Originally Posted by Moloch

Forgive me if this question has been answered. Is the serial protocol of this radio documented somewhere?

It's there

http://www.rcgroups.com/forums/showp...9&postcount=79


Reinhard

This transmitter and the others in the price range seem to get great reviews. People automatically think that if it is cheap its crap. I know a lot of cheap junk comes from China, but if the US had slave labor and sweat shops and our employers paid us 1 dollar a day, than our tx's would be dirt cheap too. Or it may just come down to pure greed.

IWFS

I did some more experimenting with the ISP software. The English version of 4.88 does not have support for the 5408 processor but the Chinese version does. By comparing the two versions I'm able to work my way through the Chinese software and it does identify the processor in the radio. I could probably use this software to program the chip but it doesn't look like the ISP software has any way to dump the ROM. I don't want to load firmware into my radio with out a backup of the original ROM. Perhaps a buffer overflow attack would yield a ROM dump...

UPDATE: I used a serial port monitor to see what the ISP software was doing. It is continually sending 0x7F after you click the "Check MCU" button. When I power on the radio the ISP software enters into a short dialog with the processor then closes the port. When browsing through the ISP sample code I noticed those 0x46 commands. Perhaps I can write a small app to put the chip into download mode and dump the ROM. I've attached the serial log.

im following your progress with great interest. maybe sometime you could zip up those tools and post them here. specially assembler. im quite experienced with micro programming and would love to get into this particular one. imo its one of the best 2.4ghz radios out there. i did a couple radio ppm encoders so far. for example this tiny261 based one to convert cheapo heli toy remote for planes:

http://www.rcgroups.com/forums/showt...5#post20327722

the serial trace was specially interesting. i had good luck with developing my own silabs, stm, and avr flash utilities and might be able to do something here.

if we could get our hands on some blank chips it might be possible to swap out the original for safe keeping and experiment with a new one. i got the heat gun. that way if things didnt work out we could put the original back in.

Their documentation refers to the Keil compiler so I'm guessing that is the one to use for this chip. You can get a 30-day eval version from https://www.keil.com/demo/eval/c51.htm

The ISP programming software I'm messing with can be found at the following links.

Chinese 4.88 : http://www.stcmcu.com/datasheet/stc/...UP-CHINESE.EXE
English 4.86 : http://www.stcmcu.com/datasheet/stc/...UP-ENGLISH.EXE
English 4.88 patch: http://www.stcmcu.com/datasheet/stc/...88-english.exe

Those are all self extracting archives. I believe running the official installer is necessary before the above versions to work. You just have to guess which button is OK and which is Cancel.

The installer version (Chinese) is here http://www.stcmcu.com/datasheet/stc/...4.80-setup.EXE

The ISP application is written in VB. Before I sacrifice some chips to RE the serial protocol I'm going to try to determine it by decompiling the application.

i dont really have time to struggle with tools atm but will follow your success with great interest. do you have blank chips? if so where to get them?

This is a pretty good radio, for the price, but its power consumption is a bit heavy! I measured mine at 130mA with a 12V supply and thought to improve that by getting rid of the 5V linear regulators. I couldn't find a readily available, CHEAP switcing regulator, so I made my own. Its on a little pcb measuring about .9" by .9", has a tiny choke, 4 caps, 2 resistors and a smps chip with a Schotky diode and can be built for about $5.
I removed both the 78L05 and the 78M05 regulators, the "L' powers the micro and the "M" powers the RF board. I stuck my little regulator on to the back of the existing pcb with a bit of double sided sponge tape, added a few wires and - voila! The thing now draws just 58.3 mA at 12V which is less than half the original.
It works out at about 88% efficiency compared to about 43% for the linear regulators. Oh, and it works right down to about 6V input too.
If anyone wants to have a go at making one, drop me a line and I'll send the circuit schematic and pcb files.

here one i got off ebay for $2 and change. not worth me building at that price. those projects are huge fun though and i highly recommend scratch building one if youve never done it before.

got drain down to 60ma or so. to tell the truth even this was not really necessary as stock batteries went 20+ hours (ignoring the led).

http://www.ebay.com/itm/4A-UBEC-RC-H...item415442120d

Well, I have done it before - lots of times, its what I do and I have lots of smt parts available or else I wouldn't consider it.
I wanted to drop the current drain because my alkaline cells certainly didn't last 20 hours, it was more like 2 hours. Where do you get alkaline batteries that will supply 2.6 AHrs?
I had a look at that link on eBay and I can't even figure out what it is he is selling! Can you explain what it is/does? Since you bought one.

Originally Posted by harlequin2

I had a look at that link on eBay and I can't even figure out what it is he is selling! Can you explain what it is/does?

It's a switch-mode regulator like you built, but is being marketed for use on the receiver end of the R/C system.

Originally Posted by harlequin2

...I wanted to drop the current drain because my alkaline cells certainly didn't last 20 hours, it was more like 2 hours...

You could also consider my 4-cell modification as detailed earlier.
It will not drop the current, but give twice the operating time from your 8 cells at zero cost and 100% efficiency!
See posts #721, 722, 726, 727, 769, 772, 783, 800, 801, 809, 949, 984, 989, 990 to 994 for a complete details.

Done here also
http://www.rcgroups.com/forums/showp...postcount=1234

with similar results.

And with fully working LED

Reinhard

Originally Posted by ReSt

Done here also
http://www.rcgroups.com/forums/showp...postcount=1234

with similar results.

And with fully working LED

Reinhard

Yes, I looked at that, but mine is much simpler and easier and the LED still works as per normal without any modifications. All I had to do was to remove the two linear regulators, stick my board in place with some sticky foam and connect 4 wires.

Originally Posted by JMP_blackfoot

You could also consider my 4-cell modification as detailed earlier.
It will not drop the current, but give twice the operating time from your 8 cells at zero cost and 100% efficiency!
See posts #721, 722, 726, 727, 769, 772, 783, 800, 801, 809, 949, 984, 989, 990 to 994 for a complete details.

Thanks for those post references, I hadn't seen them before. There is so much stuff here that it takes a long time to discover it all!
I must admit I hadn't thought to use NiMH cells, but that's because this is the first R/C thing I've ever done and I've only been at it for a very short time. I just bought myself a big pack of alkaline cells and have been going from there. I guess when you have been buying batteries for a while, you start to think about rechargeables!
Anyway, my regulator does it very well and I can always buy some batteries from the nearest store if I am out flying and run out of Tx power.
Next time I mod it though, I might change to NiMH.
By the way, for those interested, the current drain of the micro section is about 35 mA and the RF module about 95 mA. Connecting the two supplies together is fine - I think they are separated because the original transmitter had the RF section on the main pcb and it was probably a 27 MHz thing. When they went to 2.4 GHz, they just added the external module and did away with the original transmitter. Also, putting 130 mA through a single 78M05 pushes its dissipation up and it would've needed a heatsink.
The whole design looks as if its been around for years and sort of evolved into what it is now from an early - my guess - 27 MHz 4 channel device.
I looked up the ST micro and it is a derivative of the venerable 8051.
I did see a post somewhere about dumping its contents and re-programming it, but I don't know if that ever happened.

One more question: I see i the earlier posts that there were two receivers with this system. Mine came with only one and no socket for another one ie it is designed to have only one now. Does anyone know when this change happened and has there been any feedback on whether it is an improvement or not?

v2 receiver review: http://www.rcmodelreviews.com/turnigy9xv2review3.shtml