RC Groups

RC Groups
    DIY Electronics
        Discussion FlySky/Turnigy 9X Protocol

#1 PhracturedBlue Apr 02, 2012 10:45 PM

FlySky/Turnigy 9X Protocol
 
The information below may be somewhat out of date. The most recent information on this protocol can be found in the doc directory of the Deviation firmware project:
https://bitbucket.org/PhracturedBlue/deviation/src

While I probably won't pursue this much further at this point, I thought I'd document what I've found out so far in case anyone ever comes looking for it.
Updated 2012-07-01
I've been playing with a V911 transmitter which contains the A7105 FSK Tx/Rx chip. This transmitter uses 3-wire SPI to send data which makes it easy to look at.
The V911 is compatible with the Turnigy 9X/FlySky FS-TH9X, though it is only a 4-channel heli.

Initial analysis shows that all channel data is sent in 22-byte frames every ~1.5ms

The data in the frame is apparently not encrypted, and each channel is sent as a 16bit little-endian word.

The A7105 Data sheet can be found here:

After power-on, the following steps are initiated:
1) A7105 is reset send (0x00, 0x00)
2) Send 32bit address to address 0x06: 0x5475c52a
3) Program the A7105 control registers as follows:
Code:
Code:

0x00: --, 42, 00, 14, 00, --, --, 00, 00, 00, 00, 01, 21, 05, 00, 50
0x10: 9e, 4b, 00, 02, 16, 2b, 12, 00, 62, 80, 80, 00, 0a, 32, c3, 0f
0x20: 13, c3, 00, --, 00, 00, 3b, 00, 17, 47, 80, 03, 01, 45, 18, 00
0x30: 01, 0f, --

4) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
5) Write '1' to address 0x02 to start the IF Filter Bank calibration
6) Poll address 0x02 until it returns '0' indicating calibration is complete
7) Read IF calibration info from Address 0x22
8) Write VCO Current calibration to 0x24 (value = 0x13)
9) Write VCO Bank calibration limits to 0x26 (value = 0x3b)
10) Write channel to Address 0x0f (value = 0x00)
11) Write '2' to address 0x02 to start VCO bank Calibration
12) Poll address 0x02 until it returns '0' indicating calibration is complete
13) Read VCO calibration from Address 0x25 (test for success?)
14) Write channel to Address 0x0f (value = 0xa0)
15) Write '2' to Address 0x02 to start VCO bank Calibration
16) Poll address 0x02 until it returns '0' indicating calibration is complete
17) Read VCO calibration from Address 0x25 (test for success?)
18) Write manual VCO Bank calibration to Address 0x25 (value = 0x08) ???
19) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
20) Start sending frames as follows

Frames are sent each 1.46ms. Each frame consists of sending a 'FIFO Write Pointer Reset' (Strobe = 0xe0), 22 bytes of data, setting the channel (via the 0x0f register) and then sending 'TX mode' (Strobe = 0x0d) to actually initiate the transfer

The frame data is not encrypted, and is 16-bit little endian. the data appears to be as follows.
Fo each channel the minimum value I observed was ~ 0x03e8 and the maximum was ~ 0x07ca.

Code:

        TX1                TX2
word 1:      0xaa05/0x5505
word 2: 0x01f3            0x0002
word 3: 0x2000            0x7000
word 4:      aileron  (ch1)
word 5:      elevator (ch2)
word 6:      throttle (ch3)
word 7:      rudder  (ch4)
word 8: 0x02c3            0xedfc
word 9: 0x02ed            0x02eb
word 10:      see below
word 11:        0x0000

Word 1 is 0xaa05 until 3 seconds have elapsed and the throttle has been brought to its minimum value. It then changes to 0x5505 at the same time that the Tx starts cycling between channels

Word 2 and 3 are apparently the Transmitter's Unique ID (thanks zeza from RCGroups)
word 8 and 9 are likely to be channels 5 and 6

Word 10 seems to continuously cycle between 10 states (changing state every frame):
State 1 : 0x100, 0x200, or 0x300 (almost always 0x200)
State 2 : 0x23 or 0x24 (almost always 0x24)
State 3 : 0x32
State 4 - 10: 0xffe or 0xfff

The Tx channel will be 01 until initialization is done and the throttle is brought to 0. At ~ 3 seconds, data is transmitted on multiple channels. Channel ordering is dependent on Transmitter?
Tx2: 0a, 5a, 50, a0, 14, 64, 46, 96, 1e, 6e, 3c, 8c, 28, 78, 32, 82
Tx1: 79, 29, 6f, 1f, 83, 33, 65, 25, 8d, 3d, 5b, 0b, 97, 47, 51, 01

Also, there is still work to do to determine how the Bank Calibration data is used

#2 kile Apr 03, 2012 04:51 AM

Hey, thanks a lot for this!

I though about analyzing the details of the protocol but I never got into it.

Do you know of an online store where I can get a A7105 module in small quantities? I wouldn't like to butcher a perfectly functional transmitter or receiver to get to the module. I googled this a little, but couldn't find anything.

Thanks again!

#3 PhracturedBlue Apr 03, 2012 10:26 AM

I didn't find the chip itself, but I found pretty inexpensive modules at aliexpress:
http://www.aliexpress.com/product-fm...olesalers.html

#4 kile Apr 03, 2012 01:04 PM

Yes, that would is a great price even if I have to order at least 10 pieces, but they don't offer "china post" shipping to Hungary. So, $63 with EMS shipping is a little too expensive for me.

But, thanks for the info!

#5 dave1993 Apr 05, 2012 02:30 PM

hi phractured. amazing post.

ive spent considerable time recently working with 9x code and based on your info just ordered a v911. mostly to get the radio. i definitely would like to order these modules if compatible but the ali ad mentions 24L01 which is a different chip:

Quote:

low-cost 2.4 G wireless module/A7105 / NRF24L01
i have quite a few 24L01 (it does look vaguely similar) and do not need any more. id order some of these but not if its 24L01. any hints what this actually is? pinout?

#6 PhracturedBlue Apr 05, 2012 03:16 PM

Quote:

Originally Posted by dave1993 (Post 21246344)
i have quite a few 24L01 (it does look vaguely similar) and do not need any more. id order some of these but not if its 24L01. any hints what this actually is? pinout?

If you read the detail, they are just comparing it to the 24L01. They state it does use the A7105:
Quote:

XL7105-SY adopt Taiwan sheng division (AMIC) 2.4 G wireless transceiver chip high performance A7105 make!!!!!...
and
Quote:

SPI interface, independent 64 bytes RX and TX FIFO. cost performance higher than NRF24L01 and CC2500
I am certainly not advocating for that company, I have no idea what they are actually providing, but it is a pretty good deal at $30 if you are in the US. I've been considering using them, as they're basically ready to go, and would be a lot cheaper than a zigbee solution for some RF projects I have around the house. In fact, I just ordered a set from ALI just to have them around :)

By the way, I've placed a few orders via ALIExpress in the past and haven't been disappointed so far. Their merchants have been reliable for me at least.

I may be willing to part with a few when I get them, as I doubt I actually need 10 of them.

#7 dave1993 Apr 05, 2012 03:34 PM

you are right. i now recall ebay puts the word 24L01 into almost every rf module ad too to garner hits. apparently ali is doing the same. i also had good luck with ali but i much prefer the ebay protection.

i has occurred to me that the flysky 3ch rx is essentially an a7105 module with built in antenna, regulator, pins, and micro pads. those are lacking in those modules. i picked up a few dozen of these rx from ali and bidproducts for $3 but it didnt occur to me to use them as tx until your post. thanks for the inspiration.

i would like to get a few from you though if you would consider that. they are so cheap. pm me when they come in. thanks.

#8 RottenFishHead Apr 05, 2012 07:05 PM

Quote:

Originally Posted by dave1993 (Post 21246940)
you are right. i now recall ebay puts the word 24L01 into almost every rf module ad too to garner hits. apparently ali is doing the same. i also had good luck with ali but i much prefer the ebay protection.

i has occurred to me that the flysky 3ch rx is essentially an a7105 module with built in antenna, regulator, pins, and micro pads. those are lacking in those modules. i picked up a few dozen of these rx from ali and bidproducts for $3 but it didnt occur to me to use them as tx until your post. thanks for the inspiration.

i would like to get a few from you though if you would consider that. they are so cheap. pm me when they come in. thanks.

Hi Dave,

I was also curious about the ability to use the flysky rx as a tx. And also the tx as an rx. If so it would make a very convenient telemetry downlink similar to the frysky products.

Does anyone know if the circuit board is wired in a manner that will allow both tx and rx operation? Are both the RFI and RFO pins connected to the antenna?

The same question applies to the A7121 modules used in the first generation flysky modules.

#9 dave1993 Apr 06, 2012 04:42 AM

1 Attachment(s)
as seen in the 6ch photo from dragant in post #227 of the rx rssi thread in fpv forum rfo is unconnected. same for my 3ch and 8ch. last nite i shorted it to part of the antenna circuit with a choke to regoa on one of my 3ch. very tiny work. we will see how that works out. i doubt it will ever perform as telemetry due to lack of proper tx matching components but should suffice for software development for my purpose. im not sure how useful 1mw is for telemetry anyway.

#10 Cesco Apr 18, 2012 12:25 PM

Very intresting.

I am not focused on the transmit side but in the receiver. Goal would be an rx with combined PPM (all channels on one signal) or even better a simple serial output.

This system is described as frequency hopper. I assume the A7105 does not do this on his own, but needs to be told where to go. We should see a constant data stream going to the vco register ?

Unluckily i am not able to solder in the necessary wires to listen to the data bus. That is a tiny spacing there :mad:

#11 dave1993 Apr 18, 2012 12:29 PM

Quote:

Originally Posted by Cesco (Post 21367105)
Goal would be an rx with combined PPM (all channels on one signal)

the regular 6ch flysky rx has ppm and only cost $9 making it the cheapest rx with this capability.

#12 Cesco Apr 18, 2012 03:17 PM

Dave, can you explain that ?

I have some 6ch V1 receivers and one 6ch V2 receiver, but none has combined PPM on the batt connector. Do i have to do a special setup ?

#13 dave1993 Apr 18, 2012 04:52 PM

bind conn not bat. i can verify that all my v2 output ppm. and im told v2 only. heres a thread where reliable sources state not available on v1:

http://www.rcgroups.com/forums/showt...h#post20008392

i wonder why people refer to "combined" ppm and ppm "sum". afaik there is no uncombined or non-summed version. only one ppm in the world. now pwm... thats a different story. too bad they dont differentiate the two unrelated types of pwm.

#14 Cesco Apr 18, 2012 05:22 PM

1 Attachment(s)
Dave,

There is no f****** PPM on the third pin of the batt/bind connector of my V2 !

Maybe i did burn it out. :mad:
Sometimes i put the power connector in the wrong way. Bind is still working but no output. I will order a new one.

Attached the picture from the frsky D8R. I expect the TR6A-V2 to look about the same, but nope, green line missing.

#15 dave1993 Apr 18, 2012 05:56 PM

hmmm.... maybe there are more than 2 versions. i have a very clear 7 negative pulses on the 7th set of pins. you are looking at the signal pin (towards the inside), right? i have units from hobbyking couple years ago and hobbypartz less than a month ago. they are all the same in this respect.


All times are GMT -5. The time now is 03:51 AM.