HobbyKing.com New Products Flash Sale
Reply
Thread Tools
Old Jun 23, 2012, 07:04 PM
Registered User
Joined Apr 2012
14 Posts
Quote:
Originally Posted by PhracturedBlue View Post
word 1: 0x05aa for 3 seconds, and then 0x5505
word 2: 0x01f3
word 3: 0x2000

should be 05aa then 0555

The 05 is FIFO register address
the "aa" means bind mode, the 55 would be !bind mode

0x01f3 0x2000

is the transmitter's flysky id code, it is written to the eeprom on the rx
zeza is offline Find More Posts by zeza
Reply With Quote
Sign up now
to remove ads between posts
Old Jun 23, 2012, 07:12 PM
Registered User
Joined Jan 2012
682 Posts
Quote:
Originally Posted by zeza View Post
should be 05aa then 0555

The 05 is FIFO register address
the "aa" means bind mode, the 55 would be !bind mode

0x01f3 0x2000

is the transmitter's flysky id code, it is written to the eeprom on the rx
Yep, I found that I got it backwards recently. I've done some further work on the protocol as I plan to add it to the new Deviation firmware I'm working on. You can find the latest copy of the doc here:
https://bitbucket.org/PhracturedBlue...doc/Flysky.txt

Thanks for the comment on the 1st 2 words. I noticed they were different between my 2 v911 transmitters, but knowing why is useful.
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Jun 23, 2012, 09:01 PM
Registered User
Joined Apr 2012
14 Posts
Quote:
Originally Posted by PhracturedBlue View Post
Yep, I found that I got it backwards recently. I've done some further work on the protocol as I plan to add it to the new Deviation firmware I'm working on. You can find the latest copy of the doc here:
https://bitbucket.org/PhracturedBlue...doc/Flysky.txt

Thanks for the comment on the 1st 2 words. I noticed they were different between my 2 v911 transmitters, but knowing why is useful.

Thanks for those hoping sequences.

Another note:

I am dumping the traffic from both the tx and rx at the same time. The rx always sets "PLL Register I" at one less then the tx. There is also one hop that is miss aligned during each iteration.
zeza is offline Find More Posts by zeza
Reply With Quote
Old Jun 23, 2012, 09:37 PM
Registered User
Joined Jan 2012
682 Posts
Quote:
Originally Posted by zeza View Post
Thanks for those hoping sequences.

Another note:

I am dumping the traffic from both the tx and rx at the same time. The rx always sets "PLL Register I" at one less then the tx. There is also one hop that is miss aligned during each iteration.
Are you looking at the v911 or a turnigy tx/rx?
I ask only because I wanted to work on the 8ch Flysky9x, but the shild is pretty well welded to the board, and I don't want to destroy it just to get at the SPI pins. So I'm currently working with only a v911 transmitter (well 2 of them). I have a 9x Receiver that I have been playing with (bound to the V911) but if I can help it I don't want to try to hook into the SPI on it, so I'm hoping I can glean enough out of the 4ch V911 to be able to extend it to 8ch.
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Jun 24, 2012, 08:47 AM
Registered User
Joined Apr 2012
14 Posts
I am doing the same setup, for the same reasons as you. I tried to dump the spi off the 9x rx but I think I toasted it. The regulator gets hot and there is no spi traffic, but it does read the eeprom and flash the led. They are so cheap that I am going to order a few more. I have considered cutting off the 9x tx shield.

I am working on a software defined radio rc system, so I should be able provide full over the air dumps in the near future.

For the people looking for PPM on the v911 rx, 8 bytes are read from the eeprom, the first 4 are the "flysky id", the rest are ff. This may be for a config, or something else or just a programing error. Just a hunch that I am not interested in investigating at this time.


If there are any autistic savant reading this, I am interested in the hopping sequences. I am going to attempt an automated "flysky id" changer in the next few weeks to obtain more data points. This is what I have now between myself and PhracturedBlue. I have an additional v911 and 9x tx that are currently disassembled, dumping these sequences is also on my list. These are from the tx side, the rx side is one less except for the (#) which is where they miss. I think the reason for the offset discussed in section 14 of the manual, tl;dr.

zeza - V911 tx #1
ID: 92 04 00 20
sequence: 6F 29 79 01 51 47 97 0B 5B 3D 8D 25(14) 65 33 83 1F

zeza - 9x tx #1
ID: FB 81 02 00
sequence: 1E 96 46 82 32 8C 3C 5A 0A 78 28 ??(64) 14 50 00 6E

PhracturedBlue
ID: 01 f3 20 00
Tx1: 79, 29, 6f, 1f, 83, 33, 65, 25, 8d, 3d, 5b, 0b, 97, 47, 51, 01

ID: 00 02 70 00
Tx2: 0a, 5a, 50, a0, 14, 64, 46, 96, 1e, 6e, 3c, 8c, 28, 78, 32, 82
zeza is offline Find More Posts by zeza
Reply With Quote
Old Jun 24, 2012, 09:43 AM
Registered User
Joined Jan 2012
682 Posts
I spent some time on the sequence stuff earlier. I didn't figure it out, but here are some clues:
values always come in pairs (same bottom nibble)
For a given pair the 2nd upper nibble is either 5 more or 5 less than the lower nibble) (except for one case of 6->2. I wonder if this is an error in the table?)

If you look at your Tx1 and my Tx1 you'll notice they are identical except that the order is reversed. Read your sequence right to left and you get mine left to right (once you line them up)

If you look at your tx2 and my tx2 you'll see the pairs are almost the same (but swapped) but the ordering of the pairs is different (there is one case where yours has a '00' that mine has an 'a0' though)

On both of our Tx1s, The low nibbles come in an (almost) sequence: e,c,a,8,6,4,2
for instance for my 1st Tx (using base16 clock arithmetic):
9 +6 = f
f + 4 = 3
3 + 2 = 5
5 + 8? = d
d + e(14) = b
b + c(12) = 7
7 + a(10) = 1

However for the other 2 Tx there is no such pattern
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Jun 25, 2012, 04:38 AM
Registered User
slebetman's Avatar
Malaysia, Selangor, Kajang
Joined Jun 2009
1,453 Posts
Just to clarify. This is the bitstream from the encoder board to the TX board right?

I have a Hobbyking HK-GT2 transmitter that should in theory have the same SPI sequence that I've been meaning to reverse engineer. Just never got around to doing it.

Also, since the RX id code is transmitted each packet does this mean that we can write software to bind to more than 1 RX? I'm thinking of simple round-robin scheduling to talk to multiple RX's in sequence.
slebetman is online now Find More Posts by slebetman
Reply With Quote
Old Jun 25, 2012, 08:50 AM
Registered User
Joined Jan 2012
682 Posts
Quote:
Originally Posted by slebetman View Post
Just to clarify. This is the bitstream from the encoder board to the TX board right?

I have a Hobbyking HK-GT2 transmitter that should in theory have the same SPI sequence that I've been meaning to reverse engineer. Just never got around to doing it.

Also, since the RX id code is transmitted each packet does this mean that we can write software to bind to more than 1 RX? I'm thinking of simple round-robin scheduling to talk to multiple RX's in sequence.
Yes it is the signal from the encoder to the tx board (i.e. the SPI input directly to the A7105 module)
I am not sure the GT2 will be the exactly the same. Has anyone has ever bound a 9X to a GT2 Rx (or the other way around)? If that can be done, they're compatible.
If you have the equipment, it would still be really helpful to dump the SPI data to the Tx module from the GT-2. Assuming they use the same protocol, having access to more channel-hopping codes will help determine the hopping algorithm.
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Jun 25, 2012, 08:52 AM
RC beginner
New York
Joined Oct 2008
6,054 Posts
Quote:
Originally Posted by slebetman View Post
Just to clarify. This is the bitstream from the encoder board to the TX board right?

I have a Hobbyking HK-GT2 transmitter that should in theory have the same SPI sequence that I've been meaning to reverse engineer. Just never got around to doing it.
all my hobbyking flysky tx use ppm between the encoder and module. most of the reverse engineering here was done using toy heli remote which does have spi there instead.

http://www.rcgroups.com/forums/showt...3#post21552291



Quote:
Originally Posted by slebetman View Post
Also, since the RX id code is transmitted each packet does this mean that we can write software to bind to more than 1 RX?
id be surprised to see any company make a radio that DONT bind more than one rx. certainly a collectors item since the company would go under shortly after startup.
dave1993 is offline Find More Posts by dave1993
Reply With Quote
Old Jun 25, 2012, 09:31 AM
Registered User
cr8tive_leo's Avatar
Canada, ON, Cochrane District
Joined Oct 2011
743 Posts
I'm sorry, but , the rx remembers the tx id, not the other way around. You can't control one rx by multiple 2.5ghz radios, but you can control multiple rx's with one radio.
Without something like model match, you would be controlling all the rx's at the same time.
I see where you are trying to go with this, but, there are other hurdles. Goodluck. (use two tx modules and two seperate ppm signals, that works)
cr8tive_leo is offline Find More Posts by cr8tive_leo
Reply With Quote
Old Jun 25, 2012, 09:39 AM
Registered User
Joined Apr 2012
14 Posts
Quote:
Originally Posted by slebetman View Post
Just to clarify. This is the bitstream from the encoder board to the TX board right?

I have a Hobbyking HK-GT2 transmitter that should in theory have the same SPI sequence that I've been meaning to reverse engineer. Just never got around to doing it.

Also, since the RX id code is transmitted each packet does this mean that we can write software to bind to more than 1 RX? I'm thinking of simple round-robin scheduling to talk to multiple RX's in sequence.
In theory this would be possible, but with only one a705 chip you have a limited link budget. In order to make contact with two rx at every hop would require retuning the tx twice and sending data twice. I didn't do the math, just saying that this would be the limiting factor.

If on the other hand you mean multiplexing between two hoping sequences at the current hoping speed, this should be possible depending on how the rx responds to high data loss conditions.

Also the retuning overhead could be reduced by replacing the stock crystal with a nice low ppm txco. The current bit time is 2us, the total tuning overhead is on the order of a few 100us, and the frames have a total of 24 bytes of overhead in addition to the payload. More details are in the datasheet.
zeza is offline Find More Posts by zeza
Last edited by zeza; Jun 25, 2012 at 09:50 AM. Reason: had another thought
Reply With Quote
Old Jun 25, 2012, 09:45 AM
Registered User
Joined Jan 2012
682 Posts
Quote:
Originally Posted by cr8tive_leo View Post
I'm sorry, but , the rx remembers the tx id, not the other way around. You can't control one rx by multiple 2.5ghz radios, but you can control multiple rx's with one radio.
Without something like model match, you would be controlling all the rx's at the same time.
I see where you are trying to go with this, but, there are other hurdles. Goodluck. (use two tx modules and two seperate ppm signals, that works)
With proper coding it should be doable. Since the Flysky protocol (as do others I've seen) use binding packets, it should be possible to 1st bind one Rx and then bind a 2nd Rx. I think the Flysky/V911 save the previous binding in EEPROM, since I need to activate binding mode on my 9x and once I've done so, the V911 stays bound through multiple reboot cylces (until I turn on a V911 Tx and reset it).
If that is right, you'd bind each Rx separately (one at a time with the other one off), and then never send bind packets again. Once bound you should be able to use a round-robin approach to control multiple Rx with a single Tx. I guess that is what you meant by model-match, but done manually in this case.
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Old Jun 25, 2012, 11:07 AM
Registered User
slebetman's Avatar
Malaysia, Selangor, Kajang
Joined Jun 2009
1,453 Posts
Quote:
Originally Posted by dave1993 View Post
id be surprised to see any company make a radio that DONT bind more than one rx. certainly a collectors item since the company would go under shortly after startup.
Quote:
Originally Posted by cr8tive_leo View Post
I'm sorry, but , the rx remembers the tx id, not the other way around. You can't control one rx by multiple 2.5ghz radios, but you can control multiple rx's with one radio.
Without something like model match, you would be controlling all the rx's at the same time.
I think I wasn't clear on what I was trying to say. What I meant was to bind two separate RXes to two "virtual" TXes using only one physical TX. In effect this would allow a flysky system to control 16 channels using two 8 channel receivers. Or 12 channels using two 6 channel receivers. Or 6 channels using two 3 channel receivers (GT2 receivers which are compatible with flysky V2 protocol).

In theory if the TX sends its ID each packet it can multiplex between IDs and pretend to be two TXes. Was thinking of doing this with an auxiliary TX module connected to my programming/debug/trainer port but a single TX should in theory produce better signal since it doesn't suffer interference from the secondary TX or absorption from the secondary antenna.

I know for a fact that the PPM TX module can handle half the normal transmit rate (40ms instead of 20). The servos would be just a tiny bit more sluggish. And I suspect the SPI signals can be sent at a higher rate. So in theory the multiplexing would at least be plausible.

I'm pursuing this because my more ambitious flying wing projects tend to consume channels very quickly. 4 for duckerons + 2 for inboard elevons + 2 for flapperons + throttle is 9 channels. And that's quite basic. If I built a twin with retracts and steerable nose wheel I would need 12 channels. I'd either have to buy a Futaba or do some coding and soldering. Personally I tend to prefer to do some coding and soldering.
slebetman is online now Find More Posts by slebetman
Reply With Quote
Old Jun 25, 2012, 11:14 AM
Registered User
slebetman's Avatar
Malaysia, Selangor, Kajang
Joined Jun 2009
1,453 Posts
Quote:
Originally Posted by zeza View Post
In theory this would be possible, but with only one a705 chip you have a limited link budget. In order to make contact with two rx at every hop would require retuning the tx twice and sending data twice. I didn't do the math, just saying that this would be the limiting factor.

If on the other hand you mean multiplexing between two hoping sequences at the current hoping speed, this should be possible depending on how the rx responds to high data loss conditions.
Ah crap. Didn't consider frequency hopping. The TX wouldn't be able to delay the hop because the RX would hop anyway and we risk losing sync of hopping sequence.
slebetman is online now Find More Posts by slebetman
Reply With Quote
Old Jun 25, 2012, 11:26 AM
Registered User
Joined Jan 2012
682 Posts
Quote:
Originally Posted by slebetman View Post
I'm pursuing this because my more ambitious flying wing projects tend to consume channels very quickly. 4 for duckerons + 2 for inboard elevons + 2 for flapperons + throttle is 9 channels. And that's quite basic. If I built a twin with retracts and steerable nose wheel I would need 12 channels. I'd either have to buy a Futaba or do some coding and soldering. Personally I tend to prefer to do some coding and soldering.
At 12 channels, you could use the Walkera protocol to get 12 channels with telemetry. The Rx are a bit pricey at $50 for 12ch I guess, but I think you can get 8 channels of telemetry per Rx, though I'm not sure what interface it has for that). You can get the necessary Tx module for ~$10, and we've basically fully documented the protocol for that too so installing it into the Transmitter of your choice shouldn't be too hard.
You'd have no issue doubling up the Rx here in the same way, getting you to 24channels and (I think)16 channels of telemetry. Or for the price conscious, pairing the Devo module with DSM2 Rx should be possible soonish.
There's nothing wrong with the flysky system, but you need to get access to a module that has SPI in and has a pre-amp if you want any range. Maybe you can get this by salvaging from a Tx, but most boards seem to either have an onboard uC or no/small amp. The nice thing about the Devo module is it has a nice 100mw amp.
PhracturedBlue is offline Find More Posts by PhracturedBlue
Reply With Quote
Reply


Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Discussion Benefits of buying FlySky TH9x (v2) over Turnigy 9x (v2) wwfisher Radios 98 Dec 09, 2014 09:06 PM
Question 9X - FlySky/iMax/Turnigy/Eurgle FOR DUMMIES aeajr Radios 1016 Nov 18, 2014 06:53 PM
Found turnigy 9x/flysky 9x wanted!!! kremecheze Aircraft - General - Radio Equipment (FS/W) 2 Mar 25, 2012 05:04 PM
Wanted ER9x or Turnigy/Flysky 9x daign FPV Equipment (FS/W) 0 Mar 22, 2012 07:21 PM
Found Turnigy/FlySky/Eurkle/etc 9X Shell flyandi Aircraft - General - Radio Equipment (FS/W) 0 Mar 11, 2012 07:12 PM