Home/
GPS/
Trimble/
Trimble 4000 GPS Receiver Resources/Trimble 4000 Protocol
4000 Series Undocumented Serial Commands
Undocumented Normal Mode Commands
The documented commands can be found in the: 4000SE/SSE/SSi RS-232 Interface/Data Collector Format Specification Manual
0x80 - Switch to 4000A/S Compatible Mode
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x80 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | ACK | 0x06 |
0x87 - Mode Change
This switches the receiver into monitor mode. The commands for monitor mode are different than those used in normal mode, and are documented later in this document.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x87 |
| 3 | Length | 1 |
| 4 | | 0x57 |
| 5 | Checksum | computed |
| 6 | ETX | 0x03 |
It can take a few seconds for the monitor to start. When the receiver enters monitor mode, the baud rate defaults back to 9600-N-8-1. A good practice is to switch to monitor mode, reconfigure the computer serial port to 9600-N-8-1, then periodically poll the port with ENQ requests until an ACK is received. When this happens, the monitor is ready.
Reply
| Byte | Description | Value |
|---|
| 0 | ACK | 0x06 |
Monitor Mode Commands
There are 10 monitor mode commands implemented in the monitor program.
0x80 - Write Memory
Command
NOTE: The format of the address is neither big-endian nor little-endian. It feels like there was a bug that went un-noticed, that then made it into the ROM of the PPU and they were stuck with it. The order is a little endian combo of big endian words.
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x80 |
| 3 | Length | length of data+4 |
| 4 | Address | Address 15:8 |
| 5 | Address 7:0 |
| 6 | Address 31:24 |
| 7 | Address 23:16 |
| 8-n | Data | data |
| n+1 | Checksum | computed |
| n+2 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | ACK | 0x06 |
0x81 - Ignored
This command packet is ignored and produces no response.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x81 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
Reply
No reply is sent.
0x82 - Read Memory
NOTE: The format of the address is regular big endian, unlike the write command.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x82 |
| 3 | Length | 5 |
| 4 | Address | Address 31:24 |
| 5 | Address 23:16 |
| 6 | Address 15:8 |
| 7 | Address 7:0 |
| 8 | Length | Number of bytes to read |
| n+1 | Checksum | computed |
| n+2 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x92 |
| 3 | Length | length of data+4 |
| 4 | Address | Address 31:24 |
| 5 | Address 23:16 |
| 6 | Address 15:8 |
| 7 | Address 7:0 |
| 8-n | Data | data |
| n+1 | Checksum | computed |
| n+2 | ETX | 0x03 |
0x83 - ACK ping
This command does nothing, then returns an ACK.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x83 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | ACK | 0x06 |
0x84 - ?
This command does nothing, then returns 4 zero bytes.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x84 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x94 |
| 3 | Length | 4 |
| 4 | | 0 |
| 5 | | 0 |
| 6 | | 0 |
| 7 | | 0 |
| 8 | Checksum | computed |
| 9 | ETX | 0x03 |
0x85 - ?
This command does nothing, then returns 9 zero bytes.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x85 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x95 |
| 3 | Length | 9 |
| 4 | | 0 |
| 5 | | 0 |
| 6 | | 0 |
| 7 | | 0 |
| 8 | | 0 |
| 9 | | 0 |
| 10 | | 0 |
| 11 | | 0 |
| 12 | | 0 |
| 13 | Checksum | computed |
| 14 | ETX | 0x03 |
0x86 - Set Baud Rate
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x86 |
| 3 | Length | 1 |
| 4 | Data | Baud Rate (see table below) |
| 5 | Checksum | computed |
| 6 | ETX | 0x03 |
Known Values for BAUD, from page 80 of the MC68332 Technical Summary:
| Value | Rate |
|---|
| 0xDA | 2400 |
| 0x6D | 4800 |
| 0x37 | 9600 |
| 0x1B | 19200 |
| 0x0E | 38400 |
Reply
| Byte | Description | Value |
|---|
| 0 | ACK | 0x06 |
0x87 - Backspace Ping
This command doesn't do anything, but it responds in a non-standard way, returning a single byte, 0x08, rather than a properly structured STX/ETX packet.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x87 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
Reply
| Byte | Description | Value |
|---|
| 0 | | 0x08 |
0x88 - Reset Receiver
This exits the ROM monitor and resets the CPU. Because it resets the CPU, no response is sent.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x88 |
| 3 | Length | 0 |
| 4 | Checksum | computed |
| 5 | ETX | 0x03 |
0x89 - Jump
This causes the ROM monitor to jump to the given address. Because it jumps out of the monitor, no response is sent. I suspect there are debug routines at known addresses that are used with this functionality.
Command
| Byte | Description | Value |
|---|
| 0 | STX | 0x02 |
| 1 | Status | 0x00 |
| 2 | Command | 0x89 |
| 3 | Length | 4 |
| 4 |
Data |
Address (Big Endian) |
| 5 |
| 6 |
| 7 |
| 8 | Checksum | computed |
| 9 | ETX | 0x03 |