Leica TPS 1100 communication problem

Hi, he has a CD with drivers and update(firmware)?

@gulatast?ÿ

If you register your instrument with Leica MyWorld you can download the latest (or last) firmware for your instrument.

Mick.

I had the same problem 3-4 month ago. English and german language installed. Could not change to english language (configuration file missing). But i dont know exactly how i solved the problem.

I think it was the sequence i installed firmware and language files v2.21 several times from serial cable and from PCMCIA Card, but can??t remember how ???? . Now i can switch between english german without error message. Maybe also used some config file, but dont know.... I can have a look at pcmcia card if necessary...

But before loading firmware again maybe download TPS1100 Simulator (myworld_leica_geosystems) and install your languages at programm install routine. When starting simulator there ist debug window and there you can find where it is stored on your pc (Directory"Textdb" on my PC). Maybe there is also a configurating file in _en _us language that you can use.

For uploading i used winxp laptop with old real physical 9 pin serial connector and y-cable with rs232 adapter at instrument (see picture). Also used this laptop with very cheap chinese CH340 usb-serial cable from china and that was also working. I used Software survey office (did not register anything) --upload software and made correct RS232 settings for 1100 instrument. You have to put TCRA in GEOCOM MODE (5-2-3-yes) to upload firmware/language/application with Survey office or use PCMCIA CARD to install all.?ÿ

The*.key file is only to unlock Programms, as far as i know.

@mike1202?ÿ

I actually solved the problem by reinitialising the instrument. Then I started fresh with new firmware.

And yes, I have kept an old Dell 32 bit laptop with windows XP on it for the exact same reason as you.

This is a very interesting thread for me.  The problem I have is that my TPS1100 got bricked when the internal battery died.  At this point, the device powers on to the Leica splash screen.  In the lower right hand side I see 'FLASH' which then goes through a series of three character messages such as MOT (head moves a bit), EDM, etc.  The screen finally settles on a screen which is entirely blank except for a black bar on the top, an MC icon (memory card) located at the usual place on the upper right, and a 'CFG' on the lower right.  Pressing buttons does not have any noticeable change to the display, and it isn't even possible to turn off the unit without physically removing the batteries...

OK, so what did I do next?  I signed up for the my-world account with Leica and they nicely had the Leica Office software and the different firmware files (all with a naming convention of XXXX.TPS).  I read on the web that you can copy the main firmware version to a directory named SYSTEM on the PC-CARD and then start the TPS1100.  The boot loader is supposed to pick up the file... That doesn't seem to happen even after waiting 10 minutes. 

I then tried the serial port route.... I connected a cable from the TPS to a (real) serial port.  When I try to upload, the computer side times out and provides a message saying it couldn't find the TPS.  I did notice that the icon on the TPS changed, however, to one of the RS232 based icons (either RCS or GeoCOM, but I don't recall which).  So.... there is *some* activity there, but I still haven't gotten a successful firmware upload.

At this point, the questions I have are:

1. Where do you obtain the software keys?  I didn't see anything on the My-World site 
2. How do I upload the keys to my device? 
3. I believe I need to upload the firmware first, but is there anything else special about the sequencing
4. Is it possible to write the files to the PC-CARD and have the loader read those file(s) and install them
5. Are there any special keystrokes on the keyboard that need to be performed to upload via either the PC-CARD or RS-232
6. What baud, stop, parity, data length settings are needed on the PC to match the boot loader RS-232 (because you can't change anything on the TPS.... it is essentially 'dead')
7. What things require keys?  Applications or just the firmware?

Really what I'm asking here is.... If you have successfully uploaded firmware, can you detail your experiences so that I can hopefully replicate them.  As it stands now, this is still a work in progress thing for me, but I'm not having the best luck in the world. My progress has been incremental and I'd like to improve my odds at resurrecting this TPS.  It may be old, but I do like it.  🙂 

Posted by: @deckelhead

↑

I read on the web that you can copy the main firmware version to a directory named SYSTEM on the PC-CARD and then start the TPS1100.  The boot loader is supposed to pick up the file...

Sorry, but no. The internet is wrong this time.

You seem to have dug a bit of a hole for yourself.

The way you described the potential solution (quoted above) tells me that you've done it this way in Windows via the bios settings. Using terms like "bricked" tells me that you done this with an Android phone as well. But Leica were not using any sort of Windows based OS in the TPS1100s. I don't know how their system actually works (it was DOS based I believe), but I can promise you that the mainboard will not go hunting for a firmware update from a PCMIA card unless you tell it to via the menus. If you can't reach that stage then this is not a viable solution for you. Whoever told you that this is possible is probably talking about a TPS1200 or later. Even then, I don't think it would work that way, because the Leica software in question is not the Windows OS and any bootloader would be associated with the OS. Not Viva, Captivate etc.

My suggestion would be that if you cannot reach the menu stage of the OS then you'll need to flash the firmware via the port located on the mainboard itself. This is something I have never done, and I doubt that LGO (or similar) would do it for you. You would need to find someone with the Leica service software I think.

1. The keys are located in MyWorld. If they are not there, then your programs have probably been hacked.

2. If you manage to find them, you can enter them manually or upload a license file by putting it on the card. But you obviously have bigger problems to solve first.

3. Theoretically, the license keys should remain in place on the mainboard even when the firmware is updated. Flashing the system might erase them though. I have no idea really, but my gut tells me bye-bye.

4. There is no loader, so the answer is no.

5. No. It can be done entirely via the card or entirely via LGO, but you'll need access to the menus either way. LGO (or similar) will not "break into" the OS and force it to do anything. You need to tell the instrument to communicate with the PC first, and you need to do that from the instrument.

6. Again, I think terms like "bootloader" do not apply here. You must do this from the TPS1100 menus, or possibly from the port on the mainboard if you have access to Leica service software (again, I have no idea if this is how it works. But I have played with the internals of the 1100s in the past, and they all have the port on the board).

7. Only the applications require keys.

My gut tells me that you damaged something whilst changing the battery. The tabs are soldered to the board at one end, and welded to the battery at the other. I am wondering if you have applied too much heat to the board itself and cooked something, or used a capacitive discharge welder to attach the tabs at the battery end, which would send waaaaaaaaay too many volts/amps through that fragile 25 year old board. Your instrument is obviously trying to boot, which tells me that the firmware is actually there and is trying to do what it is meant to do.

Sorry champ. I think you might be flogging a dead horse here.

Mick

First off, thank you, Mick, for taking the time to read through my admittedly long post and to provide your input.... I should clarify a few things.  First, when I use terms like bootloader, that isn't meant to indicate a Windows OS type of system.  I actually come from an EE and software background with a great deal of embedded software experience.  To me, bootloader is a rather generic term that really relates to a bit of software that is burned into EPROM.  That system's sole function is to provide the basic tools to allow a person to upload the updatable firmware that will thereafter run the device under question.

As for the PC-CARD.  I actually dislike that name but felt it was "more generic" and, most importantly, consistent with the Leica documentation.  Technically, however, it is a simple PCMIA card with a CF card.  To that end, it is actually no more than a hard disk.  In my past days of software development, it was quite common to have a directory into which a bootstrap or bootloader would "look" on a removable disk (the CF card in this case) for things like configuration files or firmware.  That is where I was going with all this.

There is also a bit more learning I've had since I started playing with this...  According to the TPS1100 documentation, to update firmware (I use update intentionally because I'm specifically talking about changing versions from an already installed version), you do, in fact, use the menus (which I do not have).  The updating is accomplished through using GeoCom.....  OK, that is an important facet of the conversation--GeoCom.  Now, if you look at the GeoCom reference manual, you'll see that all of those three character messages that show up on my device in bricked mode (so, what I would call the bootstrap or bootloader) are in, in fact, GeoCom modules.  My suspicion is that these are displayed as the different modules are "loaded" from EPROM.  As such, I actually believe that the system *is* currently running GeoCom and, therefore, that can probably be the mechanism by which the firmware is uploaded.  Once done, I'd be back in business with menus and such.

The question now is why am I not able to "find" the TPS with my Leica uploader application on the PC.  One potential answer to that is that RS232 is notoriously difficult to setup.  If a stop bit, parity, etc is not correct, you'll end up with crickets.  RS232 is also fantastic once it is running because it doesn't require a ton of drivers like USB.  But, back to the task at hand, RS232 is a pain right now.... Part of my next plan of attack is to attach some RS232 monitoring tools so that I can validate the sync bits being sent out.  Hopefully there is something from the TPS that I can look at with either the a scope or my other tools so that I can verify the protocols and baud rate that the TPS is using.  This is TBD.

Oh, there is another development... I have not been able to reproduce *how* to get this to occur, but I have definitely seen the icon on the upper right of the TPS screen change to indicate that it is in GeoCom mode.  I think that is a pretty strong indication that there is a form of loader that I can probably exploit too.

OK.... keys.... I thought I read someplace that the firmware itself actually needed keys.  That seems awfully odd to me, but maybe?  As for the applications?  I cannot really speak to whether this was hacked or not, but I don't believe it was.  And, frankly, I'll be happy if I just get the basic functionality of the unit back online again.  That is step #1 right now and I'll worry about applications later.

One last note... I should clarify what actually happened...  I didn't actually replace the battery.  What happened is that the elevation motor was not turning.  I took the cover off to investigate and removing the cover would give me better access to see what was going on.  What I didn't realize is that there was a battery on the backside of the board, so when I removed the ribbon cable, I ultimately disconnected the battery that was keeping the (likely) CMOS memory with the firmware "alive."  THAT is what caused me to brick the unit.  Self inflicted. 

For what it is worth, the motor actually is bad on that axis.  I think that the unit was put into the case and it turned on.  The elevation knob was probably touched in the process and the system was trying to move the scope but could not.  That likely resulted in a constant flow of current to the motor which subsequently overheated it.  The motor armature is now not even capable of being turned, although the rest of the gearing is working perfectly.  I'll have to resolve that (have several ideas, but all secondary to getting the firmware loaded).

I know some of the history of the TPS before I acquired it, but not a whole lot.  I do believe, however, that everything on it was legitimately loaded.  When I created a MyWorld account and registered the serial number, however, I didn't see any keys at all.  This is also true for a TCRA1103 that my brother recently purchased. I registered that to see if there were keys there and there were not.  Now, I'm looking under the "Certificates" on MyWorld.  It is possible that this is not the correct location.  Can you tell me where you see your keys?

That is about it for now.  But, again, I am grateful for your message.  I think these dialogs not only benefit me but some other soul that runs into the same problem and finds this thread.  Therefore, I will update the thread with any successes I have in my journey of trying to get the firmware back.  If I haven't been clear on some of my descriptions above, please feel free to ask for clarification. 

Thanks!

if you are in MyWorld, AND you have registered your 1100, then if you go to My Products, you should see your instrument.  And if you click on software, you should see the software licensed to that instrument and a toggle to download keys.

good luck.  Fwiw, I had a program to 'destroy' the firmware and os for a 1200 but not the 1100.  Maybe you need to destroy/format the eprom prior to uploading the new firmware.

Also, there are some in Eastern Europe that may be able to get your 1100 back up and running if you cannot do same.

keep on trying as the 1100 had good hardware and optics.  

Hmm, interesting.... I'm wondering how my screen, which is attached to this response, differs from yours.  When I click on software, I see a bunch of download options, but I don't see any type of toggle...  If I download the Applications zip file (which it sounds as though is the only thing that actually requires keys (?)), I don't see any files there that have a .key extension.

Just to be sure I've got my wiring correct.... Does anyone have a wiring diagram for the cable when connecting a TPS1100 to an IBM-PC serial port?  In theory, I believe that the serial port should be Xon/Xoff as I don't believe there are enough pins on the TPS to support hardware protocols and external power.  But I've thus far not found a definitive pinout on the TPS.  The uploader application from Leica also has all of the baud/cfg options grey'd out, so I have to rely on the COM setting in the System's Device Manager tool.

LIKE EVER ALL ON Your OWN RISK!!

I have no wiring diagram.  And also not 100% sure, but i think the Leica TPS300 series was build in the same era 1998-2000 like TPS1100 instruments.

Leica Wild Details / Year

So here at the manual from TPS300 series at Page 83 it shows the pinout interface from TPS300 and i believe it is the same for TPS1100. 

But better confirm this from other source before maybe connecting Power to wrong port and maybe finally brick it.

TPS300_manual_en.pdf

LIKE EVER ALL ON Your OWN RISK!!

@deckelhead   Go to the 'Overview' tab- there is a download key button and also a software subsection.  You should be able to download keys from both

Sigh... Still no love on that either.  When I go to the overview table, there is a software section, but no downloadable components contained therein (see screenshot).  I tried selecting a language just to be sure this setting wasn't trapping anything, but I saw no change in the webpage rendering.  I. know that the TPS had TDS software on it originally and several other things, but I honestly don't know which of these may have required keys.  Maybe this particular TPS just didn't have any non-free applications that would require a key.  That said, my brother has a TCRA1103 which I've added to my MyWorld account and he also has nothing in the overview -> software area (or certificates)

@deckelhead That overview page is where the license keys are. They are not located anywhere else. In other words, according to Leica there are no added licenses on your instrument. This is why I thought yours were hacked.

Regarding the RS232 setup, the parity etc is extremely easy to setup. Once you have accessed your menus and told your instrument to enter geocom mode, you have the option to choose the parity and stop bit. If you get it wrong at the PC end, the instrument is extremely forgiving and does not complain. Just choose a different setting at the PC end and try again. If the instrument is open to communication, it'll happen eventually. I have no doubt you already know all of this. But of course, you need to turn that option on in the instrument first. Therein lay the problem.

Regarding the loading issue you are facing, the flashing 3 digit codes you see when she is firing up are the startup diagnostics. MOT for your servos (I've never seen the head move during this phase, and I wonder if your vertical axis servo is getting a pulse containing too much current during this diagnostics phase), EDM for your EDM board (you should hear the rotating disc in the EDM trigger a couple of times at some stage- usually very early on), ATR for the ATR and CFG. CFG stands for configuration I believe. If your instrument is hanging at the CFG stage then that might be where your issue is. But I have no idea how to fix that.

The TPS pinout most certainly takes power as well as RX & TX. The board on the 1100s runs at 6V, but the TPS lemo port takes the full 12V (its rated to take 3V to 25V) and reduces the voltage at the mainboard itself. I don't remember the 1100s outputting current like the GPS500s did, but I might be wrong. It's been a while.

For the 1100 lemo pinout, assume you are looking into the lemo cable and the red dot is facing up. Then assume that the other end has a female DB9 plug on it.

Lemo 0 degrees (+12V to instrument) = DB9 pin (N/A) 

Lemo 72 degrees (+12V from instrument**) = DB9 pin (N/A)

Lemo 144 degrees (Ground) = DB9 pin 5 (Ground)

Lemo 216 degrees (Rx) = DB9 pin 3 (Tx)

Lemo 288 degrees (Tx) = DB9 pin 2 (Rx)

**This pin is active on the GPS500 units, but I don’t think it is active on the TPS1100s. You’ll need to check yourself though.

Mick

Thank you, Mick, for the confirmation.  I don't really know the history of the instrument before my acquisition.  I would say that there are probably three options though:

1. Before it got bricked, there may not have been any key'd applications.  I thought I read that even the firmware required a key file, but that was refuted earlier in this thread.  So maybe all of the apps were just free
2. The instrument had key'd applications and it was hacked (I would think this would be more common today than when these came out but maybe not)
3. Leica no longer maintains the key file and simply doesn't show them on MyWorld.  This could be for everyone or it could be for new registrants such as myself.

As for the menus.... I don't have access to any menus at all, and keyboard keys have no effect whatsoever (although there may be some secret keystroke that is functional and I just don't know about it).  Therefore, I cannot enter GeoCom mode from via the menus...

Although that last statement is a loaded comment.  It would be pretty standard practice to have a bootloader that brought up a minimalist system. I don't recall the "normal" boot (prior to bricking) having the modules (MOT (yes, for motor), EDM, ATR (well, mine doesn't have ATR), etc) show up, but that could be a function of the backup boot loader (my theory).  And, yes, I agree that CFG is likely configuration.  If I were designing this system (and I did a lot of that work in the past), I'd set the RS232 at a specific baud rate, parity, stop bit, Xon/Xoff protocol, etc.  I'd probably move the screen to something like 'waiting for connection, but not everyone would.  So, sitting at CFG may well be just waiting for the GeoCom upload commands

There is some evidence that this is exactly what is happening.  I haven't been able to reproduce how to trigger this, but under some unknown situation the icon in the upper right of the screen changes to the GeoCom icon (basically a computer with a sine wave below it).  So, I'm pretty sure it *wants* to communicate with an external (i.e. a computer) device over RS232.  That would be fantastic because it means this would be the way to reload the firmware.  I just haven't managed to get this to work yet... but I'm stubborn!  Either I'll be planted 6 feed under or I'll throw this thing off a bridge!  LOL.... But this is why I wanted confirmation as to the wiring.  Thank you for giving me that!

I'll still have a different problem even if I get this firmware thing worked out though.  The Faulhaber 2224U0006SR motor on the elevation is toast.  it simply would not rotate the screw (when the instrument was not bricked).  I took the motor off and the armature was frozen solid.  I thought the sintered bearings might have gotten gummed up so I ground out the pinches on the case and opened it up.  Unfortunately, this brushed motor is glued together on the front. Removing the armature is essentially impossible, but I did find the reason why the motor failed.  The squirrel cage must hae been rubbing as the

(continued because my post is too long)...

The squirrel cage must have been rubbing as it was wearing.  This resulted in a buildup of debris that then resulted in the armature (which is of a very unique design) to basically get stuck in the whole mire.  Ultimately, the motor flat out couldn't move. And because the muck is magnetic, it is near impossible to actually clean this even if the armature wasn't messed up.  Furthermore, it would be exceptionally difficult to reassemble this motor and not damage the brushes.....   It really is an elegant design, but not serviceable at all.

All of this means that I'm on the hunt for a reasonably priced 2224U0006SR motor.  This is essentially a 24mm diameter motor with a 5 threaded hole face mount and running at 6V.  Does anyone have one to spare?  It is not economically feasible for me to buy this from FaulHaber as it is about $150USD and the instrument probably isn't worth that.  But I may find an alternative or adapt a different motor....  All part of an interesting journey.

I persevered with the 1100s until last year when I finally upgraded to a TS16. I would just use them until they fail then buy another one off eBay. But I always strip them of the more reusable parts when they fail. I have quite a few of those servos sitting in a box. Where are you located?

Smart man!  I never throw anything away without stripping it first!

I am located in California.

I have some additional information.  It occurred to me that the startup sequence on my "bricked" unit might be similar to the real startup sequence.  My brother has a (nicer) TCRA1103 and I asked him to take a video of his starting.  That was interesting.... His starts a LOT faster than my bricked unit, but at about the same speed as my TCM1103 before I bricked it.  But, I can definitely see the splash screen and then the modules loading.  In his case it traverses:

MEM -> FIL -> (splash screen shows) ATA -> ANG -> MOT (no motor movement) -> WIR -> BAP -> CNF -> menu structure.  This takes about 6 seconds

On my TPS1100 I see:

MEM -> FIL -> (splash screen shows) FLASH.. -> ATA -> EDM (very quick) -> ANG -> MOT (axis moves) -> TMC -> WIR -> CNF (no further changes).  This takes about 34 seconds

There are some differences, of course, because the TPM is not a robotic instrument; therefore I'd expect modules associated with that feature to not me loaded.  In the bricked mode, I do get motor movement which I didn't have originally (only on the horizontal axis, not vertical, but that could be because my vertical motor is not working).  In addition, the startup sequence is clearly almost 30 seconds longer than what I had originally.

I don't have any conclusion in all of this.  If the unit started up quickly and didn't move the axes, I'd be thinking that perhaps my firmware is corrupted and it simply cannot make the final transition to the menu subsection.  But the the inclusion of the FLASH, motor movement in MOT, and the length of startup makes me think there is more here than just a corrupted part of memory.

What would happen if you disconnected the servo and tried starting it again?