Quote from JesseG on April 20, 2024, 10:09 am

I continue to tinker with these old Geodimeter units. I have a couple 610's, a couple 140's, a 4400 and a 5601.

Here's some notes in case anyone else is following this same path!

Also got a couple RMTs (the 360 and the non-360 long range) for the 600's, and one for the 4400.

The 5601 is ram bat dead, still has the boot loader in it through.

One 610 seems to work fine, except I cannot get it to communicate with my TSCe/Ranger.

The other 610 works except EDM returns random readings, but it works fine with TSCe/Ranger.

The 4400 seems to work fine most of the time except when the level compensator isn't working...

I also have two CU's -- one works with the two 610's.

The other says "Wrong device" and it's got settings in it relating to direct reflex, so I think it's for some variant that does direct reflex.

Some interesting notes -- the 610's won't let you read out their firmware unless you solve a math problem, which @robots shows in his code:

KEY=(((SEED+171)*0x0d)-780)&0xFFFF

The station gives you a seed and you do the math and give it the key and that lets you then read the memory contents in some generic HEX format that has no checksums.

Interestingly, the 5601 lets me read the memory contents without authenticating -- but maybe that's because it failed a checksum (since the battery is dead)?

As to the 610 which won't work with the TSCe/Ranger, at first I thought maybe it's swivel was just bad and there wasn't a good connection on the serial port.

However, I can read the ram backup (although I did notice it only did the first 3 banks, not all 7.)

As to the 610 with the bad EDM which does work with TSCe/Ranger, it spits out 7 banks.

But I noticed in the case of both 610's, the data is different every single time I read it. About 75 lines of hex are different. However, the raw hex dump is the exact same size and still correctly formatted so I don't think it's just corruption in transit.

< 19E0H: 31 30 0D 41 54 53 33 3D 34 0D 41 54 4B 34 04 00

---

> 19E0H: 31 30 0D 41 54 53 33 3D 34 0D 00 00 00 00 00 00

Quote from JesseG on April 27, 2024, 3:36 pm

To the Unknown person offering services,
It looks like your lunar waneshaft overfumbled.

Quote from richard-imrie on September 7, 2024, 3:04 am

(I've been away for some time and I couldn't figure out how to just add a message to this thread, so I've done a reply to this message.)

I finally got around to using the toolkit to get a FW backup of the three instruments. Thank you very much to the OP and other P's for producing this.

My operating GDM 650 (same as 5601) looks like it has lost it's internal batteries and I get this:

PS C:UsersRichard> & C:/Users/Richard/AppData/Local/Programs/Python/Python312/python.exe c:/Users/Richard/Downloads/backupfirmware.py

c:UsersRichardDownloadsbackupfirmware.py:87: SyntaxWarning: invalid escape sequence 'd'

val = re.findall('d*.?d+', l)

c:UsersRichardDownloadsbackupfirmware.py:103: SyntaxWarning: invalid escape sequence 'd'

p, val = re.findall('d*.?d+', l)

cmd send: RG,127

cmd recv: 30.8

Traceback (most recent call last):

File "c:UsersRichardDownloadsbackupfirmware.py", line 113, in <module>

seed = gdm_read('G', 127)

^^^^^^^^^^^^^^^^^^

File "c:UsersRichardDownloadsbackupfirmware.py", line 101, in gdm_read

raise Exception("bad response")

Exception: bad response

PS C:UsersRichard>

I couldn't figure out the SEED thing in the previous posts.

I also have a 5601 which had batteries and calibration done around 2016, I think, but never really used it because the tracker is not aligned well with the scope, and it was problematic to get to run in robotic in SurvCE. However it is still "live" and I got this:

PS C:UsersRichard> & C:/Users/Richard/AppData/Local/Programs/Python/Python312/python.exe c:/Users/Richard/Downloads/backupfirmware.py

c:UsersRichardDownloadsbackupfirmware.py:87: SyntaxWarning: invalid escape sequence 'd'

val = re.findall('d*.?d+', l)

c:UsersRichardDownloadsbackupfirmware.py:103: SyntaxWarning: invalid escape sequence 'd'

p, val = re.findall('d*.?d+', l)

cmd send: RG,127

cmd recv: 127=6079

seed 6079

key 80470

key 14934

cmd send: WG,127=14934

cmd recv: >0.0>

send OV*

Reading main mem ... 7ff0 99%

Reading bank 1/8 ... fff0 99%

Reading bank 2/8 ... fff0 99%

Reading bank 3/8 ... fff0 99%

Reading bank 4/8 ... fff0 99%

Reading bank 5/8 ... fff0 99%

Reading bank 6/8 ... fff0 99%

Reading bank 7/8 ... fff0 99%

Readout done. Saving to firmware to fw.s

cmd send: WG,127=14935

cmd recv: 40.8>

PS C:UsersRichard>

I have attached the FW file.

I also have another GDM 650 which I got as a spare and never really bothered with as I had the other one working. It was probably last calibrated and batteries done in 2016 as well, and it is still operational! And I got this:

PS C:UsersRichard> & C:/Users/Richard/AppData/Local/Programs/Python/Python312/python.exe c:/Users/Richard/Downloads/backupfirmware.py

c:UsersRichardDownloadsbackupfirmware.py:87: SyntaxWarning: invalid escape sequence 'd'

val = re.findall('d*.?d+', l)

c:UsersRichardDownloadsbackupfirmware.py:103: SyntaxWarning: invalid escape sequence 'd'

p, val = re.findall('d*.?d+', l)

cmd send: RG,127

cmd recv: 127=13636

seed 13636

key 178711

key 47639

cmd send: WG,127=47639

cmd recv: >0.0>

send OV*

Reading main mem ... 7ff0 99%

Reading bank 1/8 ... fff0 99%

Reading bank 2/8 ... fff0 99%

Reading bank 3/8 ... fff0 99%

Reading bank 4/8 ... fff0 99%

Reading bank 5/8 ... fff0 99%

Reading bank 6/8 ... fff0 99%

Reading bank 7/8 ... fff0 99%

Readout done. Saving to firmware to fw.s

cmd send: WG,127=47640

cmd recv: 40.8>

PS C:UsersRichard>

I have attached the FW file.

I have three CU's and a ACU but unfortunately only one CU is operational and the ACU capitulated yesterday, so I share it around to check the instruments. I suspect the CU is on its last legs.