EEVblog
Vložit
- čas přidán 30. 04. 2019
- Hackable STM32 based ARM RF dev boards are literally falling from the sky!
A teardown of two weather balloon Vaisala radiosondes, the RS41 and RS92.
Repurposing tre RS41: www.om3bc.com/docs/rs41/rs41_e...
Github: github.com/bazjo
Conference Talk: • STM32 Development Boar...
Paper on capacitive humidity sensors: pdfs.semanticscholar.org/0728...
#STM32 #RadioSonde #Teardown
Bitcoin Donations: 38y7DE8HEHNj8fGDtUr4PkCn9nWxiorvvy
Litecoin: ML7oQokTwB38bgzzjLDbRV97HKAHuwRfHA
Ethereum: 0x11AceA38DCA9DbFfB4F35f3F746af65F9dED28ce
EEVblog Main Web Site: www.eevblog.com
The 2nd EEVblog Channel: / eevblog2
Support the EEVblog through Patreon!
/ eevblog
AliExpress Affiliate: s.click.aliexpress.com/e/c2LRpe8g
Buy anything through that link and Dave gets a commission at no cost to you.
Stuff I recommend:
kit.com/EEVblog/
Donate With Bitcoin & Other Crypto Currencies!
www.eevblog.com/crypto-currency/
T-Shirts: teespring.com/stores/eevblog
Likecoin - Coins for Likes: likecoin.pro/@eevblog/dil9/hcq3 - Věda a technologie
![The moment we stopped understanding AI [AlexNet]](/img/n.gif)
Sadly disposable, the ones from the Michigan (usa) fall from the sky with postage and an envelop to send back to the weather station for reuse.
I have documented my progress in reverse engineering the RS41 in GitHub. CZcams is a bit picky in me posting links here, but searching GitHub for RS41 will bring you there.
RS41_Hardware - hardware reverse engineering with mostly complete theory of operation
RS41_Decoding - radio transmission format reversing with mostly complete description of the transmission protocol
Dedication. Respect!
Awesome work!
Nice job!
Hy Bazjo xD here is the "Admin" xD
@@radiosonde.online8164 ?
The water packs might just be to keep the batteries above 0°C. They can't get below that without freezing the water entirely first, which takes a huge amount of energy (*to be conducted out)
I take it you mean the removal of a huge amount of energy? ;-)
@@cambridgemart2075 I knew someone would bring that up ;)
What about phase change material, isn't that a possibility too ?
@@phoenixsmith4001 Water is cheap, plus when it's thrown in the garbage and starts to leak it won't poison the environment.
@@therealjammit It's probably water. But to make it last longer the PCM like Salt hydrates (MnH2O), or even table salt would fit in the same bottle, maybe with a little water for better heat transfer and some heat sink grease between the bottle and batteries. That would still be non-toxic. But worse is the probably tin/lead or less toxic alloy for solder, battery chemicals, maybe tantalum or cadmium in the parts and batteries. Myself I would use more foam so it would float, maybe seal it with candle wax and come with prepaid return postage so when found have the outside have printed on it "return to postal dept" and used again for cost and polluting. These things I'm guessing are at least $50 - 100 each especially since they have a monopoly. But if you know the actual price let me know. Just the part have to be close to that I would think.
Beautiful video. Some remarks on the old RS92. Labelling: "D"=AA Batteries, "A"=AA Batteries, suitable for automatic launchers; "L"=Lithium battery pack; "W"=Water batteries. The A model has an on-off switch that would be punched in by the launch robotor.
The RS92 did not process GPS coordinates onboard; this was down by a computer at the ground station.
The realistic operating time with the RS41 and for the RS92 A and D models are about 10 hours.
Weiter unten hatte jemand die D als wasser batterie bezeichnet allerdings ist das auch meine erfahrung mit den nummer oben wie du das hast.
Interesting. Were these codings on all the sondes? Across the ditch here in NZ ours weren't GPS ones and I don't remember the W being anywhere on them (we had batteries that soaked in water - they generated heat and therefore didn't need much in the way of thermal insulation).
Dave, the RS41 sends full 10 hours. The 240 minutes are a very cautious statement in the data sheet.
I choose to believe the liquid is vodka, and it's for whomever finds the sonde :)
Should be!
Why not!
i wish where i live it would ARM Dev Boards Falling From The Sky!
Yeah, it rains cats and dogs here. That's why I've adopted a house full of puppies.
Check Radiosondy.info
there is the trade off, everything in aus wants to kill us so if its not trying to rip your legs off or bite your face it hits you in the head -.-
Nice teardowns and analysis Dave... 10/10
went on a RS41 hunt recently.
first two, someone else was faster. third one.. on a rooftop, fourth one fell into a river. fifth lost in the woods, sixth one i finally retrieved.
it had a expansion port with a weird module fitted i couldnt informations about, looked like a barometric pressure sensor (1cm diameter metal can on ceramic substrate, hole in the bottom, qr code ontop).
60mW may not sound like a lot, but with unobstructed line-of-sight, it can go a long ways (these often reach over 100,000 feet altitude). I've been able to receive and decode the signal from these at distances in excess of 300km!
I live in Vienna and with my "crap chineese Antenna" i get the from zagreb from time to time.
Jesus! A product of Finland! The Head office of the company is right next to my house :D
Use the FORCE to make vaisalla completely remove the kill timer. Please xD
They make the lightning detection system in use at Canada's weather office, as well.
weather.gc.ca/lightning/index_e.html
Jesus! You won! I have 37 minutes
drive to Vaisala headquarters :D
I worked there for a little while :)
Max Mustermann in Europe recently we have 8 hours from the ballon explosion to recover the radiosonde. The comunity of radiosonde hunters asked vaisalia to modified the default timer from zero to 8 hours and they gently modified the new Radiosonde production stock
A followup would be nice! Thanks for this interesting stuff.
"It's up-side-down, so all the electrons have already all fallen out..." And this is why I watch your channel.
It's raining ARMs.
Hallelujah
It's raining STM
Now I WANT the Australian Meteorological Agency to make a platy-board with a custom platypus silk-screened chip!😂😂
in Australia, electrons fall out when the board is up straight
I'd like to see a follow up on this to see how it can be programmed to do different things. Can't get one myself but would love to see it do things.
For a radiosonde, they don't need to fully process the GPS data into a position as the sonde doesn't need to know where it is - they can send raw or intermediate data to be processed at the receiving end, saving on battery power and cost.
Hunters can load Almanac datas herself and find the sondes too xD
This was how the RS92 worked, but it was definitely a product of its time - I suspect when the RS92 was designed fully contained GPS modules were prohibitively expensive for something as mass-produced as the RS92 was. The newer RS41 shows the modernisation of the idea, using the uBlox GPS chipset. Realistically i doubt there would be any significant saving (cost or battery power) nowdays doing the 'half-a-GPS-receiver' approach. GPS chipsets are so cheap and so low power... (Though I should note that uBlox have made significant advancements on power consumption since the uBlox 6-series chip used on the RS41)
Helical antennas look great ;-)
MrJef06 And really good for satnav if the size isn't a problem.
@@johnfrancisdoe1563 Just shows how much the sensitivity/noise of GPS receivers has improved that the helical antenna can be replaced by a tiny chip antenna.
It's a turnstile antenna not a helical as such.
Is it helical or turnstile? It does not look like en.m.wikipedia.org/wiki/Turnstile_antenna or en.m.wikipedia.org/wiki/Helical_antenna
@@MrJef06 It's a quadrifilar helix antenna.
I worked for u-Nav! I was an applications engineer, and I designed most of the eval and demo boards. Good times. u-Nav was bought by Atheros, then they were bought by Qualcomm. Three employers, same desk. I wasn't aware that anybody was using our front end without its matching baseband processor. But it makes sense that Vaisala would have used them without me ever hearing about it here in the USA, since they naturally would have interacted with our Finland office, where most of our software development was done.
And good thing about this is that you can just wiggle wiggle yeah..
Neat! I had no idea so many of them go up there everyday.
Finally! I was waiting for this video since one of the sondes cam in, in a mailbag a year or so ago! Thanks a lot :)
I nearly didn't click this video because I thought it's just a Dev board. This is much more interesting!
We had to wait until 16:07 for Bob today *lol* - great vid as always!
That is a good way to keep the battery stable even when the water freezes it won't drop below Oc.
It’s funny to see the same topology “chip” antennas for GPS and WiFi. They are nothing but a capacitive divider to resonate the inductive notch in the PCB. They will sell you one for several $ when it’s equivalent to two SMT capacitors.
Your teeny tiny inductance to ground is part of the RF output filter (band-pass?). May be more than 60mW output as there is a 4 legged transistor (or MMIC amplifier?) feeding into the filter.
Those water containers will clamp the temperature to 0C until they froze completely.
like a pot boilling at 100 degrees C ?.... mmmhhhh not sure it's the same, honestly i don't think
@@redoverdrivetheunstoppable4637 It's true. Latent heat - check it out.
I really wished I could get ahold of one of these.
Hi, according to what I have read, these batteries (AA size)are not the "right" batteries used in a sonde so the organization must insert that sort of ballast (water containers)
because the sonde must have the same weight compared to the others.
The "right" batteries are ... water batteries: I mean they are activated by adding water a little before the launch (probably they are a sort of lead-acid batteries and this hypothesis justifies the considerable weight).
A battery of that type can be stored (dry) even for years without problems.
They use standard alcaline batteries pack in case the operator... "forgets" to prepare it or if for different reasons they have not the "right" batteries
I think the water packs are thermal mass to keep the batteries warm for the relatively short amount of time they're at altitude. There would be no reason to add weight, that would just mean extra gas required for lift.
A lot of these would also be launched from a automatic rotary launcher which is loaded in advance.
I have found that lots of suppliers in China are happy to silkscreen the chips they send to you. :)
cloud-based devices :D
Dave
the 2 humidity sensors allows for 1 sensor to be heated and remove moisture while the other sensor is in use. they are switched back and forth. D= alkaline dry-cell battery L= lithium battery A= dry-cell for autosonde all 3 radiosondes measure pressure. temperature. and humidity .
Oh Dave you should had attached a probe on the RF output.
Very nice video 👍
Do you remember (back in the days of analog) when these contained a vacuum tube (launched via weather balloon)?
If only that cloud could rain on my house!
Most important Dave Vocabulary:
1) "Here you go" = "Bob's your uncle"
2) "Freehanging" = "Flapping around in the breeze"
3) "Fan" = "Aficionado"
4) "Let's take a look" = "Let's have a squiz"
5) "Look what we have here" = "look at these bobby dazzlers"
6) "That's pretty cool" = "That's sex on a stick right there!"
7) "This is way better than that" = This is non of that rubbish"
8) "We have opened the device" = "We're in like flyn"
The PTU probe is typically coated with a vacuum deposited aluminum. The aluminum helps reflect the IR and UV heat from the probe. If this tracks altitude, it will likely have some sort of temperature correction because it still absorbs some heat at higher altitudes
k Vaisalas software calculates the sun angle based on location, date and time and corrects the sounding data accordingly
bazingaJojo Ideally, all such corrections should be done on the reusable base station unless it happens reduce transmission bit count or is needed to make the probe work.
The sonde just transmittes the raw ptu acquisition “ADC” data, all processing is done in the ground station.
The RS92 didn’t even uses a full gps chipset and send doppler shift an pseudoranges to the base station where position is calculated, RS41 sends the same data alongsite the real position most likely for backward compatibility
I probably shouldve noted I got this data from a radiosonde I was on the design team for. I'm sure theres a ton of ways to do it. That's just how we did it.
LoL, was waiting for the 👮 police to arrive when you took the stup outside and got a GPS sink 😎 would have been fun!
Ha ha, i thought you went skydiving when i saw the title :D lol
11:20 I believe the idea with the duplicate humidity sensors is that one is measuring while the other is heating (or cooling down to ambient afterwards), and so they can alternate.
I bet the slot around the temperature sensor also provides thermal separation from the rest of the PCB. That's actually a really good idea; I built a thermostat with an onboard thermal sensor - and think I'll add some similar sort of thermal gap for the next rev!
At 15:58 upside down chip and all electrons falling out? huh?? #easylab4kids cracking up!! :P
I have documented my progress in reverse engineering the rs41 on github:
hardware - github.com/bazjo/RS41_Hardware
radio protocol - github.com/bazjo/RS41_Decoding
very interesting...
I might start going deeper into this, perhaps building a few receivers and go fox hunting like in the old days!
A bit of a "heads-up" Dave. Although the antenna has helical parts it isn't a helical antenna. It's what is know as a "turnstile". A true helical antenna is quite directive. A turnstile is designed to be quite onmi-directional.
Made to be disposable, their probably not concerned for anyone reverse engineering these especially with packaging that's not designed to protect the insides, just keep it functioning in the extreme cold. Those packs are definitely for warming, the upper atmosphere can get so cold it will not only freeze batteries but it can freeze i/c's too. Looks to do the basic function of collecting data and sending it out and that's about it.
That would hurt...
At 16:45 you mention the totem pole... I can't be sure, but maybe this is a receiver circuit. The sondes power themselves up when they are sat on their ground check devices. At a guess this is a coil that receives the initial initialization and processing signals before the transmitter is bought online later in the ground check sequence.
Oh nice, Finnish stuff.
I'm still rocking with my Nokia N-Gage.
Finally I can go to my grave knowing what this module is I picked up at the local flea market, I recognized the RF components of the module, that's the reason I purchased it for a few penny's, but I could not find any information on it's function until this video.
Nice. I have a potential application for these. May save me developing my own.
Every man and his dog will be chasing them now after Dave let the cat out of the bag.
@@BenMitro Fortunately, I have so many of them that I might then make money sometimes xD
Should we be discussing that knife, Mr. Dundee?
Website for re-purposing is gone, is there another site?
Is there some guard wireing going on? 15:38
Not the usual EEVblog video ending... bummer.
I got lazy
Love your letter opener😎.
Stmicro samples stuff like crazy lol, its basically like falling from the sky
Looks like "BRR" chip is "TPS6120x Low Input Voltage Synchronous Boost Converter", costs whole 1$
Word of the day "platypus"
It uses the GPS signal for windfinding.
Bet you didn't know that!
Does anybody know the partnumber and manufacturer of the battery holder? It looks very interesting and I want one :)
Surprised at the high energy consumption. Emptying two primary AA lithium batteries in one flight seems a lot. I would have hoped an efficient design could have used less with a more energy hungry base station. For example a motorized directional tracking antenna to maximize SNR, gold code modulation (like in GPS L1 signals, these can be demodulated at extreme low signal levels), strong ECC to overcome noise (ECC decoding is the energy intense part, but again base station).
The batteries last a lot longer than vaisala claims. The standard maximum runtime configurable in ground check is 8h30min after ballon burst. After that, the batteries are mostly flat but still run ages in remote controls with the advantage they will never leak. Choosing Lithium has more to do with thermal properties than energy density
DAVE Dave Dave, "Dave's not here man!" HEHEHE got your attention?
Here is an update for you regarding my experience with Varta NMiH 15 minute rechargeable AA cells and Eneloop charged on the Varta charger.
I have used 1 set of 1600 mAh Varta 15min (4 ea), and one set of Eneloop 2000mAh in White, recharging as necessary in the 15 minute charger since 2005. This model www.master-instruments.com.au/products/57780/57253%20201%20421.html (Varta 15 minute charge and go I-C3 type 57253 output 1.6 V DC 15 Amp)
I also use an Energiser rechargable compact charger model CHM4AA, a 15 hour charger for two sets of Panasonic 2000 mAh and 1 set of Energizer 2300 mAh
They were all used originally in a series of Digital still cameras like the Fujifilm AV215 and its predecessors, now they are used for clocks and PC mice, keyboards etc.
There were times I needed quick charging of the Panasonic and Energizer, but one Panasonic failed after around 600 charges, and was discarded, it was replaced with another two Panasonic's.
The Sony Eneloop's have been the most resilient as far as holding charge over long shelf times, and charge in 15 minutes the Varta set are still charging in 15 minutes and have over 1200 charge cycles. The Energizers had more power initially but after 14 years they are now down around 1500 mAh.
The 15 minute charger seems to know which type of cell has been placed in it, and only charges the Varta and Eneloop at 15 minutes now, when the Panasonic's were new they also charged at 15 minutes but like I hinted at only for 600 cycles then the charger treated them like regular cells and does 15 hour charges on them now.
As Panasonic has purchased Sony's battery division, Eneloops are now black and marked Panasonic. I do not have any of those.
The above relates to AA cells.
I have six sets of AAA cells two each of Panasonic and two of unbranded white sets from various test equipment, and one set of 'Solar' brand from solar lamps my neighbor discarded. All sets of four cells. I charge the Panasonic's in the 15 minute charger, and the rest in the Energizer. No failures at all after 10 years, I use them in remote controls, computer keyboards, and test equipment.
I hope this is of some use to you Dave. Regards Andrew.
Did you plan to reuse these components ? I ask because they are special and free 👍 thumbs up 👍
I wonder if they are doing there own GPS processing on chip because any off-the-shelf GPS modules shut down if you get above X height or over X speed due to USA restrictions to prevent GPS being used to guide missiles.
Ben Wilson ublox implements it the right way where it is ‘and’ not ‘or’ so no trouble there
@@bazjo Also, ublox isn't in the US and they can sell you completely unrestricted receivers as they wish. Those restrictions on consumer GPS receivers are silly anyways, do they really think that there are no skilled engineers in China or North Korea that could implement one on their own using the RF frontend and an FPGA?
In my experience cellphone GPS works in airplanes near the windows. They go at around 500 MPH at 40,000 feet.
Is there a reason why the battery holder (at 13:57) has two gold-plated contacts and two non-plated ?
RF people: if the "duffle winkle topology" is not a thing make it happen!!!
Bonus points of they manage to make it look like a weiner XD
Thanks for sharing😀👍
Looking forward to the continuing videos on this subject....especially how to hack them to use on Ham Radio frequencies.
73 WB4RHA
Check our our conference talk on this: czcams.com/video/YBy-bXEWZeM/video.html
just programm it xD github.com/darksidelemm/RS41HUP
lol, i though the title was just clickbait, but i thought...'im ahhh clickin' it just cause its that crazy aussie guy. plus i like to see dave constantly balls it up with those envelope packages and get crap everywhere lol
"Isn't that sex on a stick." - LOL!!!!
nice t-shirt, i was just busy with an opamp circuit yesterday
Now if only they were shaped like an EPO glider and in the end of the voyage they would fly to the nearest radiosonde launch station, though... :D
It's not a data out connector but it's the programming connector also used for calibration.
Please do not create interference turning on Radiosondes near launch site.
Giuseppe Maggio The RS41 is only calibrated in the factory and not on-site with the exception of the barometric pressure sensor in SGP models. Indeed it is a data out, it just is not taking very much
@@bazjo www.eurelettronicaicas.com/files/prodotti/vaisala_radiosonde_rs41-sg_and_rs41-sgp_user_guide_m211667en.pdf
@LabCat you are right, but better safe that sorry!
I live near a launch site (8 km), if I turn on a radisonde in the second floor of my house, I'm pretty sure that I can create interference. Whit a poor antenna it's possible to receive a Radiosonde on the ground from about 1km far away ( experience hunting Radiosonde).
We ( Radiosonde hunter) waited a long time to have the possibility to recover Radiosonde, asking vaisalia to modify the default shut down time
I wonder if these could be repurposed as a tracking device for model rockets or drones?
Membrane556 of course. Transmitter works well in the 433MHz ISM Band if you follow the local restrictions, or in the 70 cm HAM Band if you are allowed to use it
OMG, your Rhohde & Schwarz is as big as mine!
Schwarzstucka
I found one of those once. It landed in the parking lot of the hotel I was staying at.
Did you keep it.
@@simontay4851 I held on to it for a while. It was like the more complex one. I think I threw it out when I moved last year though. I should check my parts box.
Maybe it is a transponder. You need the signal from the base station to waken the sonde and send back the data.
It's transmitting continously if turned on, in every second, like the famous sputnik, until kill timer expires, or runs out of battery.
There is PLL inside the STM32 chip, the chip can do 72MHz from this little 24MHz crystal.
I just wonder why they don't extend the plastic to protect the sensors as well, leaving some small holes for them
MFeinstein The sole purpose of this thing is to expose those sensors to the weather at each altitude from ground to airline height, and get the results. Everything else is unwanted overhead.
That's why I said to leave a hole
@@michelfeinstein That still doesn't make any sense. They *want* to expose them to the elements, that's the point.
@@Mythricia1988 as far as I can see the de sensors are small dots in a flexible PCB. I am saying to place the flexible PCB inside a rigid plastic and make vent holes so the temperature and humidity sensors are exposed to air.
Could you do a thorough review of the Micsig STO1104C? Battery life, etc.
Poke around on the GPS chip see if you get anything out of it. Could be interesting :)
Would it spit NMEA sentences out, or raw timing data?
Azy GPS Data can be read out, you can even reconfigure the chip with the original ublox software. Just cut the traces between GPS and MCU and connect a UART/USB adapter
The letter opener.... XD
Everyone and their dog knows a dupawinkle topology! Come on Dave, don't underestimate us!
Looking a little sun burned Dave!
0:24 OUCH!
Does anyone remember the meteorological sonds that had a couple of subminiture tubes? They had a plate battery that was soaked in water just before takeoff for activation.
LutzSchafer the RS92 also used a water activated battery at first, the alkaline pack was used by automated stations. The tube equipped sondes I own use two dry stack batteries with a ridiculous voltage like 40V in series...
I had one found about 1 week ago xD with miniature vacuum tube by searching for an RS41.
... so there is 123K results for "Doffa-winkle topology"
The water keeps the RH sensor damp. RH is figured by the difference between a wet bulb thermometer and a dry bulb.
nope thats just against freezing,...
More info about RS92: brmlab.cz/project/weathersonde/start
nice! i want one!...unfortunatly theres hardly ever going to be any falling from the sky around here...from the info ive seen the closest launches are from Williamstown..would be very lucky to get one travel north north-east from there i think!...may have some chance of getting one the from the east, Lord Howe Island...if it makes it across 600kms of ocean! LOL..but no car to go hunt it down...so ill probably never see one :(
Yeah, ones in Sydney tend to travel out to sea
Never looked but I bet they show up on eBay now & again... I think if I really wanted one, I'd set up an eBay 'saved search'.
@@EEVblog You do get the occasional few days flights with land on land. You can run flight predictions at: predict.habhub.org/ The auto_rx receiver in Sydney doesn't have a very good receive setup, so flights aren't tracked down to the ground often - we definitely need more receiver stations there!
@@markjessop8536 Radiosondy.info raspberry image and go on Worldwide network
When I first saw it I thought that thermometer was a hot wire anemometer. Then again there's not really much point to one of those as any wind would just blow the whole device around.
ManWithBeard1990 exactly, wind speed is measured by tracking the speed of ballon+sonde themselves via GPS
Michael and I did a conference presentation on how we track and recover these, which is available here: czcams.com/video/YBy-bXEWZeM/video.html
I really need one of those
Did it pump out any RF packets when you got a GPS lock?
It pumps out RF as soon as you power it on, however, it only gives a short serial readout on power up and has no active rx as long as you are not connecting external sensors
It should have, I tested that one before sending it to Dave
It fun to see it stated that they are harmless. Of course they are the you kids say, well that was not the case several years back. Then they used an custom made very simple acid.lead battery like in a car and that contained sulfuric acid that is of course not good to get on you. Now they just use ordinary batteries, I don't know why that wasn't the case before.
Were they programmed to self-destruct, like the tape recorders in Mission Impossible, emitting 'magic smoke' ?
Alan Smith You can set a timer for turn off while groundcheck. Often only the data from ascent is used, and when a sounding fails, you need to have an additional frequency for another launch attempt