Vaisala RS92-SGPD firmware

Sonde have 32KB EEPROM chip. Chip contains (probably) some firmware binary patches for VLSI DSP chip, configuration (transmitting frequency, name, callibration data, ..) and others.

EEPROM can be dumped trought servicing connector (flat one). Anny SPI can be used in configuration 00. Digital IO use 2.8V logic, but inputs are 3.3 V tollerant. As power supply can be used anny source in range 4.7-10 V. Voltages bellow cca 7V will result in power-saving mode, but this does not matter for interfacing with EEPROM. Wiring for Bus Pirate is bellow.

Pin RESET must be pulled-down for al least 2 second before anny other operation can start.

Python script for EEPROM dump

http://nat.brmlab.cz/project/weathersonde/buspirate_dump_eeprom.py

TODO: eeprom manipulation scripts and tools

The sonde first used 250kHz clock to read bytes from EEPROM up to addres 376 (included). Then switches to faster bus speed (2MHz).

Address space in EEPROM can be visualy divided into severall subblocks. Each subblock is separeted from others by wide field of 0x00. Start address of block shows nice alignment to multiple of 0x100 +- frew bytes, those bytes might be missalignment, or more probably footer of previous block.

• series of blobs loaded into X and program memmory

// Structure description in pseudocode
const uint256_t eeprom[32768]; // EEPROM content
int idx = 0;  
while (eeprom[idx] == 1) {
  int data_len = eeprom[idx+1] | (eeprom[idx+2] << 8);
  int addr = eeprom[idx+3] | (eeprom[idx+4] << 8);
  // copy data: X[addr]..X[addr+data_len] = eeprom[idx+5]..eeprom[idx+5+data_len]
  // but some trick for writing program memmory are probably involved
  idx += 5 + data_len;
}
// end of content
if (eeprom[idx] == 3) {
  data_len = eeprom[idx+1] | (eeprom[idx+2] << 8);
  // data_len souhld be 0
  addr = eeprom[idx+3] | (eeprom[idx+4] << 8);
  goto addr;
}

• data_len - bytes to copy into memory
• addr - data destination address in X memory (instruction memory should be mapped to X+0x2000)

• VS_DSP v2 Users manual (this one is used in sonde CPU)
• VS_DSP v4 Users manual

This block is compressed. Compression algirithm is rather simple, replaces identical sequences of data with copy-from operation.

struct compressed_block_t {
  chunk_t chunk1;
  ...
  chunk_t chunkN;
  chunk_t chunk_exec;    // chunks repeats until EOF chunk is found
}

struct chunk_t {
  chunk_header_t chunk_header;
  uint8_t chunk_data[];         // chunk size varies and ends with EOF code
}

struct chunk_header_t {
  uint8_t prefix;      // prefix code used for decompression
  uint1_t bus_type;    // (top bit of address word) 0 => X bus, 1 => Y
  uint15_t address;    // block destionation address
  uint8_t prefix_size; // size of prefix in bites, 0xff for EOF
}

• chunk_data are read as bite stream

This block (512B long) is repeatedly broadcasted by sonde, in first part of frame.

see Callibration data for details

TODO: (verification needed)

• 4B header
• 42B superblock
• 7 * 6B - block

• ST4
  • 0 - low power Tx?
  • 1 - medium power Tx?
  • 2 - normal sonde operation
  • 3 - no Tx, set by FW when battery is low (eg bellow 6 or 7 V, not sure) for some time (100 frames?), sonde stop transmitting

• http://blog.darklomax.org/?p=56
• http://forum.radiosonda.sk/viewtopic.php?f=11&t=22