Ateq Protocol Reverse Engineering

ateq.md

A teq g520 serial port request/response reverse engineering

Get status

->

255 003 000 048 000 037 145 192

<-

255 003 074 000 000 000 000 001 000 032 128 255 255 056 074 000   
000 112 023 000 000 120 005 000 000 056 199 000 000 244 001 000   
000 066 000 000 000 000 000 050 000 000 000 000 000 051 000 000   
000 000 000 000 000 000 000 000 000 127 000 056 199 000 000 060   
000 160 134 001 000 000 000 000 000 000 000 020 000 238 032

bytes:

• 1 - 3 Command
• 10 Test result: Ok = 33, Fail = 34, Break = 40
• 12 - 13 Run mode step, default = 255 255 (-1)
• 14 - 17 Pressure value
• 18 - 19 Pressure unit (MPa = 152 58, Pa = 112 23, kPa = 224 46, bar = 248 42, mBar = 176 54, kpi = 200 50)
• 22 - 25 Flow value
• 26 - 27 Flow unit (056 199 – ml/min, 032 203 – ml/h)

Change program

->

255 016 002 000 000 001 002 xxx xxx yyy yyy

xxx xxx - program number (0 0 = 1, 1 0 = 2) yyy yyy - Modbus RTU CRC 16

Run program

->

255 005 000 001 255 000 200 036

Reset

-> few times

255 005 000 000 255 000 153 228

Modbus RTU CRC 16

unsigned int CRC16_2(unsigned char *buf, int len)
{  
  unsigned int crc = 0xFFFF;
  for (int pos = 0; pos < len; pos++)
  {
  crc ^= (unsigned int)buf[pos];    // XOR byte into least sig. byte of crc

  for (int i = 8; i != 0; i--) {    // Loop over each bit
    if ((crc & 0x0001) != 0) {      // If the LSB is set
      crc >>= 1;                    // Shift right and XOR 0xA001
      crc ^= 0xA001;
    }
    else                            // Else LSB is not set
      crc >>= 1;                    // Just shift right
    }
  }

  return crc;
}