olympus ix81 and reverse engineering, beta testers

classic Classic list List threaded Threaded
4 messages Options
mahogny mahogny
Reply | Threaded
Open this post in threaded view
|

olympus ix81 and reverse engineering, beta testers

we've acquired some new equipment at our facility, including an olympus
ix81. unfortunately olympus happens to be one of those few companies
left that still refuse to give out protocol specifications, unless with
some effort you manage to sign an NDA. the problem with the NDA is that
we want to share the code so others can repeat our experiments. I've
told this to a salesperson at olympus but still no reply; it would be
nice if others also could point out that the investment is at jeopardy
without this kind of information. for example, the now hyped feature of
creating mosaic images is a one-hour programming exercise with proper
documentation. or you go out and buy yet another limited software
package, for money that could have been spent better (if there is one
that works with your hardware).

anyway, we had a small team sit down for two hours and reverse engineer
the stand, with legal precautions. most of it is done and attached.
we're looking for beta testers since I know there are related models,
ix71 & ix91, maybe more, and it would be nice if compatibility could be
confirmed. send me a private mail in that case. to see if it works, just
use the Hyper Terminal in windows, with the attached commands. if you
have signed an NDA you can for legal reasons not participate.

want to try reverse engineering? if you run windows and the equipment
has a parallel or serial interface then it's trivial. you can use for
example portmon
(http://technet.microsoft.com/en-us/sysinternals/bb896644.aspx). to be
legally safe you should have 3 teams; one analyzing the hardware and
writing a specification, one which implements the specification, and one
that tests the implementation. sometimes it's possible with fewer.

happy hacking!

/Johan

--
--
------------------------------------------------
Johan Henriksson
MSc Engineering
PhD student, Karolinska Institutet
http://mahogny.areta.org http://www.endrov.net



Olympus IX81 microscope stand
=====================================================

These commands have been obtained by using "Portmon for Windows v3.02",
logging the traffic from bundled software.

Commands are sent over a serial cable.
Each command is ended by CR LF (0x0d 0x0a)
Command is separated by arguments by a single space.

Replies might not need not arrive in order, it seems the
stand supports event driven programming as opposed to polling.
Replies can be sent without a query if status changes.

Serial port mode
================
baud: 19200
StopBits: ERROR Parity: EVEN WordLength: 8
EOF:0 ERR:0 BRK:0 EVT:a XON:11 XOFF:13
Shake:80000008 Replace:80 XonLimit:2048 XoffLimit:512

Querying value
==============
If a command has name CMD then a status query can be sent as
  'CMD?'
whereby the stand will reply
  'CMD xxx'                  
where xxx is the value.

Setting value
=============
if CMD is the command then write
  'CMD xxx'
where xxx is the value.

Undetermined value
==================
It seems the stand can reply + as the argument, meaning
"currently not determined", while state is being changed.

Command list
=======================

# is used whenever something needs confirmation

==Shutter 1
command: 1SHUT1
observed argument: IN OUT

==Shutter 2
command: 1SHUT2
observed argument: IN OUT

==#mirror unit
command: 1MU
observed argument: 3 5 +(read)
polled a lot
maybe related to objective change

==objective
command: 1OB
observed argument: 2 3 +(read)

==Lamp source
command: 1LMPSEL
observed argument: DIA
probably selection of which light source to have turned on.
#EPI might be another argument

==#Lamp intensity
command: 1LMP
observed argument: 0

==Condenser selection
command: 1CD
observed argument: 5

==Prism selection
command: 1PRISM
observed argument: 1 2 +(read)
        1=eye piece
        2=side i.e. camera
        (need confirmation)

==#autofocus
command: 2AFSTS
observed argument: OFF

==#jog dial sensitivity
command: 2JOGSNS
observed argument: 9 +(read)

==#movement, relative?
command: 2MOV
observed written arg: F,3000000
observed written arg: N,600000
observed read arg: !,E02412

==#absolute position Z
command: 2POS
observed argument: 610000 598625 10000


========= todo

need to check for a version command to allow plug and play

====================== additional log, setting 20x ============

0.00000148      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 11: 2JOGSNS +..
0.00002462      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 2POS?..
0.00000131      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 13: 2POS 610000..
0.00002384      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 2POS?..
0.00000129      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 13: 2POS 610000..
0.00817574      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 16: 2MOV F,3000000..
0.00000244      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 15: 2MOV !,E02412..
0.00002848      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 1OB 2..
0.00000249      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 7: 1OB +..
0.00002955      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 2POS?..
0.00000143      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 12: 2POS 10000..
0.00817658      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 15: 2MOV N,600000..

Shalin Mehta Shalin Mehta
Reply | Threaded
Open this post in threaded view
|

Re: olympus ix81 and reverse engineering, beta testers

Hello Johan,

 Bold step!

I have seen these commands myself using Portmon. I am in a similar situation with BX51 scope (which uses same command set with a universal controller). My first choice was to try to do a device adapter for micromanager, but Nico informed me that Olympus's NDA policy  has prevented Olympus scopes being supported in an open source environment. Interestingly, Olympus or NI provides labview driver (olxx2 library) http://sine.ni.com/apps/utf8/niid_web_display.model_page?p_model_id=2468 for IX/BX series scopes. I have been using them to develope labview VIs that allow me to do automation that I need. Notably, some of the library drivers are broken (e.g. login command), but were easy to fix with help of information gleaned from portmon. Also note that the commands are visible in plain text inside the library.

We were provided the NDA by local olympus rep, but have not yet signed it because of the dilemma of development effort turning out to be of little value.  Can you elaborate more on/off list about the legal status of the approach that you have suggested? Is reverse engineering OK if one hasn't signed NDA?  If there is zero chance of being jailed, I will be happy to join you in this effort :)

Any voices from Olympus?

To those at Olympus on this list (who are in position to take decisions about this NDA policy), is there a way of changing the situation quickly?  Why not just post the command set on Olympus website?

Once the hardware is paid for, it is particularly frustrating for the user not to be able to control it according to his needs.
The user should of course pay if he wants professional software to run their scope, but those who can (and need) should be allowed to develope their own software and share their work without limitation. Olympus scopes are really good hardware-wise (as they allow easy customization), change in this policy should make them more popular.

Those in similar situation, please lend your voice.

Best regards,
Shalin



On Sat, Oct 11, 2008 at 7:45 AM, Johan Henriksson <[hidden email]> wrote:
we've acquired some new equipment at our facility, including an olympus
ix81. unfortunately olympus happens to be one of those few companies
left that still refuse to give out protocol specifications, unless with
some effort you manage to sign an NDA. the problem with the NDA is that
we want to share the code so others can repeat our experiments. I've
told this to a salesperson at olympus but still no reply; it would be
nice if others also could point out that the investment is at jeopardy
without this kind of information. for example, the now hyped feature of
creating mosaic images is a one-hour programming exercise with proper
documentation. or you go out and buy yet another limited software
package, for money that could have been spent better (if there is one
that works with your hardware).

anyway, we had a small team sit down for two hours and reverse engineer
the stand, with legal precautions. most of it is done and attached.
we're looking for beta testers since I know there are related models,
ix71 & ix91, maybe more, and it would be nice if compatibility could be
confirmed. send me a private mail in that case. to see if it works, just
use the Hyper Terminal in windows, with the attached commands. if you
have signed an NDA you can for legal reasons not participate.

want to try reverse engineering? if you run windows and the equipment
has a parallel or serial interface then it's trivial. you can use for
example portmon
(http://technet.microsoft.com/en-us/sysinternals/bb896644.aspx). to be
legally safe you should have 3 teams; one analyzing the hardware and
writing a specification, one which implements the specification, and one
that tests the implementation. sometimes it's possible with fewer.

happy hacking!

/Johan

--
--
------------------------------------------------
Johan Henriksson
MSc Engineering
PhD student, Karolinska Institutet
http://mahogny.areta.org http://www.endrov.net



Olympus IX81 microscope stand
=====================================================

These commands have been obtained by using "Portmon for Windows v3.02",
logging the traffic from bundled software.

Commands are sent over a serial cable.
Each command is ended by CR LF (0x0d 0x0a)
Command is separated by arguments by a single space.

Replies might not need not arrive in order, it seems the
stand supports event driven programming as opposed to polling.
Replies can be sent without a query if status changes.

Serial port mode
================
baud: 19200
StopBits: ERROR Parity: EVEN WordLength: 8
EOF:0 ERR:0 BRK:0 EVT:a XON:11 XOFF:13
Shake:80000008 Replace:80 XonLimit:2048 XoffLimit:512

Querying value
==============
If a command has name CMD then a status query can be sent as
 'CMD?'
whereby the stand will reply
 'CMD xxx'
where xxx is the value.

Setting value
=============
if CMD is the command then write
 'CMD xxx'
where xxx is the value.

Undetermined value
==================
It seems the stand can reply + as the argument, meaning
"currently not determined", while state is being changed.

Command list
=======================

# is used whenever something needs confirmation

==Shutter 1
command: 1SHUT1
observed argument: IN OUT

==Shutter 2
command: 1SHUT2
observed argument: IN OUT

==#mirror unit
command: 1MU
observed argument: 3 5 +(read)
polled a lot
maybe related to objective change

==objective
command: 1OB
observed argument: 2 3 +(read)

==Lamp source
command: 1LMPSEL
observed argument: DIA
probably selection of which light source to have turned on.
#EPI might be another argument

==#Lamp intensity
command: 1LMP
observed argument: 0

==Condenser selection
command: 1CD
observed argument: 5

==Prism selection
command: 1PRISM
observed argument: 1 2 +(read)
       1=eye piece
       2=side i.e. camera
       (need confirmation)

==#autofocus
command: 2AFSTS
observed argument: OFF

==#jog dial sensitivity
command: 2JOGSNS
observed argument: 9 +(read)

==#movement, relative?
command: 2MOV
observed written arg: F,3000000
observed written arg: N,600000
observed read arg: !,E02412

==#absolute position Z
command: 2POS
observed argument: 610000 598625 10000


========= todo

need to check for a version command to allow plug and play

====================== additional log, setting 20x ============

0.00000148      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 11: 2JOGSNS +..
0.00002462      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 2POS?..
0.00000131      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 13: 2POS 610000..
0.00002384      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 2POS?..
0.00000129      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 13: 2POS 610000..
0.00817574      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 16: 2MOV F,3000000..
0.00000244      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 15: 2MOV !,E02412..
0.00002848      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 1OB 2..
0.00000249      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 7: 1OB +..
0.00002955      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 7: 2POS?..
0.00000143      ANDOR iQ.exe    IRP_MJ_READ     Serial0 SUCCESS Length 12: 2POS 10000..
0.00817658      ANDOR iQ.exe    IRP_MJ_WRITE    Serial0 SUCCESS Length 15: 2MOV N,600000..




mahogny mahogny
Reply | Threaded
Open this post in threaded view
|

Re: olympus ix81 and reverse engineering, beta testers

Shalin Mehta wrote:

> Hello Johan,
>
>  Bold step!
>
> I have seen these commands myself using Portmon. I am in a similar situation
> with BX51 scope (which uses same command set with a universal controller).
> My first choice was to try to do a device adapter for micromanager, but Nico
> informed me that Olympus's NDA policy  has prevented Olympus scopes being
> supported in an open source environment. Interestingly, Olympus or NI
> provides labview driver (olxx2 library)
>  
yes, my next step is to have the spec implemented in micro-manager.
since we reverse engineered, the NDA will not stop it, politics might.

> We were provided the NDA by local olympus rep, but have not yet signed it
> because of the dilemma of development effort turning out to be of little
> value.  Can you elaborate more on/off list about the legal status of the
> approach that you have suggested? Is reverse engineering OK if one hasn't
> signed NDA?  If there is zero chance of being jailed, I will be happy to
> join you in this effort :)
>  
there is good literature, I got my hands on "Intellectual property and
open source" by Van Lindberg. the legal status is determined by prior
reverse engineering attempts. there are many success stories, for
example compaq and phoenix reverse engineering the PC so you don't have
to buy it from IBM. NEC took their cpu from Intel. accolade took the
entire code protection system from sega when replicating a console, etc.

reverse engineering is a procedure to avoid *copyright issues*. the NDA
makes reverse engineering impossible by disallowing information
exchange, traded for access to the system. reverse engingeering does not
protect from patents. which copyright might you infringe? since we're
not disassembling the hardware there is no way we could infringe on
Olympus copyright. then we have the bundled software, not from olympus
in our case, in theory it might have a "personality" in the way it
issues commands. this software polls plentiful, if we copy this and it
is not required behaviour it might be considered a copyright breach. so
really, we're a bystander between two publicly discussing entities.
still, it might be a good time to be paranoid, in the highly theoretical
case Olympus would sue (and effectively remove themselves from the
microscope market).

you want two teams at minimum, the dirty and clean. the dirty team is
allowed to disassemble the code and the hardware, essentially do
anything that could infringe a copyright had them let out an
implementation that might be influenced by how the product is
implemented. the idea is to "wash" these from any influence by having
them pass on the minimal spec to the clean team. these can based on the
specification happily implement and release the code.

my book lists 2 additional teams:
* the evaluation team that checks the spec in-between to remove
lingering unnecessary details.
* the testing team, which in less sensitive cases can be the evaluation
team, just reports if it works.
I find the eval team overkill here since the spec is so small, the dirty
team should be able to clean it up themselves

one additional note on copyright: not everything is copyrightable.
functional elements, things that are the only possible means of doing a
certain thing, cannot be copyrighted. so there is no way you can
copyright an OS-call or a for-loop. neither should you be able to
copyright the code to send out a command to the microscope, the code is
dictated by the format of the command.

in short, I think we are legally safe if we just monitor the connection
(IANAL), we are politically safe since the companies will earn tons of
badwill if they start suing customers, and we can be provably legally
safe through standard reverse engineering practices.

/Johan

--
--
------------------------------------------------
Johan Henriksson
MSc Engineering
PhD student, Karolinska Institutet
http://mahogny.areta.org http://www.endrov.net
Martin Wessendorf-2 Martin Wessendorf-2
Reply | Threaded
Open this post in threaded view
|

Re: olympus ix81 and reverse engineering, beta testers

Johan Henriksson wrote:

> in short, I think we are legally safe if we just monitor the connection
> (IANAL), we are politically safe since the companies will earn tons of
> badwill if they start suing customers, and we can be provably legally
> safe through standard reverse engineering practices.

Back when Molecular Dynamics held the patent on using a computer to
manipulate confocal datasets, they informed anyone (including, as I
understand it, Wayne Rasband of NIH-Image and ImageJ) who wrote programs
that manipulated confocal datasets that they were infringing their
patent.  And they HAD to do so, in order to show to the courts that they
were not giving away their rights.

I'm not sure of the details of copyright vs. patent law, but if
Olympus's lawyers think you're infringing, I would expect them to say so.

Martin

--
Martin Wessendorf, PhD   (612) 626 0145 (office)
Associate Professor      (612) 624 2991 (lab)
Dept Neuroscience      (612) 624 8118 (FAX)
Univ Minnesota        e-mail: martinw(at)umn.edu