| Dris Display retrofitting | |
|---|---|
 | |
| Participants | Melan |
| Skills | 1337 Skillz |
| Status | Getting parts |
| Niche | Electronics |
| Purpose | |
| Tool | No |
| Location | Not at the space for now |
| Cost | Free.99 |
| Tool category | Electronics |
DRIS.jpg {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::Free.99 | }}
What in the hark is this?
This is a Dynamic Passenger Infromation Display (DRIS) We got one from the Province since they are upgrading them to newer units.
Plan
In order to get this unit working we first will have to fix the broken 3V 25A power supply, or buy a replacement. Another issue is that the computer seems to post but then just shows a black screen and does nothing. I still have to figure out if this is due to the panel itself not working yet, or has other problems. It does seem that it does not trigger the watchdog on the "modem board" causing the "modem board" to constantly power cycle the computer.
What we could do is to power up one single, a few or just all the led panel using a PC power supply. We have a few laying around that seems to be capable of delivering at least 14A on the 3.3v bus. Assuming that unit itself won't run the leds at full brightness as long as we make the light sensor believe that we are in the dark.
I also want to explore the files on the computer, and see what exactly makes the system tick and how it communicates with the controller board.
The project has laid dormant for 8 months, but recently has gotten new live blown into it. We finally decided to power up the DRIS with a PC power supply and it has proven that the DRIS works, somewhat. The hardware seems to work fine, and the DRIS happily displayed the time and the familiar "geen dienstregeling beschikbaar". Meaning we can finally start looking into reverse engineering the system again. Due to complaints, we want to get rid of the casing itself (too heavy to mount somewhere) and only keep the hardware so that we can hopefully, once fully harked, put it up on a wall bare naked.
The plan now is to continue to reverse-engineer. My idea is to sniff the serial communication between the PC and the controller board and see if I can mimic that with a mcu/pi as well as to see if I can figure out how the java code (previously decompiled) works and port it to Python.
First, we have to figure out what kind of serial communication is used between the PC and controller board. As both the controller board and PC are capable of both RS422 and RS485.
Pictures
The entire unit in it's case
First look of the led panels
Guts spilled on the table in zaal 1, showing the led's busbars
PC booted and dumping the ide dom to an image
The 5v power supply powering the controller board
Filtering used on the 230V input
Temperature sensor of sorts
Information gathered
According to the files located on the system, the panel was still operational at 2022-06-17.
Hardware
Power supply
- Tracopower 12v / 6.0a (Supply for IO)
- (Tracopower 3.3v / 25A (Supply for Leds ) BROKEN)[1]
- Tracopower TMT 15105C 5v (Supply for led and FPGA board)
A possible replacement for the 3.3v supply is https://www.ebay.de/itm/151886747221
The dris works absolutely fine having all 3 power supplies replaced with a PC power supply that delivers enough amps on all the 3 needed rails.
Controller Board
Main controller board which is connected to the led panel. Seems to communicate over serial with the build-in PC. The heart of the board seems to be a ST10f276Z5Q3 which is a 64Mhz 16-bit MCU. The UART seems to be handled by a TL16C550CIFN.
So far from glancing around we found that:
- It is NOT a FPGA but instead has a 16bit MCU
- It has a RTC
- It has both RS422 and RS485
- It has ethernet
- It has various IO of which the following devices are connected to it
- A temperature sensor
- A light sensor
- A sense for the bus bar for the leds
VISTRA-I Version 174 (Hardware 010), Built of 2013-05-04, 12:28:17
==================================================================
Chip ID 1143, F276, Rev.C, PConf.E, 64MHz, WdtCon=3C, P0H=07
Detected Ram size = 1024k
[M32 LDC Geld]
*** NV Bala-Parameters defaulted ***
Panel address is 1
Multiplex FPGA 32x16 LED Panel set to 192 x 32 pixel
Interfaces:
Async0 : 115200,8n1 (RS232/Download/Debug/Userdata)
Async1 : 19200,8n1 (RS232/RS422/RS485/Userdata)
Ethernet: MAC=00-50-C2-3A-70-81
IP Addr : IP=192.168.254.225 Mask=255.255.255.0 Gate=0.0.0.0 DHCP=off
TCP Port: Userdata=16975 FTP=21 TELNET=23 HTTP=80
Date/Time: 2022-07-12 20:26:04
RAM Disk:
0 bytes in 0 files (max. 100 files)
523824 bytes free of 523824 bytes (100% free)
ADC Init ok.
MMC detected
MMC ready, 249.856k
MmcUpdate(1063ms): Start Scan
Unknown modem board
I haven't been able to detect a serial number yet. It has a sim slot that had a KPN sim card in it and is connected to the PC with two com ports. It also seems to act as a watchdog as the PC's power is directly connected to it and it reboots the PC. Seems to be powered by a 32 Mhz Atmel ATXMEGA128XA1
Led Panel
The unit consists of 13x 32x16 amber coloured led panels. Each of these panels has it's own FPGA, an Altera Cyclone 2. Interesting of note is that one of them has a sticker on them saying "led_matrix.pof 27.02.2007".
It's a huge shame that these panels are running of FPGAs as that means we have no way of just controlling them since we know nothing about the protocol that they use to communicate with the other board.
You can clearly see the Altera Cyclone
PC
The PC is running an Intel Atom NZ70 running at 1,60Ghz and 1GB of DDR2 ram. The OS is located on a 4GB IDE DOM and the motherboard is a Jetway NF95A-270-LF.
From the config file we were able to deduct the following COM ports been used
| Port | Connected to | Baudrate | Description |
|---|---|---|---|
| COM1 | Controller | 19200,8,none,1 | Used to communicate with the led controller. |
| COM2 | Watchdog | 57600,8,none,1 | For communication with the watchdog |
| COM3 | Watchdog | 19200,8,none,1 | For the KAR Modem |
| COM4 | ??? | ??? | ??? |
- Firing up the OS in a VM showed no activity from the OS on the com ports aside for COM4 which is not documented in the config
Software
OS
The system is running Windows XP Embedded and the software stack seems to be written in Java. The raw disk image of the IDE dom can be found on Harmony under "shared_nurds_folder/Dris Display" along with the extracted partitions with zip and the decompiled java source. Please refrain from putting this data online on the internet as it contains sensitive data!
