Spread spectrum module

How cool would it be to have a wireless spread spectrum (DSM2/DSMX) module on a Xbee footprint which (also!) can be installed in the long range double shock controller?! That’s were this page is about. To develop this module a few things needs to be done:MLP4DSM

  • Protocol study, or reverse engineering a current transmitter
  • Hardware design
  • Software design

I’m trying to reverse engineer the transmitter MLP4DSM for the Blade 120SR with Spektrum DSMX technology. After opening up the product it was easy to see that there was a seperate TX module (X10EMTX) installed:


The part numbers of the IC’s are covered with some white ink, it isn’t possible to scratch off this ink easily. After some Googling of the pcb number it seems there were pictures available that didn’t had the ink on the parts. These parts are used on the TX module:



The first part is where it’s all about: “WirelessUSB™ LP 2.4 GHz Radio SoC”. The second part is just a 8-bit microcontroller from CIMG_2032ypress. The SoC uses SPI communication. So it would be usefull to log this data with a logic analyser. This should be a job for the “Seleae Logic 4”. First I attached some small wires to the RF chip, this is quite a challenge with the small QFN form factor. But I succeeded 🙂 See the pictures:


It was the first time right, there was immediately a data transfer visible in the application of Saleae! It was not directly obvious which register meant exactly wat, because the datasheet is not really complete in register explanation.

But after some web research, I found this product that contains the CYRF6936 chip: LINK with a better overview of the SPI communication method and registers information.

For example:

Looking into the SPI transaction format it seems the first 2 bits don’t define the address. So if I see for example 0x9D, it means a “write” action to address 0x1D, this register address is explained in the datasheet 🙂 Within the Seleae application (Logic) it’s possible to export all the measured data to a CSV file. This can be of course be imported in Excel. But then there is a huge list (because of the 1MHz clock) of data that doesn’t clearify things more than a visual waveform.

Therefore I wrote a small VBA script that automaticly converts the address bytes to real address information that directly correspondents with the registers in the datasheet of the SoC. Also the corresponding data bytes are filled after the address bytes in seperate columns. To determine the difference between a address byte or data byte it’s possible to look at the timing: between address and data is always less the 9us. And corresponding data bytes is also followed up between 9us.

So it becomes a more readable overview of the sent dataframes. I copied the register table from the datasheet in an Excel workpage and used it as an lookup table. This way the address registers are found in the table and noted. Example data:

The binding procedure:

It seems there is some kind of init period, and afterwards a repeating sequence of messages (not shown in example picture!). After some time, it was obvious which data fields were for the joysticks and buttons, rotating a joystick looks like:


In the meantime (05-08-2017) the first PCB layout is finished, it’s based on an ATmega328p. All the IO’s are pin compatible with the standard Xbee footprint. All analog and digital inputs are emc protected by lowpass filters. The reset pin of the ATmega is connected to the DTR pin via a capacitor, this makes it possible to upload Arduino sketches via the IDE. There is one led available for status feedback.

Now waiting for PCBA products ordered from iTead.cc


The custom spread spectrum module has these features:

  • Power supply via +3.3V
  • 6 analog inputs 0-3.3V (hardware emc filtered)
  • 2 digital inputs (hardware emc filtered)
  • 2 digital outputs
  • 1 led for status feedback
  • Xbee footprint compatible
  • Arduino compatible (bootloader)
  • Arduino sketches can be uploaded via the USB motherboard
  • ISP (in system programming) pins available on edge of the board

To be continued……

One Response to “Spread spectrum module

Geef een reactie

Het e-mailadres wordt niet gepubliceerd. Vereiste velden zijn gemarkeerd met *