OM3BC's page of RS41's:
http://www.om3bc.com/docs/rs41/rs41_en.htmlGithub of a polish firmware:
https://github.com/Qyon/STM32_RTTYAustralian fork of those:
https://github.com/darksidelemm/RS41HUPOther interesting project:
https://github.com/darksidelemm/RS41FOX (search RS41 at github!)
Open source receivers:
https://github.com/rs1729/RS/tree/master/rs41Hardware analysis with schematics by Bazjo:
https://github.com/bazjo/RS41_HardwareBazjo's radiosonde page:
https://sondehunt.de/language/en/vaisala-rs41My analysis of the RS41, written by a year ago for a radiosonde related, closed group:
Most important parts:
STM32F100C8T6B CPU (same as DFM-09) with a 24MHz XTAL. (important to turn off the PLL clock and connect SYSCLK directly to HSE in the init script!)
Silicon Labs Si4032 radio NOTE! 26MHz clock from GPS, instead of 30 MHz! Frequency calculations differ from datasheet!
U-blox UBX-G6010-ST GPS chipset
TPS61202 Boost-converter, set to 3.6V
3V LDO's for each main unit (radio, GPS, CPU, sensors) marked "A811" (unknown type, ~LP2985). Later versions: mark ODM, TLV70030DDCR
Power distribution: 2xAA batteries (Energizer L91), with a FET power switch to the main boost converter. Then, the power is distributed to the main 3.6V rail, feeding the LDO's. Power ON FET can be turned off by CPU by PA12. Power is also enabled by hardware on NFC reception or pressing the ON button.
Battery voltage can be monitored by ADC value on PA5. The different sections have separate LDO's from the rail.
User interface: a pushbutton (hardwired to PWR_ON FET. Button press can be read by the ADC value of PA6), two LED's (red - PB8, green - PB7).
Peripherials:
GPS: connected to UART1
Radio: Connected to SPI2, Chip select:software NSS, MCU PIN2 / PC13
UART3 is available directly on the 10-pin connector. USART2 is not available, its pins are used for the sensor circuit.
NFC interface: operated by software, only a few parts (fast diodes & transistors) are used to interface with the NFC loop. A similar solution can be seen HERE or HERE
Analog section:
DG9411 (code 4DVA, SC-70 package) and TS3A4751PWR (YC751) CMOS switches used for switching the measured signals.
For buffering/inverting the CMOS signals, a 74LVC3G34DC (TSSOP-08 code Y34) and a 74hcu04 is used.
There is also an unknown part coded Z27B, 6-pin SC-70 package. UPDATE: it may be an NC7SZ27 3-input OR gate, but it has triangle waves on it, so it may be an analogue switch or op. amplifier.
Sensors: the RS41 has the most advanced sensors compared to its competitiors. The old "thermocap" temperature measurement capacitor used on RS92 family is replaced by a platinum thermistor. The glass-based humidity sensor is also improved, it has 3 main parts: capacitive humidity sensor, a temperature compensation resistor, and a heating resistor. The humidity sensor can be heated periodically, removing the moisture from the sensor. The RS41 has only one humidity sensor, while the older RS92 has two of them, one in pre-heating, and one in measurement stage. This method, when the sensor heating can be enabled / disabled by software, power usage can be minimized. DFM09 and M10 don't have a heated humidity sensor, so crossing and leaving clouds can cause invalid humidity data. Heating can be turned on/off by MCU PIN 46 (PB9).
The sensor data is encoded as pulses. When the selector pins are altered by the MCU, the analog part sends back pulses to the MCU port PA1. The temperature readout is doubled in every measurement cycle. Humidity sensor has two reference capacitors.
Optional pressure sensor module (RPM411):
This module is installed in the RS41-SGP model. The module has an additional STM32F100C8T6 MCU, which is connected to the sonde MCU by an SPI connection, with a separate chip select line. Parameters are read in every second.
The pressure is sensed by a Barocap(tm), with a 15pF reference capacitor. The module has also an NTC temperature sensor.
IC's on the board are almost the same models used on sonde PCB, CMOS switches, 3V LDO, and precision op amps.
RPM411 and external dataflash (RS41-SGM) cannot be used together, because both peripherials are using same Chip Select. (PB2 of main MCU).
Optional 8mbit (1MByte) M25PE80VP flash memory used on military models for delayed transmission. This SO-08 packaged memory chip is also connected to SPI2, and using PB2 for chip select.
Sonde connector UART works on 9600bps / 8 / N / 1
it gives a simple response during poweron, but no terminal is available, it doesn't react on keystrokes.
It may react on NFC commands. The NFC coil is connected to PA11 / PB0 pins of the MCU. I think, coil energization triggers an interrupt on PA11 (EXTERNAL INTERRUPT #11), and the sonde MCU can pull down the coil load by raising PB0 (as GPIO or as a timer output compare).
So a simple NFC protocol may be implemented by software.
The coil is also connected to the power on circuit by a simple switching diode, to turn the sonde on if the launch station wants to communicate.
Vaisala RS41 Radiosonde SW V2.02.14
Copyright (c) Vaisala Oyj 2016. All rights reserved.
Serial number: P231xxxx
Pressure module serial number: P222xxxx SW V2.01
Transmitter frequency: 403.00 MHz
Transmitter power: 3/7
Enabled TX
STM32Cube project file (save as .ioc)
#MicroXplorer Configuration settings - do not modify
ADC1.Channel-0\#ChannelRegularConversion=ADC_CHANNEL_TEMPSENSOR
ADC1.IPParameters=Rank-0\#ChannelRegularConversion,Channel-0\#ChannelRegularConversion,SamplingTime-0\#ChannelRegularConversion,NbrOfConversionFlag,master
ADC1.NbrOfConversionFlag=1
ADC1.Rank-0\#ChannelRegularConversion=1
ADC1.SamplingTime-0\#ChannelRegularConversion=ADC_SAMPLETIME_1CYCLE_5
ADC1.master=1
File.Version=6
KeepUserPlacement=false
Mcu.Family=STM32F1
Mcu.IP0=ADC1
Mcu.IP1=NVIC
Mcu.IP2=RCC
Mcu.IP3=SPI2
Mcu.IP4=SYS
Mcu.IP5=USART1
Mcu.IP6=USART3
Mcu.IPNb=7
Mcu.Name=STM32F100C(8-B)Tx
Mcu.Package=LQFP48
Mcu.Pin0=PC13-TAMPER-RTC
Mcu.Pin1=PC14-OSC32_IN
Mcu.Pin10=PA5
Mcu.Pin11=PA6
Mcu.Pin12=PA7
Mcu.Pin13=PB0
Mcu.Pin14=PB1
Mcu.Pin15=PB2
Mcu.Pin16=PB10
Mcu.Pin17=PB11
Mcu.Pin18=PB12
Mcu.Pin19=PB13
Mcu.Pin2=PC15-OSC32_OUT
Mcu.Pin20=PB14
Mcu.Pin21=PB15
Mcu.Pin22=PA8
Mcu.Pin23=PA9
Mcu.Pin24=PA10
Mcu.Pin25=PA11
Mcu.Pin26=PA12
Mcu.Pin27=PA13
Mcu.Pin28=PA14
Mcu.Pin29=PA15
Mcu.Pin3=PD0-OSC_IN
Mcu.Pin30=PB3
Mcu.Pin31=PB4
Mcu.Pin32=PB5
Mcu.Pin33=PB6
Mcu.Pin34=PB7
Mcu.Pin35=PB8
Mcu.Pin36=PB9
Mcu.Pin37=VP_ADC1_TempSens_Input
Mcu.Pin38=VP_SYS_VS_ND
Mcu.Pin39=VP_SYS_VS_Systick
Mcu.Pin4=PD1-OSC_OUT
Mcu.Pin5=PA0-WKUP
Mcu.Pin6=PA1
Mcu.Pin7=PA2
Mcu.Pin8=PA3
Mcu.Pin9=PA4
Mcu.PinsNb=40
Mcu.UserConstants=
Mcu.UserName=STM32F100C8Tx
MxCube.Version=4.22.0
MxDb.Version=DB.4.0.220
NVIC.BusFault_IRQn=true\:0\:0\:false\:false\:true
NVIC.DebugMonitor_IRQn=true\:0\:0\:false\:false\:true
NVIC.HardFault_IRQn=true\:0\:0\:false\:false\:true
NVIC.MemoryManagement_IRQn=true\:0\:0\:false\:false\:true
NVIC.NonMaskableInt_IRQn=true\:0\:0\:false\:false\:true
NVIC.PendSV_IRQn=true\:0\:0\:false\:false\:true
NVIC.PriorityGroup=NVIC_PRIORITYGROUP_4
NVIC.SVCall_IRQn=true\:0\:0\:false\:false\:true
NVIC.SysTick_IRQn=true\:0\:0\:false\:false\:true
NVIC.UsageFault_IRQn=true\:0\:0\:false\:false\:true
PA0-WKUP.GPIOParameters=GPIO_Label
PA0-WKUP.GPIO_Label=NFC_FIELD
PA0-WKUP.Locked=true
PA0-WKUP.Signal=S_TIM2_CH1_ETR
PA1.GPIOParameters=GPIO_Label
PA1.GPIO_Label=INPUT_MEASURED_VALUE_COUNT
PA1.Locked=true
PA1.Signal=GPXTI1
PA10.GPIOParameters=GPIO_Label
PA10.GPIO_Label=GPS_RX
PA10.Mode=Asynchronous
PA10.Signal=USART1_RX
PA11.GPIOParameters=GPIO_Label
PA11.GPIO_Label=NFC_CARRIER_DETECT_EXT_IRQ11
PA11.Locked=true
PA11.Signal=GPXTI11
PA12.GPIOParameters=GPIO_Label
PA12.GPIO_Label=POWER_OFF
PA12.Locked=true
PA12.Signal=GPIO_Output
PA13.Locked=true
PA13.Signal=SYS_JTMS-SWDIO
PA14.Locked=true
PA14.Signal=SYS_JTCK-SWCLK
PA15.GPIOParameters=GPIO_Label
PA15.GPIO_Label=GPS_RESET
PA15.Locked=true
PA15.Signal=GPIO_Output
PA2.GPIOParameters=GPIO_Label
PA2.GPIO_Label=HUMI_MODE_SELECT_START
PA2.Locked=true
PA2.Signal=GPIO_Output
PA3.GPIOParameters=GPIO_Label
PA3.GPIO_Label=T_MEAS_SEL0
PA3.Locked=true
PA3.Signal=GPIO_Output
PA4.GPIOParameters=GPIO_Label
PA4.GPIO_Label=ADC_IN4_OPTIONAL_INTERNAL_TEMP
PA4.Locked=true
PA4.Signal=ADCx_IN4
PA5.GPIOParameters=GPIO_Label
PA5.GPIO_Label=ADC_IN5_VBAT
PA5.Locked=true
PA5.Signal=ADCx_IN5
PA6.GPIOParameters=GPIO_Label
PA6.GPIO_Label=ADC_IN6_BUTTON
PA6.Locked=true
PA6.Signal=ADCx_IN6
PA7.GPIOParameters=GPIO_Label
PA7.GPIO_Label=ADC1_IN7_HEATING_MONITOR
PA7.Locked=true
PA7.Signal=ADCx_IN7
PA8.GPIOParameters=GPIO_Label
PA8.GPIO_Label=RCC_MCO_TO_PRESSURE_MODULE
PA8.Mode=Clock-out
PA8.Signal=RCC_MCO
PA9.GPIOParameters=GPIO_Label
PA9.GPIO_Label=GPS_TX
PA9.Mode=Asynchronous
PA9.Signal=USART1_TX
PB0.GPIOParameters=GPIO_Label
PB0.GPIO_Label=NFC_LOAD_COIL_BGD_BASE
PB0.Locked=true
PB0.Signal=GPIO_Output
PB1.GPIOParameters=GPIO_Label
PB1.GPIO_Label=EXT_PIN4
PB1.Locked=true
PB1.Signal=GPIO_Input
PB10.GPIOParameters=GPIO_Label
PB10.GPIO_Label=EXT_USART_TX_PIN3
PB10.Mode=Asynchronous
PB10.Signal=USART3_TX
PB11.GPIOParameters=GPIO_Label
PB11.GPIO_Label=EXT_USART_RX_PIN2
PB11.Mode=Asynchronous
PB11.Signal=USART3_RX
PB12.GPIOParameters=GPIO_Label
PB12.GPIO_Label=TEMP_MODE_SELECT_START
PB12.Locked=true
PB12.Signal=GPIO_Output
PB13.Mode=Full_Duplex_Master
PB13.Signal=SPI2_SCK
PB14.Mode=Full_Duplex_Master
PB14.Signal=SPI2_MISO
PB15.Mode=Full_Duplex_Master
PB15.Signal=SPI2_MOSI
PB2.GPIOParameters=GPIO_Label
PB2.GPIO_Label=PRESSURE_DATAFLASH_NSS
PB2.Locked=true
PB2.Signal=GPIO_Output
PB3.GPIOParameters=GPIO_Label
PB3.GPIO_Label=HUMI_SEL0
PB3.Locked=true
PB3.Signal=GPIO_Output
PB4.GPIOParameters=GPIO_Label
PB4.GPIO_Label=HUMI_SEL1
PB4.Locked=true
PB4.Signal=GPIO_Output
PB5.GPIOParameters=GPIO_Label
PB5.GPIO_Label=HUMI_SEL2
PB5.Locked=true
PB5.Signal=GPIO_Output
PB6.GPIOParameters=GPIO_Label
PB6.GPIO_Label=T_MEAS_SEL1
PB6.Locked=true
PB6.Signal=GPIO_Output
PB7.GPIOParameters=GPIO_Label
PB7.GPIO_Label=GREEN_LED
PB7.Locked=true
PB7.Signal=GPIO_Output
PB8.GPIOParameters=GPIO_Label
PB8.GPIO_Label=RED_LED
PB8.Locked=true
PB8.Signal=GPIO_Output
PB9.GPIOParameters=GPIO_Label
PB9.GPIO_Label=HUMIDITY_HEATING_ON
PB9.Locked=true
PB9.Signal=GPIO_Output
PC13-TAMPER-RTC.GPIOParameters=GPIO_Label
PC13-TAMPER-RTC.GPIO_Label=RADIO_NSS
PC13-TAMPER-RTC.Locked=true
PC13-TAMPER-RTC.Signal=GPIO_Output
PC14-OSC32_IN.GPIOParameters=GPIO_Label
PC14-OSC32_IN.GPIO_Label=T_MEAS_SEL_HUMITEMP
PC14-OSC32_IN.Locked=true
PC14-OSC32_IN.Signal=GPIO_Output
PC15-OSC32_OUT.GPIOParameters=GPIO_Label
PC15-OSC32_OUT.GPIO_Label=T_MEAS_SEL_MAINTEMP
PC15-OSC32_OUT.Locked=true
PC15-OSC32_OUT.Signal=GPIO_Output
PCC.Checker=false
PCC.Line=STM32F100 Value Line
PCC.MCU=STM32F100C(8-B)Tx
PCC.PartNumber=STM32F100C8Tx
PCC.Seq0=0
PCC.Series=STM32F1
PCC.Temperature=25
PCC.Vdd=3.3
PD0-OSC_IN.Mode=HSE-External-Oscillator
PD0-OSC_IN.Signal=RCC_OSC_IN
PD1-OSC_OUT.Mode=HSE-External-Oscillator
PD1-OSC_OUT.Signal=RCC_OSC_OUT
PinOutPanel.RotationAngle=0
RCC.ADCFreqValue=12000000
RCC.AHBFreq_Value=24000000
RCC.APB1Freq_Value=24000000
RCC.APB1TimFreq_Value=24000000
RCC.APB2Freq_Value=24000000
RCC.APB2TimFreq_Value=24000000
RCC.FCLKCortexFreq_Value=24000000
RCC.FamilyName=M
RCC.HCLKFreq_Value=24000000
RCC.HSE_VALUE=24000000
RCC.IPParameters=ADCFreqValue,AHBFreq_Value,APB1Freq_Value,APB1TimFreq_Value,APB2Freq_Value,APB2TimFreq_Value,FCLKCortexFreq_Value,FamilyName,HCLKFreq_Value,HSE_VALUE,MCOFreq_Value,PLLCLKFreq_Value,PLLMCOFreq_Value,RCC_MCOSource,SYSCLKFreq_VALUE,SYSCLKSource,TimSysFreq_Value
RCC.MCOFreq_Value=24000000
RCC.PLLCLKFreq_Value=8000000
RCC.PLLMCOFreq_Value=4000000
RCC.RCC_MCOSource=RCC_MCO1SOURCE_HSE
RCC.SYSCLKFreq_VALUE=24000000
RCC.SYSCLKSource=RCC_SYSCLKSOURCE_HSE
RCC.TimSysFreq_Value=24000000
SH.ADCx_IN4.0=ADC1_IN4,IN4
SH.ADCx_IN4.ConfNb=1
SH.ADCx_IN5.0=ADC1_IN5,IN5
SH.ADCx_IN5.ConfNb=1
SH.ADCx_IN6.0=ADC1_IN6,IN6
SH.ADCx_IN6.ConfNb=1
SH.ADCx_IN7.0=ADC1_IN7,IN7
SH.ADCx_IN7.ConfNb=1
SH.GPXTI1.0=GPIO_EXTI1
SH.GPXTI1.ConfNb=1
SH.GPXTI11.0=GPIO_EXTI11
SH.GPXTI11.ConfNb=1
SH.S_TIM2_CH1_ETR.0=TIM2_CH1
SH.S_TIM2_CH1_ETR.ConfNb=1
SPI2.CalculateBaudRate=12.0 MBits/s
SPI2.Direction=SPI_DIRECTION_2LINES
SPI2.IPParameters=VirtualType,Mode,Direction,CalculateBaudRate
SPI2.Mode=SPI_MODE_MASTER
SPI2.VirtualType=VM_MASTER
USART1.IPParameters=VirtualMode
USART1.VirtualMode=VM_ASYNC
USART3.IPParameters=VirtualMode
USART3.VirtualMode=VM_ASYNC
VP_ADC1_TempSens_Input.Mode=IN-TempSens
VP_ADC1_TempSens_Input.Signal=ADC1_TempSens_Input
VP_SYS_VS_ND.Mode=No_Debug
VP_SYS_VS_ND.Signal=SYS_VS_ND
VP_SYS_VS_Systick.Mode=SysTick
VP_SYS_VS_Systick.Signal=SYS_VS_Systick
There's some info in the attached files, too.