FrSky SPort protocol specs

from https://www.ordinoscope.net/static/frsky-arduino/FrskySP/doc/html/index.html

It's a master/slave protocol. The RX sends a poll packet every 12ms (4bytes)

2bytes	description
0x7E	poll header
ID	physical ID (1-28) computed with a CRC

The receiver will poll the IDs in sequence to find which one is present. If only one physical ID is found, the receiver will alternate the sensor polling and the search (present sensor, next ID to search, present sensor, next ID and so on). If more sensors are found, the poll sequence returns almost to a normal search pattern.

Sensor behavior

The sensor answers to every pool on its physical ID to announce its presence. If no data can be transmitted (no refresh), the sensor answers by an empty packet and a false CRC (type 0x00, ID 0x0000, value 0x00000000, CRC 0xFF).

byte(s)	descrption
1	type 0x10,0x30,0x31,0x32
2	sensor logical ID
4	value
1	CRC

Types (from betaflight for MSP over Frsky)

• FSSP_DATA_FRAME = 0x10 (Standard Frsky sensor Frame, OpenTX passes to LUA sensor_logical_ID:0x5000-0x50FF)
• FSSP_MSPC_FRAME_SMARTPORT = 0x30, // MSP client frame
• FSSP_MSPC_FRAME_FPORT = 0x31, // MSP client frame
• FSSP_MSPS_FRAME = 0x32, // MSP server frame (OpenTX passes to LUA sensor_logical_ID:0x0000-0xFFFF)

For full bandwidth 2 way communication with OpenTX, FC has to use sensor logical ID 0x32 because it's the only ID passed to LUA untouched. LUA can use all sensor IDs because the FC has full control on what to read or discard.

Phisycal Sensor ID List

Sensor Ids (from betaflight for MSP over Frsky)

1. FSSP_SENSOR_ID1 = 0x1B,
2. FSSP_SENSOR_ID2 = 0x0D,
3. FSSP_SENSOR_ID3 = 0x34,
4. FSSP_SENSOR_ID4 = 0x67

there are 32 ID's polled by smartport master, remaining 3 bits are crc (according to comments in openTx code)

ID	description
0x00	// Physical ID 1 - Vario2 (altimeter high precision)
0xA1	// Physical ID 2 - FLVSS Lipo sensor (can be sent with one or two cell voltages)
0x22	// Physical ID 3 - FAS-40S current sensor
0x83	// Physical ID 4 - GPS / altimeter (normal precision)
0xE4	// Physical ID 5 - RPM
0x45	// Physical ID 6 - SP2UART(Host)
0xC6	// Physical ID 7 - SPUART(Remote)
0x67	// Physical ID 8 -
0x48	// Physical ID 9 -
0xE9	// Physical ID 10 -
0x6A	// Physical ID 11 -
0xCB	// Physical ID 12 -
0xAC	// Physical ID 13 -
0x0D	// Physical ID 14 -
0x8E	// Physical ID 15 -
0x2F	// Physical ID 16 -
0xD0	// Physical ID 17 -
0x71	// Physical ID 18 -
0xF2	// Physical ID 19 -
0x53	// Physical ID 20 -
0x34	// Physical ID 21 -
0x95	// Physical ID 22 -
0x16	// Physical ID 23 -
0xB7	// Physical ID 24 - IMU ACC (x,y,z)
0x98	// Physical ID 25 -
0x39	// Physical ID 26 - Power Box
0xBA	// Physical ID 27 - Temp
0x1B	// Physical ID 28 - Fuel (ArduPilot/Betaflight)