Nikon Laser 440 Rangefinder Hack

 

Overview:

A tear down and attempt to interface the Nikon laser 400 and 440 laser rangefinders with a computer / microcontroller is documented. The laser 400 and Laser 440 rangefinders are mostly identical with some minor differences.
 

Rangefinder (2/7/2014):

Laser 400

Used rangefinder, will not range, possibly has a bad laser

A second rangefinder that does range properly was also purchased.
 

Rangefinder (2/7/2014):

View through eyepiece
 

Rangefinder (3/2/2014):

View through eyepiece
 

Rangefinder (2/7/2014):

A triwing bit is needed to open the case.
 

Rangefinder (2/7/2014):

A DC-DC converter is used to supply power. the rangefinder requires 3V
 

Rangefinder (2/7/2014):

Power converter board. Regulates power to controller and provides HV bias to the avalanche photodiode and laser.

Top left green inductor is for the Avalanche PD boost converter

Bottom right green inductor is for the laser boost converter
 

Rangefinder (2/7/2014):

Laser 400 Controller board connects to laser transmitter, photodiode and display LCD.
 

Rangefinder (3/1/2014):

Laser 440 Controller board connects to laser transmitter, photodiode and display LCD.
 

Rangefinder (2/7/2014):

Laser 400 Nikon NVD001 0111 controller chip. Proprietary / no documentation.
 

Rangefinder (3/2/2014):

Laser 440 Nikon NV-L456-H01 controller chip. Proprietary / no documentation.
 

Rangefinder (2/7/2014):

Laser 400 Display controller.

Altera Flex EPF6010ATI100-2 field programmable gate array. FPGA chip has extremely good documentation. It has a JTAG interface but can't be configured over it. It is configures by a passive serial device on power up. The small chip next to the LCD connector appears similar to an Altera EPC1 configuration chip, but is not connected to the FPGA.

It appears to communicate with the Nikon chip with a two wire interface.

All interfacing will focus on this chip.

The 14 pin SMT chip next to it is a Fairchild LCX14 hex inverter
 

Rangefinder (2/7/2014):

Laser 440 Display controller.

Altera Flex EPF6010ATC100-3

Different speed grade
 

Rangefinder (2/7/2014):

Laser transmitter
 

Rangefinder (2/7/2014):

Values given are power on steady state, not ranging unless noted. (pwr = when power/range button is pressed)

Top row:

  • Br: 3.3v
  • Rd: 0v (2.9V when Mode)
  • Or: 0v (3V when Pwr)
  • Yl: 0v (pulsating when Pwr)
  • LAND115: Bat +
  • LAND116: Pwr/Range(high)
  • LAND117: Mode (high)

Bottom row:

  • Gn: 3v
  • Bl: 3.3v
  • Pr: 3.3v
  • Gr: ground
  • W: 4.4v
  • Bk: 0v (pulsating when Pwr)
  • Bn:+42v for Laser (when Pwr)
  • Rd:+130v for Avalanche PD (when Pwr)
 

Rangefinder (2/11/2014):

Effect when wires are disconnected

Top row:

  • Br: rangefinder will not remain on when pwr is released
  • Rd: mode button inoperative
  • Or: pwr button function does not release
  • Yl: rangefinder turns off after second pwr button release

Bottom row:

  • Gn: dc-dc converter activates on pwr press but rangefinder does not turn on, converter deactivates on pwr release
  • Bl: no apparent effect
  • Pr: dc-dc converter activates on pwr press but rangefinder does not turn on, converter deactivates on pwr release
  • Gr: (not tested) ground
  • Wh: will not give laser active indicator, no voltage output to laser or avalanche PD HV lines. rangefinder turns off after second pwr button release
  • Bk: no voltage output to laser HV lines.
  • Bn: no effect other then no HV power to laser
  • Rd: rangefinder turns off after second pwr button release
 

Rangefinder (2/7/2014):

Values given are power on steady state, not ranging unless noted.

Left (Laser):

  • Bk: +42v for Laser (when Pwr)
  • R: 4.4v (connected to Wh on bottom header)
  • Or: 4.4v w/ 5us pull low pulses at 140ms apart. to FPGA pin 1
  • Yl: ground
  • Bl: 3.3v to FPGA pin 2 through R300 (680ohm)

Bottom (to power board):

  • Rd1: +130v for Avalanche PD (when Pwr)
  • Bn1: +42v for Laser (when Pwr)
  • Bk: 0v (pulsating when Pwr)
  • Wh: 4.4v (laser logic power?)
  • Gr: ground
  • Pr: 3.3v (ASIC, FPGA power)
  • Bl: 3.3v (ASIC pin 1, FPGA pin 12)
  • Gn: 3v
  • Yl: 0v (pulsating when Pwr) (from ASCI pin 46 through LCX14 pin 6(out))
  • Or: 0v (3V when Pwr)
  • Rd2: 0v (2.9V when Mode) (to ASIC pin 27 through LCX14 pin 1(in))
  • Br2: 3.3v (ASIC pin 13,14) (pull low to shutdown rangefinder?)

Right (Avalanche PD):

  • Rd: +130v for Avalanche PD (when Pwr)
  • Bk: pulsating 1khz
  • Or: pulsating 1khz
  • Yl: pulsating 1khz
  • Bl: ground
 

Rangefinder (2/25/2014):

Test points:

  • TP5: ?
  • TP1: FPGA pin 63
  • TP2: ground
  • TP4: ASIC 79
  • TP3: ASIC 78 (TTL serial data out 9600baud 8N1, transmits "TX<LF>" on power up)
  • TP6: ground
  • TP?: NC?
  • TP15: something in Avalanche PD
  • TP14: something in Avalanche PD
 

Rangefinder (2/10/2014):

Nikon ASIC

  • gnd: 9:12,21:26,38,48:59,73
  • power(3.3V): 27 (bottom purple)
  • Bottom Br2 wire: 13,14
  • Bottom Bl wire: 1 (also FPGA pin 12)
  • Mode button: 27 (through LCX14 inverter(output pin 2))
  • Bottom Yl wire: 46 (through LCX14 inverter(input pin 5))
  • Bottom Rd1 wire: 34 (through a several Mohm resistor with a 47k pull low in parallel across pin)

ASIC pin 3 to FPGA pin 13,14

 
 

Rangefinder (2/7/2014):

FPGA I/O pins:

  • FPGA pin 1 to Laser Or
  • FPGA pin 2 to Laser BL through R300 (680ohm)
  • FPGA pin 4,5 to ground
  • FPGA pin 8 to ?
  • FPGA pin 9 to ?
  • FPGA pin 12 to ASIC pin 1 and Bl bottom wire
  • FPGA pin 63 to TP1
  • FPGA pin 13,14 to ASIC pin 3

LCD:

  • FPGA pin 100:88 to LCD 1:11
  • FPGA pin 85:76 to LCD 12:21

VCC(3.3v): 6,21,38,54,71,88

GND: 5,20,37,53,70,87

JTAG Interface (not used):

  • TDI: 10
  • TDO: 51
  • TCK: 23
  • TMS: 18

Passive Serial Interface (used for config):

  • DCLK: 89
  • DATA: 86
  • nSTATUS: 39
  • CONF_DONE: 72
  • nCE: 4 (grounded)
  • INIT_DONE: 64
 

Rangefinder (2/10/2014):

LCD connector

  • 1:11 to FPGA 100:88
  • 12:21 to FPGA 85:76
  • 22 to FPGA 75
  • 23 to FPGA 74
  • 24 to FPGA 73
  • 25 to FPGA 67
  • 26 to FPGA 66
  • 27 to FPGA 65
  • 28 to FPGA 64
  • 29 to FPGA 61
  • 30 to FPGA 60

Logic levels:

  • 3.3v oscillating(50% duty cycle at about 100Hz)

LCD displays must be driven by a signal with 0 DC component
 

Rangefinder (2/22/2014):

LCD elements are activated by putting them out of phase with the common connection that is selected. This is tested with a 100Hz square wave generator with complementary outputs.

 
 

Rangefinder (2/22/2014):

Notation is 7seg <R(right), C(center), L(left)>, for which 7seg digit and

<B(bottom), M(middle), T(top)><R(right), C(center), L(left)> for 7seg digit elements

Pins 1 and 5 are out of phase(probably common) with all other pins when all segments are on during power up.

LCD connector pinout

  • 01: common?
  • 02: bat interior right
  • 03: bat interior left
  • 04: bat perimeter
  • 05: common?
  • 06: cross hairs
  • 07: 7sec R, BR
  • 08: 7sec R, BC
  • 09: 7sec R, BL
  • 10: decimal point
  • 11: 7sec C, BR
  • 12: 7sec C, BC
  • 13: 7sec C, BL
  • 14: 7sec L, BR
  • 15: 7sec L, BC
  • 16: 7sec L, BL
  • 17: 7sec L, MC
  • 18: 7sec L, TL
  • 19: 7sec L, TC
  • 20: 7sec L, TR
  • 21: 7sec C, MC
  • 22: 7sec C, TL
  • 23: 7sec C, TC
  • 24: 7sec C, TR
  • 25: 7sec R, MC
  • 26: 7sec R, TL
  • 27: 7sec R, TC
  • 28: 7sec R, TR
  • 29: meter
  • 30: yard
 

Rangefinder (2/22/2014):

Power shutdown sequence:

On power board

  • Br goes low (this is probably the power shutdown line)
  • Gn goes low
  • Bl goes low
  • Pr/Wh go low simultaneously

Logic analyzer PDFs

 
 

Rangefinder (2/22/2014):

Power control board test

Removing the brown wire and connecting a 10k resistor between the connector pad and battery+ causes the rangefinder to power up as soon as power is applied to the power terminals, and locks the rangefinder in a powered on state. All the rangefinder controls and buttons work properly, however after the 8 second inactivity delay when the rangefinder usually shuts down, it will no longer respond to button inputs. The LCD display remains on though.

The brown wire is bootstrapped high through the power button and is pulled high by the ASIC to keep the power on after the power button is released. It is pulled low to shut off rangefinder power.
 

Rangefinder (2/25/2014):

Laser output testing with a thorlabs DET10A high speed silicon detector.
 

Rangefinder (2/25/2014):

Laser pulse burst lasts 600ms
 

Rangefinder (2/25/2014):

Pulses are 1.2ms apart, this equates to 500 pulses per range measurement. This measurement is with a 1K resistor across diode output(RC decay time in pulse trace instead of proper time resolution with matched load, but greater amplitude)

Based on logic analyzer traces it appears the controller shifts the timing between the laser pulse and the avalanche PD pulse and probably looks to see if the pulse turns on. In essence it is iteratively looking at all 500 one meter increments between the rangefinder and the maximum range and determining if something is there.

A binary search would have been a much better way to find the target and could range ~50 times faster.
 

Rangefinder (2/25/2014):

Pulse with matched 50ohm load. Average of 500 pulses. Each pulse is ~20ns wide.
 

Rangefinder (2/25/2014):

FPGA JTAG interface attempt. This will require !ltera Quartus 9.0 SP2 web version, which is the last version to support the FLEX6000 FPGA which has entered legacy status.
 

Rangefinder (2/25/2014):

So far attempts to connect with the JTAG interface have been unsuccessful probably due to a poor connection between the ribbon cable header and the FPGA pins. When connected this would allow uploading of the SOF configuration file from the FPGA as a backup if the code is modified.

Engineers at !ltera say it is impossible to decompile a SOF file back into VHDL but some coders on the internet say that it is possible. It is possible to upload the SOF file and download it onto other chips though.

This chip has a JTAG interface but can't be configured over it. It is configures by a passive serial device on power up. The small chip next to the LCD connector appears similar to an Altera EPC1 configuration chip, but is not connected to the FPGA.
 

Rangefinder (2/25/2014):

ASIC serial data interface:

  • TP2: ground
  • TP4: ASIC 79 (TTL data in? (unconfirmed))
  • TP3: ASIC 78 (TTL serial data out 9600baud 8N1)

 
 

Rangefinder (2/25/2014):

ASIC transmits "TX<LF>" on power up. No <CR>, just <LF>

ignore the comma, that's just a power cycling glitch.
 

Rangefinder (3/2/2014):

Passive serial data interface

Nano clips and USB microscope for clip placement on 0.5mm pitch pins

Surface mount nano test clips connecting logic analyser to passive serial config pins
 

Rangefinder (3/2/2014):

Nano clips attached
 

Rangefinder (3/2/2014):

Nano clips attached to passive serial pins
 

Rangefinder (3/2/2014):

Passive serial data capture

Successful interfacing with passive serial data stream. Unfortunately it is generated by ASIC, which can not be reconfigured like an external configuration device.

Possibilities for computer interfacing are now hacking the TTL serial on the ASIC, decoding the LCD signals, or intercepting data between the ASIC and FPGA.

Passive Serial Interface:

  • FPGA DCLK: 89 to ASIC 80
  • FPGA DATA: 86 to ASIC 77
  • FPGA nSTATUS: 39 to ASIC 75
  • FPGA CONF_DONE: 72 to ASIC 76
  • FPGA nCE: 4 (grounded)
  • FPGA INIT_DONE: 64 to LCD 28 (config'd as user I/O)

 
 

Rangefinder (3/2/2014):

Passive serial data capture zoomed in
 
 

Rangefinder (3/2/2014):

 
 

 

 

  Google
WWW http://www.rtftechnologies.org

By attempting to reproduce any experiments or devices listed on this domain in part or in whole, you agree to hold me harmless against any lawsuit or liability.

Copyright © 1998 - 2005 by Andrew Seltzman. All rights reserved.
   
Contact me at: admin@rtftechnologies.org