Run SPOT Run

Skill Level: Intermediate

by Nate April 06, 2012 | 40 comments

Let's jump to the punch line: With a clear, open view of the sky, you can transmit small amounts of data (think text messages or 41 character tweets) across a low-orbit satellite network from nearly any surface of the earth. The SPOT Connect Satellite Messenger is easily controlled with a few serial commands. This opens the door to all sorts of remote data sensing and tracking projects. It's not cheap ($150 for the hardware, $100 a year for the service, $20 for the breakout board, $0.10 per message) and you won't be streaming YouTube, but it's a heck of a lot better coverage than cellular.

Part 1 covers the serial interface requirements. So if you're just looking to use the breakout board, start there.

Part 2 covers the tear down and reverse engineering required in this project. Good for eye candy but may be a bit technical for folks that don't enjoy a good continuity test now and again.

Part 1 - Serial Interface

If you've got the breakout board and are eager to get started, here's information about the command structure.

You can find example code on the Run SPOT Run github repo. The breakout board layout files are also there.

The SPOT Connect receives serial messages on the RX-I pin and transmits messages on the TX-O pin. All communication is at 115200bps, 8N1. Each message or command begins with a preamble (0xAA), the length of the command, and then the remainder of the packet. There are no termination characters or CRC.

Remember: You need to activate your SPOT (pay your $100 per year) before the SPOT website will start showing the position and messages from your device. You will need to be in an open, clear area outdoors. I've gotten my SPOT to work in a windowsill but assume you will need to be outside. SPOT does not work through roofs.

Send Message:

0xAA 0C 26 01 00 01 00 01 54 65 73 74

0xAA : Preamble

0x0C : Length of command (0x0C = 12 bytes)

0x26 : Transmit message command

0x01 : Message type (0x01 = Ok, 0x04 = help, 0x40 track)

0x00 01 00 01 : Unknown status and command bytes

0x54 65 73 74 : These are ASCII characters 'Test'. There's our message! Change this string and the length command (if your string length is longer or shorter than 4).

Request Status:

0xAA 03 52

0xAA : Preamble

0x03 : Length of 3

0x52 : Request status. The SPOT will then respond with a large packet of 41 bytes. See Status Response Packet below.

Request last known GPS location:

0xAA 03 25

0xAA : Preamble

0x03 : Length of 3

0x25 : Request last known GPS location. Unit will respond with a 12 byte packet containing the encoded Latitude and Longitude. See one of these great articles to learn how to decode the data.

Cancel Message Command:

0xAA 04 51 10

0xAA : Preamble

0x04 : Length of 4

0x51 10 : Cancel last message

Send Help Message:

0xAA 0C 26 04 00 01 00 01 54 65 73 74

0xAA : Preamble

0x0C : Length of 12 (hex, remember?)

0x26 : Transmit message command

0x04 : Message type (0x04 = help)

0x00 01 00 01 : Unknown status and command bytes

0x54 65 73 74: Our message 'Test' in ASCII letters

Status Response Packet:

The SPOT Connect will respond with a 41 byte packet (a monster!). You can get the full OpenOffice .ods spreadsheet here. What!? You don't use OpenOffice? Cool, here's an XLS.

0xAA 2B 52 00 00 01 04 06 01 00 07 ....

0xAA : Preamble (array location zero)

0x2B : Length of 43. But this is completely weird. The length is always 41 bytes. Very odd indeed. (array location one)

Rather than rattling off all the bytes, here are the good ones:

Location 7 : Unit status (0x00 = GPS/Radio powered off, 0x07 = GPS searching, 0x0F = GPS lock, 0x06 = transmitting to satellite network). Note: Once the unit has GPS lock it will power down the GPS receiver and move to radio transmission.

Location 11 / 12 : (ex: 0x1BF = 447s) Seconds until next transmission. During GPS search it is zero. The is a number that is different after each transmission. It will start at an unknown about (such as 447s)  and count down to zero where the unit will then re-transmit.

Location 19 : Number of tries sending message. This will increase from 00 to 01 after GPS lock. It will increase again after seconds until next transmission reaches zero. It will increase from 00 to 01 to 02. After the 02nd transmission attempt reaches zero seconds, the unit will shut down the radio front end and go to status 0x00.

Location 26 : GPS lock achieved. This will switch to 0x01 once a GPS lock is achieved. Once this switches to 0x01 it is common for the phone app to request the last known GPS location (so you can too!).

Location 31 : Number of satellites in view. This will increase from 00 to 04 or more (I've seen as high as 08 in testing). However, once the unit obtains GPS lock it will turn GPS off and this number will return to 00 during the attempts to broadcast the location and message to the satellite network.

Part 2 - The Teardown and Reverse Engineering

I started this project around Christmas of 2011 after walking past Aaron's office at SparkFun. He had a chunk of electronics hooked up sitting on his window sill. I immediately recognized it as the original SPOT geolocator. After losing my first high altitude balloon to Kansas, I had purchased a SPOT a few months earlier as a backup locator beacon. Aaron mentioned that someone had figured out how to send the right commands to get the SPOT to transmit encoded information (rather than just Lat/Long coordinates).

So I set out to replicate Natrium42's work. He did kind of an amazing job of figuring out which byte was responsible for what. I'm still not entirely sure how he figured out byte five of the setup message was the RF channel. Above is my attempt at controlling SPOT (the original, now dubbed 1).

Disassembling the SPOT is easy enough, but you really have to mod the hardware to tap into the serial lines. You can see here that I hot aired off the MSP controller with the Heaterizer (yes, it can do modest SMD rework) and added the various serial connections. 5 seconds after I had removed the MSP I realized I could have left the MSP in place and simply pulled the reset line low on the MSP. Dah! Oh well. After a few hours of serial packet hacking, I found I could send and receive packets reliably to the STX2 satellite radio. After using the SPOT 1 for a few days I found it had pretty bad antenna transmission and the GPS chipset is pretty low-end. The other limitation is that you can really only transmit modified location information, limiting you to 5 bytes of user data. Not horrible, but the recent release of SPOT 2 and SPOT Connect got me interested in hacking other platforms.

Enter the SPOT Connect. For $150 (there was a $50 rebate which brought it down to $100) you get a black box that connects to your cell phone over Bluetooth. From my Android phone, I could send messages over Bluetooth to the SPOT, and it piped out my message over the sat network to anyone on my contacts list. "Hi Mom!" takes on a whole new meaning from the middle of the Atlantic.

Like many of the projects landing on my desk (Nest thermostat, Laser tape measure, Wiimote) the SPOT didn't hang out for long before screws started to fly.

Hello miniUSB port! Disassembly was easy with just a few simple Phillips head screws to remove.

This is the combination satellite transmission antenna and GPS receiving antenna on the front of the main board. The odd slice marks (that look like arrows) are the intentional scratches made during antenna calibration. Antenna tuning is black magic to me. You can also see the 5 LEDs from the top in clock wise fashion: Bluetooth, On/Off, GPS, Satellite, SOS.

There is a stack of two boards inside the SPOT connect. Here is the daughter board (responsible for power) stacked on top of the main board. This stack up of boards is what originally intrigued me from Travis Goodspeed's write up and pictures. These interconnects make it a lot easier to hack by listen to what's going on between boards. It also opens up the potential for easy end-user hardware modification. Buy a SPOT, unplug one board, plug it onto a SparkFun breakout board and you shouldn't have to solder anything! This was the idea anyway.

This is the back of the main board.

Here's a nice high-res image of the main players. The main brain of the SPOT Connect is the MSP430F5524. It does everything. The satellite radio front end is controlled by a PIC30F2012. The GPS chipset was upgraded from the original SPOT to a respectable uBlox-5. You can also see the proliferation of test points on this board. This was made to be hacked!

Here is the back of the power board. It is much less populated but contains some very interesting surprises.

I first set out by continuity testing a lot of the IC interconnections. I originally thought I would do what Narium43 did and take over from the MSP, and talk to the radio/PIC directly. To do this I had to locate the GPS TX/RX pins and the TX/RX pins going to the radio (now the PIC30F2012).

Reverse engineering gets surprisingly easier as you do more of it. I had poked and prodded the SPOT 1 quite a bit which gave me some phenomenal advantages when working on the SPOT Connect. It turns out the MSP is connected to the GPS and radio in the same muxed UART via a quad analog switch (74LVC4066) as it was on the original SPOT 1!

So I broke out the faithful Logic analyzer (this thing is worth its weight in gold and has saved my life many times) and started listening.

The serial interface between the MSP (brain), PIC (radio), and uBlox (GPS) was similar to the SPOT 1 that Narium had decoded. It had the same preamble, # of bytes, and a CRC byte or two at the end, but the number of bytes was significantly larger. I chalk this up to the more complex radio communication going on to send full character streams instead of just coordinate information. After a few hours of trying to make sense of the 29 byte packets, it suddenly occurred to me (and with the help of Travis' link to the BT module datasheet) that there must be some additional serial coming to/from the Bluetooth module via the smartphone application.

Sure enough - there are TX and RX pins from the Bluetooth module on the daughter power board running to the MSP on the main board at 115200bps! There is some overhead that the cellphone application sends ('hi, how are you?', 'I'm bluetooth ID blarg', 'can I get access?') but it's all junk that we can skip.

If you can get the following characters into the BT-TX pin of the main board, the main board will then transmit the word 'Test' plus your Longitude and Latitude at 115200bps:

0xAA 0C 26 01 00 01 00 01 54 65 73 74

0xAA : Preamble

0x0C: Length of command (0x0C = 12 bytes)

0x26 01 00 01 00 01: All status and command bytes, currently unknown but can remain unchanged

0x54 65 73 74: These are ASCII characters 'Test'. There's our message! Change this string and the length command (if your string length is longer or shorter than 4).

We should now be able to ditch the daughter power board and plug the main board onto a breakout board for our own purposes. I spent a few days tracing all the power pins and checking the noise levels on various buses. There are multiple DC to DC converters on the power board and injecting noise into the GPS or PIC controller will severely degrade GPS reception and cause satellite transmission issues.

Apple security IC?! What is that? The MFI341S2164 is an authentication co-processor that Apple requires on approved iPhone peripherals. Crazy! Here's a schematic I found showing how a MFI341S2164 is wired up. The 20-pin QFN label 2164 on this board does indeed match the schematic connections. This IC is pinged by the MSP over I2C after the unit turns on. If the MSP doesn't get a response from the IC the unit will got into one of many failure modes (blinking various LEDs in various patterns). Luckily, if we put the unit into Bluetooth discovery mode (holding the On button for more than 5 seconds) the MSP never talks to the 2164 so our breakout board doesn't need to counterfeit a response on the I2C lines (this is a very good thing).

The other IC and power control groups are fairly straight forward, however the PIC power block is worth noting. The various DC/DC converters produced some power rails that were fairly noisy (between 50 and 150mV of ripple). The PIC has a linear regulator and some nice decoupling which produces 3.0V with very low ripple (10-20mV). I found this was required on the breakout board to get good satellite transmission. I assume noise powering the PIC will translate to noisy in the radio transmission.

Going back to the main board, you can see the pins and various functions of the connectors. Most everything was identified.

Here are the major test points identified. You shouldn't need to wire to these points unless you're getting really nitty gritty. If you need a hi-res image of the board without labels you can find it here (good for IC identification).

Here's an image of the inside of the RF shielded areas. I believe the left block contains the receiver for the GPS signal. The right side contains the amplifier for the satellite transmitter.

And just because I could not resist, here are some images (1 2 3 4 5 6) for a tear down of the more recent SPOT 2 locator. They took the SPOT 1 and boiled it down to a very simple, single IC solution using the PIC30F3014. Do you think there are rubber band wars between the MSP engineer and the PIC engineer at SPOT?

I hope you enjoyed this breakdown! Let us know if you come up with any hair-brained ideas for this powerful satellite transmitter.