Hardware Platform

The Carryout G2 is the most thoroughly documented variant in this project. Its firmware is verbose at boot and exposes low-level hardware state through GPIO, ADC, and SPI submenu commands. This page covers what we’ve identified about the three major silicon components and how they interconnect.

System overview

The G2 runs on three chips connected by two SPI buses:

                    SPI1 (4 MHz)
  K60 MCU ────────────────────────── 2x A3981 (Stepper Drivers)
  (Cortex-M4)                            AZ motor (40000 steps/rev)
     |                                   EL motor (24960 steps/rev)
     |
     |              SPI2 (6.857 MHz)
     └──────────────────────────── BCM4515 (DVB-S2 Tuner)
                                       RSSI, SNR, lock detect
                                       DiSEqC 2.x controller

The MCU runs the firmware shell, motor control loop, and DVB signal processing. The motor drivers are pure slave peripherals — they receive step/direction commands over SPI and handle microstepping and current regulation. The DVB tuner is also a slave but much more complex, running its own firmware for RF signal processing.

NXP MK60DN512VLQ10 (K60 MCU)

Spec	Value
Core	ARM Cortex-M4
Clock	96 MHz
Flash	512 KB
RAM	128 KB SRAM
Package	144-LQFP
FlexNVM	EEPROM emulation (EE> submenu)
GPIO	5 ports (A-E), ~92 pins bonded
SPI	3 controllers (SPI0-SPI2)
UART	6 controllers (UART0-UART5)

The K60 is an NXP Kinetis part, part of the K60 sub-family designed for industrial and motor control applications. Its Cortex-M4 core includes a single-precision FPU, which the firmware uses for angle calculations (position readouts are floating-point).

Firmware version

The boot log reports firmware version 02.02.48, copyright 2013, Winegard Company. Bootloader version 1.01. The firmware is stored in the K60’s internal 512 KB flash and runs directly from there (no external code memory).

UART4 — serial console

The firmware console runs on UART4 at 115200 baud, 8N1:

K60 Pin	GPIO	Function
PTE24	E24	UART4_TX (to computer RX pair)
PTE25	E25	UART4_RX (from computer TX pair)
PTE26	E26	UART4_CTS (hardware flow control, idle high)

CTS is connected but the firmware doesn’t appear to require hardware flow control — the console works fine without it.

GPIO mapping

Live GPIO probing (gpio regs, gpio dir, gpio r) across ports A-E revealed 92 pins. Notable patterns:

• Port E is densely used: SPI1 (E0-E5), UART4 (E24-E27), plus unidentified pins
• Port D carries SPI2 (D11-D15) and an output on D10 (likely BCM4515 reset/enable)
• Port B has a cluster at B0-B3 (possibly SPI0 or I2C) and B11 (status LED or peripheral enable)
• Port C has a contiguous block at C10-C13 (bus interface) and C18 (LNB voltage control)
• Absent pins: A20-A23 and B12-B15 are not bonded on this package variant

Allegro A3981 (Stepper Motor Drivers)

Two A3981 ICs, one per motor axis, controlled over SPI1.

Spec	Value
Interface	SPI (mode 0x03) at 4 MHz
Microstepping	Up to 1/16 step, AUTO mode
Current control	AUTO mode (adapts to load)
Fault detection	DIAG pin per driver (active-low open-drain)
Step resolution	Full, Half, Quarter, Eighth, Sixteenth

Motor specifications

Parameter	AZ (Motor 0)	EL (Motor 1)
Steps per revolution	40000	24960
Max velocity	65.00 deg/s	45.00 deg/s
Max acceleration	400.00 deg/s^2	(from NVS)
Step velocity (raw)	7222 ustep/s	3120 ustep/s
Step acceleration (raw)	44 ustep/s/ms	28 ustep/s/ms
Gear ratio	1.602564	(from boot log)

The AZ motor is the “master” (more steps, faster) and drives the entire dish rotation. The EL motor is the “slave” with fewer steps per revolution.

SPI1 pin assignments

K60 Pin	GPIO	SPI Function	Notes
PTE1	E1	SPI1_SOUT	MOSI — MCU to A3981
PTE2	E2	SPI1_SCK	SPI clock
PTE3	E3	SPI1_SIN	MISO — A3981 to MCU
PTE4	E4	SPI1_PCS0	Chip select: AZ motor driver
PTE0	E0	SPI1_PCS1	Chip select: EL motor driver
PTE5	E5	SPI1_PCS2	Possibly A3981 RESET or enable

AUTO mode

The a3981 cm command reports both drivers in “AUTO” current mode, and a3981 sm reports “AUTO” step mode. In AUTO mode, the A3981 selects the microstepping level based on the commanded step rate — coarser steps at high speed for efficiency, finer steps at low speed for precision.

Motor control hierarchy

Three layers of motor control exist in the firmware:

1. STEP submenu — raw stepper API in microstep units. Commands like p [motor] [steps] and v [motor] [ustep/sec] operate directly on the step counters.
2. MOT submenu — angle-based API. The a <id> <deg> command converts degrees to steps using the steps-per-revolution values and manages PID control.
3. BirdcageAntenna (our code) — adds leap-frog compensation and motor alternation on top of MOT commands.

Homing and calibration

On boot (when tracker is enabled), the firmware runs a homing sequence:

EL home: stall detect, 2 second timeout
AZ home: stall detect, 8 second timeout
"Antenna Facing Front"

The dish uses motor stalling (not limit switches) to find mechanical boundaries. The A3981’s stall detection watches for back-EMF signatures that indicate the motor has hit a hard stop.

After homing, the firmware reports cable wrap limits: wrap_min:-42333 wrap_max:2333 (centidegrees). Total AZ range is approximately 446.66 degrees.

The h <id> command triggers explicit homing for a single motor outside the boot sequence.

Unhomed axes

When NVS 20 is TRUE (tracker disabled), homing is skipped entirely on boot. Motor positions read as INT_MAX (2147483647) until manually homed with h 0 and h 1. The ADC scan command will target INT_MAX on an unhomed axis and deadlock the shell.

Broadcom BCM4515 (DVB-S2 Tuner)

Spec	Value
Chip ID	0x4515
Silicon revision	B0
Firmware version	v113.37
Strap config	0x25018
Interface	SPI (mode 0x03) at 6.857 MHz
Standard	DVB-S2 (Digital Video Broadcasting - Satellite, 2nd gen)
Search range	18000-24000 ksps, rolloff 0.35

The BCM4515 is a highly integrated DVB-S2 demodulator. It handles the entire receive chain from IF input to transport stream output: RF/IF AGC, carrier recovery, timing recovery, LDPC/BCH decoding, and baseband processing.

SPI2 pin assignments

K60 Pin	GPIO	SPI Function	Notes
PTD12	D12	SPI2_SCK	SPI clock
PTD13	D13	SPI2_SOUT	MOSI — MCU to BCM4515
PTD14	D14	SPI2_SIN	MISO — BCM4515 to MCU
PTD11	D11	SPI2_PCS0	Chip select
PTD15	D15	SPI2_PCS1	Secondary chip select (unused)
PTD10	D10	GPIO (OUT)	Likely BCM4515 reset or power enable

Signal measurement capabilities

The DVB submenu exposes several signal measurement modes useful for ham radio:

RSSI — rssi <n> returns the average and current raw ADC values over n samples. Noise floor is approximately 500. Used for RF power measurement at each pointing position.

AGC — agc streams real-time RF/IF AGC levels plus SNR and NID (Network ID). This is a continuous output interrupted by q.

SNR — Signal-to-noise ratio in dB.

Lock status — ls returns total reads, no-signal count, glitch count, and NID table. qls gives a quick check.

LNB control — lnbdc odu sets the LNB to 13V (V-polarization). Boot default is 18V (H-polarization). The lnbv command streams the actual voltage being applied.

DiSEqC 2.x interface

The BCM4515 includes a DiSEqC controller for LNB switch control. DiSEqC uses 22 kHz tone bursts superimposed on the coax LNB bias line. The DVB submenu provides:

• di2conf — LNB config register read
• di2id — Hardware ID query
• di2stat — LNB status flags
• send <hex> — Raw DiSEqC packet transmission (up to 6 bytes)
• ovraddr — Override target address (default 0x11)

Without an external DiSEqC switch connected, these commands return RxReplyTimeout.

Radio telescope mode

The azscanwxp command in the MOT submenu performs an azimuth sweep while cycling through DVB transponders at each position. At each step, it records motor angle, RSSI, lock status, SNR, and scan delta. Combined with elevation stepping, this produces a 2D RF power map of the sky — essentially using the dish as a radio telescope.

azscanwxp [motor] [span_deg] [resolution_cdeg] [num_xponders]

Output per position:

Motor:<id> Angle:<cdeg> RSSI:<adc> Lock:<0/1> SNR:<dB> Scan Delta:<step>

This capability exists in the stock firmware — it was designed for Winegard’s factory alignment and satellite acquisition testing, but it works just as well for amateur radio sky mapping.