Flashing a Vaisala RS41 radiosonde

The Vaisala RS41 radiosonde is a weather radiosonde that is currently being launched in Madrid Barajas and other sounding sites in Spain, Europe and Australia. I have already spoken about how to decode it. One of the most interesting aspects of this model is that the RS41 contains a STM32F1 ARM Cortex-M3 microcontroller, a SiLabs FSK transmitter, and a uBlox GPS receiver, whereas the older RS92 contained custom ASICs to perform these functions. Thus, it is easy to reflash this radiosonde and write custom firmware for it, giving a lot of possibilities for experimentation.

In STARcon 2018, Julián Santamaría from AEMET (the Spanish meteorological office) gave me an RS41. While I have some long-term ideas about how to use it as a propagation sounder, I have just started playing with it. In this brief note, I explain how to flash the radiosonde with custom firmware.

The particular radiosonde I have has serial number N2720012. The CPU is an STM32F100C8T6B with 64kB of flash, the radio transmitter is a SiLabs Si4032 and the GPS receiver is an uBlox UBX-G6010-ST.

To flash the STM32F1, an STM32 programmer is needed. I have used an ST-LINK/V2 Chinese clone, which is very inexpensive in eBay and similar sites. The RS41 has a pin header that exposes the programming lines, so the ST-LINK can be connected directly to this header. The pinout of can be seen here. I reproduce it below for completeness.

RS41 header:
| ----------- |
|  2 4 6 8 10 |
|  1 3 5 7 9  |
| ----   ---- |

Programer cable connections:
RS41 ----- ST-LINK
===================
Pin 1 ----- GND
Pin 5 ----- 5.0V
Pin 8 ----- SWCLK
Pin 9 ----- SWDIO

The flash of the RS41 is read and write protected. This means that there is no easy way of dumping the factory firmware. The protection can be removed by issuing a command to the STM32F1, but the flash gets erased when the protection is disabled. The easiest way to remove the protection is with ST-LINK Utility. Presumably it should also be possible to do it with openocd. See here for more information on the protection.

To program the STM32F1 I’m using stlink. It is also possible to use openocd. As Dan Gisselquist, from ZipCPU, says, the first step of any embedded project should be to blink and LED. In this way we can check that our toolchain and programmer are working correctly.

After blinking an LED, many people would probably like to flash the RS41HUP firmware, which transmits RTTY and ARPS in the 70cm Amateur band.

To blink an LED in the RS41, I’m using the blink-plain template from stm32-templates, which also includes an arm-none-eabi toolchain for amd64, in case you don’t want to install your own toolchain.

It is necessary to change all occurrences of GPIOC to GPIOB in src/main.c to get the red LED flashing, since it is connected to GPIO_Pin_8 in GPIOB. The green LED is connected to GPIO_Pin_7, also in GPIOB.

After compiling the code with the Makefile included in the template, we can flash it as follows:

$ arm-none-eabi-objcopy -O binary blink-plain.elf blink-plain.bin
$ st-flash write blink-plain.bin 0x8000000

It is also possibly to run the firmware under GDB in the following way:

$ st-util
...
$ arm-none-eabi-gdb blink-plain.elf
...
(gdb) target extended-remote :4242
...
(gdb) load
...
(gdb) continue