Differences

This shows you the differences between two versions of the page.

--- project:weathersonde:firmware [2013/06/26 19:25] – pinky
+++ project:weathersonde:firmware [2015/01/15 13:07] – update power status pinky
@@ Line 1: / Line 1: @@
+ ====== Vaisala RS92-SGPD firmware  ======
+Sonde have 32KB EEPROM chip. Chip contains (probably) some firmware binary patches for VLSI DSP chip, configuration (transmitting frequency, name, callibration data, ..) and others.
+===== Dumping EEPROM with Bus Pirate =====
+EEPROM can be dumped trought servicing connector (flat one). Anny SPI can be used in configuration 00. Digital IO use 2.8V logic, but inputs are 3.3 V tollerant. As power supply can be used anny source in range 4.7-10 V. Voltages bellow cca 7V will result in power-saving mode, but this does not matter for interfacing with EEPROM. Wiring for Bus Pirate is bellow.
+Pin RESET must be pulled-down for al least 2 second before anny other operation can start.
+^ Bus Pirate pin ^ Vaisala probe pin ^
+| GND | 1 - GND |
+| +3V3 | NC |
+| +5V | 2 - VCC |
+| ADC | NC |
+| Vpu | NC |
+| AUX | 12 - RESET |
+| CLK | 10 - SPI_CLK |
+| MOSI | 9 - SPI_MOSI |
+| CS | 8 - SPI_SS_EEPROM |
+| MISO | 11 - SPI_MISO |
+Python script for EEPROM dump
+[[http://nat.brmlab.cz/project/weathersonde/buspirate_dump_eeprom.py]]
+TODO: eeprom manipulation scripts and tools
+== notes ==
+The sonde first used 250kHz clock to read bytes from EEPROM up to addres 376 (included). Then switches to faster bus speed (2MHz).
+===== EEPROM =====
+==== address space description ====
+Address space in EEPROM can be visualy divided into severall subblocks.
+Each subblock is separeted from others by wide field of 0x00.
+Start address of block shows nice alignment to multiple of 0x100 +- frew bytes, those bytes might be missalignment, or more probably footer of previous block.
+^ start address ^ end address ^ name ^ description ^
+| 0x0000 | 0x07FF | blob 1 | firmware, stage 2 bootloader |
+| 0x0800 | 0x4FFF | blob 2 | firmware, compressed image of X and Y memory (I memory is mapped to X) |
+| 0x5000 | 0x6FFF | blob 3 | high entropy, (compressed?) |
+| 0x7000 | 0x71FF | blob 4 | configuration and callibration |
+| 0x7200 | 0x79FF | blob 5 | event log? |
+| 0x7A00 | 0x7FFF | blob 6 | runtime status? |
+==== blob 1 - stage 2 bootloader ====
+  * series of blobs loaded into X  and program memmory
+  // Structure description in pseudocode
+  const uint256_t eeprom[32768]; // EEPROM content
+  int idx = 0;
+  while (eeprom[idx] == 1) {
+    int data_len = eeprom[idx+1] | (eeprom[idx+2] << 8);
+    int addr = eeprom[idx+3] | (eeprom[idx+4] << 8);
+    // copy data: X[addr]..X[addr+data_len] = eeprom[idx+5]..eeprom[idx+5+data_len]
+    // but some trick for writing program memmory are probably involved
+    idx += 5 + data_len;
+  }
+  // end of content
+  if (eeprom[idx] == 3) {
+    data_len = eeprom[idx+1] | (eeprom[idx+2] << 8);
+    // data_len souhld be 0
+    addr = eeprom[idx+3] | (eeprom[idx+4] << 8);
+    goto addr;
+  }
+  * data_len - bytes to copy into memory
+  * addr - data destination address in X memory (instruction memory should be mapped to X+0x2000)
+  * [[http://nat.brmlab.cz/project/weathersonde/vsdsp2_um.pdf|VS_DSP v2 Users manual]] << this one is used in sonde CPU
+  * [[http://nat.brmlab.cz/project/weathersonde/vsdsp4_ump.pdf|VS_DSP v4 Users manual]]
+==== blob 2 ====
+This block is compressed. Compression algirithm is rather simple, replaces identical sequences of data with copy-from operation.
+  struct compressed_block_t {
+    chunk_t chunk1;
+    ...
+    chunk_t chunkN;
+    chunk_t chunk_exec;    // chunks repeats until EOF chunk is found
+  }
+  struct chunk_t {
+    chunk_header_t chunk_header;
+    uint8_t chunk_data[];         // chunk size varies and ends with EOF code
+  }
+  struct chunk_header_t {
+    uint8_t prefix;      // prefix code used for decompression
+    uint1_t bus_type;    // (top bit of address word) 0 => X bus, 1 => Y
+    uint15_t address;    // block destionation address
+    uint8_t prefix_size; // size of prefix in bites, 0xff for EOF
+  }
+  * chunk_data are read as bite stream
+==== blob 4 - configuration and calibration ====
+This block (512B long) is repeatedly broadcasted by sonde, in first part of frame.
+see [[telemetry_decoding#Callibration data]] for details
+==== blob 5 - log ====
+TODO: (verification needed)
+  * 4B header
+  * 42B superblock
+  * 7 * 6B - block
+=== blob 6 - status ===
+^ address ^ symbol ^ meanign ^
+| 0x7A02 - 0x7A03 | DOWN_CNT | have something todo with frame count? |
+| 0x7A04 | ST4 | operation status |
+  * ST4
+    * 0 - low power Tx?
+    * 1 - medium power Tx?
+    * 2 - normal sonde operation
+    * 3 - no Tx, set by FW when battery is low (eg bellow 6 or 7 V, not sure) for some time (100 frames?), sonde stop transmitting
+==== dumps ====
+^ start date (UTC) ^ ID ^ type ^ start location ^ EEPROM dump ^
+| 2013-02-25 00:00 | H2813056 | RS92-SGPD | CZ, Prague - Libuš | [[http://nat.brmlab.cz/project/weathersonde/cz_prague_2013_05_1xTtt.bin]] |
+| 2013-07-03 00:00 | H4043220 | RS92-SGPD | CZ, Prague - Libuš | TODO |
+===== related links =====
+  * [[http://blog.darklomax.org/?p=56]]
+  * [[http://forum.radiosonda.sk/viewtopic.php?f=11&t=22]]