Mjx Bugs 3

More
17 Nov 2017 07:31 #65920 by SeByDocKy
Replied by SeByDocKy on topic Mjx Bugs 3
It will be great if telemetry and the Bug6 variant can be done too :)

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 09:44 #65921 by Moeder
Replied by Moeder on topic Mjx Bugs 3
Let's see what we can do :)

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 16:34 - 17 Nov 2017 16:35 #65937 by Moeder
Replied by Moeder on topic Mjx Bugs 3
There is still something wrong with the bind capture. It cannot be decoded in Logic
Last edit: 17 Nov 2017 16:35 by Moeder.

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 16:41 #65940 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Is it something I'm doing wrong?How can I troubleshoot it?

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 17:07 #65944 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Check this 1 out see if anything changed.
drive.google.com/file/d/1fcPGeU3RqH9g-mD...eD9/view?usp=sharing

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 17:31 #65946 by Moeder
Replied by Moeder on topic Mjx Bugs 3
The last capture is fine, but I still can't seem to find a bind sequence. After setting up the module the TX right away starts sending the data packets with channel values...

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 17:42 #65948 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
The transmitter is on and the battery is then plugged into quad the transmitter makes one beep indicating bind but I have to engage the motors by a tap of a button and disengage by holding button down.I'll try a couple of more captures.I also start the sample recording before I start the process to capture everything.I'll try to plug the quad up first then the transmitter.

Please Log in or Create an account to join the conversation.

More
17 Nov 2017 17:52 #65949 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Here's a couple of captures off and on binding.
drive.google.com/file/d/1eI2oV-h1MpEMVI8...C5H/view?usp=sharing

Please Log in or Create an account to join the conversation.

More
25 Nov 2017 11:27 #66159 by Moeder
Replied by Moeder on topic Mjx Bugs 3
Again starting with channel data right away. Is there a bind sequence you had to go through when first binding it? Maybe make a bind sequence capture without the quad plugged in

Please Log in or Create an account to join the conversation.

More
26 Nov 2017 01:26 - 26 Nov 2017 01:27 #66169 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Sorry for the delay just got off work not to long ago,I greatly appreciate your time on behalf of all who desperately want this deviated Moeder.I took these captures I am almost certain these are good.I was just cutting the quad on and letting it bind to the tx,never went into the initial bind sequence on the previous captures.The light blinks on the tx and stops after about 25 seconds,I recorded the entire 25 seconds.The quad wasn't on for that capture but the rx and tx sequence were captured in the other capture,thanks again.
drive.google.com/file/d/17qH1GOj55-XqyB8...8PG/view?usp=sharing
drive.google.com/file/d/1h3SaVgoCTj_hgKT...MVv/view?usp=sharing
Last edit: 26 Nov 2017 01:27 by C0ckpitvue 777. Reason: error

Please Log in or Create an account to join the conversation.

More
27 Nov 2017 22:57 #66217 by Moeder
Replied by Moeder on topic Mjx Bugs 3
first one is still starting with data...I wonder if they do binding different due to it being a bidirectional protocol. Second capture can't be downloaded, the file is private

Please Log in or Create an account to join the conversation.

More
28 Nov 2017 07:04 #66226 by SeByDocKy
Replied by SeByDocKy on topic Mjx Bugs 3
Stupid question, but was the Bug3 bind procedure proceed before to capture data ? (as far I remember with this one, you have press & hold the red button while turning the radio and then the quad .... something like this)

Please Log in or Create an account to join the conversation.

More
28 Nov 2017 10:06 #66228 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Yep and the tx light starts flashing green like it's searching for the quad.I did that and tried other things also.

Please Log in or Create an account to join the conversation.

More
29 Nov 2017 16:24 #66259 by FlyBuy66
Replied by FlyBuy66 on topic Mjx Bugs 3
I'm also interested in binding my Bugs 3 to my own transmitter. I don't know if this will help but because of the A7105 chip, I thought it might help


The information below may be somewhat out of date. The most recent information on this protocol can be found in the doc directory of the Deviation firmware project:
bitbucket.org/PhracturedBlue/deviation/src

While I probably won't pursue this much further at this point, I thought I'd document what I've found out so far in case anyone ever comes looking for it.
Updated 2012-07-01
I've been playing with a V911 transmitter which contains the A7105 FSK Tx/Rx chip. This transmitter uses 3-wire SPI to send data which makes it easy to look at.
The V911 is compatible with the Turnigy 9X/FlySky FS-TH9X, though it is only a 4-channel heli.

Initial analysis shows that all channel data is sent in 22-byte frames every ~1.5ms

The data in the frame is apparently not encrypted, and each channel is sent as a 16bit little-endian word.

The A7105 Data sheet can be found here:

After power-on, the following steps are initiated:
1) A7105 is reset send (0x00, 0x00)
2) Send 32bit address to address 0x06: 0x5475c52a
3) Program the A7105 control registers as follows:
Code:
Code:
0x00: --, 42, 00, 14, 00, --, --, 00, 00, 00, 00, 01, 21, 05, 00, 50
0x10: 9e, 4b, 00, 02, 16, 2b, 12, 00, 62, 80, 80, 00, 0a, 32, c3, 0f
0x20: 13, c3, 00, --, 00, 00, 3b, 00, 17, 47, 80, 03, 01, 45, 18, 00
0x30: 01, 0f, --
4) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
5) Write '1' to address 0x02 to start the IF Filter Bank calibration
6) Poll address 0x02 until it returns '0' indicating calibration is complete
7) Read IF calibration info from Address 0x22
8) Write VCO Current calibration to 0x24 (value = 0x13)
9) Write VCO Bank calibration limits to 0x26 (value = 0x3b)
10) Write channel to Address 0x0f (value = 0x00)
11) Write '2' to address 0x02 to start VCO bank Calibration
12) Poll address 0x02 until it returns '0' indicating calibration is complete
13) Read VCO calibration from Address 0x25 (test for success?)
14) Write channel to Address 0x0f (value = 0xa0)
15) Write '2' to Address 0x02 to start VCO bank Calibration
16) Poll address 0x02 until it returns '0' indicating calibration is complete
17) Read VCO calibration from Address 0x25 (test for success?)
18) Write manual VCO Bank calibration to Address 0x25 (value = 0x08) ???
19) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
20) Start sending frames as follows

Frames are sent each 1.46ms. Each frame consists of sending a 'FIFO Write Pointer Reset' (Strobe = 0xe0), 22 bytes of data, setting the channel (via the 0x0f register) and then sending 'TX mode' (Strobe = 0x0d) to actually initiate the transfer

The frame data is not encrypted, and is 16-bit little endian. the data appears to be as follows.
Fo each channel the minimum value I observed was ~ 0x03e8 and the maximum was ~ 0x07ca.

Code:
TX1 TX2
word 1: 0xaa05/0x5505
word 2: 0x01f3 0x0002
word 3: 0x2000 0x7000
word 4: aileron (ch1)
word 5: elevator (ch2)
word 6: throttle (ch3)
word 7: rudder (ch4)
word 8: 0x02c3 0xedfc
word 9: 0x02ed 0x02eb
word 10: see below
word 11: 0x0000
Word 1 is 0xaa05 until 3 seconds have elapsed and the throttle has been brought to its minimum value. It then changes to 0x5505 at the same time that the Tx starts cycling between channels

Word 2 and 3 are apparently the Transmitter's Unique ID (thanks zeza from RCGroups)
word 8 and 9 are likely to be channels 5 and 6

Word 10 seems to continuously cycle between 10 states (changing state every frame):
State 1 : 0x100, 0x200, or 0x300 (almost always 0x200)
State 2 : 0x23 or 0x24 (almost always 0x24)
State 3 : 0x32
State 4 - 10: 0xffe or 0xfff

The Tx channel will be 01 until initialization is done and the throttle is brought to 0. At ~ 3 seconds, data is transmitted on multiple channels. Channel ordering is dependent on Transmitter?
Tx2: 0a, 5a, 50, a0, 14, 64, 46, 96, 1e, 6e, 3c, 8c, 28, 78, 32, 82
Tx1: 79, 29, 6f, 1f, 83, 33, 65, 25, 8d, 3d, 5b, 0b, 97, 47, 51, 01

Also, there is still work to do to determine how the Bank Calibration data is used

Please Log in or Create an account to join the conversation.

More
29 Nov 2017 18:38 #66263 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Thank you for the valid information as I'm in very novice stages with all this I hope a seasoned guru can interpret this all.I also found out that there are different versions and revisions of the bugs 3.I'm using the first generation board,the only distinguishing characteristics from the other revisions that I have detected is the original bugs 3 board is green and has the #5 in a round white circle on the board of the quad.There are multiple protocols to this model.

Please Log in or Create an account to join the conversation.

More
29 Nov 2017 20:08 - 29 Nov 2017 20:28 #66265 by Moeder
Replied by Moeder on topic Mjx Bugs 3
Well, I still don't see how binding is done, maybe goebish or hexfet can figure it out. I'm just writing down what I have so I can safely delete my notes and forget about this protocol ;)
Bidirectional protocol, after every TX channel is changed -2 for RX; TX channel changes every 2 packets transmitted
Hopping patterns noticed (TX, add -2 for every RX channel between two TX channels), dependent on transmitter ID:
ID 0x56926d94: 0x25, 0x0a, 0x57, 0x27, 0x4b, 0x1c, 0x63 
ID 0xac59a453: 0x1d, 0x3b, 0x4d, 0x29, 0x11, 0x2d, 0x63

Packet layout:
packet 0 and 4 change +/- 0x40 every packet, one is probably a checksum
packet 1, 2 and 3 unknown (id?)
packet 5: flags (arm/disarm (0x60 [disarmed] 0x20 [armed], 0x00 ?), photo 0x01, light 0x80)
packet 6: aileron (min 0x00 max 0xc8)
packet 7: elevator (min 0x00 max 0xc8)
packet 8: throttle (min 0x00 max 0xc8)
packet 9: rudder (min 0x00 max 0xc8)
packet 10: 0x64
packet 11: 0x64
packet 12: 0x64
packet 13: 0x64
packet 14: ? (three states seen: 0x04, 0x0c and 0x00)
packet 15: 0x00
packet 16: trim aileron (min 0x0e, mid 0x40, max 0x72)
packet 17: trim elevator (min 0x0e, mid 0x40, max 0x72)
packet 18: trim throttle (min 0x0e, mid 0x40, max 0x72)
packet 19: trim rudder (min 0x0e, mid 0x40, max 0x72)
packet 20: 0x00
packet 21: 0x00
Last edit: 29 Nov 2017 20:28 by Moeder. Reason: updated protocol notes

Please Log in or Create an account to join the conversation.

More
29 Nov 2017 20:10 #66266 by goebish
Replied by goebish on topic Mjx Bugs 3
I'm not the only one to use the forum as a notepad ;)

Please Log in or Create an account to join the conversation.

More
29 Nov 2017 20:30 #66267 by Moeder
Replied by Moeder on topic Mjx Bugs 3
Nope, I even update my forum notepad (see above ;)
I guess there's enough info to build a simple protocol for user cockpitvue777, but without a grasp of the binding there is not much sense to it, I'd say.

Please Log in or Create an account to join the conversation.

More
29 Nov 2017 21:29 #66270 by C0ckpitvue 777
Replied by C0ckpitvue 777 on topic Mjx Bugs 3
Thanks for the attempt and help it's definitely appreciated.I took every conceivable capture trying to get the bind sequence.I did it according to the manual.Here is the procedure.
drive.google.com/file/d/1Vl2ipnJ0riV9kns...Hod/view?usp=sharing

Please Log in or Create an account to join the conversation.

Time to create page: 0.090 seconds
Powered by Kunena Forum