Wio-E5

wio-e5-dev-kit.jpg lora-e5.jpg
lora-e5-block.jpg subghz.jpg
lora-e5-schematic.jpg

This board has a package containing a STM32WLE5JC cortex-m4 microcontroller at 48 MHz.

The MCU does not contain a FPU, only the mandatory DSP for m4 cores, but it does have an embedded radio, it appears to be an SX1262.

STM32WLE5JC

RAM is in two 32K banks, which may be addressed separately or contiguously. The second bank has extended features when used separately.

256K FLASH
64K RAM
AES 256
LoRa

There is a warning in the reference manual on page 185 of RM0461 Rev 5:

“The SMPS needs a clock to be functional. If for any reason this clock stops, the device may be destroyed.”

I probably would not have bothered with this board had I read the above warning beforehand. Who designs a MCU that can self destruct if a bit doesn't get set in error?

Test

The factory default firmware uses the serial link to issue `AT' commands to control the LoRa radio. These can be used to test the device and view its unique ID.

If you type anything other than AT then the device will hang and you must restart the connection. If you do type AT (either case) you then have a tiny amount of time to continue before it rejects the command. For testing you should copy and paste commands.

The firmware was designed to emulate the Hayes AT instruction set yet was clearly implemented by someone who never used a Hayes modem or RTFM.

picocom -b 9600 --echo --omap "crcrlf" /dev/ttyUSB1
AT+VER
+VER: 4.0.11
AT+CH
+CH: 3; 0,868100000,DR0,DR5; 1,868300000,DR0,DR5; 2,868500000,DR0,DR5;
AT+POWER
+POWER: 14
AT+POWER=TABLE
+POWER: 16 14 12 10 8 6 4 2
AT+RXWIN2
+RXWIN2: 869525000,DR0
AT+RXWIN1
+RXWIN1: 3; 0,868100000; 1,868300000; 2,868500000;
AT+ID
+ID: DevAddr, XX:XX:XX:XX
+ID: DevEui, 2C:F7:F1:20:XX:XX:XX:XX
+ID: AppEui, 80:00:00:00:00:00:00:06

Once testing is complete we will erase the firwmare but if you do so there is no going back since it's not available in any format.

Programming

wio-e5-jlink.jpg

To program the board connect with a J-Link EDU Mini. This will require an adapter of some sort.

Warning: This process will erase the write protected firmware and this is non-recoverable.

NB when removing protection, the device will need to be power cycled afterwards.

/opt/JLink/JLinkExe
SEGGER J-Link Commander V7.84 (Compiled Dec 14 2022 16:05:25)
DLL version V7.84, compiled Dec 14 2022 16:04:57

Connecting to J-Link via USB...O.K.
Firmware: J-Link EDU Mini V1 compiled Dec  7 2022 12:50:10
Hardware version: V1.00
J-Link uptime (since boot): 0d 00h 00m 12s
S/N: 801011752
License(s): FlashBP, GDB
USB speed mode: Full speed (12 MBit/s)
VTref=3.278V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: STM32F411RE
Type '?' for selection dialog
Device>STM32WLE5JC
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>s
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "STM32WLE5JC" selected.


Connecting to target via SWD
ConfigTargetSettings() start
J-Link script: ConfigTargetSettings()
ConfigTargetSettings() end
InitTarget() start
Active read protection detected.
Device will be unsecured now.
Device unlocked successfully.
InitTarget() end
Found SW-DP with ID 0x6BA02477
DPIDR: 0x6BA02477
CoreSight SoC-400 or earlier
AP map detection skipped. Manually configured AP map found.
AP[0]: AHB-AP (IDR: Not set)
AP[1]: AHB-AP (IDR: Not set)
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FF000
CPUID register: 0x410FC241. Implementer code: 0x41 (ARM)
Found Cortex-M4 r0p1, Little endian.
FPUnit: 6 code (BP) slots and 2 literal slots
CoreSight components:
ROMTbl[0] @ E00FF000
[0][0]: E000E000 CID B105E00D PID 000BB000 SCS
[0][1]: E0001000 CID B105E00D PID 003BB002 DWT
[0][2]: E0002000 CID B105E00D PID 002BB003 FPB
[0][3]: E0000000 CID B105E00D PID 003BB001 ITM
[0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU
[0][6]: E0043000 CID B105900D PID 005BB906 CTI
Memory zones:
  Zone: Default Description: Default access mode
Cortex-M4 identified.
J-Link>mem32 0x8000000 0x20
08000000 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000010 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000020 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000030 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000040 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000050 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000060 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
08000070 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF

Erase

Connecting to the board using JLinkExe will remove protection and erase the firmware but this can also be done using a standalone tool.

NB when removing protection, the device will need to be power cycled afterwards.

/opt/JLink/JLinkSTM32Exe
SEGGER J-Link Unlock tool for STM32 devices
Compiled Dec 14 2022 16:07:39
(c) 2009-2015 SEGGER Microcontroller GmbH, www.segger.com
              Solutions for real time microcontroller applications

This program is designed to reset the option bytes of a STM32 device to their factory settings. If read protection of the device is enabled, reset the option bytes will cause a mass erase.

Options:
  [0] Exit
  [1] STM32F0xxxx
  [2] STM32F1xxxx
  [3] STM32F2xxxx
  [4] STM32F3xxxx
  [5] STM32F4xxxx
  [6] STM32F72xxx, STM32F73xxx
  [7] STM32F74xxx, STM32F75xxx
  [8] STM32F76xxx, STM32F77xxx
  [9] STM32G0x0xx
  [10] STM32G0x1xx
  [11] STM32G4xxxx
  [12] STM32H743_53_50
  [13] STM32H745_47_55_57
  [14] STM32L0xxxx
  [15] STM32L1xxxx
  [16] STM32L4xxxx
  [17] STM32L5xxxx
  [18] STM32U5xxxx
  [19] STM32WBxxxx
  [20] STM32WLxxxx
Please select the correct device family:

Clock

On reset the MCU uses the MSI clock at 4 MHz.

HSE

32MHz TCXO

PB0 TCXO VCC
LSE

32.768KHz

Antenna

Receiver
PA4 1
PA5 0
Transmitter with RFO_HP
PA4 0
PA5 1

SMPS mode.

Transmitter with RFO_LP

Not supported.

Resources

This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies