Karma refusing to pair - Reverse engineering investigation

[Heiko Klein]

Die Brücke FB36 muss bis zum Schluss gebrückt werden und der Kontakt mit dem Widerstand nur kurz, wenn man den Power Knopf drückt. Habe es mit einer zweiten Person gemacht.

Kein löten notwendig und nochmal danke für das Video und das Bootimage.

Das Teil für die SD Karte hatte ich schon vor einem halben Jahr gelötet, leider bin ich dann nicht weiter gekommen.

 

[Ironspear]

Well done, we have been working on this from the method that boots from the UART but have only had a little success. Im sure you will ignore anything that Luis states as we all know that he fails to tell the truth about the process he uses. I also have a right motor sensor bord that has the SD slot already on it.

I thought Louis was using his army of ex GoPro technicians in his huge French factory?? lmao. Well done.

 

[Heiko Klein]

So war jetzt mit 2 Drohnen draußen - es gab keine Probleme - GPS erkannt und sauber geflogen. Zur Info die SN der Drohne hat sich auch nicht verändert - wie auch da einfach nur der Bootsektor beschädigt war.

 

[Boko]

RevD OK!

 

[Heiko Klein]

RevD OK!

Vorsicht beim Löten und mit dem Widerstand direkt aufs Bord da kann schnell der Kontakt abbrechen. Ich mache es lieber ohne zu löten mit 3 Messspitzen.

 

[Boko]

Pairing OK Camera OK GPS OK but won't take off. I replaced the motor arm with a normal one, but it didn't work.

 

[spiglys]

Pairing OK Camera OK GPS OK but won't take off. I replaced the motor arm with a normal one, but it didn't work.

check all cables connected properly, and all have to be screw back as it was

 

[Heiko Klein]

So habe ich jetzt 10 Drohnen mit Verbindungsproblemen zum Controller wieder Bootfähig gemacht.7 konnte ich fliegen lassen. 3 Stück bleiben Ersatzteilspender. Nummer 1 war auf der Rückseite Verkohlt und dadurch ging der Gimbel nicht. Nummer 2 konnte nicht gestartet werden ??? und Nummer 3 meckerte über die Flügel - muss aber vom Bord herkommen – hatte die Microschalter alle von Hand gedrückt und auch ausgewechselt. Also es gibt auch noch andere Fehler.

 

[account deleted]

So habe ich jetzt 10 Drohnen mit Verbindungsproblemen zum Controller wieder Bootfähig gemacht.7 konnte ich fliegen lassen. 3 Stück bleiben Ersatzteilspender. Nummer 1 war auf der Rückseite Verkohlt und dadurch ging der Gimbel nicht. Nummer 2 konnte nicht gestartet werden ??? und Nummer 3 meckerte über die Flügel - muss aber vom Bord herkommen – hatte die Microschalter alle von Hand gedrückt und auch ausgewechselt. Also es gibt auch noch andere Fehler.

I don't have that many drones to experiment with, so I can only propose a solution to identify problems.
1) Connect to both diagnostic interfaces and monitor for errors.
If I understand correctly, then everything related to flight is controlled by STM32
2) Try updating the firmware from the controller
3) Flash the remaining blocks, (except the "manufacturer" - there serial numbers,
"Black box", "reserved")
4) And of course problems with electricity, cracks in the board, component failures, etc.

Firmware has file for STM32, but I did not know, this full firmware or update.

 

[Heiko Klein]

" Nummer 2 konnte nicht gestartet werden ??? " -Hatte noch ein Update gezogen aber der Fehler blieb – wahrscheinlich Hardwarefehler

 

[bozmanx]

Pairing OK Camera OK GPS OK but won't take off. I replaced the motor arm with a normal one, but it didn't work.

Its complaining about GPS, what firmware version are you on?

 

[bozmanx]

Here is the video we did off the back of Sergey's discovery

 

[Boko]

Its complaining about GPS, what firmware version are you on?

After this I updated to 2.50.1

 

[Boko]

I don't have that many drones to experiment with, so I can only propose a solution to identify problems.
1) Connect to both diagnostic interfaces and monitor for errors.
If I understand correctly, then everything related to flight is controlled by STM32
2) Try updating the firmware from the controller
3) Flash the remaining blocks, (except the "manufacturer" - there serial numbers,
"Black box", "reserved")
4) And of course problems with electricity, cracks in the board, component failures, etc.

Firmware has file for STM32, but I did not know, this full firmware or update.

3) Flash the remaining blocks, (except the "manufacturer" - there serial numbers,
"Black box", "reserved")

Please tell me the command to do this

 

[Boko]

Pairing OK Camera OK GPS OK but won't take off. I replaced the motor arm with a normal one, but it didn't work.

BARO probrem?

nsh> : nh:[K84866. noound
nsh: :: command not found
nsh>
nsh> t fou
[0946684866.875] t: Available Tests
[0946684866.876] t: batt_auth host - batt_auth test [0946684866.883] Health: expiredhost_only
: BARO0 temperature
[0946684866.887] t: batt_auth test - batt_auth test
[0946684866.899] t: batt start - batt start
[0946684866.903] t: batt stop - batt stop
[0946684866.908] t: batt read_error - batt read_error
[0946684866.915] t: batt temperature - batt temperature
[0946684866.924] t: batt current - batt current
[0946684866.931] t: batt voltage - batt voltage
[0946684866.935] t: batt cycle - batt cycle count
[0946684866.940] t: batt soh - batt state of health
[0946684866.947] t: batt t[0946684866.948] Health: expiredest - batt test
: BARO0 temperature
[0946684866.959] t: gpio dump - display GPIO state
[0946684866.967] t: gpio spi_slave_ss - get spi cs pin value
[0946684866.972] t: gpio spi_slave_int - set spi slave int pin
[0946684866.980] t: gpio esc_en - set esc en pin
[0946684866.987] t: gpio ext_esc_gt_kill - set ext esc gt kill
[0946684866.995] t: gpio esc_gt_kill - set esc gt kill
[0946684867.003] t: gpio arm_lock_rr - read rear right arm lock
[0946684867.008] t: gpio arm_lock_rl - read rear left arm lock
[0946684867.015] t: gpio arm_lock_fr - read front right arm lock
[0946684867.023] t: gpio a[0946684867.023] Health: expiredrm_lock_fl - read front lef: BARO0 temperature
t arm lock
[0946684867.032] t: gpio led - set led pin
[0946684867.039] t: gpio arm_rr_led - set rear arm led
[0946684867.044] t: gpio arm_fw_led - set front arm led
[0946684867.051] t: gpio gps_n_reset - set gps_reset pin
[0946684867.055] t: gpio power_en - set power_en pin
[0946684867.063] t: gpio vbat_en - set vbat_en pin
[0946684867.070] t: gps stop - gps stop
[0946684867.076] t: gps start - gps start
[0946684867.082] t: gps version - gps HW/FW version
[0946684867.087] t: gps navstatus - gps navstatus
[0946684867.091] Health: expired[0946684867.094] t: gps s: BARO0 temperat ure
vinfo - gps svinfo
[0946684867.107] t: gps status - gps status
[0946684867.112] t: mag version - mag version
[0946684867.118] t: esc play_tune - esc play_tune
[0946684867.123] t: esc read - esc read <motor_id> <register>
[0946684867.130] t: esc bw_test - esc bw_test <te[0946684867.135] Commander: Killst_time_period> <min_freq> <max_ing now
freq> <min_rpm> <max_rpm> <motor>/<all>
[0946684867.147] t: esc reset - esc reset
[0946684867.154] t: esc test_motors - esc test_all <motor speed>
[0946684867.159] t: esc gt_kill - esc gt_kill
[0946684867.163] Health: expired[0946684867.166] t: esc t: BARO0 temperat ure
est_motor - esc test_motor <moter id> <motor speed>
[0946684867.178] t: esc set_param - esc set_param <param_id> <param _value>
[0946684867.187] t: esc get_param - esc get_param <param_id>
[0946684867.191] t: esc clear_fault - esc clear_fault
[0946684867.199] t: esc fault - esc fault
[0946684867.204] t: esc version - esc version
[0946684867.212] t: esc status - esc status all or esc status <m otor>
[0946684867.219] t: imu sanity - factory sanity test
[0946684867.227] t: imu measure - print latest measurements
[0946684867.232] t: imu s[0946684867.235] Health: expiredelfcheck - imu selfcheck
: BARO0 temperature
[0946684867.242] t: imu version - imu version
[0946684867.250] t: baro measure - print sensor measurements
[0946684867.258] t: baro calibrate - perform MSL cal
[0946684867.264] t: baro selfcheck - basic sensor test (polled and a utomatic mode)
[0946684867.274] t: baro sanity_analyze - baro sanity test, analyze pre-s ampled measurements
[0946684867.286] t: baro sanity_sample - baro sanity test, sample in bac kground
[0946684867.295] t: baro sanity - baro sanity test (sensor noise and flatline)
[0946684867.303] t: led s[0946684867.307] Health: expiredtatus - led status
: BARO0 temperature
[0946684867.315] t: led rgb - led rgb <red> <green> <blue>
[0946684867.324] t: leg_accel sanity - sanity noise test
[0946684867.332] t: leg_accel selfcheck - factory self check
[0946684867.338] t: leg_accel accel - basic polling test
[0946684867.344] t: mag sanity - sanity noise test
[0946684867.351] t: mag selfcheck - factory self check
[0946684867.358] t: mag measure - basic polling test
[0946684867.363] t: adc batt_ntc - battery ntc raw adc
[0946684867.370] t: adc power_btn - power button raw adc
[0946684867.375] t: adc isense - battery current[0946684867.379] Health: expired raw adc
: BARO0 temperature
[0946684867.386] t: adc vsense - battery voltage raw adc
[0946684867.394] t: coyote param_write - coyote param write <name> <type > <val>
[0946684867.402] t: coyote param_read - coyote param re[0946684867.406] Gimbal Iface Txad <name>
: Gimbal Status Timedout
[0946684867.411] t: coyote p[0946684867.415] Gimbal Iface Txaram_list - coyote param li: set_gimbal_present: Current Prst
esent [X] -> Present [ ]
[0946684867.427] t: ekf m[0946684867.427] Gimbal Iface Txag_bad - ekf mag_bad
: Updating Gimbal to not-present[0946684867.436] t: ekf s
tatus - ekf status
[0946684867.443] Gimbal Iface Tx[0946684867.446] t: ekf r[0946684867.447] Health: expired: Disabling gimbal default mavlieset - ekf reset
: BARO0 temperature
nk streams
[0946684867.459] t: landing g[0946684867.463] Gimbal Iface Txear - landing gear st: Deleting stream VEHICLE_STATESate
_COYOTE
[0946684867.478] t: param s[0946684867.479] Gimbal Iface Txet - set param: NAME: Deleting stream COYOTE_PARAM
VALUE
[0946684867.490] Gimbal Iface Tx[0946684867.490] t: param s: Stream ATTITUD E already disablhow - show param valued
e: NAME[*]
[0946684867.506] t: param import - import parameters from flash (n o reset)
[0946684867.514] t: param load - load parameters from flash (res ets first)
[0946684867.522] t: param s[0946684867.523] Health: expiredave - save parameters: BARO0 temperature
to flash
[0946684867.534] t: system reboot - system reboot
[0946684867.542] t: firmware info - firmware info
nsh> dd
nsh: dd: missing required argument(s)
nsh>
nsh> nsh: und
nsh: nsh:: command not found
nsh>
nsh>
nsh>
nsh> d
nsh: d: command not found
nsh>
nsh> nshand not found [Knsh:[0866ARO0 temperature
nsh: nshand: command not found
nsh>
nsh> [0946684867.595] Health: expired: BARO0 temperature

 

[Boko]

I can't find Baro on the board.


[0946684914.143] Commander: arm_disarm: arm requested
[0946684914.144] Commander: Sending arm request
[0946684914.144] Commander: request_arm_disarm: arm: 1 force: 0 arm_status: 0
[0946684914.146] Commander: requesting IDLE state
[0946684914.147] Commander: Requesting flight state IDLE
[0946684914.148] Commander: STANDARD: transition state from DISARM -> IDLE
[0946684914.150] Commander: accel passed[X]
[0946684914.155] Commander: mag passed[X]
[0946684914.155] Commander: gyro passed[X]
[0946684914.162] Commander: baro passed[ ]
[0946684914.167] Commander: gps passed[X]
[0946684914.171] Commander: rc passed[X]
[0946684914.175] Commander: battery passed[X]
[0946684914.179] Commander: esc passed[X]
[0946684914.183] Commander: arms passed[X]
[0946684914.188] Commander: gear passed[X]
[0946684914.194] Commander: temp[0946684914.195] Health: expireds passed[ ]
: BARO0 temperature

 

[Boko]

I can't find Baro on the board.


[0946684914.143] Commander: arm_disarm: arm requested
[0946684914.144] Commander: Sending arm request
[0946684914.144] Commander: request_arm_disarm: arm: 1 force: 0 arm_status: 0
[0946684914.146] Commander: requesting IDLE state
[0946684914.147] Commander: Requesting flight state IDLE
[0946684914.148] Commander: STANDARD: transition state from DISARM -> IDLE
[0946684914.150] Commander: accel passed[X]
[0946684914.155] Commander: mag passed[X]
[0946684914.155] Commander: gyro passed[X]
[0946684914.162] Commander: baro passed[ ]
[0946684914.167] Commander: gps passed[X]
[0946684914.171] Commander: rc passed[X]
[0946684914.175] Commander: battery passed[X]
[0946684914.179] Commander: esc passed[X]
[0946684914.183] Commander: arms passed[X]
[0946684914.188] Commander: gear passed[X]
[0946684914.194] Commander: temp[0946684914.195] Health: expireds passed[ ]
: BARO0 temperature

MS5611?

 

[bozmanx]

I don't have that many drones to experiment with, so I can only propose a solution to identify problems.
1) Connect to both diagnostic interfaces and monitor for errors.
If I understand correctly, then everything related to flight is controlled by STM32
2) Try updating the firmware from the controller
3) Flash the remaining blocks, (except the "manufacturer" - there serial numbers,
"Black box", "reserved")
4) And of course problems with electricity, cracks in the board, component failures, etc.

Firmware has file for STM32, but I did not know, this full firmware or update.

Have you looked to trace the boot pins for the STM32 ? What software would you use ? It could be worth just getting a second hand board even if it has the pairing issue. If it has one of the issue mentioned at point 4, its not something you can easily find.

 

[account deleted]

3) Flash the remaining blocks, (except the "manufacturer" - there serial numbers,
"Black box", "reserved")

Please tell me the command to do this

insmod /opt/sentinel/modules/mtd_write_enable.ko - Write enable
dd-new if=/dev/mtdblock0 of=/home/backup/mtdblock0.bin conv=sync,noerror status=progress - Backup (block number - mtdblock...)
flash_eraseall /dev/mtd0 - Erase (block number - mtd...)
nandwrite -p /dev/mtd0 /home/orig/mtdblock0.bin Write image (block number - mtd... mtdblock...)
OR
dd-new if=/home/orig/mtdblock0.bin of=/dev/mtdblock0 status=progress - Write image (block number - mtdblock...)

Blocks:
0 : "bootloader" - Bootloader
1 : "params"
2 : "kernel1"
3 : "kernel2"
4 : "filesystem1" - Firmware
5 : "filesystem2"
6 : "firmware_header1"
7 : "firmware_header2"
8 : "user_data"
9 : "manufacturer" - Serial numbers
10 : "blackbox"
11 : "reserved"

 

[account deleted]

Have you looked to trace the boot pins for the STM32 ? What software would you use ? It could be worth just getting a second hand board even if it has the pairing issue. If it has one of the issue mentioned at point 4, its not something you can easily find.

I assume that there is a standard pinout (STM32),
Maybe I'll connect later and check