Ulf Schleth

by Ulf Schleth

Months after I had updated my Radiomaster TX16S to version 2.12.2, I finally wanted to practice in the simulator again. I plugged the USB connector into the computer and bam — the radio turned off! I quickly found out that I wasn’t the only one having this problem, but also that not everyone was affected by it. What followed was a mix between a research expedition and jungle warfare. Here is the text from the GitHub post:

Gotcha! Weeks later, I sacrificed a lot of free time, weekends and nights. Because am a developer but I had little clue about EdgeTX, C and hardware development at all, I weaponized myself with an AI (mainly opencode agent and its „big pickle“ model), walked lots of wrong paths, bisected, met crowds of nondeterminisms, tested hundreds of builds. And also started to hate AI much more than before.

I took the first bad commits out of my bisect, mitigated the first two (rootcause01 & 02) and then moved on to the 3rd (rootcause03) which was the MAIN rootcause: Fortunately I found a hint in the STM errata [ES0166 §2.4.6] which says that toggling the pin PA12 on the MPU, which is used for USB_OTG_FS_DP on our radio, during USB operation couples noise into the flash memory read path when Bank2 (`0x08100000–0x081FFFFF`) is accessed simultaneously. The corrupted flash read might produce invalid instructions or data, causing a HardFault, a silent hang, or cascading SRAM corruption. This bug was fixed in the 3rd revision of the MPU, which explains that only „early“ TX16S Mk1 have it.

Not all code fits in bank1. But because the Mk1 in its early versions ran very fine until EdgeTX 2.10.6 I knew it maybe depends on WHICH code is in bank1 / 2. To make it short, I shuffled around that code until it works now. At least for 6h+. But memory is getting tight, and moving things around was not easy and wouldn’t get easier.

To let it run even longer I decided to freeze UI while in USB joystick / serial mode.

I’ll append the following to this post:

– MD texts (rootcause01,rootcause02, rootcause03)explaining the root causes and some of the errors I met on the way.
– A text which explains to you or your AI how to make a good debug screen
– An untested patch file to patch the sources of v2.12.2 [3673c51811]

Be careful, it is possible that some useless code and slop resided in there.

Also, I dropped a copy of a working binary here — use it at your own risk!

I hope very much, the developers won’t leave us early Mk1 users behind and will find a way to include a target for it, or a real safe USB mode which disables any access to bank2 code while USB_FS is active. Even if the trigger is a silicon erratum, this issue reveals that USB joystick mode is too tightly coupled to unrelated subsystems, so a cleaner separation of concerns here could improve overall firmware robustness, not just work around old TX16S hardware. If I can help with that, tell me how.

Last but not least: I did all that for the people, who can’t or won’t afford to buy a new radio, just because a MPU has a bug. You also wouldn’t like your father throwing you in a trashcan just because you have errors, would you? Which leads me to think: Maybe parents should publish errata sheets for their children, too. Happy sim training.

P.S. the binaries in the patchfile are just some glibc functions i extracted to move them to the safe bank.