This is a great drafting table. The active surface is relativly large (34"×28") and the resoltion is high (1000 points/inch). The input is provides by a lightweight, wireless stylus which almost feels like a regular pen. This makes it perfect for designers and architects.

When we started, we had only one NT system working with this table. We needed to connect the table to a more recent OS (Windows XP or Vista), but unfortunately we had no documentation, no drivers, and no source code. The table uses a regular DB 9 serial port. When we connected a serial breakout box we realized that we need all 7 connections - GND, TxD, RxD, RTS, CTS, DTR, and DSR. DCD and RI are not used.

Looking at the hex output of the table, we quickly realized that all data is send in packages and each package has the same amount of data. A package starts with a byte, which highest bit is set. All subsequent bytes have the highest bit is not set. This provides a good error correction, because it is easy to find out, if a byte was dropped or if the baud rate is set wrong (which means we would receive garbage).

The X and Y coordinates are sent in 16 bit (0 - 65535). The table has 1000 points/inch, which means the biggest supported surface is 65"×65". All other properties are sent with 7 bit precision. The angle is signed (-63 - 63) and the pressure and distance is unsigned (0 - 127)

We also realized that the table works in two different modes, which we called the slow mode and the fast mode.

By default (after a power cycle) the table is in the slow mode. All data is sent 9600/8-N-1 and we receive 6 bytes with each package. The data is just the bare minimum - the button status and the X and Y coordinates.

The NT system switches the table in the fast mode - we do not know how yet. All data is sent 19200/8-N-1 and we receive 10 bytes with each package. Additionally to the previous information, the table sends also the angle in X and Y, the pressure, and the distance between the tip and the table.

The Slow Mode

Data structure in slow mode.

Byte Bits
7 6 5 4 3 2 1 0
0
1
?
?
B3
B2
B1
PosX<15:14>
1
0
PosX<13:7>
2
0
PosX<6:0>
3
0
?
?
?
?
?
PosY<15:14>
4
0
PosY<13:7>
5
0
PosY<6:0>

The Fast Mode

Data structure in fast mode.

Byte Bits
7 6 5 4 3 2 1 0
0
1
?
?
B3
B2
B1
PosX<15:14>
1
0
PosX<13:7>
2
0
PosX<6:0>
3
0
?
?
?
?
?
PosY<15:14>
4
0
PosY<13:7>
5
0
PosY<6:0>
6
0
AngleX<6:0>
7
0
AngleY<6:0>
8
0
Pressure<6:0>
9
0
Distance<6:0>

Interpretation

It is pretty simple to get the information out of the fields

  b1 = (buffer[0] & 0x04) > 0;
  b2 = (buffer[0] & 0x08) > 0;
  b3 = (buffer[0] & 0x10) > 0;
  x = (buffer[0] & 0x03) << 14 | buffer[1] << 7 | buffer[2];
  y = (buffer[3] & 0x03) << 14 | buffer[4] << 7 | buffer[5];

The reverse engineering of the table protocol required that we had to intercept the serial communication. This was more complicated, because the communication starts slow (9600/8-N-1) and becomes faster (19200/8-N-1) later on. We needed to construct a full RS232 sniffer (like the one from Lammert Bies), but instead of using a Hyper Terminal we had to use Logic Analyzer. We found an inexpensive one from Saleae. Unfortunately, all Logic Analyzers cannot work with the serial port voltage (-15V - 15V) and we had to do some level shifting.

Electronic Components

We used a DB9 Dual Breakout Board from Winford. This allows us to connect the table to the computer and also have direct access to all the pins

We got two RS232 Shifter from SparkFun. One MAX232 would have done the same, but this was already build. We need two, because we have to convert the TxD and the RxD.

The shifters need 5V regulated power, so we bought a Breadboard Power Supply from SparkFun and used a regular 9V wall wart.