Traxxas TQ gen 1

[RobertoD91]

Hi, I have an old Traxxas 2228 TX and a 2217 RX.

From this https://traxxas.com/support/Traxxas-TQi-Compatibility-Guide , I understood that it is different from the already implemented Traxxas TQ; indeed, the 2217 receiver doesn't bind to my multi-module (version 1.3.4.0).

I disassembled the radio:

I assume this is the real transmitter, right?

So, should I sniff this connection?

This is the back of the PCB, for reference:

Any suggestion?

[Pencilvestr]

I'd desolder that RF lid and grab some pictures of what is underneath

[pascallanger]

If you have a saleae compatible logic analyzer (less than $10 on ebay), hook it up to these 8 pins:

Don't forget to connect GND as well.

[RobertoD91]

I'd desolder that RF lid and grab some pictures of what is underneath

Can't desolder, but i found this: https://fccid.io/XVE-SA09181/External-Photos/Modular-Pictures-1202329

[pascallanger]

We don't see anything anyway... Connect a logic analyzer on the 8 pins I've pointed out earlier.

[RobertoD91]

I have completed an initial acquisition, but only from the motherboard to the logic analyzer, excluding the RF module.
I'm not sure if this will be useful...
traxxas2.sal.zip

What I did during the acquisition:

Started with the radio turned off, CH1 and CH2 set to the middle position:

1. Powered on the radio
2. Set CH2 to maximum
3. Set CH2 to minimum
4. Set CH to the middle position
5. Set CH1 to minimum
6. Set CH1 to maximum

I will perform an acquisition with the RF module as soon as possible.

This is the first time I'm using a logic analyzer, so I might have made some mistakes. I believe I have identified the ground pin, but I'm not sure which one is the clock pin.

[pascallanger]

Please use logic 1.2.14 instead of 2.xx
It looks like the RF module was not plugged to the motherboard and therefore the CPU went in a loop not finding what it was looking for. It means that you must connect the RF module. Out of 4 signals MOSI/MISO/SS/CLK, 2 signals MISO/SS are missing but may be due to the fact that the RF module was not present on the capture. MOSI is connected on D2 and CLK on D4.
For the dumps, make sure the TX has all the trims centered and D/R set to max range.
You need to do different dumps for each action in a separate file:

• power on not touching anything
• power on in bind mode with a RX in bind mode
• power on, CH1 mid, min, mid, max, mid
• power on, CH2 mid, min, mid, max, mid
• power on, CH3 mid, min, mid, max, mid
• power on, CH4 mid, min, mid, max, mid

[RobertoD91]

poweron.logicdata.zip

[RobertoD91]

• power on in bind mode with a RX in bind mode

binding.logicdata.zip

• power on, CH1 mid, min, mid, max, mid

ch1.logicdata.zip

• power on, CH2 mid, min, mid, max, mid

ch2.logicdata.zip

[pascallanger]

Far more better. On the file poweron: CH0=CLK, CH3=MOSI, CH5=SS and CH7=MISO.
I don't have the time to look at it further but that's a good start.

[pascallanger]

Normal packets

SOP 3C 37 CC 91 E2 F8 CC 91 . Is it constant? Set before reading the CYRF ID D8 AA 59 E6 44 FB so it could be constant.
RF channels alternates between 0B and 34. Where are they coming from ? I'm wondering if 0B could be the main RF channel and 34 (04 bind channel xor 30) is the channel that the RX uses to find the main channel. The TX listens on both channels and read the RSSI right after the packet is transmitted.
Timing is CH34 (where the sticks are read) then 7ms later on CH0B then 13ms later on CH34 for an overall 20ms loop.
Payload 16 bytes

02	D8	AA	59	E6	A2	C6	05	D9	05	90	07	90	07	0A	78
Type	ID0	ID1	ID2	ID3	UNK1	CH1L	CH1H	CH2L	CH2H	CH3L	CH3H	CH4L	CH4H	UNK2	XOR

Type: 02 normal packet?
ID0..3: CYRF ID
UNK1: unknown value A2? Bind state=2 done?
CH1H:CH1L: channel 1 value 042D..05C6..0733 -> looks like PPM values with a center on 5DC=1500 but the low part being truncated to 1069 and high part 1843. Any end points being set on the TX? Is this the throttle channel?
CH2H:CH2L: channel 2 value 036E..05D9..0840 -> looks like PPM but with extended range this time center 5DC=1500 low 878 and high 2112.
...
UNK2: unknown value 0A? Looks like the first RF channel -1: 0B-1=0A.
XOR: XOR of all payload values from Type to UNK2 stored in XOR

Bind packets

RF channel 04
Timing every 10ms
Payload 8 bytes

2A	D8	AA	59	E6	A0	03	44
Type	ID0	ID1	ID2	ID3	UNK1	UNK2	XOR

Type: 2A bind packet?
ID0..3: CYRF ID
UNK1: unknown value A0? Bind state 0?
UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03.
XOR: XOR of all payload values from Type to UNK2 stored in XOR

RX sends:

02	A8	03	A9
Type	UNK1	UNK2	XOR

Type: 02 normal packet?
UNK1: unknown value A8? Ack bind state 0 with a xor 8?
UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03.
XOR: XOR of all payload values from Type to UNK2 stored in XOR

After receiving from the RX switches to:

2A	D8	AA	59	E6	A1	92	05	D9	05	90	07	90	07	03	0E
Type	ID0	ID1	ID2	ID3	UNK1	CH1L	CH1H	CH2L	CH2H	CH3L	CH3H	CH4L	CH4H	UNK2	XOR

Type: 2A bind packet?
ID0..3: CYRF ID
UNK1: unknown value A1? Bind state 1?
CH1H:CH1L: channel 1 value
CH2H:CH2L: channel 2 value
...
UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03.
XOR: XOR of all payload values from Type to UNK2 stored in XOR

RX sends:

02	A9	03	A8
Type	UNK1	UNK2	XOR

Type: 02 normal packet?
UNK1: unknown value A9? Ack bind state 1 with a xor 8?
UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03.
XOR: XOR of all payload values from Type to UNK2 stored in XOR

After receiving from the RX switches to:

02	D8	AA	59	E6	A2	92	05	D9	05	90	07	90	07	03	25
Type	ID0	ID1	ID2	ID3	UNK1	CH1L	CH1H	CH2L	CH2H	CH3L	CH3H	CH4L	CH4H	UNK2	XOR

Type: 02 normal packet?
ID0..3: CYRF ID
UNK1: unknown value A2? Bind state=2 done?
CH1H:CH1L: channel 1 value
CH2H:CH2L: channel 2 value
...
UNK2: unknown value 03? Looks like the first RF channel -1: 04-1=03.
XOR: XOR of all payload values from Type to UNK2 stored in XOR

After some time switches to normal packets alternating on RF channels 0B and 34
Do we need to do all the bind states or just sending the initial bind packets is enough?

[RobertoD91]

CH1H:CH1L: channel 1 value 042D..05C6..0733 -> looks like PPM values with a center on 5DC=1500 but the low part being truncated to 1069 and high part 1843. Any end points being set on the TX? Is this the throttle channel?

CH1 is for steering, ch2 for throttle.
There are no end points on the radio, according to this manual https://traxxas.com/sites/default/files/KC1182_TQ-24GHz_INST.pdf can be only set an endpoint on the rx for the throttle.

PS: according to https://traxxas.com/support/parts/transmitters/Legacy-Transmitters this is TQ 1st gen, not pre TQ

[pascallanger]

Please test the new protocol Traxxas/TQ1 available here: https://downloads.multi-module.org/latest-test/
It's fully untested, just written the code and not even simulated it.
It uses your current original TX ID for now. So you don't have to bind the RX, it should just work if I've done a good job. We'll have more tests to do but for now I'm waiting for that trial.

[RobertoD91]

Wow! Congratulations on the speed!
Unfortunately, it seems that the receiver does not detect the radio.

[RobertoD91]

[pascallanger]

Please try again, stupid mistake... At least I 've found one...

[RobertoD91]

Please try again, stupid mistake... At least I 've found one...

Same problem, the receiver don't detect the radio

[pascallanger]

I don't understand why it's not working... Please test v1.3.4.8

[RobertoD91]

Same situation, tonight i will do some other test and some videos

[RobertoD91]

Note the time between turning on the radio and when the receiver "accept" the commands, maybe there is something?
https://www.youtube.com/watch?v=JomC5fWWWbc

[RobertoD91]

I have done another acquisition, maybe can be useful...

• power on not touching anything

poweron.logicdata.zip

• power on, CH1 mid, min, mid, max, mid

ch1.logicdata.zip

[pascallanger]

Please test again. If it doesn't work then I have no idea why...

[RobertoD91]

Still no luck... :(

[pascallanger]

I don't get it...
You are not trying to bind right? Just control an already bound RX to your original TX, correct?
The RX doesn't do anything? The blinking pattern stays the same when you power on the multi module (RX powered first)?
Have you tried to control with all the 4 channels set to their middle positions in the mixers? (I'm wondering if a channel outside of the expected range could be an issue...)

[RobertoD91]

You are not trying to bind right?

no

Just control an already bound RX to your original TX, correct?

yes

The RX doesn't do anything?

nothing...
power on->led off-> ~4sec->green blinking

When i poweron the traxxas TX the led become solid green (before or after the 4 sec, it is the same).

The blinking pattern stays the same when you power on the multi module (RX powered first)?

yes

Have you tried to control with all the 4 channels set to their middle positions in the mixers? (I'm wondering if a channel outside of the expected range could be an issue...)

Just tried, nothing.

Maybe my multimodule is fault? But it works with some dsm 2 1f rx...

[pascallanger]

I'm getting really annoyed, never spent so much time...
Can you try again with the latest code?

Is it possible to connect to the SPI on the RX side?

[RobertoD91]

I'm getting really annoyed, never spent so much time... Can you try again with the latest code?

Is it possible to connect to the SPI on the RX side?

It works! 🥳
All four channel

[RobertoD91]

Is it possible to connect to the SPI on the RX side?

If can be useful i will try.

Unfortunately, these circuit boards are soldered together

Any suggestion for the pin?

[pascallanger]

It works! 🥳 All four channel

Wow that's not too early. But now I need to understand why it works... We'll need to do some testing.