Vaisala 维萨拉 RS41 无线电探空仪的逆向工程_设计_文档_相关文件_下载

# RS41 Hardware For general information about radiosondes [Wikipedia](https://en.wikipedia.org/wiki/Radiosonde). For more information about the RS41 [my website](https://sondehunt.de/language/en/vaisala-rs41). The blockwise structure of the RS41 is described in the following. The schematic in Eagle format, Logic Analyzer recordings of the functional blocks and high-resolution scans of the printed circuit boards are also provided. The examination of the RPM411 daughter board with barometric sensor and the OIF411 Ozone interface can be found, as soon as available, in the separate subfolders. Pull requests with improvements, translations and bug fixes are welcome! # ToDo - [ ] identify unidentified components - [ ] find unknown connections - [ ] identify values of passive components - [ ] find out which of the resistors entered in the schematic are in fact ESD-Surpressors etc.. - [ ] front end measurement in the climate chamber - [ ] detailed description of the SPI bus - [ ] detailed description of the UART between GPS and MCU - [ ] functional investigation NFC interface - [ ] sniffing of communication between RI41 Groundcheck Device and RS41 - [ ] receive and reverse flashdump of the controller # Introduction The sonde is to be divided into six functional blocks, which are highlighted in the following picture. * [Power Supply](#powersupply) * [Microcontroller](#microcontroller) * [Front end](#frontend) * [GPS](#gps) * [Radio](#radio) * [Interface](#interface) Reverse engineering is complicated by the fact that the circuit board has four layers. # Powersupply  The power supply can be divided into three parts * a boost converter generates 3.8 V from the variable battery voltage * three Low Dropout Regulators (LDOs) each generate a 3 V rail for different blocks * a hard-wired logic determines the operating state of the boost converter and thus of the sonde ## Boost converter A [TPS61200](http://www.ti.com/lit/ds/symlink/tps61200.pdf) `U502` from TI is used for the boost converter, whose circuitry corresponds to the typical application. The input circuit contains an SMD fuse `R502` and a clamping diode `D501`. Between battery and boost converter there is a P-channel MOSFET `Q501`, which is closed by the pull-up resistor `R501` during storage. `Q501` can be opened or closed by a hardwired logic (see below) to switch the sonde on or off. ## LDOs [TVS70030](http://www.ti.com/lit/ds/symlink/tlv700-q1.pdf) from TI are used. `U501` generates the voltage for the microcontroller (MCU), `U503` for the measurement frontend and `U504` for the GPS module. Pin 4 of the LDOs, which is NC according to the data sheet, is decoupled against ground, probably so that pin compatible versions like the [MAX8887](https://datasheets.maximintegrated.com/en/ds/MAX8887-MAX8888.pdf) can be used. ## Hard wired logic The P-channel MOSFET Q501 discussed above is controlled by an N-channel MOSFET `Q502`. * The sonde is on when this transistor is closed, which means its gate is HIGH. * The sonde is off when this transistor is open, which means its gate is LOW. Via `R506` and `D502` a one-way rectified signal from the NFC coil reaches the gate. This allows the probe to be switched on via NFC. Furthermore this signal is also used for communication with the RI41 Groundcheck Device and via the voltage divider `R510` and `R514`/`C525` brought to the MCU. Once the sonde is switched on, it is kept in this state by the switched battery voltage, which is fed to the gate via `R505`. To switch it off again, the MCU can close the N-channel MOSFET `Q503`, which brings the gate from `Q502` to LOW. The button at the bottom of the probe `S501` switches the gate from `Q502` via `R507` to HIGH. The microcontroller can also query the status of the button, the gate voltage of `Q502` is fed via the voltage dividers `R506` and `R512`/`C524` to an ADC input of the MCU for this purpose. The lower voltage drop via `R507`, which leads to a higher gate voltage when this is pressed, is evaluated here. Finally, the battery voltage itself can also be evaluated by the MCU via the voltage dividers `R508` and `R512`/`C524`. # Microcontroller  The microcontroller is a [STM32F100C8](https://www.st.com/resource/en/datasheet/stm32f100c8.pdf) `U101` from ST in LQFP48 package, which gets its clock from the 24 MHz crystal `X101`. Apart from the fact that all IO pins are used, it is only worth mentioning that RC low pass filters are present at many outputs. # Frontend  ## Circuit arrangement Mechanically, the front end consists of the sensor boom, which is made of Flex PCB material covered with silver paint and connected to the board with a 20-pin FPC connector. The sensor boom includes a PT1000 temperature sensor, which is designed as a wire (the characteristic 'hook'), and a ceramic hybrid module to measure humidity. It combines three functions * Measurement of air humidity using a capacitive hygrometer (dielectric constant of the hydrophilic dielectric changes and thus the capacitance of the capacitor over the measuring range. * Measurement of the temperature of the module using a PT1000 as a feedback variable for controlling the module heating. * Module heating via a thick film resistor. During flight, the module is kept 5 K above ambient to prevent condensation. During the preflight check it is heated to remove impurities and to perform a zero humidity check. There is no on-site calibration in the Ground Check Device for temperature. In addition, two reference resistors `R208` and `R209`, one reference capacitor `C209`, five heating resistors `R201-205` and the MOSFETs `Q203-204,` required to control these resistors, as well as an unidentified component `R209`, which could be a thermistor, are available on an area delimited by milled slots from the rest of the printed circuit board. No heating of the references could be observed in tests at room temperature. ## Circuit topology Electrically seen, the frontend consists of two ring oscillators for temperature and humidity, whose frequency is varied by variable impedances (e.g. the sensors) inserted into the feedback path with the help of analog switches. Each ring oscillator is formed by 3/6 of a [74HCU04](https://assets.nexperia.com/documents/data-sheet/74HCU04.pdf) Hex Inverter `U205`. Three inverters are connected in series. The first and third inverter are feedbacked directly via an RC series element `C207`/`R210`, `R214`/`C215`, `C208`/`R211`, `R215`/`C216`, the entire ring oscillator via a capacitor `C212`, `C213`. Both ring oscillators can be pulled to +3 V by a P-channel MOSFET `Q201`, `Q202` at the first inverter with separate control, which corresponds to ground at the output, to deactivate them. The heating resistors for the reference, which can be activated by closing `Q203`, `Q204` with closed P-channel MOSFETs `Q201`, `Q202`, are also located at the input of the inverters. The feedback path for the temperature measurement consists of 2/3 buffers of a [74LVC3G34] (https://assets.nexperia.com/documents/data-sheet/74LVC3G34.pdf) `U207` and two resistors `R219` and `R223`, which probably are used for the fine tuning of the resonance frequency. This is followed by four single pole single throw (SPST) switches [TS3A4751](http://www.ti.com/lit/ds/symlink/ts3a4751.pdf) `U201`, the NO of which is connected to the output of the buffer and which each switch one of the four possible measuring resistors (temperature/humidity/Ref1/Ref2) into the feedback path. The measuring tap is located between buffer and switch with a series resistor `R224`. In the feedback path of the humidity measurement there is a circuit formed by the remaining buffer and two resistors `R226` and R220. The measuring tap is made exactly like in the tem