Topics

RS-232 and RS-465 Emco Keyboard X9A000, protocol reverse engineering

Daneel
 
Edited

Hi all,
I bought a keyboard some time ago and want to use it for a upcoming retrofit to LinuxCNC. I can't seem to get any communication going and I don't think there is any documentation.

It would be great if someone to hook it up to their machine using either RS-232 or RS-485 (or both one at a time). Start data collection, power up, press some keys and turn the knobs.

I'll send some pictures and screen dumps from some manuals. This is pretty much all I have found in terms of documentation...

There is no rush, but any help is greatly appreciated.
Thanks!
/Jonas

@Travis_S
 

I believe that Winconfig will allow you to update your project.ini file to include an external keyboard. Try the following passwords with:
SUPERVISOR
SERVICE
CONTROL

Daneel
 

Thanks Travis,
I now realize that I should have been more specific in describing my setup and what has been tried.
My setup:
I have two Emco machines, one VMC-100 mill with TM02 controller (this is the one I will try to retrofit linuxcnc on first) and one Emco Compact 6p lathe (very similar to 120p) with a TNM01 controller. So none of these controllers will work with the external keyboard.

What has been tried:
I power the keyboard with a 12DC power supply and the light comes on when the switch is thrown to the on position.
I made up a cable (as described in the pictures) to go between a prolific USB to serial adapter and the keyboard and set it up for 9600 7 databits, even parity and one stop bit.

I used Teraterm (same program I use to transfer files to and from the mill and lathe)
I pressed the key combination described in the manual to activate RS-232.
I couldn't see any output from the keyboard, no matter what knobs or keys I pressed.
I tried checking the signal levels on the keyboard port.
I get -8 V on pin 3
I get +8 V on pin 7
So I believe the keyboard is healthy.

What I have not tried yet:
I have not tried RS-485 because I have no experience or any idea of what the protocol might look like. I do have a RS-232 to RS-485 adapter that can be configured for two-wire protocol, but I could use some hints of what to do next if I made a cable up.

From a Swedish forum I could see that 4 years ago a guy had similar issues but he could connect the keyboard to his lathe and collect some data which lead him to believe that there is a initialization sequence after the control is powered up to activate the keyboard.
He did not investigate further and do not have any data left since the project. So this is where I hope someone could collect this communication and maybe I can decipher it.
Thanks again!

Doug Wilson
 

Daneel,

I might be able to help you out next week.  I have ordered a cheapo RS-485 protocol analyzer from Ukraine and according to E-Bay it should arrive on Monday.

Your post caused me to reconsider purchasing a decent RS-485 analyzer that is comparable with the other legacy analyzers I have.  I think I hit the jackpot.  I found a Telebyte (Datacom) model 905 on E-Bay that looks like new and it was only $45 including shipping.  It should arrive next week also.  It has several serial protocols built in so might be able to send some of these old legacy units to the dump.

Let me know next week if you still need some experimenting done with the analyzer.  I am also curious about the handshaking that Emco does with their 'special' RS-485 boards.

Doug

wild_kow
 

Anybody who's interested

There is an Emco RS485 ISA card on EBay #264464596990 and also control boards for PC mill 50

John


From: Emco-CNC-Users@groups.io <Emco-CNC-Users@groups.io> on behalf of calmissile via Groups.Io <calmissile@...>
Sent: Saturday, September 14, 2019 5:32:59 AM
To: Emco-CNC-Users@groups.io <Emco-CNC-Users@groups.io>
Subject: Re: [Emco-CNC-Users] RS-232 and RS-465 Emco Keyboard X9A000, protocol reverse engineering
 
Daneel,

I might be able to help you out next week.  I have ordered a cheapo RS-485 protocol analyzer from Ukraine and according to E-Bay it should arrive on Monday.

Your post caused me to reconsider purchasing a decent RS-485 analyzer that is comparable with the other legacy analyzers I have.  I think I hit the jackpot.  I found a Telebyte (Datacom) model 905 on E-Bay that looks like new and it was only $45 including shipping.  It should arrive next week also.  It has several serial protocols built in so might be able to send some of these old legacy units to the dump.

Let me know next week if you still need some experimenting done with the analyzer.  I am also curious about the handshaking that Emco does with their 'special' RS-485 boards.

Doug

@Travis_S
 

Daneel: communication on the RS485 seems to be positive and negative versions of the RS232 "TX" pin, at least in the case of an output only device like a keyboard... check out his link, there is a Texas Instruments chip that converts rs485 to rs232:

https://www.cnczone.com/forums/benchtop-machines/39868-cnc-machinist-software-25.html

Look for posts from "Rich Jones".

Daneel
 

@Calmissile - Doug,
Thanks for offering data / insights to this challenging issue.
Whenever you have the opportunity it will be interesting to see what goes on between the keyboard and host.
I'll monitor the group and will try to respond to any questions you might have.
Thanks again!
/Jonas

Daneel
 

Hi Travis,
I read through richjones posts in the thread.
It is very valuable information for anyone wishing to convert their PC50 to linuxcnc!
As far as I understood he is completely skipping all RS485 communication and replacing the card that does the RS485 to/from host, generates the steps and I/O processing. So in essence he built a electrical interface to preserve all driver electronics and using ie. a custom circuit board to interface to a host that is generating steps and pulses to drive the original mill drivers and sensors.
/Jonas

@Travis_S
 

Daneel/Jonas,

You are correct that he is skipping all of the RS485 communication  between the PC and the axis controller. In fact, in the case of linux cnc the axis controller is effectively eliminated ( it basically becomes a breakout board) as with Linuxcnc all of the control signals originate from the PC.

Our machines use rs485 in several places however. Looking at the PC Mill 50 electrical schematic posted in the files section of this site ( i am looking at page 16, "Axiscontroll x axis"), it shows that most of the signals from the axis controller board to the stepper controller board ( and the spindle control board for that matter)  are RS485 signals as well. This is verified in Rich Jones posts.

Honestly, I think this is very good news for your project :) 

What this means is that the hardware side decoding of the rs485 communication is already figured out- the Texas Instruments AM26LS31(receiver) and AM26LS32 (transmitter) chips are already documented to work at decoding the RS485 signal to normal ( sig and ground) signals. Emco seemed to really like these chips, as they use the same ones everywhere rs485 is used.

The trick from there is going to be figuring out the actual communication protocol. Rs485 is a method of transmitting a signal over long distances, but it doesnt always describe the actual protocol. You may get very lucky and find out it is RS232 (serial) over RS485 ( which I suspect it may be).

In your position, my next step would be to disassemble the keyboard enough to get good pictures of any circuit boards you may find. What you find here ( or dont find!) Will help us to figure out what we are up against in terms of communicating with this thing. 

Keep us posted!

Daneel
 

Travis,
I think you are correct in your assumptions that it will be the same communication taking place on both electrical interfaces RS485 and RS232. Without being an electronics expert it looks like they are almost wired in parallell (I assume they are not since there is a specific keyboard sequence to switch in between). In the keyboard X9A000 the interface for RS232 is built up around LT1080CN and RS485 is driven from LTC485CN8. In the picture of the inside the left hand connector is the RS232 and the right hand (with white lettering) is RS485.

It will be very interesting to see what Calmissile/Doug can record when he starts collecting some data !
/Jonas

wild_kow
 

I think you may find that the 232 is for accessory keyboard and the other for PC comms.

John


From: Emco-CNC-Users@groups.io <Emco-CNC-Users@groups.io> on behalf of Daneel via Groups.Io <jonas.warnqvist@...>
Sent: Sunday, September 22, 2019 9:16:02 AM
To: Emco-CNC-Users@groups.io <Emco-CNC-Users@groups.io>
Subject: Re: [Emco-CNC-Users] RS-232 and RS-465 Emco Keyboard X9A000, protocol reverse engineering
 
Travis,
I think you are correct in your assumptions that it will be the same communication taking place on both electrical interfaces RS485 and RS232. Without being an electronics expert it looks like they are almost wired in parallell (I assume they are not since there is a specific keyboard sequence to switch in between). In the keyboard X9A000 the interface for RS232 is built up around LT1080CN and RS485 is driven from LTC485CN8. In the picture of the inside the left hand connector is the RS232 and the right hand (with white lettering) is RS485.

It will be very interesting to see what Calmissile/Doug can record when he starts collecting some data !
/Jonas

@Travis_S
 

Wow, that keyboard is alot smarter than I would have thought! The square chip in the socket looks to be an Intel 80C196 , which is used in the machine axis controller "brain" as well along with another Intel micro- (8088-2 if memory serves) . This is an older, though very full featured, 16 bit microcontroller. 

Interestingly, Emco seems to have opted (at least in the axis controller) for the version of this micro with no onboard firmware memory- it is all stored externally in ROMs (EEPROMs or EPROMs I forget which). 

This may have work out well for this keyboard project- an arduino Mega 2560 can be programmed to read the ROM memory, and this likely has all of the program info store on it.
This is on my to do list for axis controllers as well.

arjan.dijk
 

Is there any progress made on Rs485 analyzing? Sounds interesting to emulate the original control.

@Travis_S
 

Arjan,

I would like to say there is progress, as I am steadily working on it, but progress is still slow. I did learn that the board has two processors on it, an 80c196 and an 8088-2 (that part isnt terribly hard to figure out). What is new though, is that it appears to use the 80c196 for communication ( the ISA card, Axis controller and optional external keyboard all have one). The 8088-2 runs the actual axis positioning, and the 80c196 drip feeds it commands. The volume of comm traffic on the RS-485 link between the PC and Axis controller (AC) is downright bewildering- the below program:

G90
M1
G54
M06 T02 G43 H02
X0
X1
M30

Yields approximately 500 lines of communication on the PC<-->AC RS485 link . There is also a data link between the 80C196 and 8088, and that yields a much more logical 100ish lines. I have been trying to decode this traffic, and have had some success -I believe I have identified the startup sequence the control sends to the machine when WinNC first starts for example. What I dont know yet (but want to) is how that sequence is shaped by the MSD file and others.

Additionally, I realized the machine uses a heartbeat signal ( a pattern of 00's) every 58-59 seconds when idle. This is not logged with the debug options in WinConfig. I found this using a cheap Ebay ($8) USB to RS485 converter-hooked up in parallel to the pins on the comm cable between PC and AC, it has no trouble logging traffic on the RS485 line.

Happy to share files if there is interest.

Thanks,
Travis