19
edits
Changes
Add details on changing frequency, Add link to firmware dumps
[[File:LMS-6 Radiosonde.jpg|thumb|LMS-6 Radiosonde found on railroad tracks, circled in red.]]The LMS-6 Radiosonde is a balloon-launched radiosonde manufactured by Lockheed-Martin Sippican, and used for meteorological sounding.
<br />
==Photos==
[[File:LMS6 bottom.jpg|left|thumb|Photo of the lower panel of the 403 MHz version of the LMS-6 Radiosode. Of particular note are the DIP Switch configurations for setting the transmit frequency.]]
[[File:RH Circuit.jpg|none|thumb|Relative Humidity Circuit section]]
[[File:Sonde_label.png|none|thumb|LMS6 Label possibly showing calibration factors.]]
==Audio Samples==
The following samples were taken from both frequency versions at a close distance using a HackRF SDR.
{| class="wikitable"
|+
!Frequency
!Audio file
|-
|400 MHz
|[[File:400MHz LMS-6 Sample.mp3|thumb]]
|-
|1680 MHz
|[[File:1680MHz LMS-6 Sample.mp3|thumb]]
|}
==Disassembly==This is a minimally-destructive disassembly method that will allow the payload to be held back together if you wish to reuse the payload for another weather balloon flight.[[File:RH Circuit20200926 203639.jpg|none|thumb|Relative Humidity Circuit sectionPartially-disassembled LMS-6 Radiosonde, with upper styrofoam shell removed. Some RF shielding removed. Rechargeable cells in use for testing purposes.]]<br><br>
<br />
#Cut the zip tie holding the plastic strap to the balloon/parachute tether rope.
#Examine rope, parachute and parachute rigging lines for viability. Neatly organize the flight rigging if usable. Discard if not viable for reuse.
#Peel open the battery/power cover from the bottom of the radiosonde and ensure that all 3 connectors are loose and not connected to one another.
#Remove the plastic pins from either side of the radiosonde.
#Peel away the paper wrapper starting with the corner near the external sensors
#Tear the plastic strap off. It's held on mostly with a few staples into the styrofoam
#Using a sharp utility razor, cut the bottom half of the shell off, carefully. The styrofoam is about 0.6 inch (15mm) thick on both the sides and bottom, so making a long cut all the way around the sides of the radiosonde, about 0.75" from the bottom edge, and not much deeper than 0.6" is recommended. You can use the exit of the weather sensors as a guide. DO NOT fully separate the radiosonde styrofoam shell yet.
#Cut the tape holding the antenna into its dipole shape. Completely remove the tape and straighten the antenna wires.
#Peel open the battery terminal access panel on the bottom again. Using a pair of tweezers, remove the small styrofoam block keeping the power wires restrained.
#Push the battery wires through the hole as you peel apart the styrofoam shell.
#The shell is glued together from the factory. Some of this glue will hold wires to the styrofoam shell. Carefully peel the sensor wires away from the foam and carefully pull the antenna wire (straightened in step 8) through the hole in the bottom of the shell.
#The board should be completely separated from the two styrofoam shell halves. Set aside shell, plastic strap, plastic pins and paper wrap for possible re-use later.
#Remove (3) Lithium CR-123A cells from the battery holders and discard of them safely.
==Reassembly==
#Place fresh lithium CR-123A cells into the battery holders. Use of rechargeable cells is not recommended for high-altitude flight.
#Pass antenna wire through bottom part of shell.
#Pass all 3 power wires through the bottom part of shell and into the power lead compartment.
#Make sure radiosonde circuit board is properly aligned and seated into the bottom half of the shell.
#Replace small styrofoam brick to hold power wires into the compartment. Do not connect any power wires together yet.
#Route the antenna flat against the bottom of the shell.
#Place upper half of shell onto lower half of shell, ensuring that the weather sensors are able to exit the side of the shell where they originally did.
#Affix the two halves of the radiosonde shell together. Long, sturdy zip-ties (one around where the plastic strap goes, another one or two perpendicular to it over the top and bottom) would likely work well and remain intact while exposed to the potentially harsh and cold elements at high altitudes. Alternative closures could be twine (if properly tied) or hot glue, which seems to be what is used to seal the radiosonde at the factory. Glues and cements may make further re-use problematic if you intend to recover and fly the radiosonde multiple times.
#Place the plastic strap around the radiosonde as originally equipped. You can likely push the staples back into the styrofoam if they're left intact.
#Optionally, re-attach the paper wrapper to the payload, or feel free to attach your own wrapper or identification.
#Replace the plastic pins that hold the plastic strap to the radiosonde payload.
#Ensure all sensors and antenna are extended and oriented properly. Be sure to bend the antenna into a dipole orientation similar to how it shipped (about 5.75" of the shorter lead folded back and held about 0.5" away from the twin-lead coming from the radiosonde)
#Optionally, use a loop of tape to ensure the dipole antenna remains positioned appropriately, similar to how the antenna was originally rigged.
#Attach radiosonde strap to flight rigging (rope/parachute/balloon or your choice of drone, kite, etc)
#Remember to connect the red and white wires, and do a pre-flight telemetry verification immediately before launch.
==Powering the radiosonde in the lab==
The OEM battery bank consists of three (3) CR-123A cells in series at 3.0VDC each, for a total of 9VDC. These cells are relatively expensive and only power the unit for 6-7 hours at a time. Internal battery power is enabled by connecting the white and red power wires together inside the compartment on the bottom of the radiosonde.
The unit can be powered on the bench by providing 9VDC to the red power wire and connecting the black wire to power supply ground. Do not exceed 10VDC. Lithium-Ion rechargeable RCR-123A cells can also be used for testing. These cells will not likely last the duration of a high-altitude balloon flight due to both limited power capacity and cold temperatures at altitude.
==Connectors==
|-
|4
|1 Hz - U14 (Analog MUX) Pin 9 (S2)
|-
|5
0.3" spacing. Fine gauge insulated wire run along SENS3 wire and loomed in white heat-shrink tubing.<br />
{| class="wikitable"
|+Card edge - 40-pin, looks like ISA spacing0.100" card edge connector!Pin Number!Function!Notes / Observations
!Pin Number
!Function
!Notes / Observations
|-
|1,2,7,8|<nowiki>Vdd|U3 - Vdd | U15 - Pin 4</nowiki>|2|-Vdd|9, 10, 15, 16, 19, 20, 33, 34U3 - Vdd|Ground||U15 -|2, 8, 18*, 24, 30| +5VDC|18 needs more research, may occasionally drop to ground?Pin 4
|-
|3
|<nowiki>U3 - ICCLK | Pin29 / PC6 / SCK / ICCCLKTP33 | U21 - Pin21 / PCLK</nowiki>
|
|4
|U3 - Pin38/Vpp/ICCSEL|Programmer probably has a 5->12v charge pump for this. Do not apply 12v willy-nilly, will blow chip.
|-
|5
|U3 - Pin39/RESET||6|U3 - Pin27 / PC4 / MISO / ICCDATA
|
|-
|67|Vdd|U3 - VddU15 - Pin 4|8|Vdd|U3 - ICCDATAVddU15 - Pin 4|-|9|GND||10|GND
|
|-
|J5 - Pin 2
|
|12
|U21 - Pin 20 - DCLK
|3.3v - 4800Hz square wave, clocks the serial data
This is probably not directly connected to ST7 PortF.4 which is 5V.
|-
|1213|SW1.4|U3 - Pin10/AIN3/PD3 51K resistor to ground|14|
|
|-
|1315|U3 - SW1.4GND||16|GND
|
|-
|17
|SW1.2|U3 - Pin8/AIN1/PD1 51K resistor to ground|18|SW1.21|U3 - Pin7/AIN0/PD0 51K resistor to ground|-|19|GND||20|GND
|
|-
|1821|47k pullupU3 - SW1Pin19|Appears to be some sort of test-mode select, checked before GPIO initialization.1|22|
|
|-
|23
|GPS TX Data (38400 BPS)
U3 - Pin1/RDI
|Data bursts
|24
|
|Rounded-square wave data bursts+5VDC ?
|-
|25
|
|
|26
|GPS RX Data (38400 BPS)
Maybe not connected to U3?
|Data bursts
|-
|27
|
|Rounded|28|||-square wave data bursts|29|||30|U22.3|U22 Pin 3 3V3 Enable (Active Low)Connected to R38 pull-down Connected to JP27
|-
|31
|BATT POS
|
|32
|J5 - Pin 3
|
|-
|33
|GND
|
|34
|GND
|
|-
|35
|
|
|36
|U3 - SW1.3|U3 - Pin9/AIN2/PD2 51K resistor to ground|-|37|
|
|38
|U3 - Pin18 / OCMP1_A / AIN10 / PF4
|Square wave data bursts, 0.2msec per bit
|-
|RED WIRE
|
|40
|Battery voltage
|Around 9VDC measured, 3x3V batteries
|}
Compatible connector: TE Connectivity AMP Connectors 5-5530843-4 such as Digi-Key A31723-ND[https://www.digikey.com/en/products/detail/te-connectivity-amp-connectors/5-5530843-4/770549]
*
|+J5 - 4-pin, 2.0mm spacing
!Pin
!UseDescription
|-
|1
|UnknownGND
|-
|2
|UnknownTo (?, maybe nothing); to +5 via R7 (47k) (And Card-Edge pin 11)
|-
|3
|UnknownTo U3.11 (AIN4/PD4) via R47 (100); to +5 via R7 (47k) (And Card-Edge pin 32)
|-
|4
|UnknownGND
|}
{| class="wikitable"
|+SP1 - 2x4-pin, 0.1" spacing
!Pin
!UseDescription!Notes/ObservationsPin!Description
|-
|1
| +5VDC||-All from U9
|2
|-
|3
| +5VDC
|4
|U14 Pin 14 (A1) - 5V, 0.1msec pulse once per second
|-
|5
| +5VDC
|6
|U14 Pin 15 (A2) - 5V, 0.1msec pulse once per second
|-
|7
| +5VDC
|8
|U14 Pin 12 (A3) - 3V, 250msec pulse once per second
|}
The following is a catalog of active components. Designators italicized still need positive identification; bold have been positively identified. Markings listed where known to help in identification. List additional markings when they differ.
'''U1''' - GPS - [https://www.trimble.com/embeddedsystems/copernicus2.aspx Trimble 63530-50] - 12-channel GPS, 2x serial ports, 2.7-3.3VDC, SBAS, flash almanac/ephemeris/location storage. (The -50 variant is probably a custom variant, and exact capabilities are unknown.) *This chip defaults to TSIP on the 38400 baud port, which is a binary protocol, and has been captured on this PCB.*[http://ftpserver.org.ru/fileecho/51_EMBED/TSIP.PDF TSIP Protocol Documentation]
''U2 - (Marked G4/905)''
*[http://web.archive.org/web/20200903011648/https://datasheet.octopart.com/ST72F324J6T6-STMicroelectronics-datasheet-14047.pdf 72F324J6T6 - ST72324 - Main Microcontroller, ST7 series Datasheet]
*[https://www.st.com/resource/en/programming_manual/cd00004607-st7-family-programming-manual-stmicroelectronics.pdf ST7 Family Programming Manual ( For coders)]
*[https://web.archive.org/web/20200914132209/https://www.st.com/resource/en/programming_manual/cd00054959-st7-flash-programming-quick-reference-guide-stmicroelectronics.pdf ST7 Flash Programming Quick Reference Guide]
*[https://web.archive.org/web/20200914132013/https://www.st.com/resource/en/programming_manual/cd00004616-st7-family-flash-programming-reference-manual-stmicroelectronics.pdf ST7 Family Flash Programming Reference Manual]
*[https://web.archive.org/web/20200914132431/https://www.st.com/resource/en/programming_manual/cd00004617-st7-family-icc-protocol-reference-manual-stmicroelectronics.pdf ST7 Family ICC Protocol Reference Manual]
*With a buffered 16MHz clock provided by Y3/U12, possible CPU speeds are 8MHz(/1), 4MHz(/2), 2MHz(/4), 1MHz(/8) depending on MCC configuration.
*Instruction timings are in the 'ST7 Family Programming Manual'
''U4 - (Marked Z252)''
'''U16''' - [http://web.archive.org/web/20190417163532/https://www.ti.com/lit/ds/symlink/lmv761.pdf LMV761MF] - Low Voltage Precision Comparator w/ Push-Pull Output <ref group="IC Footnotes" name="U16"> Package marking shows C22A. TI Part marking lookup provides LMV761. The SOT-23 footprint appears to match what is on the PCB.</ref>
''U17 - (Marked Z252)- 3v(blue) -> 5v(yellow) level translator *insert picture U17 here*''
''U18 - (Did not locate, maybe not placed?)''
'''U21''' - [http://web.archive.org/web/20190202204556/https://www.ti.com/lit/ds/symlink/cc1050.pdf CC1050] (back) - Low Power Transmitter - 300MHz-1000MHz, variable power, FSK
*[https://www.ti.com/lit/er/swrz006a/swrz006a.pdf Errata]
'''U22''' - [http://web.archive.org/web/20200223104004/http://www.ti.com/lit/ds/symlink/tps791.pdf TPS79133DBUR] - 3.3V LDO - for U21
|5
|Output
|Data. Square wave. 5V space, 0v mark? Pulses around 250msec per bit. Perhaps this is a capacitance or resistance to frequency converter.
|-
|6
===Notes===
<references group="IC Footnotes" responsive="0" /><br />==GPS Subsystem==Trimble 63530 baud rate is 38400, 5V, connected to ST7 SCI port(Pins 1&2 on ST7, TDO and RDI). Assuming 8N1 framing, this means interrupts must not be disabled for >260 microseconds or else bytes may be lost as the receive shift register overflows.{| class="wikitable"|+!GPSPin!GPSName!Goes to!|-|1|GND|ground||-|2|GND|ground (separated to RF subsystem)||-|3|RF-IN|Passives, then GPS antenna||-|4|GND|ground||-|5|LNA|nothing visible||-|6|VBAT|nothing visible||-|7|Open|To VCC3 via C1 & C3||-|8|Short|VCC3 - should be high||-|9|Reserved|VCC3||-|10|Reserved|VCC3||-|11|Xreset|VCC3||-|12|Vcc|VCC3 - C2 bypass to GND at pin 13||-|13|GND|ground||-|14|GND|ground||-|15|GND|ground||-|16|Xstandby|VCC3||-|17|Reserved|nothing visible||-|18|Reserved|nothing visible||-|19|PPS|C9 bypass to GND, Via to back to trace to via to small via connected to R3, then trace to 47k to ground, then some pins on U2 - looks like a level translator - through that then to a hidden via, pops back up at TP36 which is connected to PB4 on the ST7, which triggers ei3(external interrupt 3) in the firmware.||-|20|RXD-B|appears unused||-|21|RXD-A|comes from U4 level translator, splits to pin 24 on edge connector then 10k resistor to Pin16 on ST7 which is PF1||-|22|Reserved|||-|23|TXD-A|38400 baud to the ST7 RDI/Pin1/PE1||-|24|TXD-B|4800 baud appears unused||-|25|Reserved|||-|26|Reserved|||-|27|GND|ground||-|28|GND|ground||}GPS xSTANDBY - connected to 3.3v GPS xRESET - connected to 3.3v ==CC1050 Subsystem=={| class="wikitable"!CC1050Pin!CC1050Name!ST7Pin!Notes/Observations|-|19|DI|Pin18 / OCMP1_A / AIN10 / PF4|U17 appears to be a level translator between CC1050.19 and ST7.18|-|20|DCLK|Pin30 / PC7 / SS / AIN15|U7 appears to be a level translator between CC1050.20 and ST7.30|-|21|PCLK|Pin29 / PC6 / SCK / ICCCLK||-|22|PDATA|Pin28 / PC5 / MOSI / AIN14|Voltage varies between 5 and 3.something volts depending on which side is transmitting.|-|23|PALE|Pin27 / PC0||}[https://github.com/rsaxvc/LMS6APRS/blob/master/docs/cc1050%20frequency%20calculator.ods?raw=true CC1050 Frequency Register Calculator based on 14.7456MHz crystal] [https://e2e.ti.com/support/wireless-connectivity/zigbee-and-thread/f/158/t/158428?Where-can-one-find-SmartRF-Studio-6- Link to SmartRF Studio6 ( 7 doesn't have the CC1050)]
==Test Points==
===Analog Multiplexer===
U14 is an 8-channel mux/demux. *Four of the channels (A0-A3) go to SP1. *(A4-A7 appear to go to SENS2-4, need to be traced) *Pin 3 is the common in/out, and goes to R13 (560k) and R15 (47k). R15 goes to U15 Pin 7 (555 Reset), and R13 goes to U15 Pin 8 (555 Control.) *Address Select 0 is connected to ST7 Pin 2 / PB0*Address Select 1 is connected to ST7 Pin 3 / PB1*Address Select 2 is connected to ST7 Pin 4 / PB2<br /> ==Original Firmware==Original firmware is not locked and can be dumped with Rlink-STD Debugger with RFlasher7. Several dumps are publicly available on https://github.com/MrARM/lms6/tree/master/dumps Vector table and other interesting addresses: *0x9CDB - The start of frequency registers, each dip switch has registers starting from this address.*0xE003 - Serial number, at least 3 bytes. Ex: 0x7C6A34 is 8153652 big-endian.*0xE100 to 0xE136 - something that changes between units. Maybe calibration factors? Checksums?*0xFF00 - software string. Ex: "May 17, 2017 - V1.45"*0xFFE4 - AVD vector*0xFFE6 - SCI / UART vector*0xFFE8 - Timer B vector*0xFFEA - Timer A vector*0xFFEC - SPI vector*0xFFEE - vector unused on this chip*0xFFF0 - EI3 vector*0xFFF2 - EI2 vector*0xFFF4 - EI1 vector*0xFFF6 - EI0 vector*0xFFF8 - MCC/RTC vector*0xFFFA - vector unused on this chip*0xFFFC - Trap vector*0xFFFE - Reset vector IDA Pro uses CPU type ST7->ST72324J6 during loading, and can load the Intel Hex file produced by the programmer directly for analysis. ===Option Bytes===Option bytes are set to 0xE7F7{| class="wikitable"|+Original Firmware Option Byte Details!Option Description!Original Setting|-|Watchdog Reset on Halt (Reset On Entering Halt)|Reset generation when entering HALT mode|-|Hardware of Software Watchdog|Software (watchdog to be enabled by software)|-|Low Voltage Detection Selection (LVD Config)|Highest Voltage Threshold|-|FLASH read-out protection|Read-out protection disabled|-|Package slection|(A)R - TQFP64|-|RESET clock cycle selection|Reset phase with 256 CPU cycles|-|Oscillator Type|External Source|-|Oscillator Range|HS 8~16MHz|-|PLL activation|PLL x2 disabled|} ===GPIO Initialization=== *PADDR = 0xF0, PAOR = 0x38 or 0x30 depending on address 0xF3**PA7: Open Drain Output**PA6: Open Drain Output**PA5: Push Pull Output**PA4: Push Pull Output**PA3: Depends on address 0xF3*PBDDR = 0x0F, PBOR=0x1F**PB4 - Pullup interrupt input**PB3 - Push Pull Output**PB2 - Push Pull Output**PB1 - Push Pull Output**PB0 - Push Pull Output*PCDDR = 0x03, PCOR=0x0B**PC7 - floating input**PC6 - floating input**PC5 - floating input**PC4 - floating input**PC3 - pullup input**PC2 - floating input**PC1 - push pull output**PC0 - push pull output*PDDDR = 0x20, PDOR=default to 0x0**PD5 - open drain output**PD4 - floating input**PD3 - floating input**PD2 - floating input**PD1 - floating input**PD0 - floating input*PFDDR = 0x20 or 0x80 depending on address 0xF3, PFOR=0x10 or 0x80 depending on address 0xF3**PF7 - depends on 0xF3**PF6 - floating input - is checked very early on startup and used to set 0xF3. 47k resistor to 5v, TP8, CardEdge21.**PF5 - depends on 0xF3**PF4 - depends on 0xF3**PF2 - floating input**PF1 - floating input**PF0 - floating input ===MCC Initialization===Done in the main function, MCCSR is initialized to 0x0E. This means: *Clock Prescaler[CP] is set to /2*SlowModeSelect[SMS] is set to 0, so CP is ignored and Fcpu=Fosc2*TimeBase[TB] is 0b11, selecting 25ms timebase*OscillatorInterruptEnable[OIE] is set, has something to do with low-power mode(s)*OscillatorInterruptFlag[OIF] is clear, indicates main oscillator has reached countdown MCCBCR does not appear to be initialized, meaning beeper-mode is disabled. <br /> ===ADC Configuration===ADCDRL does not appear to be used, thus the ADC is operated as an 8-bit ADC instead of 10-bit. ST7 ADC AIN8 appears to be the only one used. ===Interrupts=== *ei0_int**Triggered by PortA.3**uses location 0xB2 as a shift register to output LSB first to CC1050's Data Input on PortF.4*ei3_int**Triggered by PortB.4**Sets a variable when GPS PPS occurs ===GPS Initialization===On startup, the ST7 sends the following TSIP(0x10 then 0xID, then data with 0x10 double-escaping, then 0x10,0x03) packets to the GPS. *0x10, 0x8E, 0x2A, 0x01, 0x10, 0x03 - Request Fix and Channel Tracking Info, Type 1*0x10, 0x8E, 0x26, 0x10, 0x03 - SAVE SEEPROM*0x10, 0x8E, 0x2B, 0x01, 0x10, 0x03 - Request Fix and Channel Tracking Info, Type 2*0x10, 0x8E, 0x26, 0x10, 0x03 - SAVE SEEPROM
==Modifications==
===Disable amplification===
[[File:TX circuit modified.jpg|alt=Picture of circuit board|thumb|Picture of TX circuit, highlighting components to remove to disable amplifier and a replacement jumper.]]
When testing, it's important not to transmit on unlicensed frequencies. Emissions can be eliminated by replacing the RF amplifier with a jumper between pins 1 and 3, and terminating the load at the antenna connection. The amplifier is an SOT-89 device just above the "-" terminal of B3. To access the RF chain, the shield housing may need to be temporarily removed. Also remove the bias feed resistor just below the "L104" marking. Then, remove the transmitter antenna from the "ANT1" connections. Use a 50 ohm resistor across the two terminals to provide a terminating load and eliminate any further transmission. Near-field reception is still possible after making these changes.
<br />