Custom DSMX Module

How cool would it be to have a wireless DSM2/DSMX module on a Xbee footprint which can be installed in the long range double shock controller?! That’s were this page is about. To develop this module a few things needs to be done:MLP4DSM

  • Protocol study, or reverse engineering a current transmitter
  • Hardware design
  • Software design

I’m starting reverse engineering the transmitter MLP4DSM for the Blade 120SR with Spektrum DSMX technology. After opening up the product it was easy to see that there was a seperate TX module (X10EMTX) installed:


The part numbers of the IC’s are covered with some white ink, it isn’t possible to scratch off this ink easily. After some Googling of the pcb number it seems there were pictures available that didn’t had the ink on the parts. These parts are used on the TX module:



The first part is where it’s all about: “WirelessUSB™ LP 2.4 GHz Radio SoC”. The second part is just a 8-bit microcontroller from CIMG_2032ypress. The SoC uses SPI communication. So it would be usefull to log this data with a logic analyser. This should be a job for the “Seleae Logic 4”. First I attached some small wires to the RF chip, this is quite a challenge with the small QFN form factor. But I succeeded 🙂 See the pictures:


It was the first time right, there was immediately a data transfer visible in the application of Saleae! It was not directly obvious which register meant exactly wat, because the datasheet is not really complete in register explanation.

But after some searching on the web, I found this product that contains the CYRF6936 chip: LINK with a better overview of the SPI communication method and registers information.

For example:

SPI_FormatLooking to the SPI transaction format it seems the first 2 bits don’t define the address. So if I see for example 0x9D, it means a “write” action to address 0x1D, this register address is explained in the datasheet 🙂 Within the Seleae application (Logic) it’s possible to export all the measured data to a CSV file. This can be of course be imported in Excel. But then there is a huge list (because of the 1MHz clock) of data that doesn’t clearify things more than a visual waveform.

LogicTherefore I wrote a small VBA script that automaticly converts the address bytes to real address information that directly correspondents with the registers in the datasheet of the SoC. Also the corresponding data bytes are filled after the address bytes in seperate columns. To determine the difference between a address byte or data byte it’s possible to look at the timing: between address and data is always less the 9us. And corresponding data bytes is also followed up between 9us.

So it becomes a more readable overview of the sent dataframes. I copied the register table from the datasheet in an Excel workpage and used it as an lookup table. This way the address registers are found in the table and noted. Example data:

The binding procedure:

It seems there is some kind of init period, and afterwards a repeating sequence of messages (not shown in example picture!). After some time, it was obvious which data fields were for the joysticks and buttons, rotating a joystick looks like:


In the meantime (27-09-2016) the first PCB layout is finished:

3dmodelv1_topview 3dmodelv1_bottomview

Yeah, the first samples arrived (06-10-2016):




To be continued……

Geef een reactie

Het e-mailadres wordt niet gepubliceerd. Verplichte velden zijn gemarkeerd met *