Hitec Red AFHSS Support

[z3r0c00l2005]

Hi Guys, it woudl be great to see support for the Hitec Red protocol as used for the Ares range of indoor/park flyers (I believe this is the same as the Minima protocol)

[pascallanger]

I need a Hitec transmitter and a RX to reverse the protocol...

[z3r0c00l2005]

Only kit I've got is embedded in RTF Ares models. Can hook up a logic analyser to the tx if that'll help

[pascallanger]

You can always see if you have access to the spi bus between the controller and the RF component if not all integrated in one chip. Let me know.

[z3r0c00l2005]

pwr on to bound.zip

I've attached a LA to the 3 non-power pins between the main controller board (Processor seems to be a ATMEGA48V-10U) and the RF module (FLDSTX1) and captured the power-on trace.

The Reciever was powered up, and the TX turned on and left to negotiate the link.

D0 is connected to FLDSTX1 pin 8 D1 to pin 6 D2 to pin 7

Other than the power pins, none of the others are soldered up so i've assumed they're unused

Attached trace is from Pulseview.

[z3r0c00l2005]

Had the chance to dig further - the RF module is based upon the CC2510.

[pascallanger]

The CC2510 is an all in one micro controller + RF. I'll have a look at what's going in between the main board and the rf module but little hope to find anything usefull... We need a TX with a separated RF component. Or attack over the air which requires a lot more work...

[z3r0c00l2005]

I was wandering that, especially since I didn't spot a clock signal for SPI. I was trying to assess from some of the FCC photos of there was a "budget" Hitec system that would be easier to sniff... Not sure I could see anything helpful on there. What would we need for OTA analysis?

[z3r0c00l2005]

OK, I've taken the plunge and started looking Over The Air at this using a Hack RF One.

Does anyone have a GNU Radio Flow Graph for capturing FHSS systems?

looking at https://apps.fcc.gov/eas/GetApplicationAttachment.html?id=2808483 the frequency hopping tables are known (and confirmed with a spectrum sweep) using GFSK modulation should be plausible to decode the signals.

[pascallanger]

I can't access the web page link since it's asking for a username/password. You could try to capture only one channel for now to see if some of the serial data can be located in the frame.

[z3r0c00l2005]

Odd, although the link points to the "Test Report" for FCC ID 2AEIGFLDSTX1, pages 5 & 6 seem to be the most interesting ones. I'll try to capture a bind packet from a couple of channels later.

[brandond]

FWIW, I think you have to go through the application search to get at the documents: https://apps.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=UZY6Tq53n5Xm6H7eTSYdTA%3D%3D&fcc_id=2AEIGFLDSTX1

[FXDUTRUCROSSET]

Pascal i live in the south of paris and can lend you a telemetry 9 ch receiver and tx module or full radio gear for a few if needed

i'm on open avrc list and opentxmega of franck aguerre lists on modelisme.com

[pascallanger]

That would be cool. I work in Meudon so we should be able to meet somewhere. Please contact by PM. FYI, Franck contacted me a while back to get the Assan protocol on multi. He didn't sent me the hardware but one of his friend did.

[FXDUTRUCROSSET]

i'm on paris on friday sat sun i don't see the link for PM on git, pls contact me on modelisme.com fxdr MP

[z3r0c00l2005]

I've now got access to a Spectra module, which seems to have qty 2 6-pin connectors between the main and RF boards - when i get chance i'll hook up the LA and post some traces.

[pascallanger]

Any news?

[FXDUTRUCROSSET]

i need to wait till u come back from hollidays in normandy?

Le ven. 20 juil. 2018 à 14:54, pascallanger notifications@github.com a écrit :

[image: Boxbe] https://www.boxbe.com/overview pascallanger ( notifications@github.com) is not on your Guest List https://www.boxbe.com/approved-list?tc_serial=41319478577&tc_rand=1032769584&utm_source=stf&utm_medium=email&utm_campaign=ANNO_MWTP&utm_content=001&key=iaFpZksyEza5MIZWSSpORH%2FE0pyGk3ruZWsXL3Yu3aM%3D&token=r93vKIoCgBNjAQb9BK4B8anjgVG74zrS5LhQSXkKI%2BzoHIYDvQHhTDCQGxaW1E%2Bh | Approve sender https://www.boxbe.com/anno?tc_serial=41319478577&tc_rand=1032769584&utm_source=stf&utm_medium=email&utm_campaign=ANNO_MWTP&utm_content=001&key=iaFpZksyEza5MIZWSSpORH%2FE0pyGk3ruZWsXL3Yu3aM%3D&token=r93vKIoCgBNjAQb9BK4B8anjgVG74zrS5LhQSXkKI%2BzoHIYDvQHhTDCQGxaW1E%2Bh | Approve domain https://www.boxbe.com/anno?tc_serial=41319478577&tc_rand=1032769584&utm_source=stf&utm_medium=email&utm_campaign=ANNO_MWTP&utm_content=001&dom&key=iaFpZksyEza5MIZWSSpORH%2FE0pyGk3ruZWsXL3Yu3aM%3D&token=r93vKIoCgBNjAQb9BK4B8anjgVG74zrS5LhQSXkKI%2BzoHIYDvQHhTDCQGxaW1E%2Bh

Any news?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/pascallanger/DIY-Multiprotocol-TX-Module/issues/161#issuecomment-406587729, or mute the thread https://github.com/notifications/unsubscribe-auth/AY9kuMQ29w3poY7JD53ObklKAjr0g4zbks5uIc6YgaJpZM4TvYrj .

[pascallanger]

FYI, FX sent me an Hitec TX and RX (optima). I'm planning to work on this protocol in the next few days. The TX has 2 modes to work with optima RXs or minima/micro RXs. I don't have a minima/micro RX. If you have one available and don't mind to send it my way that would be appreciated. Otherwise if at least someone could participate in the debug seesion.

[pascallanger]

I've already connected the wires on the spi bus and done my first dump. Everything looks good since I can see the cc2500 init and packets. Now the fun part starts.

[z3r0c00l2005]

I've got an irange+ module and 3 models that bind with a minima protocol (although they're not genuine HiTec recievers). More than happy to help out :)

[pascallanger]

Optima and Minima protocols and assocaited binds are pretty much reversed at this stage. The telemetry for Optima is somewhat not fully there yet. I think it's because I'm missing either a sensor on the RX side so it has more data to send or on the TX side nothing is polling on the i2c bus the data. But telemetry is for later, I need now to put it in Multi and get what is on paper working ;-)

[z3r0c00l2005]

WOuld you be willing to share the SPI dumps and analysis for the Minima? I'm interested to see how they correlate with the coding and maybe be able to halp out in the future with similar projects.

[pascallanger]

I've got Minima "potentially" working. I was planning to push it on github today for you to test. I can share the dumps, maybe temporarely on this github for ease of access. Optima does not work yet since I'm missing a small part of the bind negociation which I won't be able to work on until monday...

[z3r0c00l2005]

Sounds good to me, I'll have the environment ready this afternoon to be able to recompile and check minima over the weekend - also well timed as i'll be able to test in a flying environment on monday as well :)

[pascallanger]

I hope it will work for Minima, there is a number of unknown bytes and no RX to try out so... But since there is no negociation/talk between the TX and RX it should be ok. I've put 2 dumps here: https://we.tl/UQFwCungJv

[z3r0c00l2005]

Cool, thanks :) look forward to testing it out :)

I assume it's not going to be selectable via the OpenTX menu just yet and will use the usual AETR order on the model config

[pascallanger]

On OpenTX, it will be custom protocol=39, sub-protocol=1 (for minima) and option=freq adjustment (like all frsky, corona,...)

[schwabe]

@z3r0c00l2005 you can always use custom on OpenTX and use the protocol numbers.

[schwabe]

@pascallanger I am adding Hitec (39) with Optima (0) and Minima (1) and cc2500 freq adj to OpenTX, right?

[pascallanger]

@schwabe Yes please ;-)

[pascallanger]

Ok, I can get an Optima receiver to move a servo. Issues that I still observe:

• if I use a random hopping table the link is not good, I'm seeing delays on the servo. This means to me that some channels are not usable, now I need to figure out which ones... The channels do not seem to be linked the ID, but there is still 3 unknown bytes which are exchanged during bind which I have no idea what to do with so still some investigations are needed.
• telemetry packets are not received after some time. Relaunching the protocol restarts the telemetry stream but it will faill again. On the telemetry, I can get the RX voltage, TX LSSI and TX LQI. RX RSSI is not available... Slowly but surely...

[pascallanger]

@schwabe I'll do the same than AFHDS2A for the telemetry: FrSky Hub and forward to TX. For now I'm using FrSky Hub but anyway I haven't figured out to get all the telemetry since the receiver is only sending the 1st frame on 4 (same on the original radio). It could be bacause there is no sensor attached, or the TX not having a device pulling telemetry. So this is more a head's up that this is coming. Telemetry has GPS, temp sensors, voltage, rpm,...

[pascallanger]

Ok, Optima RX is working:

• Random ID and hopping frequency table
• Telemetry looks stable now, I have the RX voltage, TX RSSI and TX LQI through the FrSky Hub telemetry protocol.

TODO:

• Test Minima -> there is a big chance that it works out of the box if I haven't done a mistake
• Optima telemetry: how to request the next telemetry frame? Is it the RX deciding to send the frames or the TX? no idea for now...

[z3r0c00l2005]

Awesome. I can take a look at the minima if you like. Is there a dev branch available?

[pascallanger]

I've just made a push on the main repo. Please test and report!

[z3r0c00l2005]

Minima - Bound straight away

Seems to be a delay or a step on the channels, if i move the sticks to full deflection the servos respond in steps rather than a smooth motion

[pascallanger]

Could you edit the hitec_cc2500.ino file and uncomment the line #define HITEC_FORCE_ID ? It will use the ID and freq hopping of the TX I've dumped. Let me know if it improves or not.

[z3r0c00l2005]

That seems to make it much worse

[pascallanger]

Ok I'll see what I can do later this evening.

[pascallanger]

I've been thinking about it on the road... Have you tuned the frequency using option? What you describe could also be due by a bad freq tuning...

[z3r0c00l2005]

Now I will admit I've not tried that since it all bound easily! What sort of values would you suggest trying?

[pascallanger]

Follow the frsky/corona/sfhss freq tuning page: https://github.com/pascallanger/DIY-Multiprotocol-TX-Module/blob/master/docs/Frequency_Tuning.md

[pascallanger]

The freq tuning is module dependant so I can't give you numbers...

[z3r0c00l2005]

Even tuned it doesn't appear to be smooth, although it's certainly closer to being flyable :)

[pascallanger]

Have you retried once tuned with force ID?

[z3r0c00l2005]

with the forced ID ther's around a 2second delay between stick input and control deflection

[pascallanger]

What's strange is the normal mode is the same for both... I'm wondering if there is a specific exchange during bind that I can't see without the RX. Could you enable debug_serial in multiprotocol.ino open the serial monitor and let me know if you see the RX requesting something?

[pascallanger]

Both bind and normal

[z3r0c00l2005]

I can do, would I just upload a new build over serial and leave the TX connected to the PC to see that? (Usually I use a USB upload)

[pascallanger]

Upload using USB, leave the module connected to USB and open the serial monitor from Arduino. You should see the module starting and giving you some information like protocol selected... Note that the module won't start unless you open the serial port with the serial monitor.

No need for ftdi and direct serial connection.