What's new
Van's Air Force

Don't miss anything! Register now for full access to the definitive RV support community.

-EXP Deconstructed

dtw_rv6

Well Known Member
I was bored today, and since I fall under the AD that forces me to remove my Navworx -EXP, I spent a few hours on my back with my fuel selector buried in the small of my back (RV6). Here is what came of it:

Remove the EXP
oQc.jpg


I can't ever resist the urge to tear apart a piece of worthless junk if it has screws in it:
o4J.jpg


Here is the offensive little piece of silicon (GPS) that we have all heard so much about:
o4p.jpg


Really? Void my warranty? Ha!
oQz.jpg


Ah Ha!
oQI.jpg


That's all for now. If anyone has any ideas on what comes next, let me know. I'm not an electrical engineer, but I do know how to read a cut-sheet. And I'm relentless :D

Don
 
Last edited:
Would be nice to see some hi-res shots of the markings on all of the chips, especially those on both sides of any daughter/mezzanine boards that are screwed onto the main board.

I suppose it's too much to hope for that NW might have used a GPS module with an NMEA interface to the rest of the works that would possibly allow splicing in some other source. Just idle speculating on a dreary Friday afternoon.
 
Its a consumer grade Sirf IV according to the AD. Its the only chip on the board that doesnt have any sign of identification. Looks like the Sirf supports NMEA... i just have to figure out which pin is the RX and TX.

The bandsaw idea is good. I think it might work better as a Tannerite holder though.

The chip has 6 pins per side... i just started looking at digikey for clues.
 
Last edited:
Figure out how to wire in the uAvionix gps 1 wire from their all in one WAAS gps puck and we?re set. That?s what I don?t get from this whole thing. It?s an experimental and it?s up to the manufacturer to show that it is up to the standard. I believe you could show that by using known parts that are already accepted as meeting the standards we would be good to go. This is a messed up place the FAA has created as far as certified/experimental. Does anyone have an idea on what the doghouse had or how it bypassed the internal gps?
 
This is exactly what I'm hoping to discover. My assumption is that Bill was going to reprogram the i/o so that one of the spare pins on the DB9 would become an input for serial data, then disable the onboard chip. Since I probably can't get the firmware code, the only way I can imagine is to intercept the serial traces and re-route them mechanically to the DB9.

1. Altera Cyclone III - EP3C25F324C8N / G_CCAAA1519A
2. Analog Devices AD6652BBCZ / #1526 / 3174726.1
3. CY62167EV3 (3 or 4 more digits unreadable) / 45ZXI 1325 / next line is unintelligible.

The Cyclone is aparently an FPGA with Intellectual Property protection features. I'm not sure I would know how to break that with an electron microscope.....

Figure out how to wire in the uAvionix gps 1 wire from their all in one WAAS gps puck and we?re set. That?s what I don?t get from this whole thing. It?s an experimental and it?s up to the manufacturer to show that it is up to the standard. I believe you could show that by using known parts that are already accepted as meeting the standards we would be good to go. This is a messed up place the FAA has created as far as certified/experimental. Does anyone have an idea on what the doghouse had or how it bypassed the internal gps?
 
GPS Module

The EXP GPS module seems to line up with an Inventek Systems ISM-420-R1. See photo markup:

oQR.jpg


If that is the case, then I should be able to pump a new GPS signal in on PIN 14. It appears to be a UART (serial data) signal. Pins 4 and 5 configure the baud rate and data protocol with the two resistors being pulled low or high.

Does anyone know of a "safe" way to probe pin 14 to confirm it is a serial line?

I don't have an oscilloscope, but maybe someone else does?

Don
 
The EXP GPS module seems to line up with an Inventek Systems ISM-420-R1. See photo markup:

oQR.jpg


If that is the case, then I should be able to pump a new GPS signal in on PIN 14. It appears to be a UART (serial data) signal. Pins 4 and 5 configure the baud rate and data protocol with the two resistors being pulled low or high.

Does anyone know of a "safe" way to probe pin 14 to confirm it is a serial line?

I don't have an oscilloscope, but maybe someone else does?

Don
I do, but we're a good distance apart.

My Plan A would be the scope. Plan B would be to pick off the signal on that pin, buffer and invert it, and feed it to a PC serial port and see if it's serial data. I have parts for this kind of thing lying around, but most people (normal people?) don't. The easy way is a small-signal MOSFET like a 2N7000 with a pull-up resistor.
 
Does anyone know of a "safe" way to probe pin 14 to confirm it is a serial line?
Don - You could try making a simple data probe using a 2 volt LED diode and 300 ohm resistor. I don't know how to post a graphic in this text so will refer you to page 9 of the ACK E-04 instillation manual. There is a graphic on that page that shows you how the probe is made. If there is data on that line you want to test the LED will flash. This test won't tell you if the line is "serial data" but it may help you determine if the line is polled data. One would think if the flashing or flickering is repetitive it would suggest a serial data line.

Link to the ACK E-04 manual refer to page 9:
http://www.ackavionics.com/pdf/E-04%20REV%201.8%20SINGLE%20PAGE.pdf

Not sure if that will help you ... but it is an inexpensive way to have a look.

Good luck
 
Last edited:
I like the LED test circuit idea - now I just need to avoid coffee for a day so I can solder a lead on that incredibly small trace. This might be the excuse I need for buying a hot air pencil....

Thanks! I'll report back when I know the result.

Don

Don - You could try making a simple data probe using a 2 volt LED diode and 300 ohm resistor. I don't know how to post a graphic in this text so will refer you to page 9 of the ACK E-04 instillation manual. There is a graphic on that page that shows you how the probe is made. If there is data on that line you want to test the LED will flash. This test won't tell you if the line is "serial data" but it may help you determine if the line is polled data. One would think if the flashing or flickering is repetitive it would suggest a serial data line.

Link to the ACK E-04 manual refer to page 9:
http://www.ackavionics.com/pdf/E-04%20REV%201.8%20SINGLE%20PAGE.pdf

Not sure if that will help you ... but it is an inexpensive way to have a look.

Good luck
 
Last edited:
Don - Soldering to the circuit board isn't necessary is it? Unless you are wanting to make a permanent tap.

If a permanent tap is not the case, I would suggest first try using a sharp pointed object such as a needle or tiny finishing nail with a really sharp point to poke the trace or solder pad on the board. You can use a small alligator clip to connect the probe to the tester - LED/Resistor.
 
Use a terminal emulator instead of a scope

Consider using a serial to USB adapter like this one from Sparkfun. There are others out there and you may find them on amazon or eBay.

SparkFun USB to Serial Breakout - FT232RL
https://www.sparkfun.com/products/12731

Hook up your gps output to the rx terminal on the adapter and connect the adapter usb to your computer.

Download one of the free terminal emulators like terraterm or PuTTY.

Tera Term
https://ttssh2.osdn.jp/index.html.en


PuTTY
https://www.chiark.greenend.org.uk/~sgtatham/putty/

https://en.m.wikipedia.org/wiki/List_of_terminal_emulators



Find thenbaud rate through trial and error and you should see the data stream on the terminal emulator. With this you now have a lot of information about what data and format navworx was using. This will be useful in setting up the replacement gps.

-larosta
 
I have an Arduino sitting beside me here on the table. Now that I'm thinking about it, that should work well.

Time to stick 12V into the EXP!

Don
 
Wow, you guys are wild. That's the thing about people who tinker - other's willing to help and share ideas. High tech these days though. When I was a kid I remember a neighbor building a wooden row boat in his basement and I thought how cool it was. That was a few years ago. Now we fly airplanes with multiple flat screens in full color. :D
 
Last edited:
https://www.pololu.com/product/2138/specs

would this work for us?

we need to find one approved and where can we find those?

If someone knows how to program we might be able to support this box on our own....
Plus unlock the 1090!
That one will, I'm certain, be no better than what's in there -- a cheap, consumer grade GPS receiver with no pedigree whatsoever. Little to no documentation, and no provision for an off-board antenna.

I should say up front, I have no dog in this fight -- I didn't buy the NavWorx box, I'm just an interested bystander with possibly a bit of experience making things work in ways the manufacturer may not have intended. I was thinking maybe if a guy could or remove or bypass the internal GPS receiver and wire in a known approved source -- like, say, the uAvionix or Dynon or a Garmin 430W for those lucky few -- MAYBE there might be some salvaging it. Now, that said, I don't know how much of the required "integrity" is GPS hardware/firmware, and how much is device firmware. In other words, I don't know whether swapping out the GPS for one that's on the "nice list" would be sufficient, or if it would also require firmware changes to the EXP unit as well.

As for ongoing firmware support or fixes, well, good luck with that. Unless someone buys NW's assets and decides to either expend substantial programmer and testing time on a dead product (not bloody likely) or release the source code (even less likely), I think what you have is what you got. After being bitten more than once, I have learned to never ever buy anything based on promises of future upgrades or enhancements. If something doesn't work or isn't available when I buy, I assume it never will be.
 
one of the 1st

happen to be one of the first batch orders, and I held off on the dog house because I wanted to see results.
This sort of reminds me of the doghouse http://aspennexnav.com/gpssu/
I might hold off till 2020 before taking the bait again and thats unfortunate.
 
with any luck I'll be able to do some testing on Monday night and find the serial connection. Then we can use the GRT or uAvionix GPS, or 430W, or any other "compliant" GPS. We would still need a doghouse like addition to do a level shift from UART to RS232, but that is a $20 circuit and some circuit board soldering.

As pointed out by others, don't hold your breath for any firmware upgrades. It's probably encrypted.

Don

https://www.pololu.com/product/2138/specs

would this work for us?

we need to find one approved and where can we find those?

If someone knows how to program we might be able to support this box on our own....
Plus unlock the 1090!
 
Gps

Ok. Seems like you guys are getting somewhere. So the FAA is saying a specific
GPS source from NexNav needs to be used.

https://www.airworthinessdirectives.com/Public/NewAD/20171111.pdf

http://aspennexnav.com/products/?cat=cca#nexnav-max

So my assumption at this point is the software inside the Navworx
Exp box has to be changed to couple up with this unit and broadcast a Sil of 0 instead of 3?

Pardon my basic questions, but just hoping like everyone else that there may be a solution to Navworx ditching their customers.
 
Interfacing with a Garmin 430W

Hi Don,

I was pondering your work and the following occurred to me: Speaking for the certified ADS600-B NavWorx units, It's my understanding that the 430W needs firmware 5.x, or better, to output 'ADSB+' on its serial lines and that UAT Console 4.1.0, or better, is needed on the NavWorx unit. It's my guess that this is required so that the NavWorx unit can understand the ADSB+' format.

Does anybody know what's so special about the data format of 'ADSB+' that differs from typical NMEA sentences?

Do the other "certified" GPS sources (uAvionics, GRT, etc) output similar data formats?

Can the latest firmware for the EXP unit understand 'ADSB+' data format and for that matter can it understand the data format sentences from the other "certified" units?

Just thought the question should be asked because there appears to be a dependency between the ADS600-B and the 430W units so why wouldn't there be one on the EXP units.
 
We would still need a doghouse like addition to do a level shift from UART to RS232, but that is a $20 circuit and some circuit board soldering.
It can be simpler than that. The most time consuming part would be nibbling out a hole to mount a DB9 connector.

232_to_TTL.png


Ten minutes with a soldering iron, if you're fairly experienced, and less than a buck in parts stuck down with hot-melt glue. It's a dead simple level shifter/inverter. I like 2N7000s but there are other parts that will work. You really don't need anything fancy. As for the installation, it would probably be something the average person would want to have someone else do.

I was pondering your work and the following occurred to me: Speaking for the certified ADS600-B NavWorx units, It's my understanding that the 430W needs firmware 5.x, or better, to output 'ADSB+' on its serial lines and that UAT Console 4.1.0, or better, is needed on the NavWorx unit. It's my guess that this is required so that the NavWorx unit can understand the ADSB+' format.

Does anybody know what's so special about the data format of 'ADSB+' that differs from typical NMEA sentences?

Do the other "certified" GPS sources (uAvionics, GRT, etc) output similar data formats?

Can the latest firmware for the EXP unit understand 'ADSB+' data format and for that matter can it understand the data format sentences from the other "certified" units?

Just thought the question should be asked because there appears to be a dependency between the ADS600-B and the 430W units so why wouldn't there be one on the EXP units.
That's my question as well -- whether connecting an acceptable GPS source is enough (very good news) or whether the firmware would need to be tweaked to work with something else (very bad news).
 
Hi Don,

I was pondering your work and the following occurred to me: Speaking for the certified ADS600-B NavWorx units, It's my understanding that the 430W needs firmware 5.x, or better, to output 'ADSB+' on its serial lines and that UAT Console 4.1.0, or better, is needed on the NavWorx unit. It's my guess that this is required so that the NavWorx unit can understand the ADSB+' format.

Does anybody know what's so special about the data format of 'ADSB+' that differs from typical NMEA sentences?

Do the other "certified" GPS sources (uAvionics, GRT, etc) output similar data formats?

Can the latest firmware for the EXP unit understand 'ADSB+' data format and for that matter can it understand the data format sentences from the other "certified" units?

Just thought the question should be asked because there appears to be a dependency between the ADS600-B and the 430W units so why wouldn't there be one on the EXP units.


Adsb+ is Garmin proprietary. It?s only available on Garmin and Avidyne Products. I may be wrong, but I believe that Nema will only yield an sil=0.

The dependency is based upon the specific api used by the gps unit. The only easy method would be to substitute a compliant gps that uses the same api as the one that is installed. Otherwise you?ll have to update firmware, which there is no clear path to do so at the moment. I am also of the belief, based on my conversations with Mike and Kyle, that unless new gps is plug and play, getting an amoc would be difficult.
 
Hi Don,

I was pondering your work and the following occurred to me: Speaking for the certified ADS600-B NavWorx units, It's my understanding that the 430W needs firmware 5.x, or better, to output 'ADSB+' on its serial lines and that UAT Console 4.1.0, or better, is needed on the NavWorx unit. It's my guess that this is required so that the NavWorx unit can understand the ADSB+' format.

Does anybody know what's so special about the data format of 'ADSB+' that differs from typical NMEA sentences?

Do the other "certified" GPS sources (uAvionics, GRT, etc) output similar data formats?

Can the latest firmware for the EXP unit understand 'ADSB+' data format and for that matter can it understand the data format sentences from the other "certified" units?

Just thought the question should be asked because there appears to be a dependency between the ADS600-B and the 430W units so why wouldn't there be one on the EXP units.
I have spoken with Uavionix(SkyFYX), GRT(2020GPS) and Trig(TN72) in regard to output protocols for their respective GPS sources. They have each said their NMEA+ outputs are not compatible with garmins ADSB+ protocol. The best advice I have received to date besides the NexNav mini (which is already allowed by the AD) @$1.9k is a big MAYBE on the Garmin 20A, which retails at $850. They all could be guarding themselves for all I know.

George Mellen
 
My assumption is that if i expose a serial input line as described above, then the user can attach a GRT or uAvionics, or whatever else out there is broadcasting SIL 3. If the SIL has to be changed, then this effort is likely in vain.

After i get my prototype running, I?ll probably have to check in with the FAA to see if they will consider this solution.

Don
 
Back
Top