Hackable STM32 based ARM RF dev boards are literally falling from the sky!
A teardown of two weather balloon Vaisala radiosondes, the RS41 and RS92.
Repurposing tre RS41: http://www.om3bc.com/docs/rs41/rs41_en.html
Github: https://github.com/bazjo
Conference Talk: https://www.youtube.com/watch?v=YBy-bXEWZeM
Paper on capacitive humidity sensors: https://pdfs.semanticscholar.org/0728/24b548d91516d765c4b7facdceb350d61cdd.pdf
#STM32 #RadioSonde #Teardown
Bitcoin Donations: 38y7DE8HEHNj8fGDtUr4PkCn9nWxiorvvy
Litecoin: ML7oQokTwB38bgzzjLDbRV97HKAHuwRfHA
Ethereum: 0x11AceA38DCA9DbFfB4F35f3F746af65F9dED28ce
EEVblog Main Web Site: http://www.eevblog.com
The 2nd EEVblog Channel: http://www.youtube.com/EEVblog2
Support the EEVblog through Patreon!
http://www.patreon.com/eevblog
AliExpress Affiliate: http://s.click.aliexpress.com/e/c2LRpe8g
Buy anything through that link and Dave gets a commission at no cost to you.
Stuff I recommend:
https://kit.com/EEVblog/
Donate With Bitcoin & Other Crypto Currencies!
https://www.eevblog.com/crypto-currency/
T-Shirts: http://teespring.com/stores/eevblog
Likecoin โ Coins for Likes: https://likecoin.pro/ @eevblog/dil9/hcq3
A teardown of two weather balloon Vaisala radiosondes, the RS41 and RS92.
Repurposing tre RS41: http://www.om3bc.com/docs/rs41/rs41_en.html
Github: https://github.com/bazjo
Conference Talk: https://www.youtube.com/watch?v=YBy-bXEWZeM
Paper on capacitive humidity sensors: https://pdfs.semanticscholar.org/0728/24b548d91516d765c4b7facdceb350d61cdd.pdf
#STM32 #RadioSonde #Teardown
Bitcoin Donations: 38y7DE8HEHNj8fGDtUr4PkCn9nWxiorvvy
Litecoin: ML7oQokTwB38bgzzjLDbRV97HKAHuwRfHA
Ethereum: 0x11AceA38DCA9DbFfB4F35f3F746af65F9dED28ce
EEVblog Main Web Site: http://www.eevblog.com
The 2nd EEVblog Channel: http://www.youtube.com/EEVblog2
Support the EEVblog through Patreon!
http://www.patreon.com/eevblog
AliExpress Affiliate: http://s.click.aliexpress.com/e/c2LRpe8g
Buy anything through that link and Dave gets a commission at no cost to you.
Stuff I recommend:
https://kit.com/EEVblog/
Donate With Bitcoin & Other Crypto Currencies!
https://www.eevblog.com/crypto-currency/
T-Shirts: http://teespring.com/stores/eevblog
Likecoin โ Coins for Likes: https://likecoin.pro/ @eevblog/dil9/hcq3
Hi this one was actually sent in to the mailbag but it was I Think it should be so interesting that I'm gonna do a dedicated video on it. It is a Radiosonde. Check that out! and we've seen the radio songs in the mailbag before and I hope to do a future Eevee discover video on radio Sons So I'm hoping I can pull that one off anyway. it will see.
It is literally an Stm32 Dev board falling from the sky. This is what these radio songs do. They go up eventually, they come down. If you don't know these I use for our weather observations at airports and other things that require daily weather observations.
and thousands of these things go up in the air on little balloons every single day and you're not aware of it. and they fall back down in random locations. and it looks like Snderborg that where I see em Michael is from. They track these things and they go and pick them up because they're still transmitting when they come down.
So you can people outfit their cars with a array of antennas, direction-finding equipment and they go hunt these things down. It's really quite cool, so thank you very much. Michael Apparently this one is an Stm32, so I made the mistake. It's one of those stupid crud filled bags anyway.
Oh, that looks very similar, doesn't it? And oh that one looks different. Cool. Australian Bureau of Meteorology Radiosonde There you go. Do Not burn or incinerate.
Yeah, it's Vasana as well. I think they are in the market anyway. Cool. let's check it out.
Alright, let's take a look at these two. New Ver Solar Radio Suns As you can see, these are all more practically identical to the one we've seen previous, but they look almost identical except this one weighs a lot more. Maybe this one doesn't Oh Something's a bit loosey-goosey inside there. How about that one? not that one's light as sensor probe up here it looks.
this one looks significantly different. I'll show you that in detail at the moment. these are basically temperature and humidity as well as a GPS location. of course that's basically all they do and a helical antenna on these ones, but no visible helical antenna on that one unless it's inside.
You notice that the other difference between this is that this one has a little red button on the top. I'm sure the batteries are worn out so it's not gonna do anything. so let's have a squeeze inside. and they do have our external ports down here which look to be identical on both of them.
so little card edge job' there. Yeah, almost the same model set. This one's ie. could that be like analog and this one's D Could that be digital? Hmm.
we'll find out. It's pretty obvious what the weight difference is. This one has batteries and this one doesn't Look, of course it's in styrofoam because you want a temperature, protect the batteries and look at them. They've just taken standard Panasonic doublea's and just welded those together So they just made their own custom packs and they've glued them made that probably just buy them like that, do they? Hmm. And both of them included? Well actually this one included - yeah, by the looks of it, these little liquid bottle. there's some sort of liquid in there I assume that's water. Is that? Do they? Maybe that light keeps the batteries warm? Maybe they like actually worn these things up first. I would assume like it wouldn't be like an ice break then P No point doing that.
I Guess it's already cold enough up there. So I assume that they're keeping the batteries warm with these things so they keep those in the thermal chamber, and then once they're you know, moments before they're about to launch, they whack the battery pack in there, check it all out, and have their little he drink brick I assume so that would like go either side of the battery because they're molded to go around the battery like that. So yeah, that looks like to be a custom solution. That's neat, and those two look absolutely identical.
I Don't think I can spot a difference between those at all. This is the old one and this is the bothy. Yeah, the old one. In quote: Mike's this is the new one.
From memory, this didn't have where we've been promised an STM 30 - dev kit falling from the sky. but I don't see that as an Stm32. It's actually got a solar branded on it, so maybe it isn't Stm32 or - makes sense they wouldn't roll their own custom ASIC for this. That makes absolutely no sense at all.
so wouldn't surprise me if that is and Stm32. And of course, if you buy any chip you can, practically any manufacture will custom silkscreen your chips for you. If you order enough, you order. You know, ten thousand or a hundred thousand of them though.
Go. Yeah, no worries. Well silkscreen anything you want on there you want like a platypus on there. Not a problem, we just put a platypus.
I Just got some boring voltage regulation around there don't need much, just in our 3.3 volt. Whatever that job he is in this section down here. It's hooked up to the helical antenna here and well, is that our GPS receiver. Let's have a look at that chippy there I can't see it on my camcorder, but I'm shooting this in 4k so I can zoom right in.
thank you very much. Okay, from the GPS antenna, I've got a couple of filters there and a whole bunch of amplifier parts or whatnot. It seems to be a surprising amount of our external circuitry there. And then we get to a Univ 8021 C chipset and this is actually a GPS front-end but it doesn't do any of the processing it says its name says it's just a front-end receiver basically and it's designed to match with a Univ receiver.
I thinks the Ad 31 and we don't see that anywhere. so I can only presume that they're going to be doing the GPS process and also in the processor up here, which is the DSP 1c, the Vasila branded micro. So yeah, they're doing the DSP employs digital signal processing. Looks like we've got a little that looks like an E Squared prom and not much else. We just got a test end and or programming interface and then it looks like this might actually be the transmitter down here. After all, let's have a squiz. Let's get this can off. We've got big ass metal can on Jesus serious about strapping that down look at that.
So they a copper tab on there. they got shielding. You can actually see the yeah, it's like a metal coated like mylar polyester II strip kind of thing going up to the sensor elements. They're really serious about shielding on this.
so take off the outer shield and we get two more inner shields here. We've got one for all the sensor elements, so that would be probably ADCs and signal conditioning under there. Whether or not these an external ADC or whether or not it's such a signal condition and or whatever and the micro is actually doing the ad seen I'm not actually sure, but does that like our transmitter can or something? No, it's only one way to find out. and sometimes if you don't want these again, I find it's often easier just to cut the shields off rather than trying to desolder like almost all of it.
right around the edge like that. And good thing about these is that you can just wiggle wiggle wiggle Yeah! and you can break them off. Just get in there for pair of cutters. It's snips there.
We have now transmitter aliens confirmed. There we go and I'm sure all the RF people are going. Ah yeah, I know what the heck that is. That's a do for Winkle topology.
Then if we flip it over, there's our transmitter and another Vassallo branded chip. It could of course being off-the-shelf chip. I Don't know what the protocol here apart from saying it's a synthesized transmitter on for 400 point one five to 406 megahertz transmitter range up to 350 kilometres. Frequency stability plus minus two killers deviation for 20 kilohertz blah blah blah Apple Power Minimum: 60 milli watts and it uses G FSK modulation at a downlink rate of 4800 bits per second.
So they're using yet some sort of custom transmitted that like it's only low power. low 60 milli watts is not an awful lot. that's just adding a teeny tiny little bit of inductance to ground there. Just wiggle wiggle Yeah! AC coupling cap and then that looks like it I presume pops out to the the TV is there? What's going on I need to get under there? So this is actually surprisingly well engineered.
or I'm not gonna saying it's not over engineer, but you know there's a lot of parts and a lot of effort that goes into designing something that is literally disposable. They use it once and they throw it away. Yeah, like they just pollute the environment with these things. And granted, I'm guilty of that before.
I worked in the US on a boy industry designed Insogna Boys that they deploy those once and they work for like you know, 10, 12 hours or whatever. And then they actually burn through a resistor on the floatation bag that sinks them to the literally sticks him to the bottom of the ocean so that the Russian trawlers couldn't come along and pick em up. Anyway, that was the yeah, but these things just drift anywhere. And of course they tell anyone who this lands in your back. Yeah, they tell you what it does, is expendable and may be disposed of as may be convenient. Do not burn or incinerate. That's because of the batteries. If you want to know how much use they'll get out of these.
Well, the other one, which we're going to take a look at in a minute. It's got a nominal operating time of 240 minutes, so that's it. And it's Gonski Anyway, if you're wondering how they censor probes work, well, this one up here. This is a platinum resistance wire and this is the temperature sensor.
Believe it or not, our resolution of 0.01 degrees C, response time of half a second and a nominal accuracy of point calibrated the point one percent. Although the combined uncertainty after ground preparation is point two, then it goes up. Combined uncertainty in sounding at less than 16 kilometres is 0.3 degrees and above 16 kilometres is a different spec allow 0.4% but yet very nice and the accuracy also changes with the pressure as well. Less than 100 Hectopascals is 0.15 degrees c.
that's the reproducibility and less than 100 Hector packet and Hector Pascal II things is 0.3 degrees interesting. And then over here we have the humidity sense of why they've got to I don't know. but anyway, this is a a thin-film capacitor. Anyway, that is the sensor and you can really really see that down in there.
Look at the detailing that that I believe they're identical as some sort of. maybe it's some sort of differential thing. Not entirely sure. Anyway, the temperature sensor is apparently designed to prevent solar radiation.
Erica You know you're up high. You get a lot of solar radiation so that could actually heat up and affect your sensor. Hence why I Guess it's so thin and tiny and it's separated by the big air gap I Guess you know it to be a surface area thing most likely. And the door tie-in with the response rate of the sensor as well because you want to be able to record like fairly fast start fluctuations in the voltage.
and it's also designed to minimize our evaporative cooling as well. When like it goes through clouds, of course it's going to get all moisture on hood or whatnot because, well, it's a cloud and it's got water in it, then it's You could have errors caused by the evaporation, so yeah, then I'm sure that's very carefully-designed temperature sensor, you know. I Do believe the humidity sensor in there might actually have a little resistive heater in it as well. so that's just I going to act like as a de-icing kind of thing. And remember, these are extreme conditions that these things are being asked to operating. Now let's have a look at this Rs40 One model and apparently this is the popular one with the ham radio operators and radiosonde trackers because these ones can actually be hacked. Apparently they do contain an Stm32 processor or they can be hacked and repurposed to actually be used as a ham radio transmitter. So there you go.
That will have to be the subject of a second video, but let's take a squiz inside. As I said, this one is much lighter than the others. It's got a different designed sensor element which we'll take a look at, but it's going to be temperature and humidity in the same way and this one's got a fancy pantsy LED on it. You guys is a very different construction to the previous one, but once again, we see the styrofoam in there.
I Guess there's nothing really better than cheaper and simpler than you know styrofoam for thermal insulation. but we have our board inside here. That's just kind of. yep, that's just gonna pop out.
So there you go. It's just two halves of the case and oh look at that. look at that battery holder. Isn't that sex on a stick? Oh, it's just beautiful thing of beauty.
It's a joy forever. Look at that and this one would use two double-a This is classed as being suitable for two double-a Lithium batteries for a nominal two hundred and forty minutes of operation, but this is kind of more like what I would you know I Think like a disposable one might be, although you know, lots of fancy pantsy in the plastic battery holder. Be got to have that. but it seems to have much more minimalized circuitry on here.
so let's have a squiz. Check this out. Now this tinted Vero Beach Look at all the veers on here. They're all gold exposed pads and that's great for hacking because you can just like I get a mod wire and sold it directly on there.
You don't scrape anything or yeah, it's it's so much better. Tada, There's our Stim processor. 32 F100 Cat6 be for those playing along at home and 24 Megahertz. geez, that's screaming, isn't it? Geez, you wouldn't think you'd need that sort of grunt really, but it'd be just a switching converter down in there, a couple of local regulators.
you can tell they're surrounded by a bypass cap down in there and looks like some voltage set resistors perhaps off-the-shelf connector there for our interface and our routed out slot there. Well, that would be four onboard temperature sensor and this is a common technique that I've discussed over the years in several videos. I'm sure is that you're out out a slot like that because it prevents any thermal expansion in the PCB from actually stressing the through the leads of your temperature sensor here, through the leads in there, and then getting onto the die. and they can actually affect the stability of your temperature reference or voltage reference or whatever it is. So yeah, that's just a common technique for that. And on the bottom, HC uo4 gonna have some seven four series in there. Fantastic. Just got a lot of other analog E stuff, but not much else happen in there at all.
And that there is our transmitter. It's upside down so all the electrons have already fallen out. But yeah, you can see that that's what I want in a trend. That's what I expect to see any disposable transmit on just a single chip, not much else.
a few passes Bob's your uncle and I looks like I've got some sort of matching network there or something and that just goes off to. you're just. you're like gonna quarter wavelength antenna will just wire antenna just flapping around in the breeze and that coil there. Hang on.
It's not the GPS it's located near the transmitter. Where's that little via popping out - uh-huh there you go that Wow got ourselves a UH a totem pole drive up here. there of output. Okay, what's doing? So got the you blocks are GPS engine there you might be wondering.
Well where's the antenna? Oh that's gotta be it right there. tiny little surface mount patch job II What patch? or is it some sort of weird fractally thing? Oh yeah, it's just some sort of patch job. Okay, good enough restore. And there is the humidity sensor on the RS 41.
I Believe one of those is going to be the power resistor. probably that one down there. You could actually get in there and measure that and that would be for the power power resistor. In quote marks that would be for the de-icing of that.
And as you can see, they got a different arrangement here. but surely that's got to be the same. That is definitely the Platinum resistor temperature sensor in there. Just so Yeah, it's a totally different construction to the previous model now.
Unfortunately, I've powered this up and we've got our green flashing light there. Apparently it flashes that when it's looking for a connection. Once it's got a GPS connection I Believe it goes solid green and I checked all the pins on the connector there and I'm getting no data out of this at all when it powers up or anything. So I don't know if it needs a GPS lock before it outputs anything.
so I know I expected to see something there at least. Anyway, you can reflash this via the serial port and with an Stm32 St-link programmer. and then you can get it to change frequencies and transmit on different frequencies and do everything. And somebody's reverse engineered it and rewritten this software the firmware from scratch.
so hats off to whoever I figured out how to do that. That's awesome, but yeah, maybe I'll do that in a second video. but I was hoping to get some sort of data out of this like there's just nothing there. can't see it? Yes, I have hooked it up to a terminal program and tried to like to just input various characters into it to see if I can prompt it to do something. but not zippity-doo-dah so that's disappointing. Alright, I had to come outside and what do you know? Yep, it has locked in and like it only took like tens of seconds to lock in once it has that proper GPS reception. but unfortunately I'm even with the portable scope. Got the nice arm mixing out here.
The screen isn't the best. little like if I tilt it like that it's Gonski But anyway, the tilt stand is nice can still read it. it's once you get like on the high angle like that. anyway.
yeah I can't find any. There's no signals at all on that output connector. so yeah, bummer.
Website for re-purposing is gone, is there another site?
The letter opener…. XD
Dave
the 2 humidity sensors allows for 1 sensor to be heated and remove moisture while the other sensor is in use. they are switched back and forth. D= alkaline dry-cell battery L= lithium battery A= dry-cell for autosonde all 3 radiosondes measure pressure. temperature. and humidity .
A bit of a "heads-up" Dave. Although the antenna has helical parts it isn't a helical antenna. It's what is know as a "turnstile". A true helical antenna is quite directive. A turnstile is designed to be quite onmi-directional.
Does anybody know the partnumber and manufacturer of the battery holder? It looks very interesting and I want one ๐
Hi, according to what I have read, these batteries (AA size)are not the "right" batteries used in a sonde so the organization must insert that sort of ballast (water containers)
because the sonde must have the same weight compared to the others.
The "right" batteries are … water batteries: I mean they are activated by adding water a little before the launch (probably they are a sort of lead-acid batteries and this hypothesis justifies the considerable weight).
A battery of that type can be stored (dry) even for years without problems.
They use standard alcaline batteries pack in case the operator… "forgets" to prepare it or if for different reasons they have not the "right" batteries
It fun to see it stated that they are harmless. Of course they are the you kids say, well that was not the case several years back. Then they used an custom made very simple acid.lead battery like in a car and that contained sulfuric acid that is of course not good to get on you. Now they just use ordinary batteries, I don't know why that wasn't the case before.
this is so wasteful! at least they should make the chips reusable ๐ฎ
Oh Dave you should had attached a probe on the RF output.
Most important Dave Vocabulary:
1) "Here you go" = "Bob's your uncle"
2) "Freehanging" = "Flapping around in the breeze"
3) "Fan" = "Aficionado"
4) "Let's take a look" = "Let's have a squiz"
5) "Look what we have here" = "look at these bobby dazzlers"
6) "That's pretty cool" = "That's sex on a stick right there!"
7) "This is way better than that" = This is non of that rubbish"
8) "We have opened the device" = "We're in like flyn"
surely they could print on it "send back for $50" – and loads of aussies would send them back to be reused , at least partially! What a fucking waste!
There is PLL inside the STM32 chip, the chip can do 72MHz from this little 24MHz crystal.
nice t-shirt, i was just busy with an opamp circuit yesterday
@EEvblog Dave I thought you said the RS41-SG ran with 2 AA lithium cells yet you are powering it from 1.5v cells ? Maybe it needs the higher voltage to operate correctly.
Vaisala is an evil company. They buy up companies and destroy them. I know. I was a victim. I personally know of 3 companies they consumed and shat out.
I have no idea how they continue to exist. They are so incompetent.
Edit: btw, it's pronounced vie sa la.
So this industry send this into environment without any chance to collect back??? It can fall into water reservoirs, is a lot of pollution!
Love your letter opener๐.
in Australia, electrons fall out when the board is up straight
It uses the GPS signal for windfinding.
Bet you didn't know that!
Maybe it is a transponder. You need the signal from the base station to waken the sonde and send back the data.
Finally I can go to my grave knowing what this module is I picked up at the local flea market, I recognized the RF components of the module, that's the reason I purchased it for a few penny's, but I could not find any information on it's function until this video.
wow You can have a development board free from the sky. The hobbyst wet dream comes true. You have micro, gps , sensors with platinum, nice batteries holders ๐ and more! All reusable in your projects.
lol, i though the title was just clickbait, but i thought…'im ahhh clickin' it just cause its that crazy aussie guy. plus i like to see dave constantly balls it up with those envelope packages and get crap everywhere lol