Tuesday, April 16, 2013

Spektrum DX3S Hack (Part 2 - Telemetry and the first RX)

Back to the DX3S hack project, I got some time and took a look at the telemetry data. I didn't do any video, but the information below should be enough.

The telemetry data is fairly simple. On each 8 byte packet sent by the remote, the RF module responds with 8 bytes. Out of this 8 bytes, only bytes 3 and 4 are relevant.

For example: FE 00 00 12 EA 00 00 00. This is a sample telemetry data. Only bytes 12 and EA are important.
The first 4 bits (in the above case: 1) represent the telemetry value, where:
1 - current RX voltage
2 - current RPM
3 - maximum RPM
4 - not used (0 for value)
5 - not used (0 for value)
6 - not used (0 for value)
7 - current temperature
8 - maximum temperature.

The next 12 bits are the actual value for each of the telemetry index.
1: min value 1F0 - corresponds to 3.1V
    max value 5F2 - corresponds to 9.8V
    formula: value = voltage * 155 + 10
2: min value 0 - corresponds to 0 RPM
    max value 2FF - corresponds to 31620 RPM
    formula: value = RPM / 60
3: same as index 2
4, 5 and 6: always 0
7: min value is 7 - corresponds to 246 C
    max value is 624 - corresponds to 1 C
    the relation is not linear. I think it follows the thermistor characteristic. I guess I will make a lookup table for this one.

I also managed to make the first RX. It's 25x30 mm, it has a RFM22B as a RF transceiver and it's driven by a Freescale Cortex M0+ (in QFN32 package).

Here are some pictures with the RX. The plug and the 4 wires are only for programming, they will be gone once the software is done and stable enough. I was also thinking of adding a serial bootloader for easy firmware upgrading via the RX/TX pins which are exposed on the telemetry.

And a video with the entire assembly running for the first test:

Leave your questions and comments below.


  1. Nice project. I am planing to do something similar with my DX3S and your Hack is a gread starting point for me, so thanks once already :) Do you have some more documentation for your SPI to USB board and also your own RX or the souce code for your windos programm? Also what makes me a bit confused is that you are using the RFM22B for your RX. Isn't this a sub GHz transceiver and the DX3S working on the 2.4GHz band or did I miss there something? Also thanks in advance for your answer.

    1. Sorry for the late reply, but better later than never, right? :)
      The code is not available yet but I think I might make it soon available.
      The SPI to USB board is a Freescale FRDM-KL05 development board. I had it around so I used that. It could've been an Arduino. It just reads the SPI data and sends it over serial (virtual port) to PC and the small program just displays it (based on the given indications).
      Yes, the RFM is sub GHZ (868 MHz the ones I used) but since I also modified the module in the remote control (also to use a RFM), they are 100% compatible and not 2.4GHz anymore.