HobbyKing.com New Products Flash Sale
Reply
Thread Tools
Old Dec 11, 2014, 01:01 PM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Help!
Spektrum SRXL port

Hi Guys,
I have been working on decoding the data from a AR9020 receiver (SRXL port).
Basically I have it working. There is a couple of questions though:

1) What is the CRC formula used ? (I have tried the Multiplex CRC16 routine, but this does not work)

2) I receive "0xA2 0x02 xxxxxx" and 0xA2 0x03 xxxxxx" interleaved, each carries 6 channels of data I can decode. What if f.ex a DX18 was used, what is the headers for the following channels ?

3) The last 2 bytes in each frame before the CRC, what are they ?

Below you can see what I have decoded, and how I _think_ it works. Please let me know if you see something wrong or otherwise have some comments. This is just some stuff I have written down when doing the decode, so it might be a little messy (at the end there is some links to Spektrum Satellite receivers, although they are NOT the same protocol as the SRXL, they lack the checksum as far as I can see, and the headers are different)


Spektrum DX9
Receiver AR9020 with 2 satelittes (in DSMX mode), data taken from SRXL connector (3V serial data, normal "UART" levels (3V is idle, 0V is startbit).
115200, 8 data, 1 stop, no parity

Channel asignments in DX9 transmitter:
1 = THR [0x00]
2 = AIL [0x01]
3 = ELE [0x02]
4 = RUD [0x03]
5 = GEAR [0x04]
6 = AUX1 [0x05]
7 = AUX2 [0x06]
8 = AUX3 [0x07]
9 = AUX4 [0x08]

Data in [0x..] above is bit (7,)6,5,4,3 in MSB decoded. This is the channel number!

18 bytes of Data, every 2nd packet is different:

0xA2 0x02 0x0C 0x11 0x2E 0xAA 0x14 0x00 0x26 0xAA 0x36 0xAA 0x54 0x00 0x61 0x00 0xC6 0xFE
[Header ] [ Ail ] [ Aux1 ] [ Ele ] [ Gear ] [ Aux2 ] [ xch10 ] [ ?????] [ CRC ]

0xA2 0x03 0x01 0x56 0x3B 0x04 0x1C 0x02 0x46 0xAA 0x4C 0x00 0x5C 0x00 0x63 0x00 0xC8 0xAB
[Header ] [ Thr ] [ Aux3 ] [ Rud ] [ Aux4 ] [ xch9 ] [ xch11 ] [ ????? ] [ CRC ]

When transmitter is off, packets beginning with "0xA2 0x00" and "0xA2 0x01" is seen!

The question is what headers to expect when running with f.ex a DX18 (could be "0xA2 0x00" and "0xA2 0x01" or perhaps "0xA2 0x04" ?)

THR trim in center:
Full throttle +100% (Thr channel)
0xA2 0x03 0x06 0xAA 0x3B--------------------------------------------------------0xCE 0x10
Low Throttle -100% (Thr channel)
0xA2 0x03 0x01 0x56 0x3B--------------------------------------------------------0xC8 0xAB

Full throttle +150% (Thr channel)
0xA2 0x03 0x07 0xFF 0x3B------------------------
Low Throttle -150% (Thr channel)
0xA2 0x03 0x00 0x01 0x3B------------------------

So values are from 1 to 2047 (on radio it is written as 1 to 2048 in the servo settings sub-menu)

Elevator +150%:
0x17 0xFE = 0x7FE
Elevator 0%:
0x13 0xFE = 0x3FE
Elevator -150%:
0x10 0x02 = 0x002

Aux1 +150%:
0x2F 0xFF = 0x7FF
Aux 0%:
0x2C 0x00 = 0x400
Elevator -150%:
0x28 0x01 = 0x001

Bit 2,1,0 in MSB and bit 7..0 in LSB is channel position value (11 bits)
Bit (7,)6,5,4,3 in MSB is channel number (0 based) !
bit 7 are most probably also channel numbers on larger (DX18) transmitters !

Checksum ?????

http://diydrones.com/profiles/blogs/...ogPost%3A64228
http://www.desertrc.com/spektrum_protocol.htm
http://developer.mbed.org/users/offr...ite-rx-driver/
http://www.dogfight.no/2011/01/spect...o-arduino.html
cgroen is offline Find More Posts by cgroen
Last edited by cgroen; Dec 16, 2014 at 07:01 AM.
Reply With Quote
Sign up now
to remove ads between posts
Old Dec 11, 2014, 02:08 PM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Hmm,
looking at the last 2 bytes before the checksum, it seems that this is not channel data ?!?
They seem to alternate from each frame:

0xA2 02 xxxxxxxx 0x67 0x00 crc crc
0xA2 02 xxxxxxxx 0x61 0x00 crc crc
0xA2 02 xxxxxxxx 0x67 0x00 crc crc
0xA2 02 xxxxxxxx 0x61 0x00 crc crc
0xA2 02 xxxxxxxx 0x63 0x00 crc crc
0xA2 02 xxxxxxxx 0x67 0x00 crc crc
0xA2 02 xxxxxxxx 0x61 0x00 crc crc
0xA2 02 xxxxxxxx 0x65 0x00 crc crc
0xA2 02 xxxxxxxx 0x67 0x00 crc crc
etc

and the other frame:
0xA2 0x03 xxxxxx 0x65 0x00 crc crc
0xA2 0x03 xxxxxx 0x67 0x00 crc crc
0xA2 0x03 xxxxxx 0x63 0x00 crc crc
0xA2 0x03 xxxxxx 0x65 0x00 crc crc
0xA2 0x03 xxxxxx 0x67 0x00 crc crc
0xA2 0x03 xxxxxx 0x65 0x00 crc crc
0xA2 0x03 xxxxxx 0x67 0x00 crc crc

etc

Wonder what these are ?
cgroen is offline Find More Posts by cgroen
Reply With Quote
Old Dec 12, 2014, 06:13 AM
Registered User
Joined Dec 2011
292 Posts
AR9020 receiver (SRXL port) outputs Spektrum satellite serial protocol. You can connect it to any controller that accept Spektrum satellite.
vlad_vy is offline Find More Posts by vlad_vy
Reply With Quote
Old Dec 12, 2014, 06:19 AM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Vlad,
I'm not sure thats the case ? The SRXL port outputs 18 bytes pr frame, the satellites 16 if I'm not mistaken.
The satellites does NOT send the CRC bytes out, and they send 7 channels pr frame, the SRXL 6 channels pr frame (unless I'm totally wrong with the decoding I have done so far).
Also the 2 bytes header are different.

http://diydrones.com/profiles/blogs/...ogPost%3A64228
cgroen is offline Find More Posts by cgroen
Last edited by cgroen; Dec 12, 2014 at 06:24 AM.
Reply With Quote
Old Dec 12, 2014, 06:34 AM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Regarding the CRC, I took the Multiplex CRC16 formula and applied it to some of the data from the SRXL port. Does not match unfortunately


unsigned short CRC16(unsigned short crc, unsigned char value) {
unsigned char i;
crc = crc ^ (unsigned short)value<<8;
for(i = 0; i < 8; i++) {
if(crc & 0x8000)
crc = crc << 1^0x1021;
else
crc = crc << 1;
}
return crc;
}


{
int i;
unsigned short crc=0;
unsigned char buf[]={0xA2, 0x02, 0x0C, 0x11, 0x2E, 0xAA, 0x14, 0x00, 0x26, 0xAA, 0x36, 0xAA, 0x54, 0x00, 0x61, 0x00, 0xC6, 0xFE};

for (i=0; i<sizeof(buf)-2; i++) {
crc=CRC16(crc, buf[i]);
}
}

Running the above code on the data gives a calculated CRC of 0xE420 and it should be 0xC6FE according to the received data (the CRC bytes are the last two in the SRXL frame above)
cgroen is offline Find More Posts by cgroen
Reply With Quote
Old Dec 12, 2014, 08:13 AM
Registered User
Joined Dec 2011
292 Posts
http://forum.autoquad.org/viewtopic....p=18508#p18508
vlad_vy is offline Find More Posts by vlad_vy
Reply With Quote
Old Dec 12, 2014, 08:50 AM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
I have seen these before Vlad.

However, the data from the satellites and the SRXL port are NOT the same.
The data for each individual channel are the same format, they contain the channel number in the higher bits and the actual channel value in the lower. But the "compatibility" ends there.

I just grabbed data from a satellite:

0x00 0x00 0x0B 0xFE 0x2F 0xFF 0x14 0x00 0x26 0xAA 0x36 0xAA 0x54 0x00 0x65 0x00
and
0x00 0x00 0x80 0x01 0x3B 0xFF 0x1C 0x00 0x45 0x83 0x4C 0x00 0x5C 0x00 0x61 0x00

Thats 16 bytes (no checksum!)

Data from the SRXL port:
0xA2 0x02 0x0C 0x11 0x2E 0xAA 0x14 0x00 0x26 0xAA 0x36 0xAA 0x54 0x00 0x61 0x00 0xC6 0xFE

Thats 18 bytes including checksum.

Now, if the data from the satellites actually contains 7 channels, the I also think that the SRXL data contains 7 channels pr frame (the 7th channel looks the same for satellite and SRXL port). If so, its a little strange that this 7th channel fluctates around from frame to frame, it is identified as channel 16.
It might be that this is correct, but I find it strange that a DX9/AR9020 combo would spit out changing data for channel 16 ?!

I'm using a DX9 and a AR9020 with 2 x 9645 sats.
cgroen is offline Find More Posts by cgroen
Reply With Quote
Old Dec 12, 2014, 11:08 AM
Registered User
Joined Dec 2011
292 Posts
The X-Plus channels structure.

Channel numbers 0 to 11 are normal, with data resolution 11bit (2048).
Channel 12 carries the X-Plus channels, with data resolution 9bit (512).

Channel transfer structure:
packet 1 -> 1 5 2 4 6 10 12
packet 2 -> 0 7 3 8 9 11 12

X-Plus data format
each 16bit X-Plus data value is defined as:

a bbbb cc ddddddddd

a: always 0
bbbb: the channel number, always 12
cc: X-Plus channel number, low 2 bits, third bit defined by packet number, 1st packet = 0, second packet = 1
dd..: X-Plus channel data, 9 bits, 256 is midpoint

The channel data will be 0xffff if the specific X-Plus channel slot is unused.
vlad_vy is offline Find More Posts by vlad_vy
Reply With Quote
Old Dec 12, 2014, 12:11 PM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Ahh,
thanks a lot Vlad, that is very nice (can you maybe link to the source of the info?)

I will go ahead and modify my code and see if I can make sense of the data!
Still, I wonder what the checksum algorithm is.
I tried to attack it with brute-force, I used all combinations of seed values (0 to 0xFFFF) and the 0x1021 constant was changed from 0 to 0xFFFF, this was then tested on 4 different frames. This was no success so the algorithm has to be completetly different from the Multiplex CRC16 calculation (I had hoped that either the seed value or the 0x1021 just had to be different)
cgroen is offline Find More Posts by cgroen
Reply With Quote
Old Dec 12, 2014, 04:24 PM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Found the description:
http://www.deviationtx.com/forum/pro...-dsmx?start=40
and it makes perfect sense with the data I saw on the SRXL

One question more, if f.ex a DX18 is used, is it then only the first 12 channels that are full resolution (11 bits), and then up to 8 XPlus channels (with 9 bit resolution) ?


Now just missing the CRC calculation
cgroen is offline Find More Posts by cgroen
Reply With Quote
Old Dec 12, 2014, 11:13 PM
AndyKunz's Avatar
Illinois
Joined Sep 2001
25,256 Posts
Yes, 12 channels at full res and fixed latency, 8 channels at lower res and variable latency.

The logic behind the Deviation code is flawed. They need to investigate the reason we say latency is variable. It's not as fixed as they seem to think. Fortunately the receivers are well-behaved and allow either method to work.

Andy
AndyKunz is offline Find More Posts by AndyKunz
Site Sponsor
Reply With Quote
Old Dec 13, 2014, 02:14 AM
Registered User
Joined Dec 2011
292 Posts
Deviation X-Plus code is not implemented and latency is not fixed. Probably documentation is not well written.
vlad_vy is offline Find More Posts by vlad_vy
Reply With Quote
Old Dec 13, 2014, 05:38 AM
Just me..
cgroen's Avatar
Denmark (Jylland)
Joined Nov 2004
100 Posts
Thanks Andy and Vlad !

Implented the XPlus channel decoding, and it seems to work
I will get a DX18 within next week, then I can check if all is working as it is supposed to.

Now, if anyone would be so kind to give me an idea about the checksum I would be very happy, this is the last bit I still need to implement



My updated comments in the code:

Spektrum DX9
Receiver AR9020 with 2 satelittes (in DSMX mode), data taken from SRXL connector (3V serial data, normal "UART" levels (3V is idle, 0V is startbit).
115200, 8 data, 1 stop, no parity

Channel asignments in DX9 transmitter:
1 = THR [0x00]
2 = AIL [0x01]
3 = ELE [0x02]
4 = RUD [0x03]
5 = GEAR [0x04]
6 = AUX1 [0x05]
7 = AUX2 [0x06]
8 = AUX3 [0x07]
9 = AUX4 [0x08]

Data in [0x..] above is bit 6,5,4,3 in MSB decoded. This is the channel number!

18 bytes of Data, every 2nd packet is different:

0xA2 0x02 0x0C 0x11 0x2E 0xAA 0x14 0x00 0x26 0xAA 0x36 0xAA 0x54 0x00 0x61 0x00 0xC6 0xFE
[Header ] [ Ail ] [ Aux1 ] [ Ele ] [ Gear ] [ Aux2 ] [ xch10 ] [ XPlus ] [ CRC ]

0xA2 0x03 0x01 0x56 0x3B 0x04 0x1C 0x02 0x46 0xAA 0x4C 0x00 0x5C 0x00 0x63 0x00 0xC8 0xAB
[Header ] [ Thr ] [ Aux3 ] [ Rud ] [ Aux4 ] [ xch9 ] [ xch11 ] [ XPlus ] [ CRC ]

When transmitter is off, packets beginning with "0xA2 0x00" and "0xA2 0x01" is sent, but still with valid channel data


Values on the first 12 channels are from 1 to 2047 (on radio it is written as 1 to 2048 in the servo settings sub-menu)
Values for the 8 XPlus channels are from 0 to 511 (9 bits)

Elevator +150%:
0x17 0xFE = 0x7FE
Elevator 0%:
0x13 0xFE = 0x3FE
Elevator -150%:
0x10 0x02 = 0x002

For the first 6 channels in each frame:
Bit 2,1,0 in MSB and bit 7..0 in LSB is servo position (11 bits)
Bit 6,5,4,3 in MSB is channel number (0 based), goes from 0 to 11
Bit 7 in MSB is not used

The 7th "channel" in each frame contains data for 1 XPlus channel pr transmission.
The XPlus channel number is coded in bit 11,10 and bit 2 of the channel number is in bit 0 of the second byte in the header
So the each frame "0xA2 0x02" carries one of the XPlus channels (0 to 3) and the second frame "0xA2 0x03" has one of the XPlus channels 4 to 7.
This means that the XPlus channels are sent at a lower rate than the first 12 channels!


//-----------------------------------------------------------------------------
http://www.deviationtx.com/forum/pro...-dsmx?start=40
The X-Plus channels structure.

Channel numbers 0 to 11 are normal, with data resolution 11bit (2048).
Channel 12 carries the X-Plus channels, with data resolution 9bit (512).

Channel transfer structure:
packet 1 -> 1 5 2 4 6 10 12
packet 2 -> 0 7 3 8 9 11 12

X-Plus data format
each 16bit X-Plus data value is defined as:

a bbbb cc ddddddddd

a: always 0
bbbb: the channel number, always 12
cc: X-Plus channel number, low 2 bits, third bit defined by packet number, 1st packet = 0, second packet = 1
dd..: X-Plus channel data, 9 bits, 256 is midpoint

The channel data will be 0xffff if the specific X-Plus channel slot is unused.
//-----------------------------------------------------------------------------
cgroen is offline Find More Posts by cgroen
Reply With Quote
Old Dec 13, 2014, 06:01 AM
Registered User
Joined Dec 2011
292 Posts
Header 0 Vendor ID (0xA2)
Header 1 Status:
(0x00) valid 1st data frame with fail safe condition
(0x01) valid 2nd data frame with fail safe condition
(0x02) valid and live 1st data frame
(0x03) valid and live 2nd data frame
(others) invalid frame
vlad_vy is offline Find More Posts by vlad_vy
Last edited by vlad_vy; Dec 13, 2014 at 06:09 AM.
Reply With Quote
Old Dec 13, 2014, 12:44 PM
AndyKunz's Avatar
Illinois
Joined Sep 2001
25,256 Posts
Quote:
Originally Posted by cgroen View Post
Now, if anyone would be so kind to give me an idea about the checksum I would be very happy, this is the last bit I still need to implement
The best hint I could possibly give you for a process to use was in the last message I replied to you.

Andy
AndyKunz is offline Find More Posts by AndyKunz
Site Sponsor
Reply With Quote
Reply


Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Discussion Spektrum AR9110 port ? marksp Radios 3 Nov 16, 2014 07:54 PM
Discussion Pilot Boats, Port Authority & Port Facilities - River IJ, Amsterdam Tug Hercules Dock Talk 12 Oct 19, 2014 07:31 AM
Help! DragonLink (DL) with Spektrum DX8 through Trainer Port not working alexsmith FPV Equipment 4 Mar 15, 2014 02:28 PM
Discussion Spektrum DX6i Aux port peterbro Electric Plane Talk 32 Aug 07, 2013 09:09 PM
Question Getting the Aux port on a Spektrum Dx6i work peterbro Sailboats 0 Aug 31, 2008 07:58 PM