- Import PW0316 module manual for TC66C
- Browse files
-
bogdan committed 2 weeks ago
-
1 parent fdcef0acommit dad48d5
Showing 7 changed files
with
205 additions
and
0 deletions
BIN
Documentation/Research Resources/Manuals/PW0316_User_Manual_V2.9.pdf
Binary file not shown.
+9
-0
Documentation/Research Resources/Manuals/README.md
@@ -36,6 +36,15 @@ Recommended naming: |
||
| 36 | 36 |
- SHA-1: `c9272064731ab462b6c872d92536d7291b2bda1d` |
| 37 | 37 |
- extraction status: reviewed; summarized in `../Specifications/TC66 Manuals Working Summary.md` |
| 38 | 38 |
|
| 39 |
+### `PW0316_User_Manual_V2.9.pdf` |
|
| 40 |
+ |
|
| 41 |
+- status: added to repository |
|
| 42 |
+- apparent scope: vendor manual for the `PW0316` BLE module used as the `TC66C` radio path |
|
| 43 |
+- pages: `28` |
|
| 44 |
+- version label: `V2.9` |
|
| 45 |
+- SHA-1: `e325f7708f18400fd774f60219e76395797c51cc` |
|
| 46 |
+- extraction status: reviewed; summarized in `../Specifications/PW0316 BLE Module Working Summary.md` |
|
| 47 |
+ |
|
| 39 | 48 |
### `User Maual for Operation and PC software and APP of TC66(C) Type-c USB PD Trigger Meter 2019.6.5.pdf` |
| 40 | 49 |
|
| 41 | 50 |
- status: added to repository |
+17
-0
Documentation/Research Resources/Payload Notes/TC66C Transport and Payload Working Note.md
@@ -17,6 +17,7 @@ Reason: |
||
| 17 | 17 |
Primary sources used for this note: |
| 18 | 18 |
|
| 19 | 19 |
- `Documentation/Research Resources/Specifications/TC66 Manuals Working Summary.md` |
| 20 |
+- `Documentation/Research Resources/Specifications/PW0316 BLE Module Working Summary.md` |
|
| 20 | 21 |
- `USB Meter/Model/Meter.swift` |
| 21 | 22 |
- `USB Meter/Model/BluetoothRadio.swift` |
| 22 | 23 |
- `USB Meter/Model/BluetoothSerial.swift` |
@@ -44,6 +45,12 @@ This differs from the `UM` family path already documented elsewhere: |
||
| 44 | 45 |
- `UM25C` / `UM34C` use `FFE0` / `FFE1` |
| 45 | 46 |
- `TC66C` uses a separate `PW0316`-style path in the current app |
| 46 | 47 |
|
| 48 |
+The newly imported `PW0316` vendor manual explicitly validates this mapping: |
|
| 49 |
+ |
|
| 50 |
+- `FFE5` / `FFE9` is the BLE-to-UART write channel |
|
| 51 |
+- `FFE0` / `FFE4` is the UART-to-BLE notification channel |
|
| 52 |
+- `FFC0` / `FFC1` / `FFC2` exists as an optional anti-hijack password channel |
|
| 53 |
+ |
|
| 47 | 54 |
## Request / Response Shape |
| 48 | 55 |
|
| 49 | 56 |
The current app polls `TC66C` using ASCII commands. |
@@ -64,6 +71,16 @@ Important implication: |
||
| 64 | 71 |
- the app assumes fixed-length snapshot framing for `TC66C` |
| 65 | 72 |
- this is not derived from the manuals directly; it comes from the existing reverse-engineered implementation |
| 66 | 73 |
|
| 74 |
+What the `PW0316` module manual adds here: |
|
| 75 |
+ |
|
| 76 |
+- the BLE layer itself is designed around `20`-byte BLE payloads |
|
| 77 |
+- UART transparent frames can be up to `200` bytes and are automatically split by the module |
|
| 78 |
+ |
|
| 79 |
+Working interpretation: |
|
| 80 |
+ |
|
| 81 |
+- the app's reassembly of a `192`-byte encrypted snapshot is application-layer behavior above the module transport |
|
| 82 |
+- the module manual supports the fragmentation assumption, but not the `192`-byte frame itself |
|
| 83 |
+ |
|
| 67 | 84 |
## Encrypted Snapshot Structure |
| 68 | 85 |
|
| 69 | 86 |
The current parser decrypts the `192`-byte response with `AES ECB`. |
+167
-0
Documentation/Research Resources/Specifications/PW0316 BLE Module Working Summary.md
@@ -0,0 +1,167 @@ |
||
| 1 |
+# PW0316 BLE Module Working Summary |
|
| 2 |
+ |
|
| 3 |
+This note summarizes the imported module manual [`PW0316_User_Manual_V2.9.pdf`](../Manuals/PW0316_User_Manual_V2.9.pdf) and records why it matters for `TC66C`. |
|
| 4 |
+ |
|
| 5 |
+## Source Snapshot |
|
| 6 |
+ |
|
| 7 |
+- imported file: `Documentation/Research Resources/Manuals/PW0316_User_Manual_V2.9.pdf` |
|
| 8 |
+- source path before import: `/Users/bogdan/Documents/Documentatie/TC66/Other/PW0316_User_Manual_V2.9.pdf` |
|
| 9 |
+- pages: `28` |
|
| 10 |
+- version label in manual: `V2.9` |
|
| 11 |
+- part number: `PW0316` |
|
| 12 |
+- SHA-1: `e325f7708f18400fd774f60219e76395797c51cc` |
|
| 13 |
+ |
|
| 14 |
+## Why This Matters |
|
| 15 |
+ |
|
| 16 |
+The current app already mapped `TC66C` to radio type `PW0316`, but until now that was only a code-level assumption. |
|
| 17 |
+ |
|
| 18 |
+This manual strongly supports that mapping and validates the BLE side of the current `TC66C` transport model. |
|
| 19 |
+ |
|
| 20 |
+## Confirmed Module Role |
|
| 21 |
+ |
|
| 22 |
+The manual describes `PW0316` as a BLE 4.0 transparent serial bridge: |
|
| 23 |
+ |
|
| 24 |
+- user MCU talks to the module over UART |
|
| 25 |
+- mobile app talks to the module over BLE |
|
| 26 |
+- the module forwards data between UART and BLE |
|
| 27 |
+- upper-layer meaning is defined by the host MCU and mobile app |
|
| 28 |
+ |
|
| 29 |
+This is a strong fit for the existing `TC66C` implementation: |
|
| 30 |
+ |
|
| 31 |
+- the app sends ASCII commands |
|
| 32 |
+- the module bridges them to the device MCU |
|
| 33 |
+- the device MCU returns data that the module fragments into BLE notifications |
|
| 34 |
+ |
|
| 35 |
+## Confirmed GATT Layout |
|
| 36 |
+ |
|
| 37 |
+The manual explicitly documents the following BLE services and characteristics. |
|
| 38 |
+ |
|
| 39 |
+### Serial data channel |
|
| 40 |
+ |
|
| 41 |
+- service `0xFFE0` |
|
| 42 |
+- characteristic `0xFFE4` |
|
| 43 |
+- operation: `Notification` |
|
| 44 |
+- payload size: `20` bytes |
|
| 45 |
+- meaning: UART RX input is forwarded to BLE notifications |
|
| 46 |
+ |
|
| 47 |
+### Bluetooth data channel |
|
| 48 |
+ |
|
| 49 |
+- service `0xFFE5` |
|
| 50 |
+- characteristic `0xFFE9` |
|
| 51 |
+- operation: `Write` |
|
| 52 |
+- payload size: `20` bytes |
|
| 53 |
+- meaning: BLE writes are forwarded to UART TX |
|
| 54 |
+ |
|
| 55 |
+### Anti-hijacking channel |
|
| 56 |
+ |
|
| 57 |
+- service `0xFFC0` |
|
| 58 |
+- characteristic `0xFFC1` |
|
| 59 |
+ - operation: `Write` |
|
| 60 |
+ - size: `12` ASCII bytes |
|
| 61 |
+ - meaning: current password + new password |
|
| 62 |
+- characteristic `0xFFC2` |
|
| 63 |
+ - operation: `Notify` |
|
| 64 |
+ - size: `1` byte |
|
| 65 |
+ - meaning: password operation result |
|
| 66 |
+ |
|
| 67 |
+Password event values documented by the module vendor: |
|
| 68 |
+ |
|
| 69 |
+- `0` = password accepted |
|
| 70 |
+- `1` = password incorrect |
|
| 71 |
+- `2` = password updated |
|
| 72 |
+- `3` = password cancelled |
|
| 73 |
+ |
|
| 74 |
+## Broadcast and Identity Hints |
|
| 75 |
+ |
|
| 76 |
+Default BLE advertise data includes partial 16-bit UUIDs for: |
|
| 77 |
+ |
|
| 78 |
+- `FFC0` |
|
| 79 |
+- `FFE0` |
|
| 80 |
+- `FFE5` |
|
| 81 |
+ |
|
| 82 |
+Default scan-response data includes: |
|
| 83 |
+ |
|
| 84 |
+- manufacturer-specific data with default text payload `RW-BLE` |
|
| 85 |
+- local name `PW0316` |
|
| 86 |
+ |
|
| 87 |
+This directly explains why the current app can recognize a peripheral named `PW0316` as `TC66C`. |
|
| 88 |
+ |
|
| 89 |
+## UART and Flow-Control Behavior |
|
| 90 |
+ |
|
| 91 |
+The module manual documents a hardware flow-control model around: |
|
| 92 |
+ |
|
| 93 |
+- `BRTS` |
|
| 94 |
+- `BCTS` |
|
| 95 |
+ |
|
| 96 |
+Relevant points: |
|
| 97 |
+ |
|
| 98 |
+- default UART is `9600`, `8N1` |
|
| 99 |
+- transparent serial payloads can be any size up to `200` bytes |
|
| 100 |
+- BLE wireless payloads are `20` bytes each |
|
| 101 |
+- the module automatically splits large UART payloads into BLE packets |
|
| 102 |
+- the host MCU must manage `BRTS` |
|
| 103 |
+- the module uses `BCTS` to tell the MCU when module-to-host data is pending |
|
| 104 |
+ |
|
| 105 |
+## Throughput and Timing |
|
| 106 |
+ |
|
| 107 |
+The manual states: |
|
| 108 |
+ |
|
| 109 |
+- default BLE connection interval: `20 ms` |
|
| 110 |
+- highest theoretical transparent throughput is achieved with `115200` UART and `20 ms` BLE interval |
|
| 111 |
+- reliable Bluetooth data transmission is limited to about `10 KByte/s` |
|
| 112 |
+ |
|
| 113 |
+This is consistent with the current app's expectation that a `TC66C` response arrives as multiple `20`-byte BLE fragments. |
|
| 114 |
+ |
|
| 115 |
+## AT Command Surface |
|
| 116 |
+ |
|
| 117 |
+The module supports UART-side `TTM:` AT commands for module management, including: |
|
| 118 |
+ |
|
| 119 |
+- test |
|
| 120 |
+- MAC read/write |
|
| 121 |
+- baud rate |
|
| 122 |
+- rename |
|
| 123 |
+- manufacturer data |
|
| 124 |
+- advertise / scan response |
|
| 125 |
+- TX power |
|
| 126 |
+- reset |
|
| 127 |
+- factory reset |
|
| 128 |
+- version |
|
| 129 |
+- product identification code |
|
| 130 |
+- advertise interval |
|
| 131 |
+- connection interval |
|
| 132 |
+- broadcast on/off |
|
| 133 |
+- serial send setup delay |
|
| 134 |
+- anti-hijack password |
|
| 135 |
+ |
|
| 136 |
+Important implication: |
|
| 137 |
+ |
|
| 138 |
+- these are module-management commands, not necessarily `TC66C` application commands |
|
| 139 |
+- they should not be confused with the ASCII commands already seen in the app for meter data requests |
|
| 140 |
+ |
|
| 141 |
+## What This Validates For `TC66C` |
|
| 142 |
+ |
|
| 143 |
+High-confidence validations: |
|
| 144 |
+ |
|
| 145 |
+- `TC66C` does not use the same BLE channel shape as the `UM` family |
|
| 146 |
+- the current app's `FFE0` / `FFE4` and `FFE5` / `FFE9` mapping is correct for `PW0316` |
|
| 147 |
+- BLE traffic is expected in `20`-byte chunks |
|
| 148 |
+- a separate security channel `FFC0` exists and may matter if the module password is enabled |
|
| 149 |
+- the peripheral name `PW0316` is a credible alias for the hardware module used inside `TC66C` |
|
| 150 |
+ |
|
| 151 |
+## What This Does Not Validate |
|
| 152 |
+ |
|
| 153 |
+The module manual does not describe: |
|
| 154 |
+ |
|
| 155 |
+- the `TC66C` meter's application-level ASCII commands such as `bgetva` |
|
| 156 |
+- the `192`-byte encrypted snapshot format used by the current app |
|
| 157 |
+- the AES key or packet layout of `pac1` / `pac2` / `pac3` |
|
| 158 |
+- the meaning of measurement fields returned by the meter MCU |
|
| 159 |
+ |
|
| 160 |
+So this manual validates the transport shell, not the meter payload itself. |
|
| 161 |
+ |
|
| 162 |
+## Practical Implications For The Codebase |
|
| 163 |
+ |
|
| 164 |
+- keep `TC66C` on the `PW0316` transport path |
|
| 165 |
+- keep `TC66C` separate from the `UM25C` / `UM34C` `HM-10` style path |
|
| 166 |
+- consider adding `FFC0` / `FFC1` / `FFC2` support only if we discover password-protected modules in the field |
|
| 167 |
+- when debugging fragmentation, assume the BLE layer naturally emits `20`-byte chunks and that larger frames are reconstructed above that layer |
|
+5
-0
Documentation/Research Resources/Specifications/README.md
@@ -29,3 +29,8 @@ Useful content for this folder: |
||
| 29 | 29 |
|
| 30 | 30 |
- combined working summary for the imported `TC66` Chinese and English manuals |
| 31 | 31 |
- focuses on model split, USB vs BLE communication, trigger and PD behavior, and PC/mobile workflow |
| 32 |
+ |
|
| 33 |
+### `PW0316 BLE Module Working Summary.md` |
|
| 34 |
+ |
|
| 35 |
+- working summary for the vendor BLE module manual used by the `TC66C` radio path |
|
| 36 |
+- focuses on GATT channels, UART bridge behavior, packet sizing, and what the module manual does and does not validate |
|
+3
-0
Documentation/Research Resources/Specifications/TC66 Resource Inventory.md
@@ -8,6 +8,7 @@ This note captures what was directly observed from the archived `TC66` resource |
||
| 8 | 8 |
- `User Maual for Operation and PC software and APP of TC66(C) Type-c USB PD Trigger Meter 2019.6.5.pdf` |
| 9 | 9 |
- `TC66C_V1.1.6.apk` |
| 10 | 10 |
- `RuiDengUSBMeter_V1.0.0.6.rar` (reviewed locally, not retained in git) |
| 11 |
+- `PW0316_User_Manual_V2.9.pdf` |
|
| 11 | 12 |
|
| 12 | 13 |
## Skipped Duplicate |
| 13 | 14 |
|
@@ -34,6 +35,7 @@ This note captures what was directly observed from the archived `TC66` resource |
||
| 34 | 35 |
- iPhone app support is `TC66C`-only |
| 35 | 36 |
- desktop software communicates over `micro-USB`, not Bluetooth |
| 36 | 37 |
- the manuals make `PD` / `CC pull-down` state an important part of correct measurement behavior |
| 38 |
+- the supplementary `PW0316` module manual explicitly validates the `FFE0/FFE4` notify path and `FFE5/FFE9` write path already assumed by the app |
|
| 37 | 39 |
|
| 38 | 40 |
## Practical Use |
| 39 | 41 |
|
@@ -41,3 +43,4 @@ This note captures what was directly observed from the archived `TC66` resource |
||
| 41 | 43 |
- the Android APK is a good candidate for later string extraction or decompilation when we need model-specific labels and behavior hints |
| 42 | 44 |
- the PC software archive may still be useful for identifying USB/driver assumptions and desktop-side workflows, but it is intentionally left out of git for now |
| 43 | 45 |
- the payload working note `TC66C Transport and Payload Working Note.md` now records how the current app models `TC66C` transport and decoded fields |
| 46 |
+- the `PW0316 BLE Module Working Summary.md` note now records what the radio module manual validates at the BLE transport layer |
|
+4
-0
USB Meter.xcodeproj/project.pbxproj
@@ -62,6 +62,7 @@ |
||
| 62 | 62 |
1C6B6BA62A2D4F5100A0B001 /* User Maual for Operation and PC software and APP of TC66(C) Type-c USB PD Trigger Meter 2019.6.5.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = "User Maual for Operation and PC software and APP of TC66(C) Type-c USB PD Trigger Meter 2019.6.5.pdf"; sourceTree = "<group>"; };
|
| 63 | 63 |
1C6B6BAA2A2D4F5100A0B001 /* UM25 User Manual.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = "UM25 User Manual.pdf"; sourceTree = "<group>"; };
|
| 64 | 64 |
1C6B6BAB2A2D4F5100A0B001 /* User_Manual_UM34C.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = User_Manual_UM34C.pdf; sourceTree = "<group>"; };
|
| 65 |
+ 1C6B6BB02A2D4F5100A0B001 /* PW0316_User_Manual_V2.9.pdf */ = {isa = PBXFileReference; lastKnownFileType = image.pdf; path = PW0316_User_Manual_V2.9.pdf; sourceTree = "<group>"; };
|
|
| 65 | 66 |
1C6B6B982A2D4F5100A0B001 /* Software README.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = README.md; sourceTree = "<group>"; };
|
| 66 | 67 |
1C6B6B992A2D4F5100A0B001 /* Android Apps README.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = README.md; sourceTree = "<group>"; };
|
| 67 | 68 |
1C6B6B9B2A2D4F5100A0B001 /* Vendor Contacts README.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = README.md; sourceTree = "<group>"; };
|
@@ -75,6 +76,7 @@ |
||
| 75 | 76 |
1C6B6BAC2A2D4F5100A0B001 /* UM34C Manual Working Summary.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = "UM34C Manual Working Summary.md"; sourceTree = "<group>"; };
|
| 76 | 77 |
1C6B6BAD2A2D4F5100A0B001 /* UM25 Manual Working Summary.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = "UM25 Manual Working Summary.md"; sourceTree = "<group>"; };
|
| 77 | 78 |
1C6B6BAE2A2D4F5100A0B001 /* TC66 Manuals Working Summary.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = "TC66 Manuals Working Summary.md"; sourceTree = "<group>"; };
|
| 79 |
+ 1C6B6BB12A2D4F5100A0B001 /* PW0316 BLE Module Working Summary.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = "PW0316 BLE Module Working Summary.md"; sourceTree = "<group>"; };
|
|
| 78 | 80 |
1C6B6B932A2D4F5100A0B001 /* Payload Notes README.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = README.md; sourceTree = "<group>"; };
|
| 79 | 81 |
1C6B6B962A2D4F5100A0B001 /* UM24C-UM25C-UM34C from floriandotorg-um24c.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = "UM24C-UM25C-UM34C from floriandotorg-um24c.md"; sourceTree = "<group>"; };
|
| 80 | 82 |
1C6B6BAF2A2D4F5100A0B001 /* TC66C Transport and Payload Working Note.md */ = {isa = PBXFileReference; lastKnownFileType = net.daringfireball.markdown; path = "TC66C Transport and Payload Working Note.md"; sourceTree = "<group>"; };
|
@@ -169,6 +171,7 @@ |
||
| 169 | 171 |
1C6B6BA62A2D4F5100A0B001 /* User Maual for Operation and PC software and APP of TC66(C) Type-c USB PD Trigger Meter 2019.6.5.pdf */, |
| 170 | 172 |
1C6B6BAB2A2D4F5100A0B001 /* User_Manual_UM34C.pdf */, |
| 171 | 173 |
1C6B6BAA2A2D4F5100A0B001 /* UM25 User Manual.pdf */, |
| 174 |
+ 1C6B6BB02A2D4F5100A0B001 /* PW0316_User_Manual_V2.9.pdf */, |
|
| 172 | 175 |
); |
| 173 | 176 |
path = Manuals; |
| 174 | 177 |
sourceTree = "<group>"; |
@@ -182,6 +185,7 @@ |
||
| 182 | 185 |
1C6B6BAC2A2D4F5100A0B001 /* UM34C Manual Working Summary.md */, |
| 183 | 186 |
1C6B6BAD2A2D4F5100A0B001 /* UM25 Manual Working Summary.md */, |
| 184 | 187 |
1C6B6BAE2A2D4F5100A0B001 /* TC66 Manuals Working Summary.md */, |
| 188 |
+ 1C6B6BB12A2D4F5100A0B001 /* PW0316 BLE Module Working Summary.md */, |
|
| 185 | 189 |
); |
| 186 | 190 |
path = Specifications; |
| 187 | 191 |
sourceTree = "<group>"; |