Difference between revisions of "LMS-6 Radiosonde"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
(Analog Mux breakdown)
(→‎Components: Changed notes to footnotes)
Line 290: Line 290:
 
''U12 - (Marked G5/849)''
 
''U12 - (Marked G5/849)''
  
'''U13''' - [http://web.archive.org/web/20200214104034/http://www.ti.com/lit/ds/symlink/cd4040b.pdf CD4040BPW] - 12-stage Ripple-Carry Binary Counter/Divider
+
'''U13''' - [http://web.archive.org/web/20200214104034/http://www.ti.com/lit/ds/symlink/cd4040b.pdf CD4040BPW] - 12-stage Ripple-Carry Binary Counter/Divider <ref group="IC Footnotes" name="U13">Package marking shows CM040B. TI Park marking lookup provides CD4040BPW.</ref>
  
 
'''U14''' - [http://web.archive.org/web/20200214042837/http://www.ti.com/lit/ds/symlink/cd74hc4051.pdf CD74HC4051PWR] - High-Speed CMOS Logic Analog Mux/Demux - 8:1
 
'''U14''' - [http://web.archive.org/web/20200214042837/http://www.ti.com/lit/ds/symlink/cd74hc4051.pdf CD74HC4051PWR] - High-Speed CMOS Logic Analog Mux/Demux - 8:1
Line 296: Line 296:
 
'''U15''' - [https://www.ti.com/lit/ds/symlink/lmc555.pdf TI LMC555CMM Family] per the ZC5 marking noted in datasheet. Pinout and footprint matches.
 
'''U15''' - [https://www.ti.com/lit/ds/symlink/lmc555.pdf TI LMC555CMM Family] per the ZC5 marking noted in datasheet. Pinout and footprint matches.
  
'''U16''' - [http://web.archive.org/web/20190417163532/https://www.ti.com/lit/ds/symlink/lmv761.pdf LMV761MF] - Low Voltage Precision Comparator w/ Push-Pull Output
+
'''U16''' - [http://web.archive.org/web/20190417163532/https://www.ti.com/lit/ds/symlink/lmv761.pdf LMV761MF] - Low Voltage Precision Comparator w/ Push-Pull Output <ref group="IC Footnotes" name="U16"> Package marking shows  C22A. TI Part marking lookup provides LMV761. The SOT-23 footprint appears to match what is on the PCB.</ref>
  
 
''U17 - (Marked Z252)''
 
''U17 - (Marked Z252)''
Line 353: Line 353:
 
|}
 
|}
  
Sens 4 - Capacitive Relative humidity sensor
+
Sens 4 - Capacitive Relative humidity sensor <ref group="IC Footnotes" name="Sens4"> Sens 4 is known to be capacitive since it is listed as such on page 13 of the [https://web.archive.org/web/20200619153019/https://www.wmo.int/pages/prog/www/WMOCodes/WMO306_vI2/LatestVERSION/WMO306_vI2_CommonTable_en.pdf WMO Common Code Tables Document]</ref>
  
 
===Notes===
 
===Notes===
U13 Package marking shows CM040B. TI Park marking lookup provides CD4040BPW
+
<references group="IC Footnotes" />
 
 
U16 Package marking shows  C22A. TI Part marking lookup provides LMV761. The SOT-23 footprint appears to match what is on the PCB.
 
 
 
Sens 4 is know to be capacitive since it is listed as such on page 13 of the [https://web.archive.org/web/20200619153019/https://www.wmo.int/pages/prog/www/WMOCodes/WMO306_vI2/LatestVERSION/WMO306_vI2_CommonTable_en.pdf WMO Common Code Tables Document]
 
  
 
== Test Points ==
 
== Test Points ==

Revision as of 12:23, 8 September 2020

The LMS-6 Radiosonde is a radiosonde manufactured by Lockheed-Martin Sippican, and used for meteorological sounding.


Overview

There are two models of the LMS-6, a 403MHz model and a 1680MHz model. This article will cover the 403MHz model unless specified.

Specs

  • 16 Fixed transmit carrier frequencies (MHz): 400.250, 400.625, 401.000, 401.375, 401.750, 402.125, 402.500, 402.875, 403.250, 403.625, 404.000, 404.375, 404.750, 405.125, 405.500, 405.875
  • Frequency tolerance +/-30ppm
  • Mean TX Power 70.8mW (18.5dBm)
  • Emission Designator 16K8F1D
  • FSK with a maximum modulating frequency of 4.8 kHz
  • Emission 3dB BW +/-5.0 kHz
  • Emission 20dB BW +/-12.7 kHz
  • Omnidirectional antenna
  • Main beam gain 2dBi
  • Horizontal Beamwidth 360 degrees
  • Vertical Beamwidth +84 degrees

Source: https://apps.fcc.gov/els/GetAtt.html?id=121623&x=.

Photos

Relative Humidity Circuit section




Connectors

There are four sensor connectors (SENSN) used for sensor input by the radiosonde. SENS1 is not populated on the 403MHz units. SENS2-4 have leads connected to them, and the sensors are connected to the other end of the leads, outside of the radiosonde housing. Only SENS1 appears to have spacing for a connector; the others have arbitrary lead spacing.

SENS1 - 7-pin, 0.1" header spacing
Pin Characteristics
1 +5V (5.47 measured) - From U25
2 GND
3 U3 Pin 37 (PA7, High Sink/20mA)
4 1 Hz - U14 Pin 9 (S2)
5 1 Hz - U14 Pin 11 (S1)
6 1 Hz - U14 Pin 11 (S0)
7 Pulldown via R41 (47k) to GND

Public information shows this header may be used for adding additional analog sensors to the radiosonde.

SENS2 - Humidity
Pin Connection
1 Sensor pin 1
2 Sensor pin 2

0.3" spacing. Both lead wires have ferrite beads immediately before connecting to the board.

SENS3 - Temp. Sensor (standalone)
Pin Connection
1 Sensor pin 1
2 Sensor pin 2

0.5" spacing.

SENS4 - Temp. Sensor (humidistat)
Pin Connection
1 Sensor pin 1
2 Sensor pin 2

0.3" spacing. Fine gauge insulated wire run along SENS3 wire and loomed in white heat-shrink tubing.

Card edge - 40-pin, looks like ISA spacing
Pin Number Function Notes / Observations
1,2,7,8 U3 - Vdd | U15 - Pin 4
9, 10, 15, 16, 19, 20, 33, 34 Ground
2, 8, 18*, 24, 30 +5VDC 18 needs more research, may occasionally drop to ground?
3 U3 - ICCLK | TP33 | U21 - PCLK
4 U3 - Vpp/ICCSEL
5 U3 - RESET
6 U3 - ICCDATA
11 J5 - Pin 2
12 3.3v - 2.5KHz square wave (4msec p/p)
13 U3 - SW1.4
17 U3 - SW1.2
18 U3 - SW1.1
23 Rounded-square wave data bursts
26 Rounded-square wave data bursts
31 BATT POS
36 U3 - SW1.3
38 U3 - OCMP1_A / AIN10 / PF4 Square wave data bursts, 0.2msec per bit
39 RED WIRE
40 Battery voltage Around 9VDC measured
J1 - 4-pin, 0.1" header spacing
Pin Wire Color Use
1 Black Ground
2 White Battery +9
3 Red +9 VDC In
4 NC Unknown - goes to

unpopulated CR1


J4 - NC - earphone jack? uses SENS3 leads

J5 - 4-pin, 2.0mm spacing
Pin Use
1 Unknown
2 Unknown
3 Unknown
4 Unknown

These traces go to U3 (ST microcontroller)

SP1 - 2x4-pin, 0.1" spacing
Pin Use Notes/Observations
1 +5VDC
2 Unknown U14 Pin 13 (A0) - 3V rounded square pulses, 2x per second, 2 different periods avg ~75msec?
3 +5VDC
4 Unknown U14 Pin 14 (A1) - 5V, 0.1msec pulse once per second
5 +5VDC
6 Unknown U14 Pin 15 (A2) - 5V, 0.1msec pulse once per second
7 +5VDC
8 Unknown U14 Pin 12 (A3) - 3V, 250msec pulse once per second

SP1 connects to four channels of U14, an 8-channel analog MUX. Pin 2 also connects to R111, non-populated, which would provide a pull-up to +5 at Pin 1.

Components

The following is a catalog of active components. Designators italicized still need positive identification; bold have been positively identified. Markings listed where known to help in identification. List additional markings when they differ.

U1 - GPS - Trimble 63530-50 - 12-channel GPS, 2x serial ports, 2.7-3.3VDC, SBAS, flash almanac/ephemeris/location storage. (The -50 variant is probably a custom variant, and exact capabilities are unknown.)   

U2 - (Marked G4/905)

U3 - 72F324J6T6 - ST72324 - Main Microcontroller, ST7 series - 32K Flash, 1K RAM, 5VDC, 10-bit ADC (16 inputs, muxed), 4x Timer, SPI, SCI, 32-bits total I/O

U4 - (Marked Z252)

U5, U6 - LP2985 - LDO - 2.8V?

U7 - (Marked G4/905)

U8 - (Marked G4/905)

U9 - (Marked F50)

U10 - (Did not locate, maybe not placed?)

U11 - (Marked 73RW, SOT-89 or similar) - Pre-amp for GPS ant? In GPS section can.

U12 - (Marked G5/849)

U13 - CD4040BPW - 12-stage Ripple-Carry Binary Counter/Divider [IC Footnotes 1]

U14 - CD74HC4051PWR - High-Speed CMOS Logic Analog Mux/Demux - 8:1

U15 - TI LMC555CMM Family per the ZC5 marking noted in datasheet. Pinout and footprint matches.

U16 - LMV761MF - Low Voltage Precision Comparator w/ Push-Pull Output [IC Footnotes 2]

U17 - (Marked Z252)

U18 - (Did not locate, maybe not placed?)

U19 - (Did not locate, maybe not placed?)

U20 - (Marked H157/82.5; TSOP-8 or similar)

U21 - CC1050 (back) - Low Power Transmitter - 300MHz-1000MHz, variable power, FSK

U22 - TPS79133DBUR - 3.3V LDO - for U21

Unot_marked (23/24?) - (Marked W6K/W76) - RF Amp, similar to SKY65013-70LF (No designator; under TX can to bottom-right of U21.)

U25 - TPS7201Q - Adj. 1.2-9.75V LDO - (Designator silkscreen is hard to read; 8-SOIC on bottom-right)

U25 and general area
92JK ZC5 chip noted as U15
U15 Pin Function Observations/Notes
1 GND
2 5VDC
3 Trigger Rounded square wave (maybe sawtooth) alternating between 2msec and 4msec, resting at +3VDC between bursts
4 Discharge Rounded square wave alternating between 3msec and 5msec, short periods of 0v, resting at +3VDC between bursts
5 Output Data. Square wave. 5V space, 0v mark? Pulses around 250msec per bit.
6 Threshold More rounded square wave bursts
7 Reset
8 Control

Sens 4 - Capacitive Relative humidity sensor [IC Footnotes 3]

Notes

  1. Package marking shows CM040B. TI Park marking lookup provides CD4040BPW.
  2. Package marking shows C22A. TI Part marking lookup provides LMV761. The SOT-23 footprint appears to match what is on the PCB.
  3. Sens 4 is known to be capacitive since it is listed as such on page 13 of the WMO Common Code Tables Document

Test Points

TP58 - MUX in/out (U14 Pin 3)


Circuits

RF Transmitter Circuit

The transmitter RF path contains a filter IC, pi matching network, broadband amplifier, and a few more output filter stages.

Schematic diagram



Relative Humidity Circuit

File:Relative Humidity Circuit Schematic.pdf U16 -Input also has a cap to ground not shown on the sketch.


Analog Multiplexer

U14 is an 8-channel mux/demux. Four of the channels (A0-A3) go to SP1. (A4-A7 appear to go to SENS2-4, need to be traced) Pin 3 is the common in/out, and goes to R13 (560k) and R15 (47k). R15 goes to U15 Pin 7 (555 Reset), and R13 goes to U15 Pin 8 (555 Control.)

Modifications

Disable amplification

When testing, it's important not to transmit on unlicensed frequencies. Emissions can be eliminated by replacing the RF amplifier with a jumper between pins 1 and 3, and terminating the load at the antenna connection. The amplifier is an SOT-89 device just above the "-" terminal of B3. To access the RF chain, the shield housing may need to be temporarily removed. Also remove the bias feed resistor just below the "L104" marking. Then, remove the transmitter antenna from the "ANT1" connections. Use a 50 ohm resistor across the two terminals to provide a terminating load and eliminate any further transmission. Near-field reception is still possible after making these changes.

Picture of circuit board
Picture of TX circuit, hilighting components to remove to disable amplifier and a replacement jumper.