Mjx Bugs 3

It will be great if telemetry and the Bug6 variant can be done too

Let's see what we can do

There is still something wrong with the bind capture. It cannot be decoded in Logic

Is it something I'm doing wrong?How can I troubleshoot it?

Check this 1 out see if anything changed.
drive.google.com/file/d/1fcPGeU3RqH9g-mD...eD9/view?usp=sharing

The last capture is fine, but I still can't seem to find a bind sequence. After setting up the module the TX right away starts sending the data packets with channel values...

The transmitter is on and the battery is then plugged into quad the transmitter makes one beep indicating bind but I have to engage the motors by a tap of a button and disengage by holding button down.I'll try a couple of more captures.I also start the sample recording before I start the process to capture everything.I'll try to plug the quad up first then the transmitter.

Here's a couple of captures off and on binding.
drive.google.com/file/d/1eI2oV-h1MpEMVI8...C5H/view?usp=sharing

Again starting with channel data right away. Is there a bind sequence you had to go through when first binding it? Maybe make a bind sequence capture without the quad plugged in

Sorry for the delay just got off work not to long ago,I greatly appreciate your time on behalf of all who desperately want this deviated Moeder.I took these captures I am almost certain these are good.I was just cutting the quad on and letting it bind to the tx,never went into the initial bind sequence on the previous captures.The light blinks on the tx and stops after about 25 seconds,I recorded the entire 25 seconds.The quad wasn't on for that capture but the rx and tx sequence were captured in the other capture,thanks again.
drive.google.com/file/d/17qH1GOj55-XqyB8...8PG/view?usp=sharing
drive.google.com/file/d/1h3SaVgoCTj_hgKT...MVv/view?usp=sharing

first one is still starting with data...I wonder if they do binding different due to it being a bidirectional protocol. Second capture can't be downloaded, the file is private

Sorry for the inconvenience with the second file.I just took these if these aren't correct anything else to suggest. drive.google.com/file/d/1wjWUgelWMo6rjyL...-qt/view?usp=sharing
drive.google.com/file/d/1H0m-7XWblbaECDk...45r/view?usp=sharing
drive.google.com/file/d/1vD6tRjtti4tGsM0...a17/view?usp=sharing
drive.google.com/file/d/1o0VMEbFqjeiy4w8...c1G/view?usp=sharing
drive.google.com/file/d/1kE6ZDkm6OlLSboM...P6c/view?usp=sharing
drive.google.com/file/d/1H0m-7XWblbaECDk...45r/view?usp=sharing

Stupid question, but was the Bug3 bind procedure proceed before to capture data ? (as far I remember with this one, you have press & hold the red button while turning the radio and then the quad .... something like this)

Yep and the tx light starts flashing green like it's searching for the quad.I did that and tried other things also.

I'm also interested in binding my Bugs 3 to my own transmitter. I don't know if this will help but because of the A7105 chip, I thought it might help


The information below may be somewhat out of date. The most recent information on this protocol can be found in the doc directory of the Deviation firmware project:
bitbucket.org/PhracturedBlue/deviation/src

While I probably won't pursue this much further at this point, I thought I'd document what I've found out so far in case anyone ever comes looking for it.
Updated 2012-07-01
I've been playing with a V911 transmitter which contains the A7105 FSK Tx/Rx chip. This transmitter uses 3-wire SPI to send data which makes it easy to look at.
The V911 is compatible with the Turnigy 9X/FlySky FS-TH9X, though it is only a 4-channel heli.

Initial analysis shows that all channel data is sent in 22-byte frames every ~1.5ms

The data in the frame is apparently not encrypted, and each channel is sent as a 16bit little-endian word.

The A7105 Data sheet can be found here:

After power-on, the following steps are initiated:
1) A7105 is reset send (0x00, 0x00)
2) Send 32bit address to address 0x06: 0x5475c52a
3) Program the A7105 control registers as follows:
Code:
Code:
0x00: --, 42, 00, 14, 00, --, --, 00, 00, 00, 00, 01, 21, 05, 00, 50
0x10: 9e, 4b, 00, 02, 16, 2b, 12, 00, 62, 80, 80, 00, 0a, 32, c3, 0f
0x20: 13, c3, 00, --, 00, 00, 3b, 00, 17, 47, 80, 03, 01, 45, 18, 00
0x30: 01, 0f, --
4) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
5) Write '1' to address 0x02 to start the IF Filter Bank calibration
6) Poll address 0x02 until it returns '0' indicating calibration is complete
7) Read IF calibration info from Address 0x22
Write VCO Current calibration to 0x24 (value = 0x13)
9) Write VCO Bank calibration limits to 0x26 (value = 0x3b)
10) Write channel to Address 0x0f (value = 0x00)
11) Write '2' to address 0x02 to start VCO bank Calibration
12) Poll address 0x02 until it returns '0' indicating calibration is complete
13) Read VCO calibration from Address 0x25 (test for success?)
14) Write channel to Address 0x0f (value = 0xa0)
15) Write '2' to Address 0x02 to start VCO bank Calibration
16) Poll address 0x02 until it returns '0' indicating calibration is complete
17) Read VCO calibration from Address 0x25 (test for success?)
18) Write manual VCO Bank calibration to Address 0x25 (value = 0x08) ???
19) Put the A7105 into the 'Standby' state (Strobe = 0xa0)
20) Start sending frames as follows

Frames are sent each 1.46ms. Each frame consists of sending a 'FIFO Write Pointer Reset' (Strobe = 0xe0), 22 bytes of data, setting the channel (via the 0x0f register) and then sending 'TX mode' (Strobe = 0x0d) to actually initiate the transfer

The frame data is not encrypted, and is 16-bit little endian. the data appears to be as follows.
Fo each channel the minimum value I observed was ~ 0x03e8 and the maximum was ~ 0x07ca.

Code:
TX1 TX2
word 1: 0xaa05/0x5505
word 2: 0x01f3 0x0002
word 3: 0x2000 0x7000
word 4: aileron (ch1)
word 5: elevator (ch2)
word 6: throttle (ch3)
word 7: rudder (ch4)
word 8: 0x02c3 0xedfc
word 9: 0x02ed 0x02eb
word 10: see below
word 11: 0x0000
Word 1 is 0xaa05 until 3 seconds have elapsed and the throttle has been brought to its minimum value. It then changes to 0x5505 at the same time that the Tx starts cycling between channels

Word 2 and 3 are apparently the Transmitter's Unique ID (thanks zeza from RCGroups)
word 8 and 9 are likely to be channels 5 and 6

Word 10 seems to continuously cycle between 10 states (changing state every frame):
State 1 : 0x100, 0x200, or 0x300 (almost always 0x200)
State 2 : 0x23 or 0x24 (almost always 0x24)
State 3 : 0x32
State 4 - 10: 0xffe or 0xfff

The Tx channel will be 01 until initialization is done and the throttle is brought to 0. At ~ 3 seconds, data is transmitted on multiple channels. Channel ordering is dependent on Transmitter?
Tx2: 0a, 5a, 50, a0, 14, 64, 46, 96, 1e, 6e, 3c, 8c, 28, 78, 32, 82
Tx1: 79, 29, 6f, 1f, 83, 33, 65, 25, 8d, 3d, 5b, 0b, 97, 47, 51, 01

Also, there is still work to do to determine how the Bank Calibration data is used

Thank you for the valid information as I'm in very novice stages with all this I hope a seasoned guru can interpret this all.I also found out that there are different versions and revisions of the bugs 3.I'm using the first generation board,the only distinguishing characteristics from the other revisions that I have detected is the original bugs 3 board is green and has the #5 in a round white circle on the board of the quad.There are multiple protocols to this model.

Well, I still don't see how binding is done, maybe goebish or hexfet can figure it out. I'm just writing down what I have so I can safely delete my notes and forget about this protocol

Nope, I even update my forum notepad (see above
I guess there's enough info to build a simple protocol for user cockpitvue777, but without a grasp of the binding there is not much sense to it, I'd say.

Thanks for the attempt and help it's definitely appreciated.I took every conceivable capture trying to get the bind sequence.I did it according to the manual.Here is the procedure.
drive.google.com/file/d/1Vl2ipnJ0riV9kns...Hod/view?usp=sharing