DRIS Display: Difference between revisions

From NURDspace
No edit summary
No edit summary
 
(18 intermediate revisions by one other user not shown)
Line 10: Line 10:
|Category=Electronics
|Category=Electronics
}}
}}
== What in the hark is this? ==
== What in the hark is this? ==


This is a Dynamic Passenger Infromation Display (DRIS)
This is a Dynamic Passenger Infromation Display (DRIS)
We got one from the Province since they are upgrading them to newer units.
We got one from the Province since they are upgrading them to newer units.
== Plan ==
<s>In order to get this unit working we first will have to fix the broken 3V 25A power supply, or buy a replacement. Another issue is that the computer seems to post but then just shows a black screen and does nothing. I still have to figure out if this is due to the panel itself not working yet, or has other problems. It does seem that it does not trigger the watchdog on the "modem board" causing the "modem board" to constantly power cycle the computer.
What we ''could'' do is to power up one single, a few or just all the led panel using a PC power supply. We have a few laying around that seems to be capable of delivering at least 14A on the 3.3v bus. Assuming that unit itself won't run the leds at full brightness as long as we make the light sensor believe that we are in the dark.
I also want to explore the files on the computer, and see what exactly makes the system tick and how it communicates with the controller board. </s>
The project has laid dormant for 8 months, but recently has gotten new live blown into it. We finally decided to power up the DRIS with a PC power supply and it has proven that the DRIS works, somewhat. The hardware seems to work fine, and the DRIS happily displayed the time and the familiar "geen dienstregeling beschikbaar". Meaning we can finally start looking into reverse engineering the system again. Due to complaints, we want to get rid of the casing itself (too heavy to mount somewhere) and only keep the hardware so that we can hopefully, once fully harked, put it up on a wall bare naked.
The plan now is to continue to reverse-engineer. My idea is to sniff the serial communication between the PC and the controller board and see if I can mimic that with a mcu/pi as well as to see if I can figure out how the java code (previously decompiled) works and port it to Python.
First, we have to figure out what kind of serial communication is used between the PC and controller board. As both the controller board and PC are capable of both RS422 and RS485.
<gallery>
dris_workingstate.jpg
</gallery>


== Pictures ==
== Pictures ==
Line 19: Line 38:
ledunitpic1.jpg|The entire unit in it's case
ledunitpic1.jpg|The entire unit in it's case
ledunitpic2.jpg|First look of the led panels
ledunitpic2.jpg|First look of the led panels
ledunitpic3.jpg|Guts spilled on the table in zaal 2, showing the led's busbars
ledunitpic3.jpg|Guts spilled on the table in zaal 1, showing the led's busbars
ledunitpic4.jpg|PC booted and dumping the ide dom to an image
ledunitpic4.jpg|PC booted and dumping the ide dom to an image
ledunit5v.jpg|The 5v power supply powering the controller board
ledunit5v.jpg|The 5v power supply powering the controller board
Line 27: Line 46:
</gallery>
</gallery>


== Plan ==
In order to get this unit working we first will have to fix the broken 3V 25A power supply, or buy a replacement. Another issue is that the computer seems to post but then just shows a black screen and does nothing. I still have to figure out if this is due to the panel itself not working yet, or has other problems. It does seem that it does not trigger the watchdog on the "modem board" causing the "modem board" to constantly power cycle the computer.


== Information gathered ==


== Information gathered ==
According to the files located on the system, the panel was still operational at 2022-06-17.


=== Hardware ===
=== Hardware ===
Line 37: Line 55:


* Tracopower 12v / 6.0a (Supply for IO)
* Tracopower 12v / 6.0a (Supply for IO)
* Tracopower 3.3v / ? (Supply for Leds ) '''BROKEN'''
* (Tracopower 3.3v / 25A (Supply for Leds ) '''BROKEN''')[https://www.tracopower.com/int/model/txl-100-3-3s]
* Tracopower TMT 15105C 5v (Supply for led and FPGA board)
* Tracopower TMT 15105C 5v (Supply for led and FPGA board)


=== Controller Board ===
<s>A possible replacement for the 3.3v supply is https://www.ebay.de/itm/151886747221</s>
The dris works absolutely fine having all 3 power supplies replaced with a PC power supply that delivers enough amps on all the 3 needed rails.
 
==== Controller Board ====
Main controller board which is connected to the led panel. Seems to communicate over serial with the build-in PC.  
Main controller board which is connected to the led panel. Seems to communicate over serial with the build-in PC.  
The heart of the board seems to be a ST10f276Z5Q3 which is a 64Mhz 16-bit MCU. The UART seems to be handled by a TL16C550CIFN.
The heart of the board seems to be a ST10f276Z5Q3 which is a 64Mhz 16-bit MCU.  
The UART seems to be handled by a TL16C550CIFN.




Line 56: Line 78:
* A sense for the bus bar for the leds
* A sense for the bus bar for the leds


=== Unknown modem board ===
<gallery>
I haven't been able to detect a serial number yet. It has a sim slot with a KPN sim card in it and is connected to the PC with two com ports. It also seems to act as a watchdog as the PC's power is directly connected to it and it reboots the PC. Seems to be powered by a 32 Mhz Atmel ATXMEGA128XA1
ledunitcontroller.jpg
</gallery>
 
VISTRA-I Version 174 (Hardware 010), Built of 2013-05-04, 12:28:17
==================================================================
Chip ID 1143, F276, Rev.C, PConf.E, 64MHz,  WdtCon=3C, P0H=07
Detected Ram size = 1024k
[M32 LDC Geld]
*** NV Bala-Parameters defaulted ***
Panel address is 1
Multiplex FPGA 32x16 LED Panel set to 192 x 32 pixel
Interfaces:
  Async0  : 115200,8n1 (RS232/Download/Debug/Userdata)
  Async1  : 19200,8n1 (RS232/RS422/RS485/Userdata)
  Ethernet: MAC=00-50-C2-3A-70-81
  IP Addr : IP=192.168.254.225 Mask=255.255.255.0 Gate=0.0.0.0 DHCP=off
  TCP Port: Userdata=16975 FTP=21 TELNET=23 HTTP=80
Date/Time:  2022-07-12  20:26:04
RAM Disk:
          0 bytes in 0 files (max. 100 files)
    523824 bytes free of 523824 bytes (100% free)
ADC Init ok.
MMC detected
MMC ready, 249.856k
MmcUpdate(1063ms): Start Scan
 
==== Unknown modem board ====
I haven't been able to detect a serial number yet. It has a sim slot that had a KPN sim card in it and is connected to the PC with two com ports. It also seems to act as a watchdog as the PC's power is directly connected to it and it reboots the PC. Seems to be powered by a 32 Mhz Atmel ATXMEGA128XA1
 
<gallery>
ledunitmodem.jpg
</gallery>


=== Led Panel ===
==== Led Panel ====
The unit consists of 13x 32x16 amber coloured led panels. Each of these panels has it's own FPGA, an Altera Cyclone 2. Interesting of note is that one of them has a sticker on them saying "led_matrix.pof 27.02.2007".
The unit consists of 13x 32x16 amber coloured led panels. Each of these panels has it's own FPGA, an Altera Cyclone 2. Interesting of note is that one of them has a sticker on them saying "led_matrix.pof 27.02.2007".


Line 69: Line 122:
</gallery>
</gallery>


=== PC ===
==== PC ====
The PC is running an Intel Atom NZ70 running at 1,60Ghz and 1GB of DDR2 ram. The OS is located on a 4GB IDE DOM.
The PC is running an Intel Atom NZ70 running at 1,60Ghz and 1GB of DDR2 ram.  
The motherboard is a Jetway NF95A-270-LF.
The OS is located on a 4GB IDE DOM and the motherboard is a Jetway NF95A-270-LF.


=== OS ===
<gallery>
It's running Windows XP Embedded the controller software seems to be written in Java. The watchdog seems to constantly reset the PC, but likely it has a 12v barrel jack making it able for me to power it off a 12v brick and dump the ide dom.
ledunitpc.jpg
ledunitdom.jpg
</gallery>
 
* Motherboard PDF https://www.jetwaycomputer.com/download/Manual/NF95/NF95A-FV3.0.pdf
 
From the config file we were able to deduct the following COM ports been used
{| class="wikitable"
|-
! Port !! Connected to !! Baudrate !! Description
|-
| COM1 || Controller || 19200,8,none,1 || Used to communicate with the led controller.  
|-
| COM2 || Watchdog || 57600,8,none,1 || For communication with the watchdog
|-
| COM3 || Watchdog || 19200,8,none,1 || For the KAR Modem
|-
| COM4 || ??? || ??? || ???
|}


The raw disk image of the IDE dom can be found on Harmony under "shared_nurds_folder/Dris Display" along with the extracted partitions with zip.  
* Firing up the OS in a VM showed no activity from the OS on the com ports aside for COM4 which is not documented in the config
 
=== Software ===
==== OS ====
The system is running Windows XP Embedded and the software stack seems to be written in Java.
The raw disk image of the IDE dom can be found on Harmony under "shared_nurds_folder/Dris Display" along with the extracted partitions with zip and the decompiled java source.
'''Please refrain from putting this data online on the internet as it contains sensitive data!
'''Please refrain from putting this data online on the internet as it contains sensitive data!
'''
'''
<gallery>
vm_booted.png
</gallery>

Latest revision as of 16:20, 23 June 2023

Dris Display retrofitting
DRIS.jpg
Participants Melan
Skills 1337 Skillz
Status Getting parts
Niche Electronics
Purpose
Tool No
Location Not at the space for now
Cost Free.99
Tool category Electronics

Dris Display retrofitting

DRIS.jpg {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::Free.99 | }}


What in the hark is this?

This is a Dynamic Passenger Infromation Display (DRIS) We got one from the Province since they are upgrading them to newer units.

Plan

In order to get this unit working we first will have to fix the broken 3V 25A power supply, or buy a replacement. Another issue is that the computer seems to post but then just shows a black screen and does nothing. I still have to figure out if this is due to the panel itself not working yet, or has other problems. It does seem that it does not trigger the watchdog on the "modem board" causing the "modem board" to constantly power cycle the computer.

What we could do is to power up one single, a few or just all the led panel using a PC power supply. We have a few laying around that seems to be capable of delivering at least 14A on the 3.3v bus. Assuming that unit itself won't run the leds at full brightness as long as we make the light sensor believe that we are in the dark.

I also want to explore the files on the computer, and see what exactly makes the system tick and how it communicates with the controller board.

The project has laid dormant for 8 months, but recently has gotten new live blown into it. We finally decided to power up the DRIS with a PC power supply and it has proven that the DRIS works, somewhat. The hardware seems to work fine, and the DRIS happily displayed the time and the familiar "geen dienstregeling beschikbaar". Meaning we can finally start looking into reverse engineering the system again. Due to complaints, we want to get rid of the casing itself (too heavy to mount somewhere) and only keep the hardware so that we can hopefully, once fully harked, put it up on a wall bare naked.

The plan now is to continue to reverse-engineer. My idea is to sniff the serial communication between the PC and the controller board and see if I can mimic that with a mcu/pi as well as to see if I can figure out how the java code (previously decompiled) works and port it to Python.


First, we have to figure out what kind of serial communication is used between the PC and controller board. As both the controller board and PC are capable of both RS422 and RS485.

  • Dris workingstate.jpg

Pictures

  • The entire unit in it's case

    The entire unit in it's case

  • First look of the led panels

    First look of the led panels

  • Guts spilled on the table in zaal 1, showing the led's busbars

    Guts spilled on the table in zaal 1, showing the led's busbars

  • PC booted and dumping the ide dom to an image

    PC booted and dumping the ide dom to an image

  • The 5v power supply powering the controller board

    The 5v power supply powering the controller board

  • Filtering used on the 230V input

    Filtering used on the 230V input

  • Temperature sensor of sorts

    Temperature sensor of sorts

  • Ledunit230.jpg


Information gathered

According to the files located on the system, the panel was still operational at 2022-06-17.

Hardware

Power supply

  • Tracopower 12v / 6.0a (Supply for IO)
  • (Tracopower 3.3v / 25A (Supply for Leds ) BROKEN)[1]
  • Tracopower TMT 15105C 5v (Supply for led and FPGA board)

A possible replacement for the 3.3v supply is https://www.ebay.de/itm/151886747221 The dris works absolutely fine having all 3 power supplies replaced with a PC power supply that delivers enough amps on all the 3 needed rails.

Controller Board

Main controller board which is connected to the led panel. Seems to communicate over serial with the build-in PC. The heart of the board seems to be a ST10f276Z5Q3 which is a 64Mhz 16-bit MCU. The UART seems to be handled by a TL16C550CIFN.


So far from glancing around we found that:

  • It is NOT a FPGA but instead has a 16bit MCU
  • It has a RTC
  • It has both RS422 and RS485
  • It has ethernet
  • It has various IO of which the following devices are connected to it
  • A temperature sensor
  • A light sensor
  • A sense for the bus bar for the leds
  • Ledunitcontroller.jpg
VISTRA-I Version 174 (Hardware 010), Built of 2013-05-04, 12:28:17
==================================================================
Chip ID 1143, F276, Rev.C, PConf.E, 64MHz,  WdtCon=3C, P0H=07
Detected Ram size = 1024k
[M32 LDC Geld]
*** NV Bala-Parameters defaulted ***
Panel address is 1
Multiplex FPGA 32x16 LED Panel set to 192 x 32 pixel
Interfaces:
  Async0  : 115200,8n1 (RS232/Download/Debug/Userdata)
  Async1  : 19200,8n1 (RS232/RS422/RS485/Userdata)
  Ethernet: MAC=00-50-C2-3A-70-81
  IP Addr : IP=192.168.254.225 Mask=255.255.255.0 Gate=0.0.0.0 DHCP=off
  TCP Port: Userdata=16975 FTP=21 TELNET=23 HTTP=80
Date/Time:  2022-07-12  20:26:04
RAM Disk:
         0 bytes in 0 files (max. 100 files)
    523824 bytes free of 523824 bytes (100% free)
ADC Init ok.
MMC detected
MMC ready, 249.856k
MmcUpdate(1063ms): Start Scan

Unknown modem board

I haven't been able to detect a serial number yet. It has a sim slot that had a KPN sim card in it and is connected to the PC with two com ports. It also seems to act as a watchdog as the PC's power is directly connected to it and it reboots the PC. Seems to be powered by a 32 Mhz Atmel ATXMEGA128XA1

  • Ledunitmodem.jpg

Led Panel

The unit consists of 13x 32x16 amber coloured led panels. Each of these panels has it's own FPGA, an Altera Cyclone 2. Interesting of note is that one of them has a sticker on them saying "led_matrix.pof 27.02.2007".

It's a huge shame that these panels are running of FPGAs as that means we have no way of just controlling them since we know nothing about the protocol that they use to communicate with the other board.

  • Led matrix panel front.jpg
  • You can clearly see the Altera Cyclone

    You can clearly see the Altera Cyclone

PC

The PC is running an Intel Atom NZ70 running at 1,60Ghz and 1GB of DDR2 ram. The OS is located on a 4GB IDE DOM and the motherboard is a Jetway NF95A-270-LF.

  • Ledunitpc.jpg
  • Ledunitdom.jpg

From the config file we were able to deduct the following COM ports been used

Port Connected to Baudrate Description
COM1 Controller 19200,8,none,1 Used to communicate with the led controller.
COM2 Watchdog 57600,8,none,1 For communication with the watchdog
COM3 Watchdog 19200,8,none,1 For the KAR Modem
COM4 ??? ??? ???
  • Firing up the OS in a VM showed no activity from the OS on the com ports aside for COM4 which is not documented in the config

Software

OS

The system is running Windows XP Embedded and the software stack seems to be written in Java. The raw disk image of the IDE dom can be found on Harmony under "shared_nurds_folder/Dris Display" along with the extracted partitions with zip and the decompiled java source. Please refrain from putting this data online on the internet as it contains sensitive data!

  • Vm booted.png
Retrieved from "https://nurdspace.nl/index.php?title=DRIS_Display&oldid=13430"
Last modified
This page was last edited on 23 June 2023, at 16:20.