ฝัง
- เผยแพร่เมื่อ 7 ส.ค. 2024
- This video shows the analysis of the air data computer used in the Shahed-136 kamikaze drone.
00:00 - Intro
00:05 - Board overview
01:50 - Preliminary test
02:27 - Reverse engineering
03:36 - Test
Notes:
This link shows a transmission format identical to the messages sent by this air data computer:
wokwi.com/projects/3745009295...
Blog and schematics:
mwblog.fr/ldm-369-shahed-136-... - วิทยาศาสตร์และเทคโนโลยี
![แฮงแงงแฮงงาม - บอย ศิริชัย [OFFICIAL MV]](http://i.ytimg.com/vi/vCGJTy9ZeP8/mqdefault.jpg)
Nice Work, enjoy your channel.
The PTAHADC could be calibration values of Pressure sensors based on Temperature.
You have shown PTAHADA, A is for Altitude and
PTAHADV, V for Velocity.
The two different Air Speeds seem to be IAS (Indicated Air Speed) and TAS (True Air Speed). TAS is IAS corrected by temperature and altitude.
Nice work Mr. Michel, interesting to see their design is not extreme, rather robust.
I think the word you are looking for is "crude". I wouldn't be surprised if the STM32 code is not locked down. It is probably just running Betaflight. If I were designing that I would have included anti-tamper tech to make RE much harder. E.g. it would be simple matter to erase everything after launch, run from RAM. Hopefully the Ukrainians can download the code.
@@lubumbashi6666 Im sure you prob know more then me, but factor in also the production cost on a large scale, might influence such decision making. I can be wrong ofc.
@@lubumbashi6666 скачают и что?
@@JustLennyBenny I was wrong, this is just an air data module collecting pressure data for altitude and airspeed. It doesn't do any flight control. It's not that interesting, it's just a component, and what it's doing is not sophisticated, no need to lock it down.
Yeah, the pressure sensors monitor altitude and air speed (pitot tube).
Exact same system used in light aircraft.
Don't forget, in your experiment you're probably reading pressure correction, as there is ambient pressure around. Depends on how the sensor is configured.
It is possible to use new digital MEMS microphones in exactly the same way now (home weather stations).
Great reverse engineering! Big clive would be proud. 😀🇬🇧👍🏻
I wonder if they use PCBway
They don't seem to have the PCBway tracking silkscreen code on them, although I think there's an option to avoid it.
Probably a similiar service, who it is, doesn't really matter. They could even have their own China imported PCB factory...
"I wonder if they use PCBway"
Who?
@@avadhutagita3741 The Iranians.Shahed drone manufacturers.
@@rkan2 Five factory's
A man of taste I see, recognizing your usage of (probably mil spec) solid round milled pins/crimps for your jumpers/measurement test leads. I thought im the only one 🤤
Can you elaborate? I can't find the ones you mean in the video. Thanks
Add this subject matter to the list of reasons I appreciate your channel!
The part choice is very much what you would see in a western design. Use of the stm32 in particular suggests familiarity with US/Europe hobby designs. But having a separate "air data computer" is more of a traditional aerospace engineering architecture.
It is probably running something like Betaflight. It is real time and with a processor like M0+ there isn't much scope for fancy comms, so talking to satellites and overall guidance is probably on a different board.
lol, nope in a MIL spec design, very far from that. Also that board layout is very poor and certainly not up to any western military standard, or even industrial/commercial. The datas in plain ASCI via RS232 without even a crc is also quite pathetic, i cannot think of doing such thing even in a basic comemrcial project, at the very least packed structure with checksum.
@@lo2740Isn't that the entire point? Lack of adherence to quality standards and cheap mass production. Western equivalent costs what again?
@@lo2740 LoL. These shahed drones are very much reliable and cheap and that is the sole point of modern kamikaze drone warfare. They get the work done.
@@MrCarGuy The thing is board layout is not a production cost, it is a design cost, and frankly just show that it was not done by someone with experience as good layout doesn't take more time than bad layout for an experienced PCB designer. Protecting the messages with a CRC so you know you are getting good data is an undergraduate assignment if even that. You could just use Google and cut/paste the code in a few minutes. That all these are missing shows that while the concept might be good the execution is terrible.
T’a fait du bon boulot 😉 merci
Quite simple, which makes sense. Cheap to produce and less to go wrong.
I am surprised by the shear volume of data that it throws onto the serial bus. Firstly If the data is only used within the drone I didn't expect strings, rather just mapping the values directly to bytes. Secondly I didn't expect it to display things like mach number. For anything connected to that serial port it is probably much quicker to simply take the airspeed to calculate the machnumber yourself, compared to the extra wait and processing of the serial string.
Perhaps they are using some kind of 'off-the-shelve' radio serial link to send this straight back to a PC for direct viewing. Which makes me wonder, how does the navigation work? As there's no GPS here it must be somewhere else and connect through that 9pin connector. It doesn't seem to squirt out any data request messages on the serial bus, so then how is it getting that kind of navigation info?
Or perhaps this module is only for the air pressure and temperature calculations, making most processing on the drone quite distributed. But again, if the serial bus is only used 'internally' in the drone, I don't understand why they transmit the information over serial in string format.
The processor consuming this data likely has an excess of processing power vs. the cost of doing string processing. Binary communication on the otherhand increases the cost with respect to communication between teams responsible for different parts of the drone and makes basic tooling more difficult -- eg. if you were validating the module with a test fixture using csv allows you to directly dump the data and throw it into a spreadsheet.
Mach number is not solely dependent on airspeed. Keeping the 'intelligence' for this calculation in the instrument makes sense
@@nullptr472 I seriously doubt that there's a big team involved in this product, at least the electronics side. The design as shown is quite simple, and is even lacking some proper filtering and protection on the PSU input. (At least they put TVS diodes on the RS232 lines).
My point was not about the processing power of processing strings persé, rather about the time it takes to transmit. The Shahed seems to have a max airspeed of 185kmh, so for the accuracy stated it could easily fit in a 16 bit value. Now it is transmitting 5 bytes for the same information. There's about 4 values per line, so that could save 12 bytes. You can skip the commas, another 5 bytes. Skip that weird pre-amble (PTAHAD*,B) which is constant anyway, saves you 7 bytes. Drop /r/n and you save 2 more.
Thats 26 bytes per line even with such simple minimal effort. At 19.2kBaud that would shrink the time to transmit by almost 14ms. That is quite significant for the minimal amount of effort required.
Even if time delays or data rate are not a problem (which it probably isnt), it means that you could slow the bus datarate down and get things more robust.
Anyone that is able to design and test such boards, has practically no difference in basic tooling between raw bytes, or string data. Most serial loggers can display and log raw serial data without any trouble, never mind the abundance of cheap logic analyzers and oscilloscopes, or writing a simple python script of a few lines. If this serial data is used by another uc, it might even be easier to process the raw byte data rather than having to decode the string (always tedious). Also whether this was designed by a team or not, just having a list the byte structure commands is not any more difficult than having a list of possible strings and their structure to communicate. There is still the same number of inter-team communication interfaces to keep track of, just in a different format.
tl;dr In my opinion, it is not any more difficult to use bytes, nor would it cause more difficulty in working with teams.
Honestly I strongly suspect the choice of using strings is more down to quickly wanting to hack something together, or not having the knowledge to do it in a better way. An experienced engineer wouldn't have much trouble implementing it with raw data values, but for someone only used to arduinos and/or less experience with embedded, it seems more challenging than just throwing strings around.
Also regarding the mach number, this device is not going supersonic. I doubt the mach number is relevant at all for their control as stated the max airspeed is
When you don't have a parasitic arms industry to feed you can make some pretty cool stuff for a reasonable price.
This is just the *Air Data Computer*, which means it measures the air speed and barometric pressure. The flight controller is a separate module. The jamming resistant navigation receiver is another unit, and the radio link is yet another. And then there is other stuff such as engine controller, power systems, etc.
@@tHaH4x0r I take your point about data latency and channel capacity
> Honestly I strongly suspect the choice of using strings is more down to quickly wanting to hack something together, or not having the knowledge to do it in a better way. An experienced engineer wouldn't have much trouble implementing it with raw data values, but for someone only used to arduinos and/or less experience with embedded, it seems more challenging than just throwing strings around.
The whole philosophy behind this drone is being low-cost and still effective. Part of that must come from lower development costs and understanding the 'good enough' point during development. Based on real-world performance they've clearly met the 'good enough' threshold. With respect to the 'cost' of a string protocol I do not doubt that tooling could be created to perform whatever binary conversions are required pretty easily, however, the cheapest tools are the ones that don't exist and the ability to 'eyeball' some raw output without consulting a spec is valuable (eg. sanity checking).
Iran has some pretty sophisticated weapons systems so I have no doubt their weapons developers have access to good talent (I seriously doubt these people are 'arduino jockies' or whatever). My money is on the developers of this system being expeditious (if you want to call it 'hacking something together' that's your prerogative), and again the proof is in the results.
great work..
06:05 value 23.1 could be pressure in inches of mercury (782 hPa)
Or temp in C degre
@@piotrbudowlaniec9160 The temperature probe seems to be external, unless one was connected for the test
Very cool Michel! I remember when Collins was developing these types of air pressure sensors in the early 80s and it took a lot of experimentation back then to get it right. They were used, of course, as sensor inputs for the air data computers at the time. I wonder if the same sensor technology went into this drone's sensors? Now we take for granted that things like 3" backup indicator sensors are as small as these. Makes me curious how these sensors work.
there's absolutely no way this is the same technology. for example the ADC is probably much less accurate than whats used in commercial aerospace
Yeah, the old technology has been surpassed years ago. You can actually get a flight controller board for a drone/quad thing that has all this on board- for "altitude hold" for hovering like an aerial platform.
No idea how the sensors worked in the 80s, but these types of pressure sensors are generally MEMS. They contain a membrane separating two cavities. One cavity is connected to the input, and the other is either sealed (for absolute pressure sensors) or fed to the other input (differential pressure sensors).
Deflection of the membrane is measured through capacitive or strain gauge sensors, of which the signal is processed and scaled/calibrated.
Could you elaborate on the technology those early generation sensors were using? I am sure it would be very interesting.
@@tHaH4x0r they were probably all analoge
you can find a lot of pressure sensores , absolute differential, pwm output , linear output....just click at rs components catalogue
Very nice. Can you read out the memory?
What is there to read?
Init
Read sensor
Put to UART
GOTO 10?
@@VEC7ORlt firmware in the microcontroller
@@Mr1Spring I know what it is, I just transcribed/disassembled it for you.
@@VEC7ORlt well, dissasmbly of the code might reveal something interesting like who programmed it, what tools they used etc. Forensic stuff.
@VEC7ORlt scaling values woukd be useful as well as the input source (pins) for the unknown numbers like 0.07
Possibly a missing temperature sensor.
Good job, keep working.
What are the models of the two atmospheric sensors?
Looks like HPSD 3000
Nice. I wonder if this thing prints any additional information immediately after it powers up? Maybe it reports the version of firmware or something like that?
There is nothing but a first string with incorrect values.
@@lelabodemichel5162 waiting for a video on anti tank missile
@@lelabodemichel5162 Can you not do a memory read on the micro controller? Compiled program should be in there ( i bet it involves a lot of AD conversion and a simple algorythm stolen from somebody )
Thank you sir
How did you get this PCB anyhow?
C most likely stands for conditions and have one or two temperature measurements and also has to have QNH/pHg sea level atmospheric pressure - only question where this data would come from as it is weather dependent at sea level, maybe read from RS232
Which pressure sensors are used?
Kinda interestting that they don't use smaller (0402, 0603) caps for e..g the microcontroller.
Also no glue or anything for the DCDC
Потому что 1206 Россия производит сама.
they should put the smt components on one side for cheaper assembly.
The pressure sensors are similar to car MAP sensors.
generally are bridged resistors in elastometric matrice configured as wheatstone bridge , also versions with op amp buffer inside...devices in car map sensors are can bus networked for avoiding disturbances and auto calibration facilities
Can we have an open-source Shared?
Electronic - why not? Seems not to be very complicated compared to open source fpv.
Bonjour Michel, beau travail! On peut comprendre que c'est un morceau d'épave de drone ou de ce qu'il en restait.
Je me demande quand-même où il peut les trouver 😂 actuellement je suis en train de développer un drone agriculteur et j'ai besoin de ce genre de capteurs mais je sais pas où en trouver ni comment les choisir, je me demande s'il est possible de trouver sur eBay cette carte électronique peut-être que je pourrais l'utiliser sur le drone
@@scalt8367 si tu veux une large selection d'électronique pour des essaies je recommande aliexpress, mais il faudrait s'orienter vers un fournisseur plus fiable comme LCSC ou un autre fournisseur européen
@mohamedbelafdal6362 Je commande souvent sur Aliexpress. Récemment, j'ai passé une commande chez JLC PCB pour un montage avec des composants de LCSC. Tout se passe bien jusqu'à présent, mais je ne sais pas comment choisir les capteurs différentiels. Aurais-tu des conseils à ce sujet ?
Пробовали ли вы считать код из контроллера?
You don't know the "signification" of 23.1? What's the room temperature in your lab, Michel?
It would make total sense for this slightly bizzare board (simultaneously over- and under-engineered) to measure air temperature, as it infuences air density, a factor in the pitot-static airspeed formula. It's not THAT significant, though, so one could just get away with reading temperature inside that cast iron box instead of overboard.
If I was a betting man, I'd say the sensor is inside the absolute pressure sensor, which is a common thing and which explains why it would vary as you compress/decompress the air in its inlet (aside from just other components heating up the PCB).
I have the datasheet of this sensor (next video) and there isn't any temperature measurement inside, except for correction purposes.
Edit 2024/07/18: You're maybe right, it seems that the temperature can be read from the part.
how does one acquire one of these?
These devices or parts are sold in internet; country of origin Ukraine, not a suprise.
I sugggest that you wait patiently at a potential target of the Shahed 136
If these boards are from Ukraine I would be suspicious. There is no reason for Iran to use American parts.
Yes there is, Iran doesn't have a domestic tech industry that produces competing parts.
@@dammitdadWhy not? These components are all so standard that their trade can't be effectively restricted. Also everything has at least one second source (except maybe the pressure sensors, idk which ones they are)
why is 232, 485 or CAN not good?
Hi Michel! I'm curious, where did you get that shahed part? Was it from Ukraine? How it ended up in your hands and with what purpose?
From EBay, and I love air data computers!
la classe
OK, Glowie
Did you figure out the temperature sensor? I would guess it will be a jellybean part, probably a 10K ptc.
It has a small impact in one output value, nothing relevant. The value must be below 150 Ohms, because a resistor of 470 Ohms is connected to the TL431 which gives a constant current of 2.5/470=5,3mA. Therefore the maximum resistance is (3.3-2.5)/5.3mA = 150 Ohms, even less because I have supposed a complete saturation of the transistor.
@@lelabodemichel5162 Maybe they use Pt100, a 100 Ohm platinum resistance thermometer?
@@lelabodemichel5162 FWIW, Temp vs VTH curve is "linear" (1-2.7v) if R25=1000. Nonlinear if R25=100 (2.2-3.2v). Cannot say if this is relevant...
I'm a little surprised that as they use an STM micro that they don't use the STM LPS22H absolute pressure sensors. They are so good you can do airspeed by connecting one to pitot and one to static.
I've built thousands of devices similar to these for our sailplane instruments and other sailplane instrument manufacturers do the same.
There is no reason for that, these two things are uncorrelated. There are other factors like price and availability.
@@lelabodemichel5162 the LPS22H is about the cheapest pressure sensor you can buy and readily available. I suspect the Shahed's avionics was designed before about 2017.
What is the sensor manufacturer?
Silicon Microstructures Incorprated
@@lelabodemichel5162 All SMI sensors have the SMI label on top. And also the marking of the first pin. Here - clean ceramics. It's interesting what's on the other side. Are there any markings?
@@serjioalvarez Response on next video
If someone wonder what does the first word in line mean - it s a "bird da/dc"
thanks plz analyze gnss or flight of shahed
Yeah, I wonder if they use a stock sat nav chip or actually do circular maths to work out coordinates.
Means there must be a programming interface just before launch, to determine route via waypoints and final destination.
The Shahed GNSS receiver is a very complex board with two dual input SDR chips and a big FPGA. It does the position calculation internally.
The altitudes correspond to feet, not meters.
DB9 connector, RS-232, NMEA-like protocol and overall "generic" design. Looks like it is some off-the-shelf sensor, or local clone of such part.
what connectors & phys you prefer & why?
Later on the strings are likely combined with the positioning output stream and the line prefix would just serve to differentiate.
Hi Mr.Michel,let me know how much accurate this pressure sensor to measure attitude..its practically can be use to measure attitude ,and display on screen
As the STM get so rare at the pandemic that washing machine controller get desoldered the secondary sanction should be increased level by level. Not as this complete stop any chips go there but it will have the opportunity to uncover the hidden traces of delivery.
How do you want to achieve that? Stop producing electronics for western companies in China entirely? They probably have enough STMs stockpiled in China for years of Shahed manufacturing
Oh my dear! You're make me donate my washing machine! 😁 STM32 контроллеры не самые последние на свете. Есть CH32V, а также отечественные контроллеры. Вы переоцениваете свои санкции.
@@artip777 Yes, do not overestimate life. Btw there is a chinese STM which remove some bugs, exact which are coded out for the orginal. This stop car manufacture for simply hardware swap.
You make me curious as i know chips very well. What mean domestic STM?
@@reinerfranke5436 I meant not the STM, Russia produces variety of MCUs. Like Микрон, Ангстрем, Миландр and НИИЭТ. All of them already under sanctions for 2-5 years. That's simple to swap this hardware, not a big deal.
@@artip777 Оставайся сильным товарищ
No checksum or crc
He is only showing the strings that are sent over serial, depending on how RS232 is used it should have checksum buildt in to the protocol.
The two characters at the end of each string following the * is the checksum.
@@lelabodemichel5162 ok, yes I see now that it's a hex value
But why convert the data to ascii to transmit to the flight controller? It will have to convert it back to binary at that end. - They could have optimized it a bit more. Also PCB size could have been 1/3 of what it is there. Anyway, we learn that rocket science isn't that hard.
It seems to speak nmea0183. TAH is not a registered vendor code.
this is just a drone, rockets is another thing and much more advanced
@@rezah336 actually no. Basic principles are the same. Guiding something in 3D without visual reference is the rocket science.
@@SalihGoncu rockets flies so much faster, much harder to control and be accurate
@@rezah336 the theory and principle does not change.
It is very clear, that there are very few countries in the world, which design electronic components. Manufacturing is more diversited, for example: chips in Germany, packing in Vietnam, storage in Usa, selling in internet.
Chips von Funny Frisch.
Die sind aber Ungarisch!
02:46 sir please include digital schematic instead of paper schematic.thanks
Just read the description!
Good.
Why didn't they use ESP processor? This board doesn't do anything complicated. All the necessary parts can be sourced from China
That's an STM32G series, the question is really why not the Chinese version of the STM32F103.
🇮🇷🇮🇷🇮🇷🇮🇷💪💪💪💪💪❤️❤️❤️
STM32G071 microcontroller I used in my water ionizer product 😂😂😂 wtf.
The descendants of the prince of Persia are a smart people.
did not Russia already lose in May 2022?
It essentially did.
ok, so this is just the "avionics" module of the drone. Do you also have the "brain" which controls it and guides the drone to the designated GPS location?
I have other boards from this drone but I don't know their functionalities.
great explanation. Now to show the item on Amazon and Ebay or where Iran obtained them
Датчик сеорости .
It's full of Russian parts :-))))
The PCB is poorly designed
could you state why ?
@@yottakm3764 - Crystal XTL1 is connected trough via's which is something you avoid if possible, as it may cause excessive stray inductance.
- There is no reason to default to 1206 or 1210 packages, especially if there is already a TSSOP package on the board. Any monkey can solder 0805 and 0603
- All of the capacitors are too far away from their intened pins, especcially bad are the row of capacitors under the STM32
- This board could have easilly been single sided which would have cut costs and difficulty
- The return currents of the STM32 pass by the sensor, prefferebly you would place the sensor on the edge of the board, as far away from the input connector and other circuitry as possible.
- General component placement and routing just looks quite random and poorly done.
You have a point but being pragmatic it is good enough as it only has a single use. It’s just works
@@questy44russian armed forces thank you for your support 💀🤦♂️
@@questy44You sir just contributed to the Iranian war effort 😅.
1013.25 mbar - 200mbar = 813.25 mbar ( according to height vs altitude graph ) this should be +/ - 2000 Meters = 6000 feet (6188) !!!! when did Russians get rid off the metric system??
It is a DID device in a device with western spice
I do not remember the date, but it was somewhat recently, on a historical time scale. Specifically for reporting flight level in aviation, Russians have indeed switched from meters to feet, to be like the rest of the world, and to avoid possible confusion.
But I doubt that this is the reason for what we see in this device. It probably simply emulates some commercial Pitot sensor with an industry standard interface. We don't even know where this was designed, but it is probably manufactured in China.
Il ne vous a pas échappé que notre Michel national est champion du monde toutes catégories confondues de franglais 🤣🤣🤣
Поделка студентов. Серьезный инженер так не сделает.
I get the whole cost at scale principal but everything I've seen about shahed uav are very primitive by today's standards I could build something of better quality myself (not that I would mr. Fbi sir)
а зачем? накрутить стоимость?