- Posts: 1016
SYMA X5C-1, X11, X12
31 Dec 2014 10:27 - 31 Dec 2014 10:29 #27374
by Durete
I tried all the existing protocols, and don't work. But I'm very confident the old and the new versions shares a lot of similarities.
Unfortunately the RF chip is masked, like all the Syma toys I have seen, but the encapsulate is the same as Beken 24xx
I will try to capture SPI traces at the old controller when receive my logic analyzer.
Probably, we could fly the old and the new version only including a minor option at the protocol.
BTW, I will capture SPI traces for the camera controls at the X11C, but probably Seby will receive before me
Replied by Durete on topic SYMA X5C-1, X11, X12
Thanks Hexfet!hexfet wrote:
It's possible only the data rate changed, but just as likely it's something different. Have you tried the yd717 protocol and its options? (though I think someone's already tried)Durete wrote: @Hexfet.
Did you see my question about the datarates and Syma protocols?
If it uses one of the supported chips and you can get an spi capture we can take a look
I tried all the existing protocols, and don't work. But I'm very confident the old and the new versions shares a lot of similarities.
Unfortunately the RF chip is masked, like all the Syma toys I have seen, but the encapsulate is the same as Beken 24xx
I will try to capture SPI traces at the old controller when receive my logic analyzer.
Probably, we could fly the old and the new version only including a minor option at the protocol.
BTW, I will capture SPI traces for the camera controls at the X11C, but probably Seby will receive before me
31 Dec 2014 11:17 #27375
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
Just confirmed.
X11,X12,X5C-1 and the new X11C shares protocol
Including camera controls at X5C-1 and X11C.
X11,X12,X5C-1 and the new X11C shares protocol
Including camera controls at X5C-1 and X11C.
31 Dec 2014 13:22 - 31 Dec 2014 13:22 #27377
by SeByDocKy
If you have the X11-C version, and a logic analyser, here are the pinout I used to sniff SPI data
Replied by SeByDocKy on topic SYMA X5C-1, X11, X12
Durete wrote: Just confirmed.
X11,X12,X5C-1 and the new X11C shares protocol
Including camera controls at X5C-1 and X11C.
If you have the X11-C version, and a logic analyser, here are the pinout I used to sniff SPI data
31 Dec 2014 14:57 #27382
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
Thanks Seby!
You saved me a lot of work.
Unfortunately, my logic analyzer and my Syma X11C are on the way.
So if you plain to review the X11C, probably you will receive before me.
I confirmed the protocol of the Syma X11C is the same, because Quadcopter101 upload a video this morning using the X5C-1 transmitter.
You saved me a lot of work.
Unfortunately, my logic analyzer and my Syma X11C are on the way.
So if you plain to review the X11C, probably you will receive before me.
I confirmed the protocol of the Syma X11C is the same, because Quadcopter101 upload a video this morning using the X5C-1 transmitter.
11 Jan 2015 02:05 #27616
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
Don't forget we need Hexfet after I sniffed data 
Mine is the easy part
Mine is the easy part
13 Jan 2015 01:20 #27639
by czajunia
Replied by czajunia on topic SYMA X5C-1, X11, X12
Another post to say thank you for your work guys. Awesome!!!!
Just flashed my 7E. All protocols are there. Now need to wait for the bird to fly to me from China
Cheers.
Just flashed my 7E. All protocols are there. Now need to wait for the bird to fly to me from China
Cheers.
13 Jan 2015 22:33 - 02 Feb 2015 12:05 #27666
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
Hi Folks.
Today, I received my Logic Analyser and tried to capture for first time.
Really, I don't know if I captured ok
This is a capture from the TX of my Syma X5C old version, not the new version X5C-1 under discussion at this thread.
@Hexfet.
Please, could you take a look in the hope the protocol could be very similar to this X11/X12/X5C-1 protocol? As I wrote some days ago, could be Syma only changed the datarate to increase range.
As I wrote previously, I don't know if I captured ok....
Removed SPI Capture
Finishing the capture, I activated the throttle down trim to start video capture, next throttle up to take picture, and finishing I push down throttle trim to stop video capture.
I have not received my X11-C camera version yet.
Thank you very much in advance!
Today, I received my Logic Analyser and tried to capture for first time.
Really, I don't know if I captured ok
This is a capture from the TX of my Syma X5C old version, not the new version X5C-1 under discussion at this thread.
@Hexfet.
Please, could you take a look in the hope the protocol could be very similar to this X11/X12/X5C-1 protocol? As I wrote some days ago, could be Syma only changed the datarate to increase range.
As I wrote previously, I don't know if I captured ok....
Removed SPI Capture
Finishing the capture, I activated the throttle down trim to start video capture, next throttle up to take picture, and finishing I push down throttle trim to stop video capture.
I have not received my X11-C camera version yet.
Thank you very much in advance!
14 Jan 2015 00:30 - 14 Jan 2015 00:33 #27668
by btoschi
Replied by btoschi on topic SYMA X5C-1, X11, X12
I've quickly skimmed over your SPI trace.
Channel order is somehow mixed up (MOSI, CLK, CSN, MISO), but luckily one can easily change that in Logic Software.
Protocol looks similar to V2x2, but is in fact even more close to MJX V2 (which resides only on my harddisc, as its not working yet).
At least that's the case I did not mix up all things here (man, its late
)
Channel hopping sequence of binding perfectly matches MJX V2:
27 1B 39 28 24 22 2E 36 19 21 29 14 1E 12 2D 18 (27 1B ...)
Just for your reference, my MJX V2 code (not working for me, the arduino version at least sometimes transmits data to my X200, deviation port never binds for me).
Channel order is somehow mixed up (MOSI, CLK, CSN, MISO), but luckily one can easily change that in Logic Software.
Protocol looks similar to V2x2, but is in fact even more close to MJX V2 (which resides only on my harddisc, as its not working yet).
At least that's the case I did not mix up all things here (man, its late
)2.39393 1 W_REGISTER(CONFIG) 0C
2.39402 2 W_REGISTER(EN_AA) 00
2.39410 3 W_REGISTER(EN_RXADDR) 3F
2.39418 4 W_REGISTER(SETUP_AW) 03
2.39427 5 W_REGISTER(SETUP_RETR) FF
2.39435 6 W_REGISTER(RF_CH) 08 delta: 2.3943523125
2.39444 7 W_REGISTER(RF_SETUP) 07
2.39452 8 W_REGISTER(STATUS) 70
2.39460 9 W_REGISTER(OBSERVE_TX) 00
2.39469 10 W_REGISTER(CD) 00
2.39477 11 W_REGISTER(RX_ADDR_P2) C3
2.39486 12 W_REGISTER(RX_ADDR_P3) C4
2.39494 13 W_REGISTER(RX_ADDR_P4) C5
2.39502 14 W_REGISTER(RX_ADDR_P5) C6
2.39511 15 W_REGISTER(RX_PW_P0) 10
2.39519 16 W_REGISTER(RX_PW_P1) 10
2.39527 17 W_REGISTER(RX_PW_P2) 10
2.39536 18 W_REGISTER(RX_PW_P3) 10
2.39544 19 W_REGISTER(RX_PW_P4) 10
2.39553 20 W_REGISTER(RX_PW_P5) 10
2.39561 21 W_REGISTER(FIFO_STATUS) 00
2.39569 22 W_REGISTER(RX_ADDR_P0) 6D 6A 73 73 73
2.39591 23 W_REGISTER(RX_ADDR_P1) 6A 6D 37 37 37
2.39614 24 W_REGISTER(TX_ADDR) 6D 6A 73 73 73
2.39644 26 ACTIVATE(53) bank switch to 1
2.39653 27 W_REGISTER(00) 40 4B 01 E2
2.39674 28 W_REGISTER(01) C0 4B 00 00
2.39694 29 W_REGISTER(02) D0 FC 8C 02
2.39715 30 W_REGISTER(03) 99 00 39 21
2.39736 31 W_REGISTER(04) F9 96 82 1B
2.39756 32 W_REGISTER(05) 24 06 7F A6 delta: 0.00320975
2.39777 33 W_REGISTER(06) 00 00 00 00
2.39797 34 W_REGISTER(07) 00 00 00 00
2.39818 35 W_REGISTER(08) 00 00 00 00
2.39839 36 W_REGISTER(09) 00 00 00 00
2.39859 37 W_REGISTER(0A) 00 00 00 00
2.39880 38 W_REGISTER(0B) 00 00 00 00
2.39901 39 W_REGISTER(0C) 00 12 73 00
2.39921 40 W_REGISTER(0D) 46 B4 80 00
2.39941 41 W_REGISTER(0E) 41 10 04 82 20 08 08 F2 7D EF FF
2.39986 42 W_REGISTER(04) FF 96 82 1B
2.40004 43 W_REGISTER(04) F9 96 82 1B
2.45203 45 ACTIVATE(53) bank switch to 0
2.45210 46 FLUSH_TX
2.45225 48 W_REGISTER(STATUS) 0E
2.45232 49 R_REGISTER(CONFIG) 0C
2.45240 50 W_REGISTER(CONFIG) 0C
2.45247 51 W_REGISTER(CONFIG) 0C
2.45255 52 W_REGISTER(CONFIG) 0E
2.45262 53 W_TX_PAYLOAD F9 96 82 1B 20 08 08 F2 7D EF FF 00 00 00 00 00
2.46407 54 W_REGISTER(RF_CH) 27 delta: 0.06651275
2.46416 55 W_TX_PAYLOAD 00 00 00 00 00 00 00 AE A9 00 00 00 00 00 C0 17
2.46597 57 W_REGISTER(STATUS) 2E
2.46606 58 W_REGISTER(RF_CH) 27 delta: 0.0019833125
2.46614 59 W_TX_PAYLOAD 00 00 00 00 00 00 00 AE A9 00 00 00 00 00 C0 17
2.46972 61 W_REGISTER(STATUS) 2E
2.46980 62 W_REGISTER(RF_CH) 1B delta: 0.0037459375 avg: 0.0037459375
2.46989 63 W_TX_PAYLOAD 00 00 00 00 00 00 00 AE A9 00 00 00 00 00 C0 17
...Channel hopping sequence of binding perfectly matches MJX V2:
27 1B 39 28 24 22 2E 36 19 21 29 14 1E 12 2D 18 (27 1B ...)
Just for your reference, my MJX V2 code (not working for me, the arduino version at least sometimes transmits data to my X200, deviation port never binds for me).
14 Jan 2015 02:50 - 14 Jan 2015 17:29 #27669
by hexfet
Replied by hexfet on topic SYMA X5C-1, X11, X12
Interesting. Maybe we can combine this with MJX if they're close enough.
The trace is also interesting. Durete was right about the data rate change. One of the few initialization differences is 1Mbit data rate. They also changed a few other things:
It wasn't too messy to add to the SymaX protocol as a protocol option. I guessed the channel order as being the same as the -1 version. It was difficult to interpret the button controls, but they all seemed to be independent bits. Increase the channels to 8 in the model setup, then each control you pushed first to last will be on channels 5 through 8. If it works, that is
The trace is also interesting. Durete was right about the data rate change. One of the few initialization differences is 1Mbit data rate. They also changed a few other things:
- The data packet is longer at 16 bytes - perhaps error rate is improved with shorter packets in the -1 version.
- The same tx address is used for bind and data phases. Might cause issues flying multiple X5Cs in the same area. The -1 version assigns the data address.
- The X5C version uses more frequencies. Wouldn't that make it take longer to recover if the rx and tx get out of sync?
It wasn't too messy to add to the SymaX protocol as a protocol option. I guessed the channel order as being the same as the -1 version. It was difficult to interpret the button controls, but they all seemed to be independent bits. Increase the channels to 8 in the model setup, then each control you pushed first to last will be on channels 5 through 8. If it works, that is
14 Jan 2015 08:46 - 14 Jan 2015 08:47 #27673
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
Wow guys! 
You impressed me another time
So, my SPI trace capture was ok? If I can make anything to better understand my captures (maybe channel order at the logic Analizer side) feel free to suggest me. Was my first time.
@Hexfet. This evening when I return home from work I will test your DFU. (For me, now is morning )
Thank you guys!
You impressed me another time
So, my SPI trace capture was ok?
If I can make anything to better understand my captures (maybe channel order at the logic Analizer side) feel free to suggest me. Was my first time.@Hexfet. This evening when I return home from work I will test your DFU. (For me, now is morning
)Thank you guys!
14 Jan 2015 17:06 #27678
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
I return with good, and bad news...
The X5C old version Binds with the Devo!
Camera controls works!
Momentary channel 5 active Video record, momentary channel 5 stop video record.
Momentary channel 6 take a photo.
So seems to be channel 7 and 8 are not needed.
And now the bad news...
There is something strange mixing throttle with rudder I can't take off.
As soon I try to take off, the quad try to spin to the left side, like you apply full left rudder
Can't test the other channels because this issue.
The X5C old version Binds with the Devo!
Camera controls works!
Momentary channel 5 active Video record, momentary channel 5 stop video record.
Momentary channel 6 take a photo.
So seems to be channel 7 and 8 are not needed.
And now the bad news...
There is something strange mixing throttle with rudder
I can't take off.As soon I try to take off, the quad try to spin to the left side, like you apply full left rudder
Can't test the other channels because this issue.
14 Jan 2015 17:29 #27679
by hexfet
Replied by hexfet on topic SYMA X5C-1, X11, X12
Good progress! Maybe I guessed wrong on the trim channels. Try the attached version which leaves those bits alone.
Can you get an SPI capture of changing the trims? All the way in one direction, then the other, then back to center for rudder, pitch, and aileron.
Doesn't the X5C have flip and dual-rate controls? Good news on the camera.
Also need to verify the X11/12/5C-1 version still works
Can you get an SPI capture of changing the trims? All the way in one direction, then the other, then back to center for rudder, pitch, and aileron.
Doesn't the X5C have flip and dual-rate controls? Good news on the camera.
Also need to verify the X11/12/5C-1 version still works
14 Jan 2015 18:24 #27681
by Durete
Replied by Durete on topic SYMA X5C-1, X11, X12
Wow Great!
The strange mixing disappear!
Now the issue is Channel 2 and 4 are interchanged. So when I use the rudder, the quad pitch. When I pitch the quad yaw.
About the dual rates and flips, sorry I forget about it
Yes, the transmitter have shoulder button for flips, and another for change between low and high rates. Maybe I didn't capture this buttons... don't remember.
I can try channels 7 and 8 to these functions when we solve the issue with channels 2 and 4.
About the protocol for X11,X12, and X5C-1, don't worry, continues working without problem with the suboption disabled inside the SymaX protocol.
Good job Hexfet !!!
Do you need any other SPI trace capture? I can capture, but probably not today...
If you need it, I will try to do as soon as possible.
The strange mixing disappear!
Now the issue is Channel 2 and 4 are interchanged. So when I use the rudder, the quad pitch. When I pitch the quad yaw.
About the dual rates and flips, sorry I forget about it
Yes, the transmitter have shoulder button for flips, and another for change between low and high rates. Maybe I didn't capture this buttons... don't remember.
I can try channels 7 and 8 to these functions when we solve the issue with channels 2 and 4.
About the protocol for X11,X12, and X5C-1, don't worry, continues working without problem with the suboption disabled inside the SymaX protocol.
Good job Hexfet !!!
Do you need any other SPI trace capture? I can capture, but probably not today...
If you need it, I will try to do as soon as possible.
Time to create page: 0.380 seconds
-
Home
-
Forum
-
Development
-
Protocol Development
- SYMA X5C-1, X11, X12