Evaluate Team Associated iFHSS (XP2-SSI) protocol/board
Opened this issue · 26 comments
Pascal,
Per the other portion of discussion on RCG - a couple of us were looking to see if the Team Associated protocol could be reverse engineered based on what you see here (and or additional signal dumps if needed)
This is a single model control with bind button, no display, 2 channel with 4 pot's for EPA/trim adjustments
Yes it might be possible to do since the hw is compatible with multi.
You need to connect the logic analyzer on the spi bus of the cyrf6936
Ok, I can find
MOSI
MISO
CLK
Ground
I don't see CSN on the chip? Is that SS?
Yes SS sounds good
On the other side of the board there is a somewhat convenient debug header, but it would appear SS is not connected. I have MOSI, MISO, CLK, GND - not sure what value this would be without SS, unless SS is not what we are looking for?
From the data sheet (https://media.digikey.com/pdf/Data%20Sheets/Cypress%20PDFs/CYRF6936.pdf):
If I'm looking at the board correctly, the signals on that header have pull up resistors on them (seen from other side - 1st picture)
Pin 1 - GND
Pin 2 - ???
Pin 3 - MOSI
Pin 4 - CLK
Pin 5 - PWR
Pin 6 - MISO
SS is really the signal we need.
I'm not in front of my PC so I can't help you following the traces
The SPI bus can be shared with other components. This is where you need that chip select signal. May be they have something else they can connect like a screen on another version of the TX.
Gotcha.
Let me know if this looks sane, I'll grab other scans if so.
Power On.zip IFHSS-
There is also a dip switch bank with channel 1/2 reverse as well as one for IFHSS in UP position and IFHSS+ in down position
My model is bound with the + position and did not connect when in -
Hello,
I had a look at two of my Team Associated radios. The first is the XP3-SS iFHSS radio from the SC8e RTR:
The electronics seem to be different than those of XP2-SSI:
Close-up:
The board mentions 'Thunder Tiger' as manufacturer.
The second radio is the XP120 from the MT10 Rival RTR:
Close-up of the board:
I am not sure if these two radios use the same protocol as the processors seem to be different.
Kind regards
Michael
I suspect the 2 and the 3 are compatible, both Cypress chips and a quick glance, the SPI signals look similar.
IIRC I saw receivers for the two listed somewhere as compatible
The 120 looks like something else, you ever try swapping them?
What are the priorities with the implementation? The older iFHSS protocol or the newer protocol for the 1/28 scale cars?
Kind regards
Michael
I would say in whatever order the people give me things to work on. Might be dumps, send me the TX+RX or donate some money so I can purchase locally.
And obviously as my time permit!!
@pwkpete I haven't looked at it yet... I'm looking at eazyrc right now which came in before your dumps.
Sorry, didn't see your reply - no worries at all. I'm ready whenever you are, just happy to have been successful with one so far!
This protocol is going to be hard work. With only one TX we won't be able to implement different IDs unless you can connect the logic analyzer to the RX too.
Is there a bind button on the TX? What's the bind procedure?
You need to do multiple dumps like we did before for each sticks, buttons and failsafe.
I can do the multiple dumps as well, just wanted to make sure the ones I uploaded looked good before going further.
I have not opened an RX so not sure how difficult that would be, however, I do happen to have a 2nd TX, if that will help...
The second TX will definitively help but I don't think it will give us the full picture.
The TX is using a large table of 48 frequencies, finding how it's generated is going to be extremely difficult if not impossible... That will limit the number of IDs. Also the SOP and DATA codes could be dependent of the ID.
There are also some packets which are different from the others which is why I would like to know the binding procedure, if there is failsafe from the radio or all other settings the radio can have.
Sorry, forgot to answer your bind question - there is a bind button on the TX as well as the RX
Seems no failsafe - just dumb TX with POTs for EPA/trim and DIP switches for reverse
Sorry, forgot to answer your bind question - there is a bind button on the TX as well as the RX
So I need a capture of the bind at power on.
Could you post a photo on how you connected the radio to the analyser?
Kind regards
Michael
I just used the header in the above picture and then used one of the holes to get SS. I listed the pinouts above
Here are 2 bind captures one with IFHSS and IFHSS+
Let me know then if you need captures for each IFHSS setting
Did the IFHSS setting make any difference in the scans? Do I need to run tests with each setting?
Were you able to determine if this was feasible from my last upload? If not, I can disconnect the logic probe. LMK
Thanks!