Evaluate Team Associated iFHSS (XP2-SSI) protocol/board

[pwkpete]

Pascal,

Per the other portion of discussion on RCG - a couple of us were looking to see if the Team Associated protocol could be reverse engineered based on what you see here (and or additional signal dumps if needed)

This is a single model control with bind button, no display, 2 channel with 4 pot's for EPA/trim adjustments

[pascallanger]

Yes it might be possible to do since the hw is compatible with multi.
You need to connect the logic analyzer on the spi bus of the cyrf6936

[pwkpete]

Ok, I can find

MOSI
MISO
CLK
Ground

I don't see CSN on the chip? Is that SS?

[pascallanger]

Yes SS sounds good

[pwkpete]

On the other side of the board there is a somewhat convenient debug header, but it would appear SS is not connected. I have MOSI, MISO, CLK, GND - not sure what value this would be without SS, unless SS is not what we are looking for?

From the data sheet (https://media.digikey.com/pdf/Data%20Sheets/Cypress%20PDFs/CYRF6936.pdf):

If I'm looking at the board correctly, the signals on that header have pull up resistors on them (seen from other side - 1st picture)
Pin 1 - GND
Pin 2 - ???
Pin 3 - MOSI
Pin 4 - CLK
Pin 5 - PWR
Pin 6 - MISO

[pascallanger]

SS is really the signal we need.
I'm not in front of my PC so I can't help you following the traces

[pwkpete]

No worries, I can solder to pick up ss, but not sure why there would be a header like this without that signal.. hmm Will run scans tonight or tomorrow

…

On Sat, Feb 10, 2024, 3:08 PM pascallanger ***@***.***> wrote: SS is really the signal we need. I'm not in front of my PC so I can't help you following the traces — Reply to this email directly, view it on GitHub <#943 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD36JT5OZ4AKAQJ4NI6XOK3YS7OURAVCNFSM6AAAAABDCDEQYGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSMZXGE2DQNRWHE> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[pascallanger]

The SPI bus can be shared with other components. This is where you need that chip select signal. May be they have something else they can connect like a screen on another version of the TX.

[pwkpete]

Gotcha.

Let me know if this looks sane, I'll grab other scans if so.

Power On.zip IFHSS-

There is also a dip switch bank with channel 1/2 reverse as well as one for IFHSS in UP position and IFHSS+ in down position

My model is bound with the + position and did not connect when in -

[pwkpete]

TX and RX connect.zip
Power on - IFHSS+.zip

[M-i-c-h-a-e-l1]

Hello,

I had a look at two of my Team Associated radios. The first is the XP3-SS iFHSS radio from the SC8e RTR:

The electronics seem to be different than those of XP2-SSI:

Close-up:

The board mentions 'Thunder Tiger' as manufacturer.

The second radio is the XP120 from the MT10 Rival RTR:

Close-up of the board:

I am not sure if these two radios use the same protocol as the processors seem to be different.

Kind regards
Michael

[pwkpete]

I suspect the 2 and the 3 are compatible, both Cypress chips and a quick glance, the SPI signals look similar.

IIRC I saw receivers for the two listed somewhere as compatible

The 120 looks like something else, you ever try swapping them?

[M-i-c-h-a-e-l1]

What are the priorities with the implementation? The older iFHSS protocol or the newer protocol for the 1/28 scale cars?

Kind regards
Michael

[pascallanger]

I would say in whatever order the people give me things to work on. Might be dumps, send me the TX+RX or donate some money so I can purchase locally.
And obviously as my time permit!!

[pwkpete]

Was the last data file I uploaded any value? If there is something you want me to test now, I can do that over the weekend

…

On Thu, Feb 22, 2024, 12:43 PM pascallanger ***@***.***> wrote: I would say in whatever order the people give me things to work on. Might be dumps, send me the TX+RX or donate some money so I can purchase locally. — Reply to this email directly, view it on GitHub <#943 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD36JTZY5HJDFRFFAIG637TYU6GUDAVCNFSM6AAAAABDCDEQYGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNRQGA2DIOJXGY> . You are receiving this because you authored the thread.Message ID: ***@***.*** com>

[pascallanger]

@pwkpete I haven't looked at it yet... I'm looking at eazyrc right now which came in before your dumps.

[pwkpete]

I still have the tx wired up, so if there are any further tests needed, I can run them.

…

On Fri, Feb 23, 2024, 8:37 AM M-i-c-h-a-e-l1 ***@***.***> wrote: Tested the following on my desk: Radio: - Radiomaster Zorro - edgeTX 2.8.0 - MM firmware 1.3.4.00 Receivers: - Air: Multiplex RX7 with telemetry: -> *ok* - Air: Frsky X8R -> *ok* (settings: FrSky X2 LBT EU) - Air: Flysky FS-iA6B with telemetry: -> *ok* - Surface: Spektrum SR3100 clone: -> *ok* (settings: DSM2, subtype 2 2F, servo 11ms) - Surface: Reely BS-4 (=Flysky FS-BS4) with telemetry: -> *ok* (not using channel 1 as this is for the built-in gyro) - Surface: Traxxas 6533B: protocol not supported - Surface: Team Associated iFHSS: protocol not (yet) supported Kind regards Michael — Reply to this email directly, view it on GitHub <#943 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD36JTYBPZQCBK6JVFO2OPTYVCSUPAVCNFSM6AAAAABDCDEQYGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSNRRGQ2DQNZSGI> . You are receiving this because you were mentioned.Message ID: ***@***.*** com>

[pwkpete]

Sorry, didn't see your reply - no worries at all. I'm ready whenever you are, just happy to have been successful with one so far!

[pascallanger]

This protocol is going to be hard work. With only one TX we won't be able to implement different IDs unless you can connect the logic analyzer to the RX too.
Is there a bind button on the TX? What's the bind procedure?
You need to do multiple dumps like we did before for each sticks, buttons and failsafe.

[pwkpete]

I can do the multiple dumps as well, just wanted to make sure the ones I uploaded looked good before going further.

I have not opened an RX so not sure how difficult that would be, however, I do happen to have a 2nd TX, if that will help...

[pascallanger]

The second TX will definitively help but I don't think it will give us the full picture.
The TX is using a large table of 48 frequencies, finding how it's generated is going to be extremely difficult if not impossible... That will limit the number of IDs. Also the SOP and DATA codes could be dependent of the ID.
There are also some packets which are different from the others which is why I would like to know the binding procedure, if there is failsafe from the radio or all other settings the radio can have.

[pwkpete]

Sorry, forgot to answer your bind question - there is a bind button on the TX as well as the RX

Seems no failsafe - just dumb TX with POTs for EPA/trim and DIP switches for reverse

[pascallanger]

Sorry, forgot to answer your bind question - there is a bind button on the TX as well as the RX

So I need a capture of the bind at power on.

[M-i-c-h-a-e-l1]

@pwkpete

Could you post a photo on how you connected the radio to the analyser?

Kind regards
Michael

[pwkpete]

I just used the header in the above picture and then used one of the holes to get SS. I listed the pinouts above

Here are 2 bind captures one with IFHSS and IFHSS+

Power +bind.zip

Let me know then if you need captures for each IFHSS setting

[pwkpete]

@pascallanger

Did the IFHSS setting make any difference in the scans? Do I need to run tests with each setting?

[pwkpete]

@pascallanger

Were you able to determine if this was feasible from my last upload? If not, I can disconnect the logic probe. LMK

Thanks!