Dynaclear-PL75 Touchscreen - Reverse engineering

posted by sacah on logic analyzer, howto, usbee sx, logic analyser, hack,

Other markings on the touchscreen and controller are: MicroTouch, RES-15.0-PL8, 95409 D, TDP#3169, 060304C0338, SR-12-8W-232, ETP-PB-031C-0349



I was given a touchscreen that had a dead LCD, but the touchscreen part still worked. I didn't have any drivers or manuals for it, so tried searching for part numbers. I found this was a Dynaclear-PL75, whose website goes to 3M with no further references.

The touchscreen has a ribbon cable leading to 8wires that connect to a small PCB. At the other end of the PCB is 5wires, in 2 groups. 2wires go to a plug, they are Red and Black so I assume power. The other 3 wires go to a 8pin connector, which I know plugged into the serial port on the motherboard of the computer it use to work with. These cables are Red, Brown and Black.



I plug the 2wire power plug into my breadboard and hook up my Dick Smith power adaptor set to 3V. I connect the Ground of my USBee Logic Analyser to the ground on my breadboard, then I connect channels 1-3 to the 3wire group(Red, Brown, Black).



While I'd assume this is 3wire serial communication, so Red/Brown are Tx/Rx and Black is ground, I'm not sure. I power the touchscreen on, start recording on the USBee Suite and press around on the touchscreen.
Once the recording stops, there are no signals detected.

So I change the power supply to 5V, start recording again and push the touchscreen, this time I notice a small green LED lights each time I press the touchscreen, which is encouraging. Once the recording stops there are signals on 1 of the wires.



Figuring this is Async I setup a decoder for it and view the decoded info. I get 0x81 at the start of a 5byte signal, which I'm pretty sure if serial.

I start recording again, and press the screen in a pattern, as shown.



One the decoding finished, I find there are 4 distinct signal groups.



Each group has almost the same pattern in it, so the touchscreen is sending the location even when your finger is held down.

Each group has the following signals:
1. 0x81 0x00 0x5C 0x0F 0x11
2. 0x81 0x0F 0x27 0x0E 0x3F
3. 0x81 0x0F 0x46 0x00 0x69
4. 0x81 0x00 0x79 0x01 0x1E

0x81 is start byte, so guessing remaining 4 bytes are x and y coordinates. Converting to Decimal brings:
1. 92, 3857
2. 3879, 3647
3. 3910, 105
4. 121, 286

So there we have it, educated guess x and y are 0 to 4000. I plan on hooking this up to a linux machine, so I'll release source code once that's done to assist anyone else wanting to do something similar.

If anything is wrong here let me know, I'm just a hobbyist at this stuff.