Difference between revisions of "DFM-17 Radiosonde"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
m (added mentioned 3rd party source)
(Added possible LD series LDO data sheet)
(17 intermediate revisions by 2 users not shown)
Line 23: Line 23:
 
*Transmitter: Si4063
 
*Transmitter: Si4063
  
===Peripheral attachment points===
+
==Peripheral attachment points==
  
*U-Blox GPS is attached to USART_2 on the STM32 via pins PA2 and PA3
+
====LED's and Buttons====
*External serial port (USB connector) is attached to USART_1 (PA9 and PA10), sharing TX/RX with the external I²C bus.
+
 
 +
*Button = PC8
 +
*LED_Y = PC7
 +
*LED_G = PC6
 +
*LED_R = PB12
 +
 
 +
====uBlox GPS (USART_2)====
 +
 
 +
*PA3(RX) = GPS TXD (Pin 2)
 +
*PA2(TX) = GPS RXD (Pin 3)
 +
*PB8 = GPS 1pps (Pin 4) (LED next to flex cable connector)
 +
 
 +
====UART via USB Port (USART_1)====
 +
 
 +
*PA9(TX) = USB D+
 +
*PA10(RX) = USB D-
 +
 
 +
====Si4063 (SPI_1)====
 +
 
 +
*PB2 = CS/nSEL (Pin 15)
 +
*PC3 - SDN (Pin 1)
 +
*PA7 = SDI (Pin 14)
 +
*PA6 = SDO (Pin 13)
 +
*PA5 = SCLK (Pin 12)
 +
 
 +
'''NFC/RFID 4k EEPROM'''
 +
 
 +
*PC13 = RF WIP/Busy (Pin 7)
 +
*PB6 = SCL (Pin 6)
 +
*PB7 (''needs confirmed, signal routes under STM)'' = SDA (Pin 5)
 +
 
 +
'''STG719 (DPST) - U2'''
 +
 
 +
*PC11 = IN (Pin 1)
 +
 
 +
'''STG719 (DPST) - U3'''
 +
 
 +
*PD2 = IN (Pin 1)
 +
 
 +
'''STG719 (DPST) - U4'''
 +
 
 +
*PB5 = IN (Pin 1)
 +
 
 +
'''STG719 (DPST) - U5'''
 +
 
 +
*PB4= IN (Pin 1)
 +
 
 +
'''DG636 (Dual DPST) - U6'''
 +
 
 +
*VDD = ENABLE (always HIGH) (Pin 2)
 +
*PA10 = A0 (Pin 1)
 +
*''UnknownPin#1'' (routes under STM)  = A1 (Pin 14)
 +
 
 +
'''STG719 (DPST) - U7'''
 +
 
 +
*''UnknownPin#1'' (routes under STM)  = IN (Pin 1)
 +
 
 +
'''SN74LV4053 (Triple 2Ch Mux/Demux) - U8'''
 +
 
 +
*PB13 & PB14 = A (Pin 11)
 +
**STM pins connected by trace? ''Why? Read back?''
 +
*''UnknownPin#1'' (routes under STM)  = B (Pin 10) & C (Pin 9)
 +
**IC pins connected by trace
 +
 
 +
'''Analog Inputs to STM2'''
 +
 
 +
*PA0 - Vbatt/Power supply voltage (''needs confirmation)''
 +
*PB1 - Vbatt/Power supply current monitor (''needs confirmation)''
  
 +
<br />
 +
==Identified Supplementary IC's==
 +
<gallery>
 +
File:DFM-17 Uref overlay.jpg|alt=U reference designators overlaid|Top view of PCB with U reference designators overlaid
 +
</gallery>
 +
{| class="wikitable"
 +
|+
 +
IC Part Numbers and Markings
 +
!
 +
!Manufacturer
 +
!Part Number
 +
!Description
 +
!Package
 +
!Part Marking
 +
!Datasheet
 +
!Note
 +
|-
 +
|U1
 +
|STMicroelectronics
 +
|STM32F100R8T6B
 +
|ARM MCU, 24MHz, 8KB RAM, 64KB Flash
 +
|LQFP48
 +
|ARM 32F100R8T6B
 +
|[https://www.mouser.com/datasheet/2/389/stm32f100cb-1851080.pdf Mouser]
 +
|''Some recent batches of the DFM-17 have been using knockoff STM32s! The chip shortage strikes again!''
 +
|-
 +
|U2, U3, U4, U5, U7
 +
|ST
 +
|STG719
 +
|STG719STR Low Voltage 4 Ohm SPDT Switch
 +
|SOT-23-6
 +
|V719
 +
|[https://www.mouser.com/datasheet/2/389/stg719-1850635.pdf Mouser]
 +
|''Analog ADG719 pin compatible equivalent?''
 +
|-
 +
|U6
 +
|Vishay
 +
|DG636E
 +
|0.3 pC Charge Injection, 100 pA Leakage
 +
CMOS ± 5 V / 5 V / 3 V Dual SPDT Analog Switch
 +
|TSSOP14
 +
|636EE
 +
|[https://www.mouser.com/datasheet/2/427/dg636e-1766306.pdf Mouser]
 +
|
 +
|-
 +
|U8
 +
|Texas Instruments
 +
|SN74LV4053A
 +
|Triple 2-Channel Analog Multiplexer/Demultiplexer
 +
|SOT-23-6
 +
|LW053A
 +
|[https://www.ti.com/lit/ds/symlink/sn74lv4053a.pdf Texas Instruments]
 +
|
 +
|-
 +
|U9
 +
|Texas Instruments
 +
|LMV761
 +
|Low Voltage Precision Comparator with Push/Pull Output
 +
|SOT-23-6
 +
|C22A
 +
|[https://www.ti.com/lit/ds/symlink/lmv762.pdf Texas Instruments]
 +
|
 +
|-
 +
|U10
 +
|Silicon Labs
 +
|Si4063
 +
|High Performance, Low Current Transmitter
 +
|QFN20
 +
|40632A
 +
C01Q81
 +
 +
2217
 +
|[https://www.silabs.com/documents/public/data-sheets/Si4063-60-C.pdf Silcon Labs]
 +
|
 +
|-
 +
|U11
 +
|u-Blox
 +
|MAX-M8C-0-10
 +
|u-blox M8 GNSS module, ROM, crystal
 +
|
 +
|MAX-M8C-0-10
 +
|[https://www.u-blox.com/sites/default/files/MAX-M8-FW3_DataSheet_%28UBX-15031506%29.pdf u-Blox]
 +
|
 +
|-
 +
|U12
 +
|STMicroelectronics
 +
|M24LR04E-R
 +
|Dynamic NFC/RFID tag IC with 4-Kbit EEPROM,
 +
 +
energy harvesting, I²C bus and ISO 15693 RF interface
 +
|UDFN8
 +
|4BEB 8150
 +
|[https://www.st.com/resource/en/datasheet/m24lr04e-r.pdf STMicroelectronics]
 +
|''Needs verification. DFM-17 does not boot when removed; I suspect the serial and calibration is stored in the EEPROM here - Trevor229''
 +
|-
 +
|U13
 +
|STMicroelectronics
 +
|LD series, ''unsure on specific part''
 +
|3.3V Low Drop Out Voltage Regulator
 +
|DFN6
 +
|33R
 +
|[https://www.mouser.com/datasheet/2/389/ld39050-1849494.pdf Possible part from Mouser]
 +
|''Needs verification, appears to provide 3.3V regulated power''
 +
|-
 +
|U14
 +
|
 +
|
 +
|
 +
|
 +
|
 +
|
 +
|''Looks like a high side current monitor amplifier, need more information''
 +
|-
 +
|U15
 +
|ABLIC
 +
|S-8200A Series, ''unsure on specific Part Number''
 +
|BATTERY PROTECTION IC FOR 1-CELL PACK
 +
|
 +
|VDL
 +
|[https://www.mouser.com/datasheet/2/360/S8200A_E-1365901.pdf Mouser]
 +
|''Needs verification, Potentially a Winsok WSTDW01 Battery Protection IC?''
 +
|-
 +
|U16
 +
|
 +
|
 +
|
 +
|
 +
|AL
 +
 +
W24
 +
|
 +
|''In-line with battery power, need more information; chip marking''
 +
|-
 +
|U17
 +
|
 +
|
 +
|
 +
|
 +
|
 +
|
 +
|''Connected to USB data lines, likely a UART, isolation, and/or level shifter''
 +
|}
 
<br />
 
<br />
  
Line 38: Line 247:
 
File:Label id speculaton.jpg|Possible meanings of the internal labels and values. The date code in particular which may be useful to date production times. NWS sondes have the same cryptic string printed on the outside of the sonde where the mfg. date normally is on other countries'. "TU" may just indicate the board comes with sensors according to a third party source<ref>https://sondehunt.de/language/en/archive/1189</ref>.
 
File:Label id speculaton.jpg|Possible meanings of the internal labels and values. The date code in particular which may be useful to date production times. NWS sondes have the same cryptic string printed on the outside of the sonde where the mfg. date normally is on other countries'. "TU" may just indicate the board comes with sensors according to a third party source<ref>https://sondehunt.de/language/en/archive/1189</ref>.
 
File:Sensor stalk pinout.jpg|Pinout of the DFM-17 sensor stalk. Not all pins are used, and some seemingly are connected to a trace but end abruptly.
 
File:Sensor stalk pinout.jpg|Pinout of the DFM-17 sensor stalk. Not all pins are used, and some seemingly are connected to a trace but end abruptly.
 +
File:V719 and others removed.jpg|V719 SOT-23-6 packages removed as well as 636EE (SPDT Switch) and LW053A (Mux/Demuxer)
 +
File:Stalk pinout mapping.png|Mapping of the pins on the sensor stalk to the connector and their corresponding IC/IO lines. '''''<u>Top of sensor stalk corresponds to bottom of pictured connector!</u>'''''
 +
File:Dfm back pcb no battery.jpg|Back of the DFM PCB without CR123A battery holders
 
</gallery>
 
</gallery>
  
Line 78: Line 290:
  
 
==Hardware modifications==
 
==Hardware modifications==
[[File:Modified DFM-17 Radiosonde.jpg|thumb|332x332px|MrARM's modified DFM-17 with a SWD connector and a SMA antenna.]]
 
The DFM-17 has solder pads for an SMA port and a SWD header.
 
  
An [https://adafru.it/4048 Adafruit Skinny SWD SMT] connector and a generic SMA connected was used in the photo.  
+
====SMA Port to replace antenna & SWD header:====
 +
The DFM-17 has solder pads for an SMA port and a SWD header. An [https://adafru.it/4048 Adafruit Skinny SWD SMT] connector and a generic SMA connected was used in the photo.  
  
 +
====Minimizing transmit range:====
 +
As amateurs we are not licensed to transmit in the 400-406MHz band, so for testing purposes one should perform this mod. Unsolder the antenna wire and take two 100 ohm resistors and twist them in parallel, then solder them to the center pad and one of the side pads on the SMA footprint. This creates a 50 ohm dummy load for the Si4036 to transmit into. The range is reduced to a couple tens of feet. Also if you are running a radiosonde_auto_rx instance, don't forget to turn it off during testing to avoid feeding erroneous data to Sondehub!<gallery>
 +
File:Modified DFM-17 Radiosonde.jpg|MrARM's modified DFM-17 with a SWD connector and an SMA antenna port
 +
File:Dfm 17 swd and resistors.jpg|Trevor229's DFM with ST-Link SWD pins connected to debug interface and 50 ohm dummy load mod.
 +
</gallery>
  
 
 
 
 
 
<br />
 
 
==Developing and Programming the board==
 
==Developing and Programming the board==
 
[[File:DFM-17 SWD Port pinout.png|thumb|A very crude diagram showing the standard SWD pinout overlaid onto the DFM-17 board]]
 
[[File:DFM-17 SWD Port pinout.png|thumb|A very crude diagram showing the standard SWD pinout overlaid onto the DFM-17 board]]

Revision as of 02:30, 23 January 2023

The DFM-17 is a balloon-launched radiosonde manufactured by GRAW Radiosondes GmbH & Co. KG, and used for meteorological sounding.

The label side view of a DFM-17 Radiosonde


Overview

The DFM-17 radiosonde succeeds the DFM-09 radiosonde. Graw began a contract with NOAA in the US to provide radiosondes. As of Late 2021, several sites have made the transition as part of NOAA’s Operational Test and Evaluation (OT&E) program. 45 CONUS sites are expected to use these radiosondes in early 2022. [1]

Specs [2]

  • Weight: 63g
  • Size: 90 x 67 x 44 mm
  • Power supply: 2 CR123A batteries
  • Estimated runtime: ~240 minutes
  • Transmission rate: 1 packet/sec
  • Bandwidth: ~10 kHz (Website lists <12)
  • Frequency range: 400 - 405.99 MHz
  • Modulation: GFSK
  • TX Power: ~100mW
  • Error Correction: Code-spreading, interleaving
  • SoC: STM32F100R8T6B, 24MHz, 8KB RAM, 64KB Flash
  • GPS: U-Blox MAX-M8C-0-10
  • Transmitter: Si4063

Peripheral attachment points

LED's and Buttons

  • Button = PC8
  • LED_Y = PC7
  • LED_G = PC6
  • LED_R = PB12

uBlox GPS (USART_2)

  • PA3(RX) = GPS TXD (Pin 2)
  • PA2(TX) = GPS RXD (Pin 3)
  • PB8 = GPS 1pps (Pin 4) (LED next to flex cable connector)

UART via USB Port (USART_1)

  • PA9(TX) = USB D+
  • PA10(RX) = USB D-

Si4063 (SPI_1)

  • PB2 = CS/nSEL (Pin 15)
  • PC3 - SDN (Pin 1)
  • PA7 = SDI (Pin 14)
  • PA6 = SDO (Pin 13)
  • PA5 = SCLK (Pin 12)

NFC/RFID 4k EEPROM

  • PC13 = RF WIP/Busy (Pin 7)
  • PB6 = SCL (Pin 6)
  • PB7 (needs confirmed, signal routes under STM) = SDA (Pin 5)

STG719 (DPST) - U2

  • PC11 = IN (Pin 1)

STG719 (DPST) - U3

  • PD2 = IN (Pin 1)

STG719 (DPST) - U4

  • PB5 = IN (Pin 1)

STG719 (DPST) - U5

  • PB4= IN (Pin 1)

DG636 (Dual DPST) - U6

  • VDD = ENABLE (always HIGH) (Pin 2)
  • PA10 = A0 (Pin 1)
  • UnknownPin#1 (routes under STM) = A1 (Pin 14)

STG719 (DPST) - U7

  • UnknownPin#1 (routes under STM) = IN (Pin 1)

SN74LV4053 (Triple 2Ch Mux/Demux) - U8

  • PB13 & PB14 = A (Pin 11)
    • STM pins connected by trace? Why? Read back?
  • UnknownPin#1 (routes under STM) = B (Pin 10) & C (Pin 9)
    • IC pins connected by trace

Analog Inputs to STM2

  • PA0 - Vbatt/Power supply voltage (needs confirmation)
  • PB1 - Vbatt/Power supply current monitor (needs confirmation)


Identified Supplementary IC's

IC Part Numbers and Markings
Manufacturer Part Number Description Package Part Marking Datasheet Note
U1 STMicroelectronics STM32F100R8T6B ARM MCU, 24MHz, 8KB RAM, 64KB Flash LQFP48 ARM 32F100R8T6B Mouser Some recent batches of the DFM-17 have been using knockoff STM32s! The chip shortage strikes again!
U2, U3, U4, U5, U7 ST STG719 STG719STR Low Voltage 4 Ohm SPDT Switch SOT-23-6 V719 Mouser Analog ADG719 pin compatible equivalent?
U6 Vishay DG636E 0.3 pC Charge Injection, 100 pA Leakage

CMOS ± 5 V / 5 V / 3 V Dual SPDT Analog Switch

TSSOP14 636EE Mouser
U8 Texas Instruments SN74LV4053A Triple 2-Channel Analog Multiplexer/Demultiplexer SOT-23-6 LW053A Texas Instruments
U9 Texas Instruments LMV761 Low Voltage Precision Comparator with Push/Pull Output SOT-23-6 C22A Texas Instruments
U10 Silicon Labs Si4063 High Performance, Low Current Transmitter QFN20 40632A

C01Q81

2217

Silcon Labs
U11 u-Blox MAX-M8C-0-10 u-blox M8 GNSS module, ROM, crystal MAX-M8C-0-10 u-Blox
U12 STMicroelectronics M24LR04E-R Dynamic NFC/RFID tag IC with 4-Kbit EEPROM,

energy harvesting, I²C bus and ISO 15693 RF interface

UDFN8 4BEB 8150 STMicroelectronics Needs verification. DFM-17 does not boot when removed; I suspect the serial and calibration is stored in the EEPROM here - Trevor229
U13 STMicroelectronics LD series, unsure on specific part 3.3V Low Drop Out Voltage Regulator DFN6 33R Possible part from Mouser Needs verification, appears to provide 3.3V regulated power
U14 Looks like a high side current monitor amplifier, need more information
U15 ABLIC S-8200A Series, unsure on specific Part Number BATTERY PROTECTION IC FOR 1-CELL PACK VDL Mouser Needs verification, Potentially a Winsok WSTDW01 Battery Protection IC?
U16 AL

W24

In-line with battery power, need more information; chip marking
U17 Connected to USB data lines, likely a UART, isolation, and/or level shifter


Photos

Disassembly


  1. Examine rope, parachute and parachute rigging lines for viability. Neatly organize the flight rigging if usable. Discard if not viable for reuse.
  2. Cut the zip tie surrounding the Styrofoam from the top portion by the rope loop.
  3. Pull the rope loop out, there should be little to no resistance.
  4. Make a slice in the sticker[4] where the two pieces of Styrofoam meet.
  5. Pull apart the two Styrofoam pieces to reveal the circuit board.
  6. Pull the circuit board out. There will be some resistance.
  7. The board is now separated from the Styrofoam shell, reuse if desired.
  8. Pull the two CR123A batteries out, keep or discard them. The board can run off USB power. Batteries are not necessary for development on this board.

Reassembly


  1. Insert two fresh CR123A batteries into the board.
  2. Line up the board to the IO cutouts in the Styrofoam, begin to push into the slots. Make sure the antenna wire comes through.
  3. Press the top piece of Styrofoam into place.
  4. Tape or apply another sticker onto the back label. (Optional)
  5. Insert the plastic rope loop piece.
  6. zip tie the shell together, the zip tie end should end up on the edge nearest to the power button.
  7. Rope on a balloon/drone/kite/etc.. to the rope loop.
  8. Power on the device by pressing and holding the button, you will see a yellow light blink, hold until the light turns solid.

Mini USB Port

The mini USB port on the board does not use the USB protocol for communication, it is a UART bus. However using USB to power the board should not harm the board in theory.

In order to use it, splice a USB cable and wire up a USB<->TTL adapter with the following pins:

  • VBUS: 5 Volts DC
  • D-: TX
  • D+: RX
  • GND: GND


The board will communicate with the official GRAWMET software using this approach. Reverse engineering of the port's protocol is underway, however it is believed to use a similar, if not the same protocol the PS-15 uses.

Hardware modifications

SMA Port to replace antenna & SWD header:

The DFM-17 has solder pads for an SMA port and a SWD header. An Adafruit Skinny SWD SMT connector and a generic SMA connected was used in the photo.

Minimizing transmit range:

As amateurs we are not licensed to transmit in the 400-406MHz band, so for testing purposes one should perform this mod. Unsolder the antenna wire and take two 100 ohm resistors and twist them in parallel, then solder them to the center pad and one of the side pads on the SMA footprint. This creates a 50 ohm dummy load for the Si4036 to transmit into. The range is reduced to a couple tens of feet. Also if you are running a radiosonde_auto_rx instance, don't forget to turn it off during testing to avoid feeding erroneous data to Sondehub!

Developing and Programming the board

A very crude diagram showing the standard SWD pinout overlaid onto the DFM-17 board


When lab testing, you can power the board from the USB header. It also appears to run fine supplying 3.3V to the SWD port(STLink clones do this).


The board uses a STM32, and requires a ST-Link to program. The process used to upload code to the MCU is the same as the Vaisala RS41 radiosonde, you will need to solder and connect the VTRef(3.3V), Ground, SWDIO, SWDCLK and RST pins to your ST-Link.

The board can run without external power being supplied when programming. This board has read-out protection enabled similar to the RS41 and this must be disabled before you can flash firmware to the board.