HobbyKing.com New Products Flash Sale
Reply
Thread Tools
Old Apr 02, 2012, 11:45 PM
Registered User
Joined Jan 2012
682 Posts
Discussion
FlySky/Turnigy 9X Protocol

The information below may be somewhat out of date. The most recent information on this protocol can be found in the doc directory of the Deviation firmware project:
https://bitbucket.org/PhracturedBlue/deviation/src

While I probably won't pursue this much further at this point, I thought I'd document what I've found out so far in case anyone ever comes looking for it.
Updated 2012-07-01
I've been playing with a V911 transmitter which contains the A7105 FSK Tx/Rx chip. This transmitter uses 3-wire SPI to send data which makes it easy to look at.
The V911 is compatible with the Turnigy 9X/FlySky FS-TH9X, though it is only a 4-channel heli.

Initial analysis shows that all channel data is sent in 22-byte frames every ~1.5ms

The data in the frame is apparently not encrypted, and each channel is sent as a 16bit little-endian word.

The A7105 Data sheet can be found here:

After power-on, the following steps are initiated:
1) A7105 is reset send (0x00, 0x00)
2) Send 32bit address to address 0x06: 0x5475c52a
3) Program the A7105 control registers as follows:
Code:
Code:
0x00: --, 42, 00, 14, 00, --, --, 00, 00, 00, 00, 01, 21, 05, 00, 50
0x10: 9e, 4b, 00, 02, 16, 2b, 12, 00, 62, 80, 80, 00, 0a, 32, c3, 0f
0x20: 13, c3, 00, --, 00, 00, 3b, 00, 17, 47, 80, 03, 01, 45, 18, 00
0x30: 01, 0f, --
4) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
5) Write '1' to address 0x02 to start the IF Filter Bank calibration
6) Poll address 0x02 until it returns '0' indicating calibration is complete
7) Read IF calibration info from Address 0x22
8) Write VCO Current calibration to 0x24 (value = 0x13)
9) Write VCO Bank calibration limits to 0x26 (value = 0x3b)
10) Write channel to Address 0x0f (value = 0x00)
11) Write '2' to address 0x02 to start VCO bank Calibration
12) Poll address 0x02 until it returns '0' indicating calibration is complete
13) Read VCO calibration from Address 0x25 (test for success?)
14) Write channel to Address 0x0f (value = 0xa0)
15) Write '2' to Address 0x02 to start VCO bank Calibration
16) Poll address 0x02 until it returns '0' indicating calibration is complete
17) Read VCO calibration from Address 0x25 (test for success?)
18) Write manual VCO Bank calibration to Address 0x25 (value = 0x08) ???
19) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
20) Start sending frames as follows

Frames are sent each 1.46ms. Each frame consists of sending a 'FIFO Write Pointer Reset' (Strobe = 0xe0), 22 bytes of data, setting the channel (via the 0x0f register) and then sending 'TX mode' (Strobe = 0x0d) to actually initiate the transfer

The frame data is not encrypted, and is 16-bit little endian. the data appears to be as follows.
Fo each channel the minimum value I observed was ~ 0x03e8 and the maximum was ~ 0x07ca.

Code:
         TX1                 TX2
word 1:       0xaa05/0x5505
word 2: 0x01f3             0x0002
word 3: 0x2000             0x7000
word 4:      aileron  (ch1)
word 5:      elevator (ch2)
word 6:      throttle (ch3)
word 7:      rudder   (ch4)
word 8: 0x02c3             0xedfc
word 9: 0x02ed             0x02eb
word 10:       see below
word 11:        0x0000
Word 1 is 0xaa05 until 3 seconds have elapsed and the throttle has been brought to its minimum value. It then changes to 0x5505 at the same time that the Tx starts cycling between channels

Word 2 and 3 are apparently the Transmitter's Unique ID (thanks zeza from RCGroups)
word 8 and 9 are likely to be channels 5 and 6

Word 10 seems to continuously cycle between 10 states (changing state every frame):
State 1 : 0x100, 0x200, or 0x300 (almost always 0x200)
State 2 : 0x23 or 0x24 (almost always 0x24)
State 3 : 0x32
State 4 - 10: 0xffe or 0xfff

The Tx channel will be 01 until initialization is done and the throttle is brought to 0. At ~ 3 seconds, data is transmitted on multiple channels. Channel ordering is dependent on Transmitter?
Tx2: 0a, 5a, 50, a0, 14, 64, 46, 96, 1e, 6e, 3c, 8c, 28, 78, 32, 82
Tx1: 79, 29, 6f, 1f, 83, 33, 65, 25, 8d, 3d, 5b, 0b, 97, 47, 51, 01

Also, there is still work to do to determine how the Bank Calibration data is used
PhracturedBlue is offline Find More Posts by PhracturedBlue
Last edited by PhracturedBlue; Jul 02, 2012 at 01:30 AM.
Reply With Quote
Sign up now
to remove ads between posts
Old Apr 03, 2012, 05:51 AM
Registered User
hungary
Joined Jan 2011
113 Posts
Hey, thanks a lot for this!

I though about analyzing the details of the protocol but I never got into it.

Do you know of an online store where I can get a A7105 module in small quantities? I wouldn't like to butcher a perfectly functional transmitter or receiver to get to the module. I googled this a little, but couldn't find anything.

Thanks again!
kile is offline Find More Posts by kile
Reply With Quote
Old Apr 03, 2012, 11:26 AM
Registered User
Joined Jan 2012
682 Posts
I didn't find the chip itself, but I found pretty inexpensive modules at aliexpress:
http://www.aliexpress.com/product-fm...olesalers.html
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Apr 03, 2012, 02:04 PM
Registered User
hungary
Joined Jan 2011
113 Posts
Yes, that would is a great price even if I have to order at least 10 pieces, but they don't offer "china post" shipping to Hungary. So, $63 with EMS shipping is a little too expensive for me.

But, thanks for the info!
kile is offline Find More Posts by kile
Reply With Quote
Old Apr 05, 2012, 03:30 PM
RC beginner
New York
Joined Oct 2008
6,054 Posts
hi phractured. amazing post.

ive spent considerable time recently working with 9x code and based on your info just ordered a v911. mostly to get the radio. i definitely would like to order these modules if compatible but the ali ad mentions 24L01 which is a different chip:

Quote:
low-cost 2.4 G wireless module/A7105 / NRF24L01
i have quite a few 24L01 (it does look vaguely similar) and do not need any more. id order some of these but not if its 24L01. any hints what this actually is? pinout?
dave1993 is offline Find More Posts by dave1993
Reply With Quote
Old Apr 05, 2012, 04:16 PM
Registered User
Joined Jan 2012
682 Posts
Quote:
Originally Posted by dave1993 View Post
i have quite a few 24L01 (it does look vaguely similar) and do not need any more. id order some of these but not if its 24L01. any hints what this actually is? pinout?
If you read the detail, they are just comparing it to the 24L01. They state it does use the A7105:
Quote:
XL7105-SY adopt Taiwan sheng division (AMIC) 2.4 G wireless transceiver chip high performance A7105 make!!!!!...
and
Quote:
SPI interface, independent 64 bytes RX and TX FIFO. cost performance higher than NRF24L01 and CC2500
I am certainly not advocating for that company, I have no idea what they are actually providing, but it is a pretty good deal at $30 if you are in the US. I've been considering using them, as they're basically ready to go, and would be a lot cheaper than a zigbee solution for some RF projects I have around the house. In fact, I just ordered a set from ALI just to have them around

By the way, I've placed a few orders via ALIExpress in the past and haven't been disappointed so far. Their merchants have been reliable for me at least.

I may be willing to part with a few when I get them, as I doubt I actually need 10 of them.
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Apr 05, 2012, 04:34 PM
RC beginner
New York
Joined Oct 2008
6,054 Posts
you are right. i now recall ebay puts the word 24L01 into almost every rf module ad too to garner hits. apparently ali is doing the same. i also had good luck with ali but i much prefer the ebay protection.

i has occurred to me that the flysky 3ch rx is essentially an a7105 module with built in antenna, regulator, pins, and micro pads. those are lacking in those modules. i picked up a few dozen of these rx from ali and bidproducts for $3 but it didnt occur to me to use them as tx until your post. thanks for the inspiration.

i would like to get a few from you though if you would consider that. they are so cheap. pm me when they come in. thanks.
dave1993 is offline Find More Posts by dave1993
Last edited by dave1993; Apr 05, 2012 at 04:47 PM. Reason: take blue up on his offer.
Reply With Quote
Old Apr 05, 2012, 08:05 PM
Registered User
Joined May 2011
6 Posts
Quote:
Originally Posted by dave1993 View Post
you are right. i now recall ebay puts the word 24L01 into almost every rf module ad too to garner hits. apparently ali is doing the same. i also had good luck with ali but i much prefer the ebay protection.

i has occurred to me that the flysky 3ch rx is essentially an a7105 module with built in antenna, regulator, pins, and micro pads. those are lacking in those modules. i picked up a few dozen of these rx from ali and bidproducts for $3 but it didnt occur to me to use them as tx until your post. thanks for the inspiration.

i would like to get a few from you though if you would consider that. they are so cheap. pm me when they come in. thanks.
Hi Dave,

I was also curious about the ability to use the flysky rx as a tx. And also the tx as an rx. If so it would make a very convenient telemetry downlink similar to the frysky products.

Does anyone know if the circuit board is wired in a manner that will allow both tx and rx operation? Are both the RFI and RFO pins connected to the antenna?

The same question applies to the A7121 modules used in the first generation flysky modules.
RottenFishHead is offline Find More Posts by RottenFishHead
Reply With Quote
Old Apr 06, 2012, 05:42 AM
RC beginner
New York
Joined Oct 2008
6,054 Posts
as seen in the 6ch photo from dragant in post #227 of the rx rssi thread in fpv forum rfo is unconnected. same for my 3ch and 8ch. last nite i shorted it to part of the antenna circuit with a choke to regoa on one of my 3ch. very tiny work. we will see how that works out. i doubt it will ever perform as telemetry due to lack of proper tx matching components but should suffice for software development for my purpose. im not sure how useful 1mw is for telemetry anyway.
dave1993 is offline Find More Posts by dave1993
Last edited by dave1993; Apr 06, 2012 at 05:56 AM. Reason: photo
Reply With Quote
Old Apr 18, 2012, 01:25 PM
Registered User
Joined Dec 2007
569 Posts
Very intresting.

I am not focused on the transmit side but in the receiver. Goal would be an rx with combined PPM (all channels on one signal) or even better a simple serial output.

This system is described as frequency hopper. I assume the A7105 does not do this on his own, but needs to be told where to go. We should see a constant data stream going to the vco register ?

Unluckily i am not able to solder in the necessary wires to listen to the data bus. That is a tiny spacing there
Cesco is offline Find More Posts by Cesco
Reply With Quote
Old Apr 18, 2012, 01:29 PM
RC beginner
New York
Joined Oct 2008
6,054 Posts
Quote:
Originally Posted by Cesco View Post
Goal would be an rx with combined PPM (all channels on one signal)
the regular 6ch flysky rx has ppm and only cost $9 making it the cheapest rx with this capability.
dave1993 is offline Find More Posts by dave1993
Reply With Quote
Old Apr 18, 2012, 04:17 PM
Registered User
Joined Dec 2007
569 Posts
Dave, can you explain that ?

I have some 6ch V1 receivers and one 6ch V2 receiver, but none has combined PPM on the batt connector. Do i have to do a special setup ?
Cesco is offline Find More Posts by Cesco
Reply With Quote
Old Apr 18, 2012, 05:52 PM
RC beginner
New York
Joined Oct 2008
6,054 Posts
bind conn not bat. i can verify that all my v2 output ppm. and im told v2 only. heres a thread where reliable sources state not available on v1:

http://www.rcgroups.com/forums/showt...h#post20008392

i wonder why people refer to "combined" ppm and ppm "sum". afaik there is no uncombined or non-summed version. only one ppm in the world. now pwm... thats a different story. too bad they dont differentiate the two unrelated types of pwm.
dave1993 is offline Find More Posts by dave1993
Reply With Quote
Old Apr 18, 2012, 06:22 PM
Registered User
Joined Dec 2007
569 Posts
Dave,

There is no f****** PPM on the third pin of the batt/bind connector of my V2 !

Maybe i did burn it out.
Sometimes i put the power connector in the wrong way. Bind is still working but no output. I will order a new one.

Attached the picture from the frsky D8R. I expect the TR6A-V2 to look about the same, but nope, green line missing.
Cesco is offline Find More Posts by Cesco
Reply With Quote
Old Apr 18, 2012, 06:56 PM
RC beginner
New York
Joined Oct 2008
6,054 Posts
hmmm.... maybe there are more than 2 versions. i have a very clear 7 negative pulses on the 7th set of pins. you are looking at the signal pin (towards the inside), right? i have units from hobbyking couple years ago and hobbypartz less than a month ago. they are all the same in this respect.
dave1993 is offline Find More Posts by dave1993
Reply With Quote
Reply


Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Question 9X - FlySky/iMax/Turnigy/Eurgle FOR DUMMIES aeajr Radios 1016 Nov 18, 2014 06:53 PM
Discussion Benefits of buying FlySky TH9x (v2) over Turnigy 9x (v2) wwfisher Radios 71 Nov 06, 2014 09:02 PM
Found turnigy 9x/flysky 9x wanted!!! kremecheze Aircraft - General - Radio Equipment (FS/W) 2 Mar 25, 2012 05:04 PM
Wanted ER9x or Turnigy/Flysky 9x daign FPV Equipment (FS/W) 0 Mar 22, 2012 07:21 PM
Found Turnigy/FlySky/Eurkle/etc 9X Shell flyandi Aircraft - General - Radio Equipment (FS/W) 0 Mar 11, 2012 07:12 PM