ACCESS retrofit on older/custom transmitters

[Efrieh]

Hi everyone!

Since it doesn't seem like FrSky is going to make an external ACCESS module any time soon I was considering if an upgrade of older transmitters would possible with one of the internal ACCESS rf boards from the X9 Lite or Q X7. I did some searching and didn't find any discussions around this topic, so now we're here.

I don't see why it wouldn't be possible, unless they are connected through a completely different interface. Perhaps a developer can shed some light on that?
If possible, it would most likely involve a bit of finicky soldering, but in my opinion that's the easy part. The bigger part is getting the option to enable ACCESS for the internal/external module in erskyTx & openTx for transmitters that do/did not come with internal ACCESS modules.

Since I have a couple custom built and older FrSky transmitters all running erskyTx I would be more than willing to spend a little time and money on this. I tried searching through the code to find what interface is used, unfortunately unsuccessfully so far...
Once that question is answered the next step would be to buy a module and start poking around bit I guess. Let me know what you think.

Stefan

[MikeB]

The older transmitters and modules used a single signal to the module (PPM or PXX) and telemetry is returned using the SPort signal.
Access modules use a two-wire serial interface, operating at a high baud rate, for control and telemetry, while still connecting to the SPort signal.

Mike

[Efrieh]

Well that's a bummer, I guess that's not gonna happen then.
Regardless, thanks for the info, Mike!

Stefan

[Efrieh]

I assume the same applies to the the new, smaller modules?
Because I just realised that the Twin Lite Pro module can also do ACCESS, but since the lite modules interface also features PXX out/in and CAN I guess it makes use of that. It also seems to only be supported by ETHOS transmitters to begin with.

Stefan

[MikeB]

The X9E transmitter does have an uncommitted serial port. This is buffered by two, transistor inverters, however I believe the original (non-inverted) signals may be used directly. This could provide the required serial signals for an ACCESS transmitter module.
It may, therefore, be possible to use the external module, switched power (that switches battery voltage) to power an ACCESS module, then connect these two serial signals to the module, then you may have an "external", ACCESS module working.

I notice that the RF board for a X9Lite has 4 pads (suitable for a small connector) that are the two serial signals together with GND and 3.3V. You can't use the 3.3V connection as the switched power is battery voltage, but there is a place on the board where the switched battery voltage may be connected.

Mike

[Efrieh]

Oh, that sounds promising! I'd be willing to try that out for sure.
The X9E also has the bluetooth module that is of little use to most as well. I have also no clue what interface that uses, but I assume it's either i2c or uart.
Are there any schematics for the Taranis transmitters that I'm just too dumb to find? That would make poking around a lot easier of course or prevent it all together - and maybe I could also figure out if this can be done to more transmitters than just the X9E.
If you would be willing to entertain my little modification/retrofit game on the software side I would certainly order an extra X9 Lite module.

Stefan

[MikeB]

The schematics for FrSky hardware are not published. Some developers do have them, released under a NDA, so cannot be made available.

I can probably look at adding ACCESS as an external option for the X9E. It may just be needing to include all the various drivers and menus, but there may be a few pitfalls along the way!

Mike

[Efrieh]

Understandable. Poking around it is then

That would be awesome! I will order a RF board then and we shall see what we can find out along the way. Having the X9E somewhat more future proof would be very nice.

Stefan

[MikeB]

The internal module of a X9Lite is supplied with switched 5V, the external is supplied with switched battery voltage (7.4V nominal, 8.4V max).
I don't think the on board, 3.3V regulator will handle the higher voltage (even higher from a X9E), so to use this will need a 5V regulator added in the switched power supply.

Mike

[Efrieh]

Alright, I'll have a look in my box of regulators, there should be something suitable in there.

The module has been shipped and it should hopefully be here in less than 2 weeks.

Stefan

[Efrieh]

I installed the new gimbals and since I had the transmitter open anyway I did some poking around.
Since that information might be useful to someone else down the line I'll quickly summarise it here.
Please take these with a grain of salt though, I did this fairly quickly so there's a chance I counted pins on the side of the uC wrong or made other stupid mistakes.

The main uC is a STM32F407ZET6 (LQFP144 package).
The mainboard has a couple open connectors and a pad. I marked them in the pictures, but in case those are ever lost to time I'll describe them as well:

On the bottom left, next to the battery connector there is a 4-pin connector labeled P12. The pins from left to right are:
Pin 1: GND
Pin 2: battery voltage
Pin 3:
Pin 4: inverted and connected to PB11 (which can be configured as RX of USART3)
I didn't poke around enough to find exactly where pin 3 is going, but I assume there is another inverter somewhere and that probably goes to PB10.
I assume this is the inverted open serial port Mike was talking about. If I recall correctly, the X9D has it as well.

To the left of the uC there is a relatively large, single pad, "Pad 1" in the picture. This pad is connected to PF2.

On the right there is the bluetooth module, labeled on the PCB (and in the picture) "P7". Only 7 of the pads on the module are connected to the mainboard. The pads are numbered left side top to bottom followed by right side top to bottom.
Pad 1: GND
Pad 2: 3.3 V
Pad 3: connected to PD11
Pad 4: connected to PG14 (configurable as Tx of USART6)
Pad 5: connected to PG9 (configurable as Rx of USART6)
Pad 6: connected to PG6
Pad 7: connected to PE12

I didn't have time to check the connector on the bottom right ("Con 1" in the picture) and the two connectors on the top left ("Con2" & "Con3" in the picture), but the latter are at least partially connected to the F103C8T6.


The bluetooth module has (to my knowledge) no function in erskyTx and can only be used for wireless trainer functionality in openTx, right?
If so, I think it would be better to use its serial port since it isn't inverted and easier to solder to. What do you think, Mike?
Also, what is the SPort used for in the ACCESS modules? Only software updates or does it have additional functionality? In the former case one could leave that disconnected and could have the SPort available for updating receivers.


Stefan

[MikeB]

According to information I have, one of the BT connections is to PB10, shared with the serial port! This may have been changed on a later revision of the main board!
The serial port inverters are Q3 and Q5, and connections should be reasonably easy to them.
The BT module on the X9E uses different firmware compared to the "PARA" firmware used on all the other FrSky transmitters!
To use the BT serial would almost certainly need the BT module to be removed.

Con1 is, I think the JTAG connector for the main CPU.
Con2 and Con3 are JTAG and serial connections to the 'F103.

Mike

[Efrieh]

I will double check that, but I am pretty sure the BT module on my board does not connect to PB10. A lot of the markings in and on my X9E are 2014 and late 2015, so I might have an early version. Maybe it changed later on, and you have the information for a later revision? I can check for a revision number next time I open it up.
Q5 is probably on the other side of the board, or did I overlook something? I didn't want to pull the mainboard out on that day, so I stopped looking.
I was half expecting some of the other connectors to be the JTAG for the uCs, great that you confirmed that suspicion.

Yeah, since the PARA transmitters are different from the X9E to begin with I don't really see a reason to keep the bluetooth module.
I think it's fairly easy to remove the BT board, which is also part of why I suggested that instead. Then one would not even need to remove the mainboard for the modification since all the connections are on the same side - neat!

Stefan

[MikeB]

Over the last few days I've taken a prototype X9Lite internal module board and added a voltage regulator (7805) and some wires to a header I glued on to it. I did need to update the firmware as the installed version was very old (1.0 !). I have installed ISRM-N-2.1.9.
I connected the header to the external bay of my X20 and, having temporarily changed the inversion of the serial signals in the bay, I have successfully bound an ACCST Rx and registered and bound an ACCESS Rx. Both receivers returned telemetry and controlled a servo.

Mike

[Efrieh]

That is great news!
My module should arrive soon, hopefully before the weekend. I might need to stick the board into my backup x9 lite to update it or change between FCC & LBT before I install it, but that's easy and quick to do.

Stefan

[Efrieh]

I just removed the BT module in a free minute and double checked the connections.
As long as I didn't make a boneheaded mistake in the pin numbering on the uC I got the connection correct the first time, so there is NO connection between PB10 (4th pin from the right on the bottom "row" when looking at the uC in the mainboard picture I posted last weekend) and the BT module on my board.

I also found a datasheet for the BT module (RF-BM-S02I) and the pads I called 4 & 5 are the RX & TX lines on the module itself.

I didn't remove the mainboard, but my switchboard is rev 0.5 (X9E_SW_REV0.5) and has 150814 as what I assume is a date code right underneath. All the screws still have the red glue from the factory on them, so neither the switchboard or mainboard were ever removed. Just to give you some indication of the age of my X9E. Of course the switchboard might be identical between all of them.

Stefan

[Efrieh]

I finally got the x9 lite rf-board two days ago.
In a free minute I removed the perpendicular mounted breakout for external rf-modules, since that is obviously not needed here and just takes up space.



The rf-board has three open connectors. From top (wider part of the PCB) to bottom these are:

CON2
- Rx
- Tx
- 3.3V
- GND

unlabelled connector
- 3.3V
- TCK
- TMS
- GND
- BND
- BOOT
- GND

J1
- S.P
- 5 V
- GND

Connector 2 has the serial interface and J1 the S Port as well as a 5 V pad that connects to the rf-modules 3.3 V regulator.
This makes the modification fairly easy on the hardware side, since all soldering is done on dedicated pads.

I could hook the board up to the BT module ports described above some time in the next couple of days and start testing. What do you say, Mike?

Stefan

x9lite_rf-module.jpg

(1.72 MiB) Not downloaded yet

[MikeB]

Make sure you add an antenna before you power up that board!
THe board I'm using looks a bit different, it doesn't have the J1 connector.
I don't want to remove my BT module from my main board. I'm looking at trying to do some testing using the BT UART for Tx and the serial UART for Rx to start with. I need to find some time to do the hardware connections on my X9E.

Mike

[Efrieh]

Make sure you add an antenna before you power up that board!

Of course, but good to mention that here indeed! Powering up the board without an antenna could fry it!

Looking at the RF board there's also a capacitor on the feed line and shunt inductor as well. That has me a little worried that FrSky was being FrSky again and used some odd antennas and tweaked the rf board to match. We all know the confusion some receivers with various antenna lengths caused a couple years ago. Unfortunately I don't have an X9 lite antenna to tear apart to check if they are significantly different from other 2.4 GHz antennas - or better yet, hook it up to a VNA.
I doubt the "fake" SWR from the module will tell me anything of value, but I will be keeping an eye on it once I start the testing.

They probably changed a bunch of things between the versions. My RF board is rev 0.22 and has 2019 04 30 as a date code.

Sure, let me know how & when I can help with testing!

Stefan

[MikeB]

I seem to have this working!
Connections:
GND from the 5-pin "external" header to GND of CON2 of the module, and GND of a 7805, 5V regulator. (The 5-pin header is "upside down, so GND is second pin from the top).
Switched power from the 5-pin "external" header to the Vin of the 7805 (Centre pin of the 5-pin header).
Tx data from USART6 on pin 4 (on your image) of the BT module to Rx on CON2 of the module.
Rx data from USART3 (on Q3 on the main board, the single pad on the right of Q3) to Tx on CON2 of the module.

I can register, bind, control and receive telemetry from a R8-PRO using ACCESS.

I can post the firmware for this, or I could do the changes to use just USART6, with the Rx connection also going to the BT module pad. I won't be able to test this change.

Mike

[Efrieh]

That is awesome!
What about the S.Port, did you hook that up at all or would it only be used for updates of the module anyway?

If you could make the changes for USART6 that would be amazing. I can just test that and see if everything works.

Stefan

[MikeB]

File attached!
I can't test it as I still have my BT module installed.

I didn't bother with the SPort, I need to actually check whether it is used to update the firmware.

Mike

[Efrieh]

Alright, awesome, thanks Mike!
I'll test that tomorrow night after work and report back!

If it worked fine without the S.Port for you I'll not bother with it either. Then I can just make an external header in place of where the external module antenna port is so I can flash receivers with it.

Stefan

[Efrieh]

I just tested and it does not work so far.
I hooked up an oscilloscope and the uC is sending something (checked on the RX of the RF-module) and soon as I try to register a receiver, the RF-module is responding (again checked on the TX of the RF-module). Of course I also checked continuity all the way to the uC.

I double checked again, and the connection pad 5 to PG9 is correct. In case I screwed up with the orientation of the uC, just to confirm here is a picture. PG9 being pointed at with a needle (top row of the uC when looking at the PCB, pin number 124, pretty much in the centre).




I also found a bug: the internal RF module always automatically switches to ACCESS, using the internal XJT is therefore not possible anymore.

Stefan

[MikeB]

I can fix that bug easily!
That is PG9.
A first test is to select the "Hardware" option protocol menu. This will ask the module for the hardware and firmware revisions and display them on the line after "Hardware". This does test the Tx and Rx are both operating correctly.
Looks like I didn't enable PG9 to act as USART6 input, try the attached (bug fixed as well).

Mike

[Efrieh]

Fixed and fixed! Awesome, thanks again Mike!
Seems to work fine, I bound a spare R6+ in both ACCESS and ACCST mode and controlled a servo. RSSI also works, therefore I assume telemetry works as well. I will continue my testing - If I encounter any problems I'll post here or in the erskyTx bug reporting thread.

The way I hooked up the module in my X9E:




Connections:
I used the GND & 5V pins on the J1 connector on the RF-module together with a 5V buck converter module I had lying around. The buck converter is hooked up to the internal JR module pins (GND -> second from the top in the jr module bay, switched battery voltage for the voltage converter input -> third from the top).
The TX & RX from CON2 on the RF-module are directly connected to the pads of where the bluetooth module used to be.
RX to the top right pad (labeled pad 4 in one of my earlier posts).
TX to the pad right underneath that (the second from the top on the right, labeled pad 5 in my earlier post).

I mounted the module by creating two "hooks" that are glued onto the backside of the RF-module. with those hooks the module slides onto the JR module mount bridges from the right. The cable tie through the hole on the RF-module then prevents it from sliding off. One could also use a nut & bolt for this, but I was too lazy to look for one.

Additionally I also routed the S.Port from the JR module bay as well as the regulated 5V out so it's accessible without opening up the case.


Thanks again, Mike, for entertaining my shenanigans!

This modification could in theory also be done to a X9D, in that case one would need to solder to the transistor inverters, similar to how Mike did for RX on his X9E. For now I don't plan on modifying my X9D, but at some point I will open it up again and I can take pictures and describe of where to solder then. Don't bet on that happening within the next couple of days though.

Stefan