Add support for SX127X chips (TBS CrossFire, FrSky R9) #303
Comments
|
This is totally possible. The DIY module PCB has been designed with this in mind providing a connector with a full SPI bus + power supply. I remember that the Banggood 4-in-1 and iRangeX IRX4 / IR4+ modules have the port as well.
I'm usually looking at the regular use (ignoring telemetry). First looking at the packets content to locate the channels, presence of a CRC, counter... Then jumping quickly to the hopping RF channels to see what the cycle is and if there is any patterns. Next quick look on the bind sequence to see if it contains the channels, TX ID, negotiation between the TX and RX or only 1way... And move forward from there to implement something in Multi.
That's usually unneeded when you have access to the SPI bus. Pascal |
|
I found a good spot to tap into the SPI, there are 4 resistors close to the edge of the board beside the SX1276 chip:
I checked the SPI speed with an oscilloscope, it's 18 MHz. Unfortunately my old logic analyzer can only get a 20ms window at those speeds (it can't stream over USB without missing some packets). I've ordered a new one that should work, so it will probably take a bit of time before I can continue decoding. I'll also try to capture some data while it's communicating with the R9, I hope 20ms is enough to cover a full cycle. |
|
Good job. |
|
A small update, I finally got the new logic analyzer so I'm able to continue working on this. In that capture, the following pattern is repeating itself: OpMode register is setting the radio mode (modulation type, sleep, low/high power) And I guess the FIFO writing part contains the 8 channels data, I will soon make a capture while moving the sticks to confirm it |
|
I'm currently in the process of writing an initial code for the stm32 based multi-protocol module. I've set up and radio and everything, I just have a hard time to figure out the CRC algorithm they use. It looks like that last two bytes are CRC (I might be wrong though), I've tried multiple CRC16 variations with no luck. Is there any known CRC algorithm FrSky is using? Any help would be appreciated! Here are some samples (including the suspected CRC in the last 2 bytes): P.S the following bytes (up to the last 2) seems to be the channels EDIT After a lot of trial & errors, reading about CRC, trying different methods for brute force and running samples through "CRC Reveng" (a program for reverse engineering CRC's...) I finally found it! It is actually the same algorithm used in FrSkyX, implemented here. Just out of curiosity, how did you find that CRC algorithm? |
|
Another update, I managed to get a initial working firmware that can bind and send channel data: The firmware is available here: I think it's ready to start integrating into the Multi-protocol project. How should I go about connecting the RFM95 module to the Multi-protocol over SPI? And which module is the "official" one? I currently have the iRange IRX4. |
|
The IRX4 is a good one since you have an extra SPI port with pinouts available on the PCB just for this exact purpose. |
|
@pascallanger Adding the new chip was pretty straight forward, just some definitions and a small SPI abstraction, but as you can see from the video I currently "borrowed" the protocol number 63 from XN297DUMP, since I couldn't go past 63 in the model setup menu in OpenTX. I also tried to add a new protocol option in Multi_Names.ino, but that didn't work either. My guess is that it needs to be added in the OpenTX side? Also, I had some trouble understanding the units of time that Is there any documentation about those kind of stuff? I couldn't find any in the docs folder. |
|
You need OpenTX 2.3.5 or more to go past the protocol 63 and use multi names... |
|
I've modified your code, validation and updated the documentation in my last push. |
|
I've just tested the code from the master branch with your changes, and it works exactly the same as before. |
|
Great job!
About the hardware design, anyone has making a new version to
accomplish SX127x chips?
Em sex., 24 de jan. de 2020 às 08:35, Tomer Abramovich <
notifications@github.com> escreveu:
… I've just tested the code from the master branch with your changes, and it
works exactly the same as before.
As for the upper 8 channels, I think it works exactly the same as FrskyX.
But my current setup is just connecting the PWM channels of the R9 to an
oscilloscope, and it only has 8 PWM channels. I need to setup a flight
controller with SBUS and see the rest of the channels with Betaflight
configurator or something. You're welcome to try, I'm pretty sure it would
work.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#303?email_source=notifications&email_token=AABKLWOTKEYXTUA32MCTC4LQ7LHAJA5CNFSM4JVDW6M2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEJ2QSNA#issuecomment-578095412>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AABKLWPDZ2C7DG6QZPWQ3XDQ7LHAJANCNFSM4JVDW6MQ>
.
--
*Rodrigo Sclosa* • Arquiteto de Software
rodrigo.sclosa@gmail.com
(19) 99292.6385
facebook.com/rodrigo.sclosa
|
UnTraDe
changed the title
UnTraDe
changed the title
|
I've modified the code. By default it's now sending 16 channels and using subprotocols you can switch to 8 channels. |
|
|
@rodrigosclosa I don't mind doing it myself. But it looks like there going to be a lot of shuffling required to fit an RFM95 module in the existing design, so maybe designing a new one would be the way to go? There's also the question of RF power, the SX1276 alone can do up to 20 dBm (100mW), but the R9M module can do up to 1W using an RF amplifier (which will require even more space). Not sure if it's needed though, 100mW @ 915-868MHz with LoRa modulation can get pretty far as is.
@pascallanger I've re-tested with the previous commit (before the 16CH mode) and it looks like only channels 1-6 are moving. |
|
@UnTraDe cool .. excellent work on the R9M code ... In terms of size, they are small .. It could be done as an expansion card as @pascallanger commented... I ordered some 100mW and 500mW chips to do some tests and see if I can help you with that... |
|
@pascallanger I found the bug, the loop filling the channels stopped early and missed the last 3 bytes, that's why it was 1-6 and 9-14 (2 groups of 6 channels instead of 8). Channel 16 still doesn't seem to respond, I suspect that over SBUS it's used for RSSI. I've created a pull request with the fix (tested on both 915MHz and 8ch mode). @rodrigosclosa Yeah I think a daughter board can be a good solution. Although the iRangeX module's case blocks the expansion port, and at least the ones I got didn't solder the pins to it. |
|
@pascallanger nice! This module, according to the datasheet consumes only 450mA at 500mW @ 868mHz .. I believe it will be above the maximum current of the AMS1117 ... Taking advantage, can you shed some light on opening the original schematics and PCBs? I downloaded it to try to open it, but it gives KiCad an error that prevents it from opening .. |
|
@UnTraDe I'm looking at the code to search where is the CS pins definitions and I think that is missing a CS pin definition for SX1276 here: //CS pins File: https://github.com/pascallanger/DIY-Multiprotocol-TX-Module/blob/master/Multiprotocol/Pins.h |
|
@rodrigosclosa I think that the STM32 project is made using Eagle. If I remember correctly KiCad added the option to import Eagle files in KiCad 5. Regarding the CS pin definition, currently the code is using This is my current setup: |
|
@UnTraDe Oh I understood... On your external connection, did you connect the DIO0 pin on the SX1276? I was reading in the manual and some examples, it seems to me that it is necessary ... Or were you able to function normally without it? I have a Jumper 4-in-1 module here that came with my T16 .. I'll take a look at it, but I don't remember seeing an empty ICSP pad on the board ... |
|
@rodrigosclosa According to the data I captured from the R9M module, it seems that the only interrupt they are using is I'm not familiar with the module that the T16 ships with, the iRangeX 4-in-1 module has this group of 6 pins exposed:
Maybe @pascallanger knows more about the version that ships with the T16? |
|
@UnTraDe It looks like the Jumper module is another layout. See the pictures: https://drive.google.com/file/d/0B0xypZ_5kK2WSVYweXBuaG9oeGhRTjczdXJkV2tUYVhNa3Q4/preview https://drive.google.com/open?id=0B0xypZ_5kK2WMmJDa1QxTzlldnhUNVBtLUFQckprSE1paW5j I think I will need to make two models of daughter board, one for the 2x3 connector and the other for this 1x5 connector of the Jumper multiprotocol. Or, I was thinking of making only the daughter board, without any connector for the person to solder. What do you think @pascallanger? |
|
@UnTraDe @pascallanger take a look at the initial schematic and PCB i've made for a 100mW and 500mW Lora versions: 100mW Version: 500mW Version: Both has a 5V regulator exclusivelly for it and a filter section made by capacitors, to ensure a good quality power source... And they can also be ordered from JLCPCB.com and already practically assembled with the SMT Assembly service, lacking only the Lora1276 module and the UF.L connector of the antenna that they don't have ... And at a really very cheap price! What do you think? Please give me any feedback... |
|
@rodrigosclosa Looks good!
And another thing, there's this module: https://www.hoperf.com/modules/lora/RFM95P.html that can do 1W, did you see it? |
|
@UnTraDe Nice! Answering your questions:
I want to have some of these plates made at JLCPCB, but as they are in the Chinese New Year, only after the 1st of February. I will need to wait a while to be able to test them... I have already ordered some Lora1276F30 modules to test in the meantime... I saw this module that you posted.. Interesting... The NiceRF module, 500mW Lora1276F30 costs U $ 24.60 a pair, (https://pt.aliexpress.com/item/32646645489.html?spm=a2g0o.productlist.0.0.267f6d4080E8PP&algo_pvid=6a386bec-590a-45e4-8b60-9d5218e38065&algo_expid=6a386bec-590a-45e4-8b60-9d5218e38065-1&btsid=d02a6750-a9a9-48f3-8333-0753e9340cbb&ws_ab_test=searchweb0_0,searchweb201602_6,searchweb201603_53) |
|
Hello everyone, already good work. @rodrigosclosa If you need a good power supply for the Lora module, in the iRangeX module, it is possible to solder a 2x4 connector on the free SPI port with 2 angled pins in order to add power to the battery. So we go back a bit to DIY. |
|
Great work, guys. You might be interested in this, which is UART based, FCC certified, but 433 MHz. Or this, which is FCC certified, UART based and 915MHz, but only 100ish mW Or this, which 915 MHz, 1 Watt, SPI based but might not be not FCC'd. What can I do to help this project ? Seems like you guys have it figured out. Are "we" going to design an open receiver as well ? |
|
Everything you need to configure is in the file named |
|
I have used it and it works perfectly now, thank you. |
|
FAI options are to DISABLE telemetry. You don't want those unless you're participating in a competition where telemetry is forbidden, which is their whole purpose. |
|
My apologies, I have mixed up OpenTx with the 5in1 module firmwares |
|
TBS Cross Fire protocol will be added in the future ? |
|
@rodrigosclosa Did you figure out whether T16 internal module has any spare SPI pin? |
|
I haven't tested the T16 Internal Module... Only Jumper external module...
Em qui., 23 de jul. de 2020 às 09:20, Loong <notifications@github.com>
escreveu:
… @rodrigosclosa <https://github.com/rodrigosclosa> Did you figure out
whether T16 internal module has any spare SPI pin?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#303 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AABKLWLP4SNXJ7YBXCS6NWTR5ATJVANCNFSM4JVDW6MQ>
.
--
*Rodrigo Sclosa* • Arquiteto de Software
rodrigo.sclosa@gmail.com
(19) 99292.6385
facebook.com/rodrigo.sclosa
|
|
This is awesome. Thank you. The plane is still responsive to stick inputs. Radio is on opentx-t18 2.3.10N277 and Multi firmware 1.3.1.47. I posted opentx and blackbox logs over on RC Groups. The issue was first reported by mshagg2 on the T18 thread. Logs: (from line 533)
|
|
Wow, good job. Now an open source rx module would be fantastic. |
|
This is already on going with the ExpressLRS project. |
|
Hello, I have a receiver R9 868Mhz ACCST FCCID:XYFR9S09R. Thanks for your help. |
|
Why are you not using Flex in 868 as suggested before? |
|
Sorry, my English is very bad and i don't understand always all. |
|
Si tu installes la dernière version du firmware FLEX sur ton récepteur, tu pourras tester le protocole FLEX en 868Mhz: https://github.com/pascallanger/DIY-Multiprotocol-TX-Module/blob/master/Protocols_Details.md#sub_protocol-r9_868---1 |
|
Merci pour cette réponse en français. |
|
Les firmwares pour le RX R9: https://www.frsky-rc.com/wp-content/uploads/Downloads/Firmware/R9/ACCST/FW-R9-ACCST-20190201.zip |
|
C'est celui là mais sans les 3 logos au dessus de ACCST. |
|
Hum, la programmation n'en fini pas. C'est normal ? |
|
Je comprend, mon interface USB to Sport Frsky ne semble pas reconnue pourtant w10 la vois bien en COM10 mais pas le soft et il reste toujours sur 'finding device...' Un problème de driver ? J'ai essayé de le mettre à jour mais sans succès ! |
|
Je n'ai pas de câble, j'utilise la radio pour flasher les RXs. Mais bon ce n'est plus du ressort de ce thread. |
|
Oui, merci beaucoup :-) |
|
Le récepteur ne doit pas être alimenté au début, une fois que le soft dit "finding device" connecter l'alim au récepteur. |
I added a sx1276 board without extra PA on my t16 internal MPM. After setting SX1276_SetPaConfig to (true, 7, 15) and compiled with t18-5in1 board definition. FYI,bought the sx1276 here: Can you please give me some advice? |
If you didn't also do SX1276_SetPaDac(true); then the maximum power output is 17dBm, which should correspond to 87mA of current draw. The SX1276 datasheet states that the maximum duty cycle with 20dBm is 1% so you probably shouldn't be using it anyway. I'm going to order a module that has 30dBm output power. I'm guessing this is again power at 1% duty cycle and they're using a 10dBm external amplifier, but even at 17dBm continious output this should still give me 27dBm after the amplifier. |
|
@sasodoma It seems that PaDac(true) is set by default in the multi code. So I am a little confused about the power setting. If the PaDac（true）is set by default, it should be using 20-(15-power) to calculate. However the comment besides the code says sx1276 in t18 outputs 2dbm, which can only be reached by using 17-(15-power) to do the math. |
|
Just wanted to drop this link about crossfire here. |
|
What hardware is supported? The 5in1 from T18 only? Can I e.g. modify a 4in1 to work also? Any hints or advises? Thanks |
|
Yes you can add a sx1276 to a 4in1, it is explained above in this thread. |
|
would this 1.5W module be compatible? im looking to upgrade a stm32 4 in 1 module. |
|
SX1262, which that module uses is not currently supported |
and others
Is there a plan to add support for the long range systems (TBS CrossFire/FrSky R9)?
By taking apart the R9M and the R9 I own, I found they are based on the SX1276 LoRa chip from Semtech (https://www.semtech.com/products/wireless-rf/lora-transceivers/sx1276).
Some pictures I took from the R9 receiver with a microscope:
And the front-end
looks like it has an amplifierhas a switch (probably for antenna diversity):Googling around about TBS Crossfire, it looks like they use an RFM95-something chip, which appears to be the same silicon as the SX1276 chip just with different markings.
Is there any work currently being done on reverse-engineering those protocols?
As far as hardware goes, I think this module could be used easily along side the current 4-in-1 2.4GHz module, with a different antenna of course. This module is available from a lot of places really cheap (3~8$).
I've ordered a few and I'm currently designing a simple PCB that connects them to an STM32F103 and expose the antenna pad to an SMA connector. I will try to write some initial code to try to talk to a receiver.
I can capture some SPI communications with a logic analyzer between the stm32f103 and the SX1276 chip on the R9M and R9 I have. Which procedures are usually the most useful to start with? (binding/regular use/telemtry?)
I can also try to capture on-air data with SDR, but that would probably take longer to decode.
The text was updated successfully, but these errors were encountered: