base for mixing liquids, this had a large DC motor and a few sensors to drive, this got a whole 8052 to control just so it could connect to the same serial interface for expansions.)

Anyway I dumped the 64k ROM for the main 8052 which is a TS80C32X2-MCA, I was asked to post the ROM dump here for someone else to help me figure out where in the code and how its setting up and configuring its RS-232 port so I know what settings I need for the COM port.

Here's the ROM dump on paste-bin as its a bit too large for an attachment here.
http://pastebin.com/9a8bMYaf

If anyone else is interested in the project I suppose don't be afraid to chime in and or ask questions!
I posted this in off-topic knowing its already quite far off topic, I hope that I don't get any flak for posting it here.

-Connor K
 
Sadly there is no 'conversation' as far as I can tell. It appears to send nothing on startup and the few command looking sets of readable text in the ROM don't appear to do anything when sent.
 
JDallas said:
Probably because its not RS-232 communications.

The multiple 8051s suggest a multi-drop communications between those boards and even if a DB-9 is presented on the board you have the rom dump on, doesn't mean its RS-232 serial. Odds are its RS-485 or RS-422 and the rom dump seems to support that.

As I posted on the blog (might be in your capture buffer), on my 8051s (Philips/Temic) address 98h is the SCON register for serial control. Disassembling around appearances of the hex value in the rom dump discovered a routine where the SCON is loaded with a hex value D8h, which sets MODE3 (a nine bit, variable baud rate) configuration typical of the '485/'422 protocol. The baud rate will be set by one of the timers counting down the system clock, and the ninth bit is about a protocol where an address of a slave 8051 can be posted and that unit be interrupted and receive and act upon that packet. In the short snippet of code (I'll post more later) the D8h value sets TB8 high which is done before sending such an address (when 0, the 9bits just represent data). I don't yet know if its half or full duplex, a photo or some code may reveal that first.

It is *possible* but unlikely that the 8051 could use an analog switch to dual use the serial port so it could use RS-485/RS-422 when communicating with slave 8051s, but leave that interface to run a RS-232 port to a host system like a PC. A high resolution photo of the board will resolve that, if the rom dump doesn't first. I've done this some of multi-mode communications on a 8051, specifically between four portals, RS-232, TTL Serial, IrDA, and RS-485... so it is done; just don't know if its done on this board.

Point being...
just connecting it to a RS-232 port and banging away to find a baud rate could be ill-advised.

While a DB-9 certainly looks inviting from a PC perspective, it has been used for other communication protocols for its rugged and inexpensive advantages. And as this device is not a consumer product, they're more likely to assume customers are aware of this when they buy it and have read the manuals and installed any application programs on disks with the original purchase.

Caveats: The 8051 you're using appears to have a different register map, so I need to get a data sheet for that specific micro. My SCON and SBUF pair run at 98h and 99h respectively where as this code is making use of 97h for some purpose as yet unidentified.

I've only disassembled and analyzed sparse snippets of code so far. Nothing definite can be said of your machine yet.

More later. Save this message offline if you need as I don't leave messages posted past the date where I can no longer update them for corrections.
Click to expand...

I know its RS-232 because the Spec sheet and manual for the machine clearly state that is the interface. (At the very bottom of the spec sheet)
http://www.izasascientific.com/~/me...ifica/ciencias-de-la-vida/qiagen-br8000-1.pdf
This is why I 'assumed' it was RS-232, it also makes sense as many PCs in the day had RS-232 making it easy to interface with almost any machine.

As for the internal communications there is a set of connectors for expansion cards and two of the 3 cards installed are similar and each have a chip (TL16C452FN) that handles two UARTs. Two of those four UARTs are used, it is possible that one of those UARTs are in-fact the external RS-232 interface and the port on the actual 8051 itself is for the internal communications using RS-485/422. Although it is difficult to tell because there aren't simple connections directly to where those lines go. They plug into boards which lead to larger connectors carrying multiple sets of signals to other boards that then again split these signals to separate parts of the machine.

Anyway I will look more into what signals go where and take some nice high-res photos of boards to show what runs where and what chips are used.
Thanks for the help thus far though, we at-least can assume that the internal communications is some kind of RS-485/422, which I suspected since where other components hook onto the 'network' its pretty much a straight through back-plane with switches above each connector labeled "BYPASS" which is switched on for empty connectors and off for filled connectors.

Also as for the datasheet for the specific 8051 in my machine its:
http://www.atmel.com/Images/doc4184.pdf

The SCON and SBUF pair seem to be the same.
 
If it were me, I'd contact the manufacturer and see if they'd give me the software since I already own the hardware. At least then I'd have something to reverse engineer, if I still needed it.

They may tell you to take a flying leap, but you never know unless you ask.
 
The UARTs are the PLCC package on the right of the first and third expansion card in this photo:
http://i.imgur.com/A37NMGd.jpg
The two DIP packages on those boards are motor drivers, the left PLCC is a PLD, and the left components on a heat-sink are H-bridge drivers.

These UARTs are quite clearly driven by the 8051 on the main board through the data and address bus, but what address decoding that goes on between it and the UART is unknown as of now.

I did contact the manufacturer and got this:
Thank you for contacting QIAGEN Technical Service.



Installation of BR 8000 must be performed by a trained QIAGEN Engineer. We do not have any instructions for self-install of the instrument. While it may be possible for you to purchase a CD of the software (which I have yet to look into – because I need some info from your end – see below), a software on a computer without the instrument properly installed and taught, would be pretty much useless.



Can you please provide the name of your company, company address and company phone number? Also I would like to know what type of applications do you plan to run on the instrument? The software (and possibly additional hardware) that you would require, would depend on the application you plan to run. I need all this information, so I can contact the appropriate Field Service Manager and figure out what we can offer you here.
Click to expand...

To say the least I feel its an uphill battle with little chance of success ;)
 
Alright well I 'began' the hunt for this darn serial line.
It started off seemingly simple then started to get insane and I sort-of gave up for the time being...
You can see what I mean in the images I labeled with where the lines are going.

http://imgur.com/a/BVORL

It gets quite crazy towards where I got lost.

As for other photos I added a bunch to the main album I had up:

http://imgur.com/a/Oyl4D

As for 74xx138 chips I see none, but there are 4 74HCT573s, two above the EPROM and two under the 8051, not on the other side of the board but under the chip.
There are 3 PLDs in-between the connectors for the 'backplane' though, so they likely threw the work of the 138s into those if I were to guess.

On the two dual motor, dual UART boards you can see there are jumpers for what I assume addressing as one is set all off (or on) and the other with the first jumper set on.
As for the other board its for some analog sensor in a part of a pumping system so not really important.

Oh and the TI UARTS are: TL16C452FN
 
You must log in or register to reply here.
Back
Top