Spektrum Telemetry reverse engineered, make DIY sensors !
Update: Spektrum (Andy Kunz) officially released the documentation for XBUS sensors ! No more guessing. Please use his document instead of mine:
Why did I do this ? Because noone else did and I am curious
Spektrum unfortunatley makes a "secret" out of their telemetry stuff if you do not sign a NDA. On the other hand, signing a NDA does not help the community. And nowadays there are very able people in the community
I am a noob at programming microcontrollers, but I am good in finding things out. Because of that I analyzed the Spektrum telemetry protocol to make it easy for talented programmers to make their own sensors. Because it is so easy !
Also, Spektrum seems to have not enough manpower to prodice sensors we all need (used capacity, for example). It's a shame to have a telemetry enabled radio and no sensors (sometimes I get jealous if I look over to the HOTT radios).
So, I took a logic analyzer for the basics and an Arduino to find out the values.
First of all: Spektrum uses an I²C bus, they call it X-Bus. It's frequency is 100kHz. The 4 pins are SDA, SCL, Ubatt, GND, SDA on the antenna side, GND on the 3-connector side. Ubatt is direct voltage from the RX, so make sure you use a 3.3V LDO regulator for your sensor. As for termination, the pullup resistors in microcontrollers are sufficient. Spektrum uses PIC 16F677 without external resistors.
Around 70ms after the power is stable, the telemetry module enumerates the bus. It reads each address (0x01 up to 0x7D) twice, every 13ms, and if there is a telemetry module, it should answer, otherwise it will not be polled during normal operation. So if you design a sensor, make sure it listens to the I²C quickly. This enumerating takes about 3.4 seconds, after that the TM1000 transmits data and polls the sensors every 94ms. The sensors are I²C slaves.
Every sensor must transfer 16 bytes data. First byte must be address, second byte must be 0x00, and 14 bytes of data. I will describe the data format later with the various sensors.
And now, please have a look which sensors are currently implemented in the telemetry enabled radios (if you are logging the telemetry data stream, you see ALL sensor adresses !)
Address 0x01: Voltmeter. legacy, DO NOT USE !
The voltage is transferred directly from the TM1000, if you use this sensor address the value flickers on the radio, because the "real" voltage data is transferred via address 7E (which is not polled via I²C).
Address 0x02: Temperature. legacy, DO NOT USE !
Same as above, this seems some legacy stuff and interferes with the internal data.
Address 0x03: Current. Use it ! This sensor came with DX8 2.05, DX18 1.01.
MSB and LSB are a 16bit value, 1 unit is 0.1967A, seems to be some sensor related value. You can display 4 digits, I tried up to 0x2000 (displaying 1612A). Please beware that the maximum alarm value you can set in the radio is 200A.
Address 0a: Powerbox. Very useful !
You can display 2 voltages and 2 used capacities. Voltage scale 1 unit is 0.01V, capacity 1 unit is 1mAh. Alarm has to be triggered by the sensor, it is transmitted to the radio with the last byte, the first 4 bits. The fist bit is alarm V1, the second V2, the third Capacity 1, the 4th capacity 2. This sensor is nearly perfect for a used capacity sensor, with the drawback that the alarm value must be set in the sensor . You can enable or disable an alarm for each value, but not set the value.
Address 0x11: Airspeed
MSB and LSB are a 16Bit value, 1 unit is 1 km/h. Displays up to 65535 km/h, maximum alarm value 563 km/h
Address 0x12: Altitude
MSB and LSB are a 16Bit signed integer, 1 unit is 0.1m. Displays -3276.8m to 3276.7m, alarm values between -300m and 1000m. 0x7fff is 3276.7m, 0xffff=-0.1m, 0x8000 is -3276.8m
Address 0x14: G-Force
MSB/LSB are signed integers, unit is 0.01g, on the "normal" display the last digit is rounded. maximum display value is +-99.90 (actually 99.99, but when it is rounded, it overflows to 100 and displays ----)
The min/max values are retained in the sensor, because g-force cah change too quickly for the radio. Therefore you cannot clear the min/max values on the radio. Alarm can be set for Z-axis from -40g to 40g
Address 0x15: JetCat. Useful, but no alarms, display only. ONLY AVAILABLE ON THE DX9, DX10t, DX18t, DX18 (QQ) !
15,00,status,throttle,PackVoltHi,PackVoltLo,PumpVo ltHi,PumpVoltLo,RPMLo,RPMMid,RPMHi,00,TempEGTLo,Te mpEGTHi,OffCondition,00
JetCat is a display only value especially for turbines, but has some interesting fields which can be used otherwise. You can display 2 voltages, throttle, RPM and 2 status messages. There are some differences to all other sensors, JetCat uses BCD values. Only 0-9, a-f is unused. Voltages range to 99.99V, RPM to 999999, throttle up to 159% (the upper nibble is 0-f, the lower nobble 0-9), a little bit strange. EGT temperature uses only the lower nibble of the MSB, so maximum displayable value is 999°.
Possible messages for status:
0x01:WAIT FOR RPM
0x0e,0x14:TWO SHAFT REGULATE
0x16:PRE HEAT 2
0x17:MAIN F START
0x19:KERO FULL ON
Messages for Off Condition:
0x01:OFF BY RC
0x05:ACCELERATION TOO SLOW
0x07:LOW RPM OFF
0x0a.0x10:LOW TEMP OFF
0x0b,0x11:HIGH TEMP OFF
0x0c,0x12:GLOW PLUG DEFECTIVE
0x0d,0x13:WATCH DOG TIMER
0x0e,0x14:FAIL SAFE OFF
0x16:POWER BATT FAIL
0x17:TEMP SENSOR FAIL
0x1a:2nd ENGINE FAIL
0x1b:2nd ENGINE DIFFERENTIAL TOO HIGH
0x1c:2nd ENGINE NO COMMUNICATION
0x1d:MAX OFF CONDITION
Address 0x16: GPS
Edit: To have it all in one article, I have added the GPS, thanks Vlad !
40,00,altLSB,altMSB,250MSB,250LSB,500MSB,500LSB,10 00MSB,1000LSB,1500MSB,1500LSB,2000MSB,2000LSB,3000 MSB,3000LSB
alt is altitude in 0.1m
250, 500, etc is altitude change rate in 0.1m, during the last 250ms, 500ms, 1s, 1.5s, 2s, 3s. So filtering is done in the sensor. If you only have one value, either use only 250ms or transmit it for all rates. If you transmit it for the 250ms rate, you have to set the radio also to 250ms in order to get vario tones.
All altitude variables are Int16
Attached is a picture of the pinout (thanks, Schorsch).
Okay, guys. Now it should be easy to build your own sensors. I just have one wish: If you build a sensor, please make the circuit and software public, so anyone can copy them.
A guy at rc-heli.de (Schorsch) is currently working on an used capacity sensor. He told me that he will make it public when it's done.
Have fun !
Last edited by Mukenukem; Feb 24, 2016 at 10:56 AM. Reason: Official Documentation added
I use i2c a fair bit and very nice when you have information like this :-)
A good source for information on reversed engineering of a lot of radio/telemetry systems like Spektrum are the hobbyist physical computing and/ or hobbiest UAV forums etc. They tend to want to use the gear in different ways. I use Spektrum satellite receivers on there own with an Arduino for example. First time i've seen Spektrum telemetry. Other smaller brands like Jeti and Multiplex publish the protocol they use.
Hardest part as always are pcb's. I have the attopilot current sensor which was dead easy to use with atmega328 (two 3.3v ref. analogue outputs from sensor). Micro controller software for reading the sensor and outputting to i2c not hard. Problem is I can't do surface mount so ended up large and cumbersome.
I don't sell anything
They do not change the protocol, otherwise their sensors would stop working.
What I really want:
I would buy a used capacity sensor from the spot. But they don't have one. I want a current sensor.
Last edited by Mukenukem; Oct 22, 2013 at 02:20 PM.
Its all good for the end user at the end of the day, it gives us options.
I think the next step would be tapping the telemetry stream in the radio and outputting it (maybe via bluetooth). I expect that the telemetry stream comes out of the RF module, maybe just serial like the data is fed to the module. This would be the base for an Android (or PC) software for telemetry display, speech, etc. Because I am very disappointed about the STi being a fruit only device. It would be way more useful if you have a bluetooth inerface (integrated) in the radio.
I can understand the decision that the STI is Apple only, because the dock connector is (at least till now) the same on every I-thingy. Let's see what happens when the new I-phoney is presented. New connector ? Maybe no serial port on the connector ?
Adding a BT module to the radio would have cost 10$. Maybe less. At least for the DX18 it would have been logical.
If You have a DX8 or DX18 it save the telemetry to the SPEKTRUM.TLM file.
I am working on a converter to convert it to a LogView format have a look at the beta. Yes I start with a excel VBA script but change to make the converter.
What I need now is to add more sensores.
|Category||Thread||Thread Starter||Forum||Replies||Last Post|
|Discussion||Aircraft Telemetry GPS Sensor by Spektrum||RC_AVIGATOR||Radios||143||Feb 15, 2017 03:07 PM|
|Sold||Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused||boatdoc||Aircraft - General - Radio Equipment (FS/W)||0||Mar 30, 2012 02:05 PM|
|Sold||Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused||boatdoc||Aircraft - General - Radio Equipment (FS/W)||0||Mar 26, 2012 01:22 PM|
|Sold||Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused||boatdoc||Aircraft - General - Radio Equipment (FS/W)||4||Mar 26, 2012 05:52 AM|
|Sold||Spektrum Spektrum TM1000 Telemetry Module and Sensors 45.00 Shipped New Unused||boatdoc||Aircraft - General - Radio Equipment (FS/W)||2||Mar 22, 2012 09:04 AM|