This is an old revision of the document!


Vaisala RS92-SGPD firmware

Sonde have 32KB EEPROM chip. Chip contains (probably) some firmware for VLSI DSP chip and configuration options like transmitting frequency, tag (name) and others.

Dumping EEPROM with Bus Pirate

TODO: this approach is not reliable, for some sonds it returns always 0xff pattern. (investigation needed)

EEPROM can be dumped trought servicing connector (flat one). Anny SPI with low voltage outputs (2.8 V optimal, 3.3 V tested, might be 5 V tollerant) and 4.7-10 V power output can be used. Wiring for Bus Pirate is bellow. 5 V is not sufficient for sonde to operate properly, it put it-self into stand-by mode, but this does not matter.

Bus Pirate pin Vaisala probe pin
GND 1 - GND
+3V3 NC
+5V 2 - VCC
ADC NC
Vpu NC
AUX 12 - RESET
CLK 10 - SPI_CLK
MOSI 9 - SPI_MOSI
CS 8 - SPI_SS_EEPROM
MISO 11 - SPI_MISO

Python script for EEPROM dump

http://nat.brmlab.cz/project/weathersonde/buspirate_dump_eeprom.py

TODO: eeprom manipulation scripts and tools

EEPROM

address space description

Address space in EEPROM can be visualy divided into severall subblocks. Each subblock is separeted from others by wide field of 0x00. Start address of block shows nice alignment to multiple of 0x100 +- frew bytes, those bytes might be missalignment, or more probably footer of previous block.

start address end address name description
0x0000 0x0018 blob 0 EEPROM description table, boot loader?
0x00?? 0x07FF blob 1 boot loader?
0x0800 0x4FFF blob 2 code ? (high entropy)
0x5000 0x6FFF blob 3 code ? (high entropy)
0x7000 0x71FF blob 4 - configuration and callibration
0x7200 0x79FF blob 5 - may be a log?
0x7A00 0x7FFF blob 6 - runtime information?

blob 1

  • it can be split into 2 parts
    • part1: start-0x12? - VLSI Solution VSDSP code - version unknown
    • part2: 0x12?-end - VLSI Solution VSDSP code, but at some point shifted by 2 bytes

blob 4 - configuration and calibration

This block (512B long) is repeatedly broadcasted by sonde, in first part of frame.

see software for details

blob 5 - log

TODO: (verification needed)

  • 4B header
  • 42B superblock
  • 7 * 6B - block

blob 6 - status

address symbol meanign
0x7A02 - 0x7A03 DOWN_CNT have something todo with frame count?
0x7A04 ST4 operation status
  • ST4
    • 0 - ?
    • 1 - ?
    • 2 - sonde is operating
    • 3 - set when battery is low (eg bellow 6 or 7 V, not sure) for some time (eg 100 frames?), sonde stop transmitting

dumps

start date (UTC) ID type start location EEPROM dump
2013-02-25 00:00 H2813056 RS92-SGPD CZ, Prague - Libuš http://nat.brmlab.cz/project/weathersonde/cz_prague_2013_05_1xTtt.bin
2013-07-03 00:00 H4043220 RS92-SGPD CZ, Prague - Libuš TODO
 
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial-Share Alike 3.0 Unported
Recent changes RSS feed Donate Powered by PHP Valid XHTML 1.0 Valid CSS Driven by DokuWiki