DIY-Multiprotocol-TX-Module
DIY-Multiprotocol-TX-Module copied to clipboard
pascallanger
Traxxas TQ gen 1
Hi, I have an old Traxxas 2228 TX and a 2217 RX.
From this https://traxxas.com/support/Traxxas-TQi-Compatibility-Guide , I understood that it is different from the already implemented Traxxas TQ; indeed, the 2217 receiver doesn't bind to my multi-module (version 1.3.4.0).
I disassembled the radio:
I assume this is the real transmitter, right?
So, should I sniff this connection?
This is the back of the PCB, for reference:
Any suggestion?
If you have a saleae compatible logic analyzer (less than $10 on ebay), hook it up to these 8 pins:
Don't forget to connect GND as well.
I'd desolder that RF lid and grab some pictures of what is underneath
Can't desolder, but i found this: https://fccid.io/XVE-SA09181/External-Photos/Modular-Pictures-1202329
We don't see anything anyway... Connect a logic analyzer on the 8 pins I've pointed out earlier.
I have completed an initial acquisition, but only from the motherboard to the logic analyzer, excluding the RF module. I'm not sure if this will be useful... traxxas2.sal.zip
What I did during the acquisition:
Started with the radio turned off, CH1 and CH2 set to the middle position:
- Powered on the radio
- Set CH2 to maximum
- Set CH2 to minimum
- Set CH to the middle position
- Set CH1 to minimum
- Set CH1 to maximum
I will perform an acquisition with the RF module as soon as possible.
This is the first time I'm using a logic analyzer, so I might have made some mistakes. I believe I have identified the ground pin, but I'm not sure which one is the clock pin.
Please use logic 1.2.14 instead of 2.xx It looks like the RF module was not plugged to the motherboard and therefore the CPU went in a loop not finding what it was looking for. It means that you must connect the RF module. Out of 4 signals MOSI/MISO/SS/CLK, 2 signals MISO/SS are missing but may be due to the fact that the RF module was not present on the capture. MOSI is connected on D2 and CLK on D4. For the dumps, make sure the TX has all the trims centered and D/R set to max range. You need to do different dumps for each action in a separate file:
- power on not touching anything
- power on in bind mode with a RX in bind mode
- power on, CH1 mid, min, mid, max, mid
- power on, CH2 mid, min, mid, max, mid
- power on, CH3 mid, min, mid, max, mid
- power on, CH4 mid, min, mid, max, mid
- power on in bind mode with a RX in bind mode
- power on, CH1 mid, min, mid, max, mid
- power on, CH2 mid, min, mid, max, mid
Far more better. On the file poweron: CH0=CLK, CH3=MOSI, CH5=SS and CH7=MISO. I don't have the time to look at it further but that's a good start.
Normal packets
SOP 3C 37 CC 91 E2 F8 CC 91 . Is it constant? Set before reading the CYRF ID D8 AA 59 E6 44 FB so it could be constant. RF channels alternates between 0B and 34. Where are they coming from ? I'm wondering if 0B could be the main RF channel and 34 (04 bind channel xor 30) is the channel that the RX uses to find the main channel. The TX listens on both channels and read the RSSI right after the packet is transmitted. Timing is CH34 (where the sticks are read) then 7ms later on CH0B then 13ms later on CH34 for an overall 20ms loop. Payload 16 bytes
| 02 | D8 | AA | 59 | E6 | A2 | C6 | 05 | D9 | 05 | 90 | 07 | 90 | 07 | 0A | 78 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Type | ID0 | ID1 | ID2 | ID3 | UNK1 | CH1L | CH1H | CH2L | CH2H | CH3L | CH3H | CH4L | CH4H | UNK2 | XOR |
Type: 02 normal packet? ID0..3: CYRF ID UNK1: unknown value A2? Bind state=2 done? CH1H:CH1L: channel 1 value 042D..05C6..0733 -> looks like PPM values with a center on 5DC=1500 but the low part being truncated to 1069 and high part 1843. Any end points being set on the TX? Is this the throttle channel? CH2H:CH2L: channel 2 value 036E..05D9..0840 -> looks like PPM but with extended range this time center 5DC=1500 low 878 and high 2112. ... UNK2: unknown value 0A? Looks like the first RF channel -1: 0B-1=0A. XOR: XOR of all payload values from Type to UNK2 stored in XOR
Bind packets
RF channel 04 Timing every 10ms Payload 8 bytes
| 2A | D8 | AA | 59 | E6 | A0 | 03 | 44 |
|---|---|---|---|---|---|---|---|
| Type | ID0 | ID1 | ID2 | ID3 | UNK1 | UNK2 | XOR |
Type: 2A bind packet? ID0..3: CYRF ID UNK1: unknown value A0? Bind state 0? UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03. XOR: XOR of all payload values from Type to UNK2 stored in XOR
RX sends:
| 02 | A8 | 03 | A9 |
|---|---|---|---|
| Type | UNK1 | UNK2 | XOR |
Type: 02 normal packet? UNK1: unknown value A8? Ack bind state 0 with a xor 8? UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03. XOR: XOR of all payload values from Type to UNK2 stored in XOR
After receiving from the RX switches to:
| 2A | D8 | AA | 59 | E6 | A1 | 92 | 05 | D9 | 05 | 90 | 07 | 90 | 07 | 03 | 0E |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Type | ID0 | ID1 | ID2 | ID3 | UNK1 | CH1L | CH1H | CH2L | CH2H | CH3L | CH3H | CH4L | CH4H | UNK2 | XOR |
Type: 2A bind packet? ID0..3: CYRF ID UNK1: unknown value A1? Bind state 1? CH1H:CH1L: channel 1 value CH2H:CH2L: channel 2 value ... UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03. XOR: XOR of all payload values from Type to UNK2 stored in XOR
RX sends:
| 02 | A9 | 03 | A8 |
|---|---|---|---|
| Type | UNK1 | UNK2 | XOR |
Type: 02 normal packet? UNK1: unknown value A9? Ack bind state 1 with a xor 8? UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03. XOR: XOR of all payload values from Type to UNK2 stored in XOR
After receiving from the RX switches to:
| 02 | D8 | AA | 59 | E6 | A2 | 92 | 05 | D9 | 05 | 90 | 07 | 90 | 07 | 03 | 25 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Type | ID0 | ID1 | ID2 | ID3 | UNK1 | CH1L | CH1H | CH2L | CH2H | CH3L | CH3H | CH4L | CH4H | UNK2 | XOR |
Type: 02 normal packet? ID0..3: CYRF ID UNK1: unknown value A2? Bind state=2 done? CH1H:CH1L: channel 1 value CH2H:CH2L: channel 2 value ... UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03. XOR: XOR of all payload values from Type to UNK2 stored in XOR
After some time switches to normal packets alternating on RF channels 0B and 34 Do we need to do all the bind states or just sending the initial bind packets is enough?
CH1H:CH1L: channel 1 value 042D..05C6..0733 -> looks like PPM values with a center on 5DC=1500 but the low part being truncated to 1069 and high part 1843. Any end points being set on the TX? Is this the throttle channel?
CH1 is for steering, ch2 for throttle. There are no end points on the radio, according to this manual https://traxxas.com/sites/default/files/KC1182_TQ-24GHz_INST.pdf can be only set an endpoint on the rx for the throttle.
PS: according to https://traxxas.com/support/parts/transmitters/Legacy-Transmitters this is TQ 1st gen, not pre TQ
Please test the new protocol Traxxas/TQ1 available here: https://downloads.multi-module.org/latest-test/ It's fully untested, just written the code and not even simulated it. It uses your current original TX ID for now. So you don't have to bind the RX, it should just work if I've done a good job. We'll have more tests to do but for now I'm waiting for that trial.
Wow! Congratulations on the speed! Unfortunately, it seems that the receiver does not detect the radio.
Please try again, stupid mistake... At least I 've found one...
Same problem, the receiver don't detect the radio
Note the time between turning on the radio and when the receiver "accept" the commands, maybe there is something? https://www.youtube.com/watch?v=JomC5fWWWbc
I have done another acquisition, maybe can be useful...
- power on not touching anything
- power on, CH1 mid, min, mid, max, mid
I don't get it... You are not trying to bind right? Just control an already bound RX to your original TX, correct? The RX doesn't do anything? The blinking pattern stays the same when you power on the multi module (RX powered first)? Have you tried to control with all the 4 channels set to their middle positions in the mixers? (I'm wondering if a channel outside of the expected range could be an issue...)
You are not trying to bind right?
no
Just control an already bound RX to your original TX, correct?
yes
The RX doesn't do anything?
nothing... power on->led off-> ~4sec->green blinking
When i poweron the traxxas TX the led become solid green (before or after the 4 sec, it is the same).
The blinking pattern stays the same when you power on the multi module (RX powered first)?
yes
Have you tried to control with all the 4 channels set to their middle positions in the mixers? (I'm wondering if a channel outside of the expected range could be an issue...)
Just tried, nothing.
Maybe my multimodule is fault? But it works with some dsm 2 1f rx...
I'm getting really annoyed, never spent so much time... Can you try again with the latest code?
Is it possible to connect to the SPI on the RX side?
I'm getting really annoyed, never spent so much time... Can you try again with the latest code?
Is it possible to connect to the SPI on the RX side?
It works! 🥳 All four channel
Is it possible to connect to the SPI on the RX side?
If can be useful i will try.
Unfortunately, these circuit boards are soldered together
Any suggestion for the pin?
It works! 🥳 All four channel
Wow that's not too early. But now I need to understand why it works... We'll need to do some testing.