Jun 122012
 

Initialization sequence for Rimage RTP-4500 RAS 13 autoloader duplicator robot.

Serial sniffing with Beyond Logic RS-232 Protocol Analyser in ASCII mode.

For interception, I made a cable with 2 8-pin mini din connectors wired straight through after patching through a solderless breadboard. Connection to PC is 38400-8-N-1 using hardware flow control. I will post pinout and diagram later. For now, Pictures of the hardware and connections. Rimage Serial Sniffing – Second Attempt

Video recorded using Blueberry software BB FlashBack Express.

Logged output from the rs232 protocol analyser has been reformatted with a bit of perl to make reading easier. I chose 80 chars for the column width because it matches what the protocol analyser displays in the video. Each line is broken into two lines. The first line is what’s sent from the computer/printer to the autoloader. The second line is the response. To make things printable, I replaced the ASCII ESC character (hex x1B) with a plus + symbol and the ASCII EOT character (hex x04) with an = symbol.

So far, it seems all commands and replies start with ESC! and all replies end with EOT. Log file from initialization follows.

Update: It seems the end of the log file had been cut off. Whoops! If you have any more information about the command set, please let me know!

 + ! e 0 C                                   + !e0C
+ ! e 0 3 2CLIBERTY 4       VERSION 6.014E  = +    !e032CLIBERTY 4       VERSION

          + !e0C                                       + !e1C           +!f020 1
 6.014E  = +    !e032CLIBERTY 4       VERSION 6.014E  = +    !e1002000C=      +

C            + !e0C                                       +!f:C               +!
 !f01365534C= +    !e032CLIBERTY 4       VERSION 6.014E  =     +!f:1Cu054691 =

f12600C       + !e1C           +!f020 0C            + !e1C           +!f022 0C
       +!f11C= +    !e1000000C=      +  !f01365534C= +    !e1000000C=      +  !f

          +!f12600C        + ! e 1 C       + !f0220 C           +!f12602C + ! e
01002585C=         +!f11C=+ ! e 1 0 00000C= +      ! f01002585C=         + ! f 1

1 C              + !e1C           +!f02 20C            +!f12600C       +!f12402C
 0 C=+!e1003000C= +    !e1000000C=     +   !f01000500C=         +!f11C=

       + !e1C            + ! e 1 C + ! f 0 2 2 0 C            + !e1C           +
+!f10C= +    !e1003000C=+ ! e 1 0 0 0 0 0 0 C = + !f01000500C= +    !e1000000C=

!f02 40C            +!f12600C       +!f12402C + ! e 1 C               + ! e 1 C
    +   !f01300244C=         +!f11C=         + ! f 1 0 C=+!e1003000C=+ ! e 1 0 0

+ ! f 0 2 2 0 C            + !e1C           +!f0240 C            +!f12600C
 0 0 0 0 C = + !f01000500C= +    !e1000000C=       + !f01300241C=         +!f11C

 +!f12402C       + !e1C            + ! e 1 C       +!f022 0C            + !e1C
=         +!f10C= +    !e1003000C=+ ! e 1 0 00000C=      +  !f01000500C= +    !e

         +!f024 0C            +!f12600C       +!f12402C + ! e 1 C
1000000C=      +  !f01300242C=         +!f11C=         + ! f 1 0 C=+!e1003000C=+

+ ! e 1 C + ! f 0 2 2 0 C            + !e1C           +!f024 0C            +!f12
 ! e 1 0 0 0 0 0 0 C = + !f01000500C= +    !e1000000C=      +  !f01300243C=

002C       + !e1C           +!f020 0C            + !e1C
    +!f11C= +    !e1000000C=      +  !f01000000C= +    !e1000000

I jumped to the conclusion that every command gets a reply, and all replies are the result of a command. In the examples I have captured so far, this seems to be the case.

Advertisement:
+!e0C	+!e032CLIBERTY 4       VERSION 6.014E  =
+!e0C	+!e032CLIBERTY 4       VERSION 6.014E  =
+!e0C	+!e032CLIBERTY 4       VERSION 6.014E  =
+!e1C	+!e1002000C=
+!f0201C	+!f01365534C=
+!e0C	+!e032CLIBERTY 4       VERSION 6.014E  =
+!f:C	+!f:1Cu054691 =
+!f12600C	+!f11C=
+!e1C	+!e1000000C=
+!f0200C	+!f01365534C=
+!e1C	+!e1000000C=
+!f0220C	+!f01002585C=
+!f12600C	+!f11C=
+!e1C	+!e1000000C=
+!f0220C	+!f01002585C=
+!f12602C	+!f10C=
+!e1C	+!e1003000C=
+!e1C	+!e1000000C=
+!f0220C	+!f01000500C=
+!f12600C	+!f11C=
+!f12402C	+!f10C=
+!e1C	+!e1003000C=
+!e1C	+!e1000000C=
+!f0220C	+!f01000500C=
+!e1C	+!e1000000C=
+!f0240C	+!f01300244C=
+!f12600C	+!f11C=
+!f12402C	+!f10C=
+!e1C	+!e1003000C=
+!e1C	+!e1000000C=
+!f0220C	+!f01000500C=
+!e1C	+!e1000000C=
+!f0240C	+!f01300241C=
+!f12600C	+!f11C=
+!f12402C	+!f10C=
+!e1C	+!e1003000C=
+!e1C	+!e1000000C=
+!f0220C	+!f01000500C=
+!e1C	+!e1000000C=
+!f0240C	+!f01300242C=
+!f12600C	+!f11C=
+!f12402C	+!f10C=
+!e1C	+!e1003000C=
+!e1C	+!e1000000C=
+!f0220C	+!f01000500C=
+!e1C	+!e1000000C=
+!f0240C	+!f01300243C=
+!f12002C	+!f11C=
+!e1C	+!e1000000C=
+!f0200C	+!f01000000C=
+!e1C	+!e1000000

Rimage RAS 13 Serial Commands
Disclaimer, I am no expert or anything. Here’s my best guess at commands the autoloader will reply to.

+!e0C
Hello / Version
Known Replies / Suspected Meaning
+!e032CLIBERTY 4       VERSION 6.014E  =
	Autoloader name and firmware version


+!e1C
Status inquiry?
Known Replies / suspected meaning
+!e1000000C=
	OK / Continue
+!e1002000C=
	See in initialization - Suspected meaning machine uninitialized
+!e1003000C=
	Seen followed by pause then repeat of +!e1C from the controller


+!f12600C
Move to top resting/waiting
Known Replies / suspected meaning
+!f11C=
	Success?

+!f12602C
Probe to Printer Tray
Known Replies / suspected meaning
+!f10C=
	Success / No CD Present


+!f12402C
Probe to CD tray
Known Replies / suspected meaning
+!f10C=
	Success / No CD Present


Currently Unknown Commands
+!f0200C
+!f0201C
+!f0220C
+!f0240C
+!f12002C
+!f:C

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)