Laser/Hacking
For now just a unorganized pastebin to document things that don't fit the mastodon account.
Device
We have a BRM 90130 driven by a Ruida Controller (RDC6332G)
Links
Manuals
Reverse Engineering Resources
https://edutechwiki.unige.ch/en/Ruida
https://wiki.fablab-nuernberg.de/w/Diskussion:Nova_35
https://stefan.schuermans.info/rdcam/messages.html
Tools
RD-File interpreter and renderer: https://github.com/kallaballa/rdint
BRM branch of Ctrl-Cut: https://github.com/kallaballa/ctrl-cut/tree/brm
Dimensions
| Resolution | Width | Height |
|---|---|---|
| Physical | 1300 mm | 900 mm |
| Cut | 13000 positions | 9000 positions |
| Engrave | 51181 points | 35433 points |
Instructions
Cutting
tbd
Engraving
tbd
Rotary Engraving
Get the rotate engrave tool and put it in the lasercutter (in a way where the wide side faces you). Align it to the X axis of the lasercutter. Connect the two cables to the two plugs on the upper right side of the inner workarea (labeled 'rotation'). Flick the Axis Y/Axis U switch on the side of the lasercutter to the 'Axis U' position. Turn the lasercutter on. Test if everything is working by moving the y axis. If the rotate engrave tool moves you're good to go. Move the laser over the object you want to engrave. Be sure that you are exactly in the middle of the object on the y axis. If the laser hits the object, press reset, the laser will move the z axis down. Repeat as many times as needed. In the driver software, enable rotate engrave in the 'Output' Tab. Set circle pulse to 7600 and enter the diameter of the object. Enter the speed an press 'Test'. Ensure that the object does not fall after rotating 360°. Proceed as you would normally when engraving.
Reverse Engineering
Driver (LaserWorks aka RDCAM)
Nope.
Communication Protocol
The protocol can be used in 3 ways.
- USB
- Network
- By saving the job to a file in the driver.
We didn't get the net- to work (haha) so we are using USB right now.
Someone else already documented the protocol. Apparently everything is scrambled in some way byte-wise. https://stefan.schuermans.info/rdcam/messages.html
The descrambling process documented there didn't work for us.
Since different versions of the program seem to use different magic numbers we decided to try to brute-force it.
Turns out it's a new one: 0x33.
Setup Messages [Still Scrambled]
Notation:
< == from the driver > == from the laser
Before sending the job to the lasercutter the driver sends and receives a few preflight messages. We are unsure if they change when using the Network but they are omitted when saving a job to a file.
Some consistencies can be found when examining these messages. The laser always mirrors messages coming from the driver but changes one of the bytes and appends more data.
For example:
# Message by driver < 0x69 (i) < 0x34 (4) < 0xb8 < 0x4e (N) # Response by Laser > 0x69 (i) <-- mirrored > 0xb4 <-- always changed from 0x34 to 0xb4 (+128) > 0xb8 <-- mirrored > 0x4e (N) <-- mirrored # More Data > 0x36 (6) > 0x2c (,) > 0xb4 > 0x76 (v) > 0x34 (4)
Click 'Search' [Still Scrambled]
< 0x69 (i) < 0x34 (4) < 0xb8 < 0x4e (N) > 0x69 (i) > 0xb4 > 0xb8 > 0x4e (N) > 0x36 (6) > 0x2c (,) > 0xb4 > 0x76 (v) > 0x34 (4) < 0x69 (i) < 0x34 (4) < 0x34 (4) < 0x84 > 0x69 (i) > 0xb4 > 0x34 (4) > 0x84 > 0x34 (4) > 0xb2 > 0xd4 > 0x0a > 0x14
Select COM Device
< 0x69 (i) < 0x34 (4) < 0x34 (4) < 0x24 ($) > 0x69 (i) > 0xb4 > 0x34 (4) > 0x24 ($) > 0x34 (4) > 0x34 (4) > 0xb4 > 0x74 (t) > 0x34 (4)
Sending a Job
# Same as first message in 'Click Search' (x2)
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 0x69 (i)
> 0xb4
> 0xb8
> 0x4e (N)
> 0x36 (6)
> 0x2c (,)
> 0xb4
> 0x76 (v)
> 0x34 (4)
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 0x69 (i)
> 0xb4
> 0xb8
> 0x4e (N)
> 0x36 (6)
> 0x2c (,)
> 0xb4
> 0x76 (v)
> 0x34 (4)
< 0x69 (i)
< 0x34 (4)
< 0xba
< 0x22 (")
> 0x69 (i)
> 0xb4
> 0xba
> 0x22 (")
> 0xbe
> 0xa4
> 0x58 (X)
> 0x34 (4)
> 0x34 (4)
# Again, same as first message in 'Click Search'
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 0x69 (i)
> 0xb4
> 0xb8
> 0x4e (N)
> 0x36 (6)
> 0x2c (,)
> 0xb4
> 0x76 (v)
> 0x34 (4)
# ???
< 0x69 (i)
< 0x34 (4)
< 0x38 (8)
< 0x34 (4)
> 0x69 (i)
> 0xb4
> 0x38 (8)
> 0x34 (4)
> 0x34 (4)
> 0xb2
> 0x4e (N)
> 0x34 (4) <- This byte changes to 0x40 sometimes... (no idea why, seems to happen when one moves one point of the line in the test job for example.)
> 0x34 (4)
# Again, same as first message in 'Click Search'
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 0x69 (i)
> 0xb4
> 0xb8
> 0x4e (N)
> 0x36 (6)
> 0x2c (,)
> 0xb4
> 0x76 (v)
> 0x34 (4)
After this the actual job data is sent by the driver.
Laserfirmware
Nope.
