JD 395 cx-10

More
15 Mar 2015 06:09 #29721 by victzh
Replied by victzh on topic JD 395 cx-10
It's useful to have it in case we'll figure out what's the difference and just to document the protocol.

Please Log in or Create an account to join the conversation.

More
17 Mar 2015 21:55 #29790 by victzh
Replied by victzh on topic JD 395 cx-10
It is very strange. I checked the XN297 datasheet www.foxware-cn.com/UploadFile/20140808155134.pdf and though I can't read Chinese the register names are in English and all these new registers are DEMOD_CAL (0x19), RF_CAL (0x1e), and BB_CAL (0x1f) with predefined values that should be loaded:

DEMOD_CAL 0x03 0xA7 0x00 0xDF 0x0B
RF_CAL 0x95 0x2B 0x83 0x61 0xB0 0x9A 0xCA
BB_CAL 0x20 0x9C 0x67 0x84 0x7F

compare it with what happens in CX-10

DEMOD_CAL 0x03 0xA7 0xc4 0xDF 0x0B
RF_CAL 0x9C 0xAB 0xBB 0x61 0xB0 0x9A 0xC9
BB_CAL 0x20 0x9C 0x67 0x84 0x4C

These small differences can lead to frequencies slightly shifted, modulation parameters changed, and I don't know what can happen to baseband!

Almost no hope to control it with nRF24L01+. Beken on the other hand probably could be tuned if they'd be a bit more open on their "register bank 1".

As an experiment, can some happy owner of XN297 and working PPM module try and load stock parameters from datasheet and check whether it can control the heli in that state or not?

Please Log in or Create an account to join the conversation.

More
17 Mar 2015 22:00 - 17 Mar 2015 22:45 #29791 by goebish
Replied by goebish on topic JD 395 cx-10

victzh wrote: As an experiment, can some happy owner of XN297 and working PPM module try and load stock parameters from datasheet and check whether it can control the heli in that state or not?


Doesn't work, aircraft doesn't bind with default BB_CAL, RF_CAL and DEMOD register values on the transmitter.

I also tried to have the xn297 to communicate with a nrf24l01+ this way, but it didn't work. Also tried to disable CRC, listen on other channel #, but no luck...
Last edit: 17 Mar 2015 22:45 by goebish.

Please Log in or Create an account to join the conversation.

More
17 Mar 2015 22:39 - 17 Mar 2015 22:45 #29793 by goebish
Replied by goebish on topic JD 395 cx-10
edit: I made a mistake with my test, in fact the CX-10 works even if we leave those 3 registers in their default state.
Last edit: 17 Mar 2015 22:45 by goebish.

Please Log in or Create an account to join the conversation.

More
17 Mar 2015 22:46 #29795 by goebish
Replied by goebish on topic JD 395 cx-10
no, it definitively doesn't work with default register states, I thought it worked but that was only because I didn't reset the xn297 between each arduino firmwares tests :p

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 00:01 #29798 by PhracturedBlue
Replied by PhracturedBlue on topic JD 395 cx-10
can you see whether each of the differences above work indivdually, or are all 3 needed? i.e. is one of those the critical factor in connecting?

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 00:09 - 18 Mar 2015 01:56 #29799 by goebish
Replied by goebish on topic JD 395 cx-10
I confirm all altered parameters are required, it doesn't work anymore if I leave any of them in its default state.
Last edit: 18 Mar 2015 01:56 by goebish.

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 01:13 #29802 by victzh
Replied by victzh on topic JD 395 cx-10
Thanks @goebish, it clarifies the situation.

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 01:40 - 18 Mar 2015 01:42 #29804 by goebish
Replied by goebish on topic JD 395 cx-10
Let me know if you're thinking of other tests I could conduct, I'm running out of ideas.

Oh well, at least we can make PPM modules after a bit of butchery, that's better than nothing.

I might get a newer "CX-10A", I guess it's using yet another protocol to play with :)
Last edit: 18 Mar 2015 01:42 by goebish.

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 02:46 #29805 by hexfet
Replied by hexfet on topic JD 395 cx-10
Are you able to read the registers? If so, after power-up do they match the default values in the data sheet?

The datasheet describes them as "debug registers".

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 03:13 - 18 Mar 2015 03:19 #29806 by goebish
Replied by goebish on topic JD 395 cx-10
They're not exactly the same than stated in the datasheet:
(RF_CAL is completely different)
0x1F BB_CAL: 20 9C 28 44 27 
0x1E RF_CAL: AA AA 49 7F 59 4C 0D 
0x19 DEMOD_CAL: 03 A7 20 BD 0B
Last edit: 18 Mar 2015 03:19 by goebish.

Please Log in or Create an account to join the conversation.

More
18 Mar 2015 11:48 - 18 Mar 2015 12:02 #29822 by goebish
Replied by goebish on topic JD 395 cx-10
Just made another test:

As I noticed the values of the registers were not what they were supposed to be at startup, I tried to set the values as in the datasheet instead of what we found in the capture... and it works, I can control the copter.

Also, it looks like register 0x1E holds a value in the nrf24l01+ (05 2B 80 00 ? not the same length than same register in xn297...), attempting to read registers 0x19 and 0x1F on the nrf24l01+ just returns a bunch of 00s.
Last edit: 18 Mar 2015 12:02 by goebish.

Please Log in or Create an account to join the conversation.

More
29 Mar 2015 18:24 - 29 Mar 2015 18:26 #30408 by victzh
Replied by victzh on topic JD 395 cx-10
I've got very strange results comparing original CX-10 (green board) TX and my own code (assembled from different sources - hexfet's Deviation module and couple of Arduino PPM modules).

CX-10 bounds on channel 2, which translates to channel frequency 2402MHz. I have HackRF Jawbreaker SDR with which I captured the signal.

CX-10 TX transmits a packet every 1.5ms with center frequency 2402MHz and width approximately 1.2MHz at -30dB which seems to be normal for 1Mbps.

My code uses nRF24L01+ and transmits packets with center frequency 2402.2MHz! and probably slightly wider in bandwidth.

I checked the available literature and it never mentions this 200KHz deviation.

I am not so sure about calibration of HackRF, it can be other way around- nRF24L0+ transmits on 2402MHz, and XN297 on 2401.8MHz, but other than this it's very clear difference in center frequency of 200KHz.

At 1Mbps it can easily be the reason of incompatibility of these chips, and without knowledge about "debug" registers of nRF we will not be able to compensate for it.

It would be great if someone with more precise instruments can confirm this.
Last edit: 29 Mar 2015 18:26 by victzh.

Please Log in or Create an account to join the conversation.

More
29 Mar 2015 21:37 - 29 Mar 2015 21:46 #30419 by SeByDocKy
Replied by SeByDocKy on topic JD 395 cx-10

victzh wrote: I've got very strange results comparing original CX-10 (green board) TX and my own code (assembled from different sources - hexfet's Deviation module and couple of Arduino PPM modules).

CX-10 bounds on channel 2, which translates to channel frequency 2402MHz. I have HackRF Jawbreaker SDR with which I captured the signal.

CX-10 TX transmits a packet every 1.5ms with center frequency 2402MHz and width approximately 1.2MHz at -30dB which seems to be normal for 1Mbps.

My code uses nRF24L01+ and transmits packets with center frequency 2402.2MHz! and probably slightly wider in bandwidth.

EDIT : in the section 5.2 of the nRF24L01+ documention, you hade DeltaF_1M = 160Khz of deviation.... Can be set ? somewhere ?

I checked the available literature and it never mentions this 200KHz deviation.

I am not so sure about calibration of HackRF, it can be other way around- nRF24L0+ transmits on 2402MHz, and XN297 on 2401.8MHz, but other than this it's very clear difference in center frequency of 200KHz.

At 1Mbps it can easily be the reason of incompatibility of these chips, and without knowledge about "debug" registers of nRF we will not be able to compensate for it.

It would be great if someone with more precise instruments can confirm this.


Damned for 200Khz versus 2402Mhz so a deviation of 1/1000 is enough to desynchronize everything :( ....

Look section 5.2 of the nRF24L01 documention .... Devation at 1Mbits is 160Khz ....
Last edit: 29 Mar 2015 21:46 by SeByDocKy.

Please Log in or Create an account to join the conversation.

More
29 Mar 2015 22:24 #30421 by victzh
Replied by victzh on topic JD 395 cx-10
That frequency deviation is a bit different - it means how much the central frequency varies to signify 0 or 1. So say with central frequency 2402MHz 0 would be marked by emitting 2401.84MHz and 1 by emitting 2402.16MHz. There is no mention in documentation that the frequency can be systematically shifted by 200KHz.

On the other hand 200KHz is 83ppm deviation at 2.4GHz. It means shitty crystal, but for module for $3-5 bucks they can easily use 100ppm crystal.

My other experiment with Beken 2421 module is even more puzzling - it holds frequency correctly, but no binding happens.

Please Log in or Create an account to join the conversation.

More
06 Apr 2015 21:14 #30851 by victzh
Replied by victzh on topic JD 395 cx-10
All of it does not matter ;-)

I finally demodulated the binding packets using an excellent HackRF Jawbreaker and Gnu Radio. I used www.inguardians.com/pubs/GRC_signal_analysis_InGuardians_v1.pdf as a guide.

The results are the following: if I use my own code and both nRF24L01 and Beken 2421 I can successfully demodulate the signal and can see preamble (0xAA), the address (five 0xCC bytes), and following packet bytes.

If I try to demodulate XN297 I can see some demodulated signal which coincides with the radio signal but have no such well defined structure - I can't see the preamble and address - just some bytes arbitrarily appearing.

I will look at it more - I have an impression that it is passed through some scrambler. It is untypical to do so - usually only the contents of the packet is scrambled and preamble and address are as is.

Please Log in or Create an account to join the conversation.

More
12 Apr 2015 16:44 #31107 by goebish
Replied by goebish on topic JD 395 cx-10
I'd really like to go into that someday... I had a look at the HackRFs, what's the difference between the One and the JawBreaker ?
Is the Jawbreaker, the "beta" version of the one, I'm confused ?

Meanwhile, I reversed yet another XN297 protocol, for the Eachine 3D X4:
gist.github.com/goebish/6095bb2d95037297641d

Please Log in or Create an account to join the conversation.

More
12 Apr 2015 17:51 #31109 by victzh
Replied by victzh on topic JD 395 cx-10
The difference is minimal - One is a production version, with components moved around, RF cage is designed in (not populated), RF cleaned up a bit, no 900MHz antenna on board (which you needed to isolate by desoldering a bridge anyways), plastic case, reset button, LEDs in a convenient place, extension pinout.

Jawbreaker is the last beta - fully functional, but less convenient. It lives in an antistatic bag and I get it out of it and put on antenna and USB every time I need to use it. On the other hand, I've got it for free as a part of the beta program - who am I to complain ;-)

I was not very lucky with XN297 so far - I soldered to CX-10 green TX and tried to isolate the MCU so that I can use it with my own code but keep an ability to switch back to the native code to keep the baseline for comparison. This approach fails - the other elements on the TX board feed MCU enough to interfere with my code.

I ordered another CX-10 - and got a red version! So, I'm waiting for Eachine H7 which is guaranteed to have XN297 in it in a detachable form.

Next I plan to first make my code work with CX-10 green and Eachine's XN297 and make a comparison RF traces of biding sequence with XN297, Beken, and Nordic. CX-10 binding is luckily uses one RF channel so it's easy to catch. I can publish these traces for analysis - just set up GNU radio and you can read it from file. You don't need HackRF or any other SDR for this.

Please Log in or Create an account to join the conversation.

More
12 Apr 2015 18:16 #31111 by goebish
Replied by goebish on topic JD 395 cx-10
Thanks for those informations, I'm totally new to that, I've never played with GNU radio or anything SDR related (yet ;))

Please Log in or Create an account to join the conversation.

More
12 Apr 2015 21:55 #31115 by Daryoon
Replied by Daryoon on topic JD 395 cx-10
CX10 would be the holy grail for me as I have one of those. So surprise it still hasn't been deviated yet. LOL

Always appreciate you guys developing and continuing to push Deviation forward.

Please Log in or Create an account to join the conversation.

Time to create page: 0.088 seconds
Powered by Kunena Forum