HobbyKing.com New Products Flash Sale
Reply
Thread Tools
Old Sep 06, 2012, 11:21 AM
Registered User
Vienna, Austria
Joined Oct 2010
1,955 Posts
Alert
Spektrum Telemetry reverse engineered, make DIY sensors !

Why did I do this ? Because noone else did and I am curious
Spektrum unfortunatley makes a "secret" out of their telemetry stuff if you do not sign a NDA. On the other hand, signing a NDA does not help the community. And nowadays there are very able people in the community

I am a noob at programming microcontrollers, but I am good in finding things out. Because of that I analyzed the Spektrum telemetry protocol to make it easy for talented programmers to make their own sensors. Because it is so easy !

Also, Spektrum seems to have not enough manpower to prodice sensors we all need (used capacity, for example). It's a shame to have a telemetry enabled radio and no sensors (sometimes I get jealous if I look over to the HOTT radios).

So, I took a logic analyzer for the basics and an Arduino to find out the values.

First of all: Spektrum uses an IC bus, they call it X-Bus. It's frequency is 100kHz. The 4 pins are SDA, SCL, Ubatt, GND, SDA on the antenna side, GND on the 3-connector side. Ubatt is direct voltage from the RX, so make sure you use a 3.3V LDO regulator for your sensor. As for termination, the pullup resistors in microcontrollers are sufficient. Spektrum uses PIC 16F677 without external resistors.
Around 70ms after the power is stable, the telemetry module enumerates the bus. It reads each address (0x01 up to 0x7D) twice, every 13ms, and if there is a telemetry module, it should answer, otherwise it will not be polled during normal operation. So if you design a sensor, make sure it listens to the IC quickly. This enumerating takes about 3.4 seconds, after that the TM1000 transmits data and polls the sensors every 94ms. The sensors are IC slaves.

Every sensor must transfer 16 bytes data. First byte must be address, second byte must be 0x00, and 14 bytes of data. I will describe the data format later with the various sensors.

And now, please have a look which sensors are currently implemented in the telemetry enabled radios (if you are logging the telemetry data stream, you see ALL sensor adresses !)


Address 0x01: Voltmeter. legacy, DO NOT USE !

The voltage is transferred directly from the TM1000, if you use this sensor address the value flickers on the radio, because the "real" voltage data is transferred via address 7E (which is not polled via IC).


Address 0x02: Temperature. legacy, DO NOT USE !

Same as above, this seems some legacy stuff and interferes with the internal data.


Address 0x03: Current. Use it ! This sensor came with DX8 2.05, DX18 1.01.

03,00,MSB,LSB,00,00,00,00,00,00,00,00,00,00,00,00
MSB and LSB are a 16bit value, 1 unit is 0.1967A, seems to be some sensor related value. You can display 4 digits, I tried up to 0x2000 (displaying 1612A). Please beware that the maximum alarm value you can set in the radio is 200A.


Address 0a: Powerbox. Very useful !

0a,00,V1MSB,V1LSB,V2MSB,V2LSB,Cap1MSB,Cap1LSB,Cap2 MSB,Cap2LSB,00,00,00,00,00,Alarm
You can display 2 voltages and 2 used capacities. Voltage scale 1 unit is 0.01V, capacity 1 unit is 1mAh. Alarm has to be triggered by the sensor, it is transmitted to the radio with the last byte, the first 4 bits. The fist bit is alarm V1, the second V2, the third Capacity 1, the 4th capacity 2. This sensor is nearly perfect for a used capacity sensor, with the drawback that the alarm value must be set in the sensor . You can enable or disable an alarm for each value, but not set the value.


Address 0x11: Airspeed

11.00.MSB,LSB,01,F9,00,00,00,00,00,00,00,00,00,00
MSB and LSB are a 16Bit value, 1 unit is 1 km/h. Displays up to 65535 km/h, maximum alarm value 563 km/h


Address 0x12: Altitude

12.00.MSB,LSB,FF,00,00,00,00,00,00,00,00,00,00,00
MSB and LSB are a 16Bit signed integer, 1 unit is 0.1m. Displays -3276.8m to 3276.7m, alarm values between -300m and 1000m. 0x7fff is 3276.7m, 0xffff=-0.1m, 0x8000 is -3276.8m

Address 0x14: G-Force

14,00,xMSB,xLSB,yMSB,zMSB,zLSB,xmaxMSB,xmaxLSB,yma xMSB,ymaxLSB,zmaxMSB,zmaxLSB,zminMSB,zminLSB
MSB/LSB are signed integers, unit is 0.01g, on the "normal" display the last digit is rounded. maximum display value is +-99.90 (actually 99.99, but when it is rounded, it overflows to 100 and displays ----)
The min/max values are retained in the sensor, because g-force cah change too quickly for the radio. Therefore you cannot clear the min/max values on the radio. Alarm can be set for Z-axis from -40g to 40g


Address 0x15: JetCat. Useful, but no alarms, display only. ONLY AVAILABLE ON THE DX9, DX10t, DX18t, DX18 (QQ) !

15,00,status,throttle,PackVoltHi,PackVoltLo,PumpVo ltHi,PumpVoltLo,RPMLo,RPMMid,RPMHi,00,TempEGTLo,Te mpEGTHi,OffCondition,00
JetCat is a display only value especially for turbines, but has some interesting fields which can be used otherwise. You can display 2 voltages, throttle, RPM and 2 status messages. There are some differences to all other sensors, JetCat uses BCD values. Only 0-9, a-f is unused. Voltages range to 99.99V, RPM to 999999, throttle up to 159% (the upper nibble is 0-f, the lower nobble 0-9), a little bit strange. EGT temperature uses only the lower nibble of the MSB, so maximum displayable value is 999.

Possible messages for status:
0x00:OFF
0x01:WAIT FOR RPM
0x02:IGNITE
0x03;ACCELERATE
0x04:STABILIZE
0x05:LEARN HIGH
0x06:LEARN LOW
0x07:undef
0x08:SLOW DOWN
0x09:MANUAL
0x0a,0x10:AUTO OFF
0x0b,0x11:RUN
0x0c,0x12:ACCELERATION DELAY
0x0d,0x13:SPEED REG
0x0e,0x14:TWO SHAFT REGULATE
0x0f,0x15:PRE HEAT
0x16:PRE HEAT 2
0x17:MAIN F START
0x18:not used
0x19:KERO FULL ON
0x1a:MAX STATE

Messages for Off Condition:
0x00:NA
0x01:OFF BY RC
0x02:OVER TEMPERATURE
0x03:IGNITION TIMEOUT
0x04:ACCELERATION TIMEOUT
0x05:ACCELERATION TOO SLOW
0x06:OVER RPM
0x07:LOW RPM OFF
0x08:LOW BATTERY
0x09:AUTO OFF
0x0a.0x10:LOW TEMP OFF
0x0b,0x11:HIGH TEMP OFF
0x0c,0x12:GLOW PLUG DEFECTIVE
0x0d,0x13:WATCH DOG TIMER
0x0e,0x14:FAIL SAFE OFF
0x0f,0x15:MANUAL OFF
0x16:POWER BATT FAIL
0x17:TEMP SENSOR FAIL
0x18:FUEL FAIL
0x19:PROP FAIL
0x1a:2nd ENGINE FAIL
0x1b:2nd ENGINE DIFFERENTIAL TOO HIGH
0x1c:2nd ENGINE NO COMMUNICATION
0x1d:MAX OFF CONDITION

Address 0x16: GPS

Edit: To have it all in one article, I have added the GPS, thanks Vlad !

Quote:
Originally Posted by vlad_vy View Post
Data type = 0x16 GPS Sensor (always second GPS packet)

0[00] 22(0x16)
1[01] 00
2[02] Altitude LSB (Decimal) //In 0.1m
3[03] Altitude MSB (Decimal) //Altitude = Altitude(0x17) * 10000 + Value (in 0.1m)
4[04] 1/100th of a degree second latitude (Decimal) (XX YY.SSSS)
5[05] degree seconds latitude (Decimal)
6[06] degree minutes latitude (Decimal)
7[07] degrees latitude (Decimal)
8[08] 1/100th of a degree second longitude (Decimal) (XX YY.SSSS)
9[09] degree seconds longitude (Decimal)
10[0A] degree minutes longitude (Decimal)
11[0B] degrees longitude (Decimal)
12[0C] Heading LSB (Decimal)
13[0D] Heading MSB (Decimal) Divide by 10 for Degrees
14[0E] Unknown (Decimal)
15[0F] First bit for latitude: 1=N(+), 0=S(-);
Second bit for longitude: 1=E(+), 0=W(-);
Third bit for longitude over 99 degrees: 1=+-100 degrees



Data type = 0x17 GPS Sensor (always first GPS packet)

0[00] 23(0x17)
1[01] 00
2[02] Speed LSB (Decimal)
3[03] Speed MSB (Decimal) Divide by 10 for Knots. Multiply by 0.185 for Kph and 0.115 for Mph
4[04] UTC Time LSB (Decimal) 1/100th sec. (HH:MM:SS.SS)
5[05] UTC Time (Decimal) = SS
6[06] UTC Time (Decimal) = MM
7[07] UTC Time MSB (Decimal) = HH
8[08] Number of Sats (Decimal)
9[09] Altitude in 1000m (Decimal)
10[0A]-15[0F] Unused (But contains Data left in buffer)


Attached is a picture of the pinout (thanks, Schorsch).



Okay, guys. Now it should be easy to build your own sensors. I just have one wish: If you build a sensor, please make the circuit and software public, so anyone can copy them.

A guy at rc-heli.de (Schorsch) is currently working on an used capacity sensor. He told me that he will make it public when it's done.

Have fun !
Mukenukem is online now Find More Posts by Mukenukem
Last edited by Mukenukem; Feb 09, 2014 at 04:44 AM.
Reply With Quote
Sign up now
to remove ads between posts
Old Sep 06, 2012, 12:04 PM
Air, Ground & Water
freechip's Avatar
Canada, ON, Rockland
Joined Aug 2008
22,295 Posts
Quote:
Originally Posted by Mukenukem View Post
Why did I do this ? Because noone else did and I am curious
Spektrum unfortunatley makes a "secret" out of their telemetry stuff if you do not sign a NDA. On the other hand, signing a NDA does not help the community. And nowadays there are very able people in the community ...
What do you mean?
freechip is online now Find More Posts by freechip
Reply With Quote
Old Sep 06, 2012, 12:56 PM
Professional idiot
Hampshire, UK
Joined Jun 2002
3,119 Posts
I use i2c a fair bit and very nice when you have information like this :-)

A good source for information on reversed engineering of a lot of radio/telemetry systems like Spektrum are the hobbyist physical computing and/ or hobbiest UAV forums etc. They tend to want to use the gear in different ways. I use Spektrum satellite receivers on there own with an Arduino for example. First time i've seen Spektrum telemetry. Other smaller brands like Jeti and Multiplex publish the protocol they use.

Hardest part as always are pcb's. I have the attopilot current sensor which was dead easy to use with atmega328 (two 3.3v ref. analogue outputs from sensor). Micro controller software for reading the sensor and outputting to i2c not hard. Problem is I can't do surface mount so ended up large and cumbersome.

Dave
wildpalms is offline Find More Posts by wildpalms
Reply With Quote
Old Sep 06, 2012, 01:35 PM
Registered User
Vienna, Austria
Joined Oct 2010
1,955 Posts
Quote:
Originally Posted by freechip View Post
What do you mean?
When you want Spektrum to support "your" telemetry sensor, you make contracts, sign a NDA and get the specs. Or just find it out yourself

Others have official documents for everyone....
Mukenukem is online now Find More Posts by Mukenukem
Reply With Quote
Old Sep 06, 2012, 01:37 PM
Air, Ground & Water
freechip's Avatar
Canada, ON, Rockland
Joined Aug 2008
22,295 Posts
But by not signing you leave yourself for hanging when they come out with there own. They would most likely out sell you NO?
freechip is online now Find More Posts by freechip
Reply With Quote
Old Sep 06, 2012, 02:17 PM
Registered User
Vienna, Austria
Joined Oct 2010
1,955 Posts
I don't sell anything
They do not change the protocol, otherwise their sensors would stop working.

What I really want: Support for Castle Link Live, support for JLOG (logger for Kontronik ESCs). Done with JLog 2.5
I would buy a used capacity sensor from the spot. But they don't have one. I want a current sensor. They don't have one. Single cell monitoring. I don't want to wait until some decision-maker decides that it is time for stuff.
Mukenukem is online now Find More Posts by Mukenukem
Last edited by Mukenukem; Oct 22, 2013 at 02:20 PM.
Reply With Quote
Old Sep 06, 2012, 02:23 PM
Professional idiot
Hampshire, UK
Joined Jun 2002
3,119 Posts
I doubt they will come after hobbyists, given that they don't seem to stop commercial receivers implementing the Spektrum protocols. As I said above a lot of the information already out there on some of the stuff and no one clamping down.

Dave
wildpalms is offline Find More Posts by wildpalms
Reply With Quote
Old Sep 06, 2012, 03:16 PM
Registered User
Kambalunga's Avatar
Deutschland, Hessen, LA
Joined Jan 2009
1,110 Posts
Maybe usefull
Kambalunga is offline Find More Posts by Kambalunga
Reply With Quote
Old Sep 06, 2012, 03:30 PM
Air, Ground & Water
freechip's Avatar
Canada, ON, Rockland
Joined Aug 2008
22,295 Posts
Quote:
Originally Posted by wildpalms View Post
I doubt they will come after hobbyists, given that they don't seem to stop commercial receivers implementing the Spektrum protocols. As I said above a lot of the information already out there on some of the stuff and no one clamping down.

Dave
that's not what I ment. Just saying that if I was going to put some effort into this, I probably would not of kind keeping a lid on it if it ment I could sell my product associated with SPK.

Its all good for the end user at the end of the day, it gives us options.
freechip is online now Find More Posts by freechip
Reply With Quote
Old Sep 07, 2012, 01:03 PM
Registered User
Vienna, Austria
Joined Oct 2010
1,955 Posts
I think the next step would be tapping the telemetry stream in the radio and outputting it (maybe via bluetooth). I expect that the telemetry stream comes out of the RF module, maybe just serial like the data is fed to the module. This would be the base for an Android (or PC) software for telemetry display, speech, etc. Because I am very disappointed about the STi being a fruit only device. It would be way more useful if you have a bluetooth inerface (integrated) in the radio.
I can understand the decision that the STI is Apple only, because the dock connector is (at least till now) the same on every I-thingy. Let's see what happens when the new I-phoney is presented. New connector ? Maybe no serial port on the connector ?
Adding a BT module to the radio would have cost 10$. Maybe less. At least for the DX18 it would have been logical.
Mukenukem is online now Find More Posts by Mukenukem
Reply With Quote
Old Sep 07, 2012, 01:13 PM
Registered User
Denmark, Capital Region of Denmark, Ramlse
Joined Aug 2012
15 Posts
If You have a DX8 or DX18 it save the telemetry to the SPEKTRUM.TLM file.

I am working on a converter to convert it to a LogView format have a look at the beta. Yes I start with a excel VBA script but change to make the converter.

http://www.rcgroups.com/forums/showthread.php?t=1725173

What I need now is to add more sensores.
KimDK is offline Find More Posts by KimDK
Reply With Quote
Old Sep 07, 2012, 02:02 PM
Registered User
Vienna, Austria
Joined Oct 2010
1,955 Posts
Thanks, I have seen your converter ! Cool for analyzing after the flight ! It was about time someone does this. I mean, Iphone only, what the hell ?

Use the info for the other sensors !

What I want is something in real-time, like the STI.
Mukenukem is online now Find More Posts by Mukenukem
Reply With Quote
Old Sep 08, 2012, 02:54 PM
y chucu, chucu, chuuuu...
nick_cool's Avatar
Argentina, Buenos Aires
Joined Apr 2003
597 Posts
Nice, do you have any idea about how telemetry works on Hitec modules?

I really want to attach a 2 lines LCD to my converted Multiplex EVO and see the telemetry.
nick_cool is offline Find More Posts by nick_cool
RCG Plus Member
Latest blog entry: More Condor 2000 + Crimson
Reply With Quote
Old Sep 08, 2012, 03:01 PM
Registered User
Vienna, Austria
Joined Oct 2010
1,955 Posts
Nope. Spektrum only. But I think Hitec is better documented.
Mukenukem is online now Find More Posts by Mukenukem
Reply With Quote
Old Sep 21, 2012, 05:32 PM
Registered User
Joined Nov 2007
20 Posts
Quote:
But I think Hitec is better documented.
Haha. Yes, now, in the sources of my telemetry implementation.

It's almost always the same, the problems are different, but they are there, an eternal source of joy.

Tom
dl7uae is offline Find More Posts by dl7uae
Reply With Quote
Reply


Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Discussion Aircraft Telemetry GPS Sensor by Spektrum RC_AVIGATOR Radios 75 Feb 11, 2014 05:51 PM
Sold Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused boatdoc Aircraft - General - Radio Equipment (FS/W) 0 Mar 30, 2012 02:05 PM
Sold Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused boatdoc Aircraft - General - Radio Equipment (FS/W) 0 Mar 26, 2012 01:22 PM
Sold Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused boatdoc Aircraft - General - Radio Equipment (FS/W) 4 Mar 26, 2012 05:52 AM
Sold Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused boatdoc Aircraft - General - Radio Equipment (FS/W) 2 Mar 22, 2012 09:04 AM