peraino@gmu90x.gmu.edu (peraino) (11/29/89)
The code of the Infrared led of the HP28S. Since the infrared led is also used by companies other than Hewlett Packard, I want to make its code (as far as me and some friends of mine have cracked it) public. First of all, I want to thank Jurjen Bos, Niels Ferguson, and Toin Bloo, for doing this research (I am no good with hardware). Please note that this information might not be correct, it is found by our- selves, and we didn't get it from HP. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The signal consists of three parts: - Syncpulses: To synchronise the hardware with incoming information - Checksum: To detect and reconstruct bad bits - Data: The actual information The data and checksum are frequence modulated, and every mark is modulated with 6 pulses. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Schematical representation of a byte: ~0.8 msec ~3.2 msec |<-Sync>|<-----------Checksum---------->| | | | | | | Bitcel: | 0 | 1 2 3 4 | v v v _ _ _ _ _ _ _ _ _ _ |1| |1| |1| | | | | | | | | | | | | | | .... | |_| |_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_ ~6.4 msec |<-----------------------------Data-------------------------->| |Bit: 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 | | | | | | | | | | | 5 6 7 8 9 10 11 12 | v v _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ .... | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d|_|s|_|d| where: s = startpulse (clockpulse) d = datapulse - If the preceeding databit was 1, the startbit will be 0. - If the preceeding databit was 0, the startbit will be 1. - The first startbit of bitcel 1 (checksum) is always 1. - Gaps between S and D are maximum 1 msec; it is up to the hardware, to resynchronise with every byte. Example: Bitcel: | 6 | 7 | 8 | 9 | ... s d s d s d s d ... 1 1 0 0 1 0 1 1 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% Schematical representation of a bitcel: (of which a byte has 12) /| /| /| /| /| /| /| /| /| /| /| /| / |/ |/ |/ |/ |/ | / |/ |/ |/ |/ |/ | / | | | | | _| |___________________| |___________________| ^ ^ ^ ^ ^ | |--| ~0.03 msec | | | | | |<----------------------------------->| ~0.4 msec | | ~0.8 msec | |<------------------------------------------------------------------------->| %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% The checksums: Data: I.R.: (filtered from sync- Checksum: and start-bits) #00h 0 0 0 0 0 0 0 0 0 0 0 0 #0h #01h 0 0 1 1 0 0 0 0 0 0 0 1 #3h #02h 0 1 0 1 0 0 0 0 0 0 1 0 #5h #04h 0 1 1 0 0 0 0 0 0 1 0 0 #6h #08h 1 0 0 1 0 0 0 0 1 0 0 0 #9h #10h 1 0 1 0 0 0 0 1 0 0 0 0 #Ah #20h 1 1 0 0 0 0 1 0 0 0 0 0 #Ch #40h 1 1 1 0 0 1 0 0 0 0 0 0 #Eh #80h 0 1 1 1 1 0 0 0 0 0 0 0 #7h The checksum is calculated as follows: Start with 0, and for every position that is 1, take the corresponding value in the table above, and XOR it with the previous result. Example: ,---last result | ,---hex digit #27h 1 1 0 0 0 0 1 0 0 1 1 1 | | (as in table) | | ,---new result Because: ------- | | | | v v v | | | | '-> #0h XOR #3h = #3h | V V '---> #3h XOR #5h = #6h ^ | '-----> #6h XOR #6h = #0h | '->---------> #0h XOR #Ch = #Ch = #1100b | ---- '------<----------------<---------------<------' %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% We hope someone can use this information to create a device to translate the code to RS232C, and make its schemes freely available to the public (as we did with this information). If you do, please send the schematics to: Eric Toonen Djept-Zuid 6 5502 RP Veldhoven The Netherlands You people are not too lazy to send a normal letter, are you? I don't have an E-mail account. We will post the results of this quest to Comp.Sys.Handhelds, Some additional notes: Please do not mail or post any replies about "Hook-uP" or "hp28com", I know of both, but their schemes are not publicly available; I want to accomplish that the schemes and documentation of such a (even if it is output only) device are free, combining our knowledges. You probably will have noticed that I want to have the same, concerning the source-listing of the 2BB ROM. If people at Hewlett-Packard, Corvallis Division, are reading this: I want to ask you to please make the code and hardware-schemes available of the infrared led. Also, I want to ask you to make the source of the 2BB ROM available. Any information sent to me confidential shall be treated as such. Be reading from you, Eric ----------------------------------------------------------------------------- Eric Toonen Snailmail: Djept-Zuid 6 | Hogeschool-Eindhoven: s89406143@hsepm3.hse.nl 5502 RP Veldhoven | (Not an uucp-address) The Netherlands | (Might work on SURFNET (?)) -----------------------------------------------------------------------------
daver@guille.ece.orst.edu (Dave Rabinowitz) (11/29/89)
In article <2371@gmu90x.gmu.edu> peraino@gmu90x.gmu.edu (peraino) writes: > >Since the infrared led is also used by companies other than Hewlett Packard, I >want to make its code (as far as me and some friends of mine have cracked it) >public. The details of the IR interface code were published in the Hewlett-Packard Journal about three years ago. Your local HP sales office should be able to locate a copy for you. >The data and checksum are frequence modulated, and every mark is modulated with >6 pulses. The spec allows 6 or 7 pulses modulated at 32768Hz. The coding splits each bit time into a 1 and 0 slot. A burst in the 1 time slot indicates a 1 bit, a burst in the 0 slot indicates a 0 bit. A burst in both slots or neither slot is recorded as an error, and the error correction bits allow correction of up to two errors of this type. A frame starts with three bursts spaced 1/2 bit time apart, a sequence which cannot legally occur in the middle of a frame. Your interpretation appears to be equivalent, but I think this is a simpler way to look at it. > - Gaps between S and D are maximum 1 msec; it is up to the hardware, > to resynchronise with every byte. A bit time is 27 cycles of 32768Hz, or 824 usec. The printer resynchronizes its timing at each burst.
lorenh@hpcvra.CV.HP.COM (Loren Heisey) (12/09/89)
>>Since the infrared led is also used by companies other than Hewlett Packard, I >>want to make its code (as far as me and some friends of mine have cracked it) >>public. > >The details of the IR interface code were published in the Hewlett-Packard >Journal about three years ago. Your local HP sales office should be able to >locate a copy for you. You can also get details on the IR transmission method used by HP IR printing calculators by writing to HP's Calculator Technical Support. They will send information that gives the timing requirements and data encoding of the IR transmitter to anyone who asks for it. Their address is listed on the inside back cover of any HP calculator OWNER's manual.