Activity Feed › Discussion Forums › Strictly Surveying › Trimble 5500/5600
Trimble 5500/5600
Posted by robots on October 28, 2020 at 4:55 pmHello guys,
I have been searching the internet on how to “change” batteries in the 5600/5500 series of trimble totalstations. I have recently acquired one for very cheap. Good working order but the battery is dead. That means that the main firmware of the total station is erased. I have seen various places that will replace 2dollar battery for 200 and clean the seals for free. (yeah right). Me being quite keen for electronics i can replace 2 batteries by myself. But the software is nowhere to be found on the internet.
Is there someone who researched such possibility to write the firmware at home ? I have taken apart the body and researched on how to load the firmware – that would be quite easy. Even dumping from existing station would be easy. But i don’t have working one.
robots replied 2 years, 7 months ago 16 Members · 65 Replies- 65 Replies
There’s a few of us been battling this and other issues over the last few years. Presumably you’re talking about the software on a CU keyboard like the one below – in which case I understand the software that controls the instrument is “volatile” so if the keyboard batteries go flat, the software goes. I understand that when you send the instrument (or keyboard alone) to the shop to get the batteries replaced – before they go flat – the shop copies the software, replaces the batteries, then flashes the software back onto the keyboard.
The other system is an ACU keyboard that runs Survey Controller software (many versions of it, and now obsolete) and in that case the software is not volatile, it is on a card inside the keyboard.
The other way to do it is without a keyboard, with a DC running say SurvCE, but I don’t think that has the parameters for compensator, collimation, temp, etc – and may also not be able to start up the instrument to robotic mode.
Shops in the US offer to flash software back onto a CU keyboard for about $200.
No i am not talking about CU, i am talking about the 5503 unit itself. If you open the side with servo knobs there are 2 boards. One board handles servo drive and second one is the main cpu board. This is the one you communicate with over serial cable or over radio. There are also two batteries and similar circuit that keeps data in memory, also similar memory chips as in CU.
I am trying to contact trimble over this issue, hopefully i will find someone who has the “service program”.
@robots Not sure I know of any places that will service the 5600 (Geodimeter 600) anymore. Trimble discontinued them years ago. The company I work for had a 600 that we traded in for a newer Trimble robot for machine control about 9 years ago. The dealer took the robot and the radios but I still have the 360 prism. From what I understood from them was they were going to use the trade in for parts to repair other robots / radios. If you need a 360, let me know.
Transit and Level Clinic (NC) 919.467.7782.
i am located in Europe.
Transit & Level did my 5600 about 8 months ago. $500
Ask for Charlie. He’s an old timer. Great guy.might be the reason you got it “very cheap”…. good luck!
I have a Geodimeter 640 that might still have its firmware intact (I haven’t used it in a few years). If you think its firmware might be useful
I’d be willing to attempt the extraction, but I’d need some coaching on procedure.
(Apologies for the formatting, the edit form is acting weird.)
@jim-frame
You will need serial cable to computer, and some terminal emulation program (“teraterm”, realterm, hyperterminal). I have analyzed the program that is executed when no program is found. It uses simple ascii protocol to communicate. Even human should be able to do it. Parameters are 38400 8,n,1 i think.
executing command “?” and ENTER will list all commands with description! I think same command is available in the main program of geodimeter. If so, there is option to DUMP whole memory, even calibration blocks are dumped. You save that for later to upload in different format, when batteries are changed. (thats the theory)
Maybe starting with standard serial communication on GDM600. Here chapter 4.
Geodimeter CU User Guide Part 1 571 702 001
And maybe this will help:
GEODIMETER SYSTEM 600 ATS CHAPTER 1-TECHNICAL DESCRIPTION MAINTENANCE MANUAL
I have a geodimeter 620, my parameters were Parameters are 9600, 8,n,1. And with CU attached, the command “?” just shows Fimware version “632-09.00” of Control Unit. With CU detached, it shows Firmware version “632-09.00” of GDM620 i think.
The command “DUMP” shows info Code “30” –> Syntax error – Tries to send a command with illegal syntax on the serial channel.
Any other suggestions?
so the command is “OV*” – dump memory,
Other commands are:
“RV,100” – GDM model
“RV,110” – loader time and date
“RV,111”- GDM serial number
“RV,113” – program version
“MR[L]” – read ram, i think that addr needs to be 2 bytes hexadecimal … “MR2000L2” – should read the checksum (it is located on 2000h address in ram)
“BS[1|2|3|4|5|6|7]” bank select – bank is located at address 0x8000- 0x8080. You can select which bank you want to read with MR.
There are also other programs which i will not list, they are dangerous, – modify ram and load new program (which will erase the old one instantly).
Memory locations are as follows: ( at least on 5500 trimble)
0x2000 – 0x2019 – checksum, program entry point and interrupt vectors are here.
0x2800 – 0x7ff5 – actual program memory.
0x8000-0x8080 – banked data ram.
I only have loader in my 5500. this one is located in ROM inside of the main processor. It will survive battery removal. The loader will check the status of the program memory. If checksums are correct it will jump to the main program immediately.
If none of these commands work, we will have to figure out other means of entering of the loader. (if you short data pins (any two) during turn on, checksums will come up corrupted and loader will be entered, where these commands are working )
loader output looks like this (9600 8n1):
51.8
>113=698-02.00
>698-02.00 commands:Load new program LV=0
Memory ASCII-hex dump OV*
GDM model RV,100
Link date/time RV,110
GDM serial number RV,111
Program version RV,113
Check RAM CRC CRC
Run loaded program RUN
Power off WV,107=1
Read RAM byte(s): MR<adr>[L<len>]
Write RAM byte: MW<adr>=<data>
Memory bank: BS[1|2|3|4|5|6|7]
List valid commands ?
>Correction “With CU detached, it shows Firmware version “696-03.08” of GDM620 i think.”
As i dont know how to enter Loader mode without disassambling the gun, i am out of this project. Wrecked to much equipment in the past ???? .
So if there is someone adventurous.. here is manual on how to “corrupt” but not corrupt the memory 🙂 (it will look corrupted for the cpu but in reality data will not be touched.
You need to open side of the where 2 knobs are. This is the side with servo drive board and main cpu board. You will see two batteries and black cover. These two boards are connected with 3 screws and one connector. There are lot of connections in the bottom of the board.
You need to remove this top screw to remove the black protection plastic.
You will see two chips. The bottom is the one keeping memory intact using those two batteries. do not touch this one 🙂 The top chip is the one of interest. This is where the data lines from cpu are going, and its the most easy place to “touch” them.
Personally i use very blunt pencil. The bottom row of contact of this chip are … OE, D0 … D7, GND. So touching almost any two in the middle is the goal.
I have tested it few times, always in different time of the loader’s CRC command. I have also tested without the pencil in the end.
>CRC=9444H;5540H;6A0BH;4557H
>CRC=B050H;5540H;6A0BH;4557H
>CRC=CB30H;5540H;6A0BH;4557H
>CRC=9444H;5540H;6A0BH;4557HNow the work flow of the loader is as follows:
1. check some hw version
2. do crc check
3. jump to program if crc is ok
4 run loader menu otherwise.
Goal is to touch those pins during the step number. So turn station on and touch. This all with serial terminal connected using serial cable. If everything goes well you will see “error” 51.8, 113=version, and command prompt “>”. From here you can dump the memory using command “OV*”, and use “capture” function of serial terminal program. Dump will take some time over 9600 baud rate serial line. But be patient, it is worth it 🙂
If you reboot the station (unplug battery and plug back in) the crc in next time will be computed correctly and station will work as before. This can also be achieved using “RUN” command.
Hi Robot, i am located in europe as well and very interested in your work about these stations. You need a memory readout from a working 5600 station ? Maybe i can get one in a few days, can you tell me the first 3 numbers of your serial nr ? I think the software differs from station to station ? I got an old 4000 geodimeter without software, same problem. No one can tell me how the loader works or if it is a “normal” serial communication. I am new to this forum so i cant write private messages…
i think that the software is the same between stations. First 3 numbers are: 817xxxxxx. Loader works with normal serial communication 9600,8,n,1. You can talk to it using keyboard 🙂 normal ascii commands. “?” is help. I am working on restoring my 5500. But if you get dump from 5600 i would be more than grateful 🙂 (please please, do not post your dump here to forums, ill share email address) Even though the Geodimeter is OLD (Last firmware update was 2004), software licenses still apply! You can get into trouble. Probably the whole forum can get into trouble for sharing. But making your own dump, and saving it on your harddrive is ok- for restoring.
Log in to reply.