Battery powered Rigol DS1054Z

A year ago i bought a cheap 70W DCDC boost converter for 12V to 100V and first tried it external with a Kaltgerätestecker soldert on.
Not so handy, but this wouldn’t happen:

But if you open up the rigol there should be enought space for putting it inside. With a few modifications on the PSU shielding and an additional switch for selecting the power source it exactly fits inside. The DJ Jack is in thje place of the Kensington lock.

Better Tape the aluminium case of the DCDC, theres just a few millimeters left to the Mainboard.

Thers not much space for long wires. Hopefully there is no need for taking it apart ever again.

Power consumption is 24.75W @ 12V

PS: I will not provide additional information on how to do this. If you can’t figoure it out yourself, you better shouldn’t do it.

Logitech G810 – whats inside

Time to get a new keyboard. So why not the fancy Logitech G810 full RGB. Before buying I already read about the annoying pinging noise of the Romer-G switches. To find out if its possible to reduce the resonence of the metal baseplate ( if there is one) lets take it apart

Nice design, detachable cable. Inside is a STM32F100 creating 2xkeyboard and 2xHID devices. The LEDs are controlled by 3x(?) STLED524 running at 400Hz. The flickering is in fact very annoing.

Romer-G Switch with two switches inside.

Kontronik Kosmik 200 UART Protokoll

Der Kosmik 200 verfügt über 3 gleichwertige UART Schnittstellen für Bluetooth Modul und Telme Telemetrieadapter. Wer jedoch ein eigenes Protokoll für Telemetrie verwenden möchte oder auf eine Zustandsrückmeldung vom Regler angewiesen ist möchte die Daten lieber direkt abgreifen. Da Kontronik hier nicht helfen wollte jetzt für jedermann.

Blick auf Regler: [+|??|RX|TX|GND]
115200 baud/s

>> +++<\r>

Ab hier gibt der Regler die Infos aus:
?L23=22.2 V;24=0 A;25=0 A;26=5.0 V;27=0.1 A;28=30 ’22;29=29 ’22;<\n>
?M5=0 ‚6;7=0 A;8=0 ?;<\n>
?A2=22.2 V;3=0 A;4=0 mAh;<\n>
?R1=1.0 s;10=5.0 V;11=0.0 A;12=30 ’22;13=-100 %;15=0 %;16=28 ’22;19=987 us;20=9;–R=KOSMIK200+HV;–P=1;<\n>

Dabei sind die Datenblöcke durch ?X (0xA7 + X) zu unterscheiden:
?R – Regler
1=33.0 s;  // time since powerup
10=5.1 V; // BEC Voltage
11=0.0 A; // BEC Current
12=24 ’22; // BEC Temp ’22 =°C
13=-100 %; // stick % [-100 … 100]
15=100 %; // PWM %
16=22 ’22; // Temp FET
19=1227 us; // Pulse Length
20=14; // State?
12=motor off

?G – Gas
1228<\n> // Pulselength

?M – Motor
5=0 ‚6; // RPM ‚6 = R/min
7=0 A; // current
8=0 ?; // timing °

?A – Battery
2=22.3 V; // Voltage
3=0 A; // current
4=1 mAh; // discharge

?L- Limits
23=5.8 V; // min Bat Voltage
24=4 A; // max motor current
25=20 A; // max peak current
26=4.9 V; // min BEC voltage
27=0.1 A; // max BEC Current
28=25 ’22; // max BEC temp
29=23 ’22; // max Fet Temp

?V – Events (time:type=errorcode)
type: 4 = selftest
Alle Fehlertypen:
0: unknown
1: info
2: warning
3: error
4: self test
5: eeprom
6: setting wrong value
7: resetting wrong value

Alle Fehlercodes:
1: battery undervoltage
2: overcurrent
3: FET overtemperature
4: BEC overtemperature
5: BEC overcurrent
6: BEC undervoltage
7: overvoltage interrupt
8:overcurrent interrupt
9: variance too big
10: motor power limit reached
11: cpu power down interrupt
12: motor position lost
13: watchdog reset
14: missing receiver pulses
15: peak current limit reached
16: battery overvoltage
17: BEC overvoltage
18: slowing motor down
19: discharge limit reached
20: storage limit reached
21: TelMe: battery undervoltage
22: TelMe: overcurrent
23: TelMe: FET overtemperature
24: TelMe: BEC overtemperature
25: TelMe: BEC overcurrent
26: TelMe: discharge limit
30: error FET low
31: error FET high
32: error FET off
33: error FET U offset
34: error FET I offset
35: battery voltage too low
36: battery voltage too high
37: BEC voltage too low
38: BEC voltage too high
39: reverse polarity fuse
40: overvoltage fuse
41: FETs too hot
42: BEC too hot
43: no motor connected
50: no data
51: wrong stick positions
52: wrong checksum
53: wrong size info
54: wrong version number

?E – Settings (Wert:ID)
123399:16388; // Einstellungsblock
250:8270; // Alarm motor Current
90:8272; // Alarm Fet/BEC Temp
90:8274; // Alarm Fet/BEC Temp
12500:8276; // Alarm BEC Current

BT Gerät verbunden:

App gestartet ? :

BT Pairing:
<< <\r><\n>
<< PAIR_REQ,0017EB2B6F39,0<\r><\n>
<< <\r><\n>
<< OK<\r><\n>
<< <\r><\n>
<< 1,<MACohneDoppelpunkte><\r><\n>
<< <\r><\n>
<< OK<\r><\n>
<< <\r><\n>
<< OK<\r><\n>
<< <\r><\n>

(z.B $$92955:16388;92955:16388<\r><\n>)


16388: Einstellungen (20bit)

Bit Name min max Werte NOTE
1-2 Bremse 00: Aus
01: EMK
10: Aus, Prop.
11: EMK Prop.
3-4 Akku Typ 00: NiCD/NiMH
01: LiPo
10: LiFePo
 5 Drehrichtungsumkehr 1: an
0: aus
 14  Vorwärts/Rückwärts  1: an
0: aus
 6  Drehzahlregelung  1: an
0: aus
 15  Supersanftanlauf  1: an
0: aus
 18  Alternativer Anlauf  1: an
0: aus
 19  BT Motorstart aus, Taster an  1: an
0: aus
 20  BT Motorstart aus, Motorstop an  1: an
0: aus
ID Name min max Einheit NOTE
16388 Einstellungsblock
12352 Min Brems PWM 2 100 %
12354 Max Brems PWM 2 100 %
8264 Polzahl
8266 Getriebeübersetzung 1:1=100
8206 Ansprechverhalten Bremse pos. 100 9999 ms
8254 Ansprechverhalten Bremse neg. 100 9999 ms
12320 Drehzahlregelung tbd erfordert 16388 bit 6
8220 Drehzahlregelung tbd
8222 Drehzahlregelung tbd
12346 min. PWM 2 100 % EXPERT
8226 Ansprechverhalten positiv 100 30000 ms  EXPERT
8228 Ansprechverhalten negativ 100 30000 ms  EXPERT
8252 Hochlaufstrombegrenzung 1 100 A  EXPERT
8218 PWM Max Position µs
8216 PWM Aus Position µs
8214 PWM Brems Position µs
8208 BEC Spannung mV
24576 Programmierung 23: start
38: ende

RunCam split recovery

What is a bricked RunCam Split?
If the Runcam failed updating or other unknown reason it could happen your runcam stops working. The only sign of life would be the red LED blinking when powered.
RunCam tells you to change the ribbon cable between sensor and mainboard and if this does not work send them nudes of you PCB, you will get a new mainboard for free. As it costs you several weeks without your RunCam you may try fixing it yourself.

How to unbrick your RCSplit:
When bricked the cam will not boot until SD firmware flashing. So we just need to install a firmware that does that and get the stock RCSplit FW via SDcard update.
1. Get an old pc with Win7 or find a way to disable driver signature…
2. Download and unpack recovery package: RCSplit_recover_V1.1.0 (including: usb monitor, putty, SPCA6350 drivers, FRM+firmware)
3. Install Driver located in driver folder.
4. Plug in USB of RCSplit while pressing the WiFi Button.
(5. Wait for drivers to install if first time connected)
6. Start FRM.exe (no warning of no device connected should appear).
7. Click „ISP“ Button. This will flash firmware and may require up to 4 minutes. (Seems to be required before burning the other images, thanks to Klaus for the feedback)
8. Swtich to „Advanced“ tab.
9. Rigthclick an item in the right treeview window and select „Burn All“.

10. Wait 2-3min to finish, click „yes“ to all dialoges. Should finish with success.
11. Take an empty SD card and place the files located in sd_card folder.
12. Insert SD card and power RCSplit from USB charger/powerbank.
13. Wait until orange light starts blinking (SD card update).
14. Do not power off until LEDs turn off.
15. RCSplit should work fine again.

Contact me if you think something is missing.

Falls ihr gebrickte PCBs habt die ihr nicht mehr braucht, könnt ihr mir sie gerne schicken

I only had my own PBC bricked, so I played around with stock firmware of EKEN H9 but never got it to sd update mode. As the replacement PCB arrived I downloaded the firmware from it and replaced parts of eken stock fw. This is all included in the download package. I don’t know if the BRN file the firmware is looking for should be called RCSplit or SPHOST, so I put 2 identical files with different names on the card. Tell me if you know wich one it is. Could be only RCSplit because it is deleted afterwards…

Bootlog & CLI:
To get the CLI connect a 3,3V UART adapter to the testpads (don’t forget GND, a GND pad is next to the SD card slot)

Baudrate is 115200.
You don’t need to connect UART for recovery, unless you want more info or play around with cli. For fancy colours use putty as serial terminal.
If someone could send me a bootlog of a unflashed, bricked on would be nice, maybe there is a faster way.

Firmware History:
RCSplit_recover_V1.0.1 (10.07.17)
RCSplit_recover_V1.1.0 (05.09.2017)

Bugs I have:

  • V1.1.0:
  • V1.0.1:
    Corrupted SD Card, readable but no write/erase/format possible. Runcam keeps recording but no files (at least visible, maybe the data is somehow on the card) => only way to restore SD Card was to format it with a Teensy3.6 (or other Arduino like device) an the SDFat lib.
    Runcam not updating to V1.1.0 from V1.0.1. Update via app fails after uploading 99% (0x000004), sd update deletes FW file but no update.
    => ok, card was currupted again and WiFi was not able to write and on pc write is performed but not permanently stored.

Problem FAQ:
Q: Can you help me…
A: No.

Q: The USB device is not detected

A: Press the WiFi button while connecting USB
A: Try reinstalling the driver.

Q: Your manual did not work for me.
A: May happen, I just fixed mine until now, I need more bricked hardware to guarantee.

Nice Wifi Hacks:
Livestream: rtsp://
FTP Server: Port 21, User/Password any combination, but:

By sniffing the file transfer via Runcam app we see they use passive mode, but file listing seems to be not implemented

If using the app for changing settings there is also a connection on port 15740, so they uses PTP/IP. They change all settings via PTP/IP, some with custom IDs

e.g Device Property 0x0000d605 replies with video resolutions somehow (1280×720 60 1920×1080 60 1920×1080 60 1920×1080 30 1280×720 60)

Hardware Info:
Sensor: 4MP Omnivision OV4689 (1/3″, 2688*1520px, 64,6bB dynamic range)
Processor: iCatch / Sunplus SPCA6350A
16MB Winbond SPI flash
A7125 Wifi Module connected via 4-bit SDIO

Same hardware setup: EKEN H9/H9R

OMNIBUS F4 V3 – Documentation

Since there is no documentation at all on any of these F4 boards, here is my try:
– STM32F405 LQFP64 (168Mhz, 1M flash, 192kB SRAM)
– MPU6000 6DOF IMU
– BMP280 barometer
– MAX7456 OSD (or fake)
– 5V Switching regulator (MP2359)
– 6pin SM06B-SRSS connector to ESC (fits Racestar RS20A4V2)
– DSM2 port for SPEKTRUM satellit
– USB CDC serial, DFU firmware update
– micro SD card slot for Blackbox logging

Latest firmware on Betaflight github releases (V3.2.0)
Configurator as Chrome App

Power Supply MP2359 (1.4MHz switching regulator)
Input Voltage: max 24V (input capacitors may limit voltage to 4S)
Output Current: max. 1.2A (1.8A current Limit)

3.3V LDO (100mA?)

Accessable pins

RSSI A0 14 Not ADC capable
PWM5 A1 5,2 1,4 15 SoftSer 11 RX(/TX)
PWM4 A2 2,3 1,1 16 Motor 4
PWM3 A3 2,4 1,6 17 Motor 3
PWM6 A8 1,1 2,3 41 SoftSer 11 TX(/RX)
UART1 TX A9 1,2 2,2 42
UART1 RX A10 1,3 ?,? 43 DSM2 SPEKSAT
PWM1 B0 3,3 1,7 26 Motor 1
PWM2 B1 3,4 1,2 27 Motor 2
Buzzer B4 56
LED_STRIP B6 4,1 1,0 58 WS2812 LED
PPM B8 12,3 n.a 61 PPM (if jumpered)
CH2 B9 62 ? wrong in BF github.
UART3 TX B10 2,3(!) ?,? 29 Shared I²C resource
UART3 RX B11 2,4(!) ?,? 30 Shared I²C resource
CRNT C1 2,4 9  external current sense ADC
VBAT C2 2,4 10  internal VBat voltage divider ADC
UART6 TX C6 8,1 2,2 37
UART6 RX C7 8,2 2,3 38 SBUS (if jumpered)

Note: Serial ports in CAPITALs are Serial1; Serial3; Serial6, Serial11 (=SoftSer1); Serial12 (=SoftSer2)
In sourcecode and portforwarding use number-1: serial0; serial2; serial5…


USB_D+ A12  45  USB data plus
USB_D- A11  44  USB data minus
SWD A13  46  SWD_DIO
SWC A14  49  SWD_CLK
OSC_IN H0  5
SPI1_MISO A6  22  MPU600 SPI
SPI1_MOSI A7  23
SPI1_CLK A5  21
SPI1_CS_MPU A4  20
MPU_INT C4  24  MPU6000 Interrupt output
SPI2_MISO B14  35  SD card SPI
SPI2_MOSI B15  36
SPI2_CLK B13  34
SPI2_CS_SD B12  33
SD_DETECT B7  59  SD Card detect switch
SPI3_MOSI C12  53
SPI3_CLK C10  51
SPI3_CS_Baro B3  55
SPI3_CS_OSD A15  50
INVERTER C8  39  Logic Level inverter enable
LED1 C5  57  onboard LED (blue)
B2  28  GND
C3  11  resistor with NRST?
C13  2  unrouted
C14  3  unrouted
C15  4  unrouted

Where to buy:
ebay (DE)
ebay (CN)

The following is pretty much for my own configuration, but might be useful for you as well:

Set throotle check min:
set min_check = 1045

Setup SoftSer 11 for runcam control:
resource Motor 5 none
resource Motor 6 none
resource serial_rx 11 A1
resource serial_tx 11 A8

Get Mag working on UART3/I²C2:
resource Serial_TX 3 none
resource Serial_RX 3 none
resource i2c_scl 2 b10
resource i2c_sda 2 b11

Dont forget to: