Peek inside UNI-T UT390B+

Last night I spent ages getting nowhere. Software serial on an Arduino Uno connected to TxD and RxD got nowhere.

My only small consolation was that I found the 4 pads near the keypad FFC/ZIF connector on the main PCB were actually breakouts of the buttons and have a pull up resistor on them. When a button was pressed, the line is pulled low. This means it would be easy to remove the keypad and send logic level button presses from a microcontroller. Others have discussed intercepting the LCD display data stream to extract the digital readings if some form of serial communication can't be established.

The pads that are visible from the battery compartment are still intriguing - why would useless pads be designed into both the PCB underneath AND the enclosure moulding? There's too much coincidence to write them off yet. Others think they've characterised the 5 pads as including VCC, GND and Reset/reboot, with two strange pads remaining.

One of these is pulled high and the other is pulled low. Does anyone know of an electrical communication protocol which has these characteristics at rest? Perhaps an industrial protocol designed for long wire transmission distances, with a balanced signal, such as RS485 uses.

An idea I've had today is that the sine wave might not be the input to the laser driver and there's a small (but hopeful) chance that it's a feed from the laser receiver into the main STM32F controller. I'll see if I can find out more later.

Hi, I hope the mere initialisation of this project will encourage people to share what they know about the UT390B+. It's cheaper than the UT390B so if it can be hacked for microcontroller communication, there would probably be plenty of people keen to use it. All dismantling of your devices is at your own risk!

Firstly, take of the battery compartment to get right inside. There is one screw visible, one under a QC sticker inside the battery bay and one under the laser hazard sticker on the back of the UT390B+ (which by now should be facing you, just above the battery compartment. Remove the stickers and take all three screws out.

Now I wasn't sure how to separate the enclosure pieces but it appears that the front and back are still held together once the screws have been moved by a firm press-fit grey plastic band all round the optics at the front of the UT390B+. I pulled the two halves apart and the front ring suddenly popped off unharmed. I can't really see a less risky (of breaking the grey ring) way of doing this.

Inside is a flat flex cable from the main PCB (mounted in the back half of the case) to the button pcb (mounted in the front half). This was instantly pulled out of the ZIF connector on the button PCB when the two halves snapped apart but it looks unharmed.

We can now see the main processor (looks to be STM32F 030CBT6 - not sure how many digits on the chip are required to ID), the screen, piezo buzzer, laser diode and laser optics. The laser optics looks like a large (10-15mm) lens with two smaller lenses moulded into one side of it. I hope someone can determine which method of ranging this device uses (I know that's been asked over at Instructables).

If we remove the PCB (two small screws), only the two power wires are connecting it to the case. Look underneath and there are the five pads which are visible in the battery bay and two prominent pads labelled (tantalisingly) RxD and TxD. Unfortunately, they don't appear to be recognisable serial contacts.

Not far from the RxD and TxD pins is a single via which goes all the way through. My cheapo DSO138 oscilloscope showed a nice sine wave off this pin when the laser was firing. Maybe that'll help those wondering what method this device uses to determine distance.

More soon, including pictures. Please get involved if you have a UT390B+ and have ideas about getting the external comms working.