how to remove the electronic lead from the Paslode Impulse gas stapler
A couple of weeks ago, an old acquaintance approached me who is engaged in carpentry – he builds houses, household buildings, stairs, furniture and other useful country utensils from wood. In this matter, he is helped, it would be more correct to say “helped” (and now I hope he will help again) by a wonderful tool – a manual gas nailer Paslode Impulse IM100Ci made in France. This tool is a percussion mechanism equipped with a combustion chamber in which spark ignition and detonation of the gas mixture occurs; the combustion products forcefully push out the piston, hitting the nail with the striker and it enters the board with a whistle. The whole process, of course, is controlled electronically. The tool is very compact, lightweight, designed for work at heights and has adaptation to ambient temperature (can work at -20C and below).
But this tool has one unpleasant feature – gas canisters (regular “natural gas” – a propane-butane mixture) are equipped with an RFID tag of the NFC standard. A counter of “shots” is recorded in one of the memory cells of this tag. In total, the manufacturer allows you to fire no more than 1250 shots from one can. Gas canisters were supplied only by the official distributor for a considerable 100+ EURO, and with the introduction of sanctions, the official supply channel was closed and the price tag for them increased significantly, which made this tool practically unsuitable for use. Of course, this state of affairs greatly upset my friend and he turned to me with a question: is it possible to somehow… wean the instrument from this completely immoral attachment to the manufacturer, because filling a can with gas is not difficult and costs only 50 rubles! After spending one free weekend working on instruments in our laboratory, we came to the conclusion that it is possible, and it is not at all difficult to do.
Link to article in PDF format.
“Electronic hammer” from the inside
And so, this is what we saw after unscrewing a dozen Torx screws and removing the cover of this product. The product contains two printed circuit boards with electronic filling – one in the “magazine” part of the tool, the other in the handle. Both boards are immersed in a “glass” and filled with a hard compound – it’s immediately obvious that the developers tried in every possible way to complicate the work of anyone who tries to get inside their product (what about the “right to repair”, I briefly thought). In addition to two boards, the following were found in the product: two digital (PWM) buttons – one operates on the shutter position, the second on the trigger (trigger); custom LiON battery at 7.2 nominal volts; solenoid valve (solenoid); a can of gas, and a ring-shaped RFID antenna in the center of which enters the upper (plastic) part of the can containing an RFID tag. In the compartment with the combustion chamber there is a nozzle, and on the back cover of the chamber there is a fan for supplying the gas mixture and removing combustion products and a spark plug.
Power from the battery is supplied to the first board, located in the “magazine” part of the tool, and the valve solenoid and RFID antenna are connected to it. Two digital buttons, a fan and a candle are connected to the second board (in the handle), and both boards are connected to each other by a four-wire communication line.
Operating principle of the “electronic hammer”
In general terms, the operating principle of this nailing tool can be described as follows:
The tool is prepared for work: a gas cylinder, a piece of tape with nails and a charged battery are installed in it, which is moved to the working position (inserted all the way).
The operator places the “barrel” of the tool against the board and presses it, thereby cocking the shutter mechanism, the combustion chamber closes and the first button is activated, the signal of which causes the gas valve to briefly open (approximately 14ms), gas enters the combustion chamber and at the same time starts fan for mixing gas with air.
The next moment the operator presses the trigger (second button), a spark is given and detonation occurs, the piston hits the striker with force, which rests on the nail and the nail goes into the board.
After detonation, the chamber opens and exhaust gases (combustion products) are removed from it.
To hammer in the next nail, the operator must release the pressure on the board (on the bolt), move the “barrel” to another place, lean it against the board and pull the trigger. According to the instructions, the tool can generate up to five “shots” per second, but in fact it turns out no more than two, and even in this case you have to be a very dexterous guy so as not to insert a nail where it shouldn’t.
A small lyrical digression
I am developing my own electronics and software for it and, in general, reverse engineering of electronic circuits and protocols is not part of my interests and responsibilities. I have been approached more than once with questions like “how to hack a license” or “how to reset the counter” and I immediately send such questioners on a long journey with an erotic twist. But in the case of this “electronic hammer,” something grabbed me. On the one hand, I wanted to somehow help my old comrade in his trouble – he was so strongly attached to his instrument (and as a professional it’s very easy for me to understand him), he praised the instrument itself and the manufacturer in every possible way – no match for Chinese bullshit, but here’s this manufacturer and turn to him… with your back face. And if we don’t solve the problem, then at least demonstrate the impossibility of a solution under our existing conditions. On the other hand, the continuous attempts of manufacturers around the world to tie the user to their consumables or subscriptions to useless cloud services, without which the product cannot be used normally, causes persistent disgust in almost every normal person. On this score, an article came to mind from HN two years ago by an American student who untied the dishwasher from vendor consumables and from the vendor “cloud”, thereby significantly reducing the cost of its maintenance, as a result the company (startup) immediately went bankrupt since all of it the value and business model was built only on the continuous “milking” of the owners of a very mediocre household machine. In general, I suddenly had the desire to tinker a little with the “electronic hammer”.
Finding a solution
I left the idea of reversing the RFID tag itself “for later” – this is not a simple task for me, requiring certain skills and equipment, and something told me that the product developers had laid quite a few traps along this path. Instead, my friend and I decided to study in more detail the electronic filling of the product, and first of all, find out why there are two boards in the product and what function each of them performs. These boards are connected to each other via four wires. By simply poking a multimeter with a probe, it was discovered that two of the four wires provide power (+7.2V and ground) to the second board from the first one located in the “shop” compartment, and the other two provide the digital exchange line. An analysis of the recorded oscillograms showed that these lines are used for exchange in I2C format, while the board in the handle is a “slave” and, as mentioned above, it is to this board that the RFID antenna and gas valve control solenoid are connected.
Having disconnected the antenna and tried to put the tool into operation, we found out that the tool seemed to be trying to work, but something was preventing it: the fan started and even a spark was produced, everything was as usual, but detonation did not occur. I2C exchange does not change either. After thinking a little, we made the assumption that the system does not open (block) the valve and a portion of gas does not enter the chamber. This was indirectly confirmed by the absence of a specific smell of gas, which is present during normal operation of the instrument. By hooking the oscilloscope probe to the conductors going to the valve, we were convinced that our assumption was correct. The idea immediately arose to apply the gas “manually”, but to do this it was necessary to understand what voltage was supplied to the valve and for what time interval. Logic dictated that too little gas (lean mixture) or too much could lead to either no detonation at all, or something not very good – we would damage something. In short, we connected a can with an RFID tag and measured the signal shape on the valve with an oscilloscope. It turned out that at room temperature the valve opens with full battery voltage for a time of 14 ms. It remains to figure out how to apply such an impulse to the valve, bypassing the first board.
The peculiarity of this product is that all full-scale experiments (i.e. with real detonation) should be carried out with the instrument fully assembled and the lid tightly closed, otherwise there is a chance that during detonation it will fly apart into parts and could damage someone or something – the tool is very dangerous. Therefore, it was decided to build a small-sized “knee” prototype of the bypass board device with its own microcontroller and build it inside the instrument, connecting all the wires and completely assembling the instrument. This device, upon a signal (presumably from the shutter button), will generate single pulses to the valve at a certain interval and thereby fill the combustion chamber with a gas mixture.
An ATtiny13A microcontroller in a DIP-8 package was chosen as a miniature and fairly unpretentious microcontroller, and it was decided to use the available TLP3123 solid-state relay to supply a pulse to the valve solenoid. Deputyep showed that the solenoid in the open state consumes a current of about 650 mA, which fits well with the characteristics of this relay. In general, the bypass device board was quickly assembled on a textolite breadboard and immediately programmed – fortunately, the ATtiny13A is as simple as a felt boot. The only problem that arose was where to take the control signal from, and therefore it was necessary to understand at what point in time the gas was supplied to the combustion chamber.
As we expected, gas is supplied to the combustion chamber via a button mechanically connected to the shutter, i.e., at the moment when the operator leans the tool against the board and is ready to hammer in a nail. However, what was unexpected was that both buttons (shutter and trigger) were digital – they generated a PWM signal at the output proportional to the degree of pressing. We tried to find out whether the degree to which these buttons are pressed somehow affects anything (the impact force, the impact frequency), but no correlation was found – under normal conditions, the tool valve always operates when the PWM duty cycle reaches approximately half, and the same applies spark. And, to be honest, we still don’t understand why the developers of this tool needed such sophisticated buttons with PWM output – did they really want to scare off third-party repairmen in this way? In short, the PWM from the shutter button was connected in parallel to our bypass board, and the firmware was slightly modified. We called our device “Electronic leash bypass unit – IM100 Override”, the prototype of which is shown in the image below.
First try of the “bypass block”
As often happens, we didn’t succeed the first time. We tested the bypass unit on a disassembled product (without a gas cartridge) and made sure that the valve opens at the right moment and for a given amount of time, visually the tool works “like a real one.” But having put everything together and closing the lids, we were unable to hammer in the nail – detonation did not occur. We tried several times, making sure that the gas was entering the chamber and a spark was forming – but nothing worked. All sorts of strange thoughts began to occur to me – whether we had accidentally damaged any of the original boards, or maybe everything was much more complicated and, in addition to supplying gas to the chamber, something else was required for the tool to work. I started to think that it was time to end the “project”, and so the whole day was wasted. But then a miracle happened – once again putting the hammer to the board and pressing the trigger, we heard something similar to… such a weak “fart”. Then again, and a little louder, then again… and again… but everything was somehow quiet and without a strong blow to the firing pin. Those. detonation was present, but very weak. We gave up the experiments and went to drink coffee, and at the same time began to think about what was going on with us and why, instead of a loud “bang”, we get a rare and quiet “fart”.
Let’s remember how the internal combustion engine works
In the process of discussing the results of the experiment, a simple analogy came to mind – an internal combustion engine. All you had to do was remember how the internal combustion engine works, namely, how and what mixture is supplied to the combustion chamber and at what moment it is ignited. Somewhere from personal experience, somewhere from a school physics course, I remembered that: firstly, for the mixture to ignite, it must have certain proportions, if they are violated, then a miracle will not happen. Secondly, the spark must be supplied at the right moment – ahead of time. Having finished our coffee and armed with new knowledge (more precisely, having shaken off the dust from the old), we began to turn the temporarysThe parameters of the gas supply to the chamber are the only thing we could influence in this case. And indeed, by reducing the intensity of the pulse repetition (instead of 200 ms, we set intervals to 500 ms) and adding a small delay, we immediately got the desired result – a clear detonation and a nail in the board! Thus, we explained the lack of detonation in the previous experiment with a too rich mixture – since the pulses arrive continuously, the chamber manages to fill with too much gas. This may not be a correct understanding of the physics of the process, but increasing the interval between pulses clearly has a positive effect on the operation of the “electronic hammer”.
Adaptation to ambient temperature
As I mentioned above, the Paslode Impulse IM100Ci “electronic hammer” has built-in automatic adaptation to ambient temperature and can operate at very low temperatures (down to -30C). Our assumption was that the controller controlling the tool regulates the amount of gas supplied to the chamber depending on the temperature. Experimentally (by freezing in a climate chamber) it was found that at an ambient temperature of -20C, the pulse duration is 28 ms, and at 0C – 18 ms, respectively.
An NTC thermistor was added to the circuit of the bypass block, connected to the pin of one of the ADC channels of the microcontroller. The software was slightly expanded, adding a “by eye” table of pulse duration values depending on temperature. All this was assembled and successfully tested in street conditions at minus 5C. Testing at -20C is still waiting in the wings.
From prototype to product
Based on the results of two days of research, I redesigned the bypass device – instead of a breadboard, I developed a circuit and a board in the KiCAD CAD system of a size suitable for installation in one of the compartments of the “electronic hammer” just on top of the original one, without any additional fasteners. The board was ordered and manufactured in Resonit, assembled and installed in the tool (see photo). This entire “IM100 Override” project is freely available on GitHub and GitFlic – maybe it will be useful to someone.
https://github.com/pointcheck/IM100_Override.git
https://gitflic.ru/project/fabmicro/im100_override
Well, according to established tradition, I present a short video of the testing process of the “repaired” nail-driving tool Paslode Impulse IM100Ci:
As a conclusion
I would like to apologize to the readers who expected from the article a more detailed study of exchange protocols, the storage format for an NFC tag, etc. All this, of course, could have been done if I had a little more free time. However, as popular wisdom says, “real heroes always take a detour,” and in this sense, the decision we have taken is a demonstration that all this electronic connection, especially where it should not exist, is not worth the money invested in its development and is easily gets by with simple means. Moreover, I even had the idea to completely get rid of the “native” electronic filling and make my own, I added fan control and a spark supply to the bypass unit, all you need is a good capacitance and a voltage multiplier.
Best regards, Ruslan.
