4

I recently bought a Tacx Flow trainer, which has a handlebar computer, with a 6channel RJ-11 cable between the trainer and the handlebar computer. The computer reads pedal frequency, power and speed, and is also able to adjust the trainer's brake -- thus two-way communication.

I have little to no experience in electrical engineering, but I thought I would buy a logic analyzer to see what I could find.

I think I managed to infer the GND and PWR (the computer gets power from this cable), and saw some patterns possibly related to speed and pedal frequency in two of the four lines (the two other lines were regular beats, and irregular, tiny signals).

I could not think of a way to progress further. Is this just impossible for a beginner to do?

meastp
  • 141
  • 2
  • The Tacx Fortius trainer has been reverse-engineered here: http://code.google.com/p/fortius/ Maybe the Flow was designed by the same people and would work similarly? The code is worth a look. – markrages Mar 27 '12 at 03:02

4 Answers4

4

I would start by looking at the PCB for the driver chips that are used (RS232? RS485? TTL? analog?). This gives a first clue how to look at the signals.

It won't hurt to have some idea of how an asynch serial, I2C, SPI, etc signal might look like. Google is (of course) your friend.

You could try to vary the inputs (speed, power, etc) to see what changes in the signals.

From a designer point of view, I would imagine how I would build such a system (or how others have done it) and check whether it's done the same way here. I would probably use a dynamo-like thing in the wheel-blob and do all processing in the display unit. (Which would make it very hard for you to interpret the signals).

Mark Omo
  • 528
  • 6
  • 22
Wouter van Ooijen
  • 48,572
  • 1
  • 63
  • 136
2

The regular beats are probably clock signals. Look at the irregular signals with reference to the clock. Most systems will sample the data lines (the irregular signals) when the clock is either changing, high or low.

Try and send some fixed signal (pressing a button or something repeatable) and looking for a predictable pattern.

Toby Jaffey
  • 28,836
  • 19
  • 98
  • 150
1

Take a few snapshots with the logic analyzer and note the values the display shows when or shortly after you take them.

First try to find a packet structure.

Take a look at how serial communication works, especially asynchronous serial communication as it is the simplest possible solution.

Look at the packets for regularities and differences, and whether you find the values (maybe scaled by some factor). It helps if you can vary only one parameter and keep all others the same, but that may be difficult in this case.

There may also be a checksum/CRC that varies whenever anything in the packet changes.

It helps to be patient (I mostly use pen and paper to analyze the data). And if at first you don't succeed try something else.

starblue
  • 6,502
  • 2
  • 23
  • 36
1

An old topic, but I had a go with an oscilloscope and the tacx flow, and from what I can tell you get 3.3V, GND, a 3.3V pulse length that varies with the speed of the flywheel, one pin that is 3.3V and pulled down when the cadence sensor/reed relay is triggered. Then one pin with +- 16V AC with a 50hz period (I guess for calibration for the mains unit) and one which either is for powering the head unit or for communicating from the head unit to the flywheel unit. I didn't really care to investigate further since my goal was to intercept any digital communication which could tell me what power level I was currently inputting..

So..analog stuff and if you don't want to do the processing yourself, just buy another trainer. The Fortius/genius ones from tacx seems nicer..

Since this is the nr1 post (out of 1 or 2) when googling Tacx flow reverse engineering, I thought I would add my conclusions. Cheers. :-)

Henrik
  • 11
  • 2