Jump to content
Sign in to follow this  
FredericG

futaba 12FG, 12Z, 14MZ, FX40 RF module

Recommended Posts

I don't own such a module and have never seen one but I am looking for any (even basic) info on how this module works.

The problem is that my cousin would like to use it with a frequency (in the 35Mhz range) that is just outside the range it will generate, but legal in Belgium.

I have found this thread http://www.helifreak.com/showthread...www.helifreak.c that describes how to reprogram the EEPROM inside the module but that does not help me, the eeprom just seem to contain the country code. This thread also contains some pictures of the module.

I am wondering, for example, how does the module get its instructions from the transmitter to generate a specific frequency? I presume it generates the carrier and would think that it gets a value from the TX somehow, or is this completely wrong?

Would it be possible to "de-tune" it so that it is 20Khz off?

Thanks,

Frederic

Edited by FredericG

Share this post


Link to post
Share on other sites

My guess is that it sends a stream of serial commands to the PLL to generate the frequency. De-tuning would involve careful understanding of the PLL IC since the output is usually the product of a multiple of some fundamental crystal frequency so this isn't as easy as detuning a typical LC or even crystal oscillator.

Probably the best way is to hack the firmware if possible, and you can probably get a few more channels out of that. The other problem with out of band frequencies would be the tuned circuit performance for both the transmitting amplifiers, transmission lines, and the receiver. The performance is likely to fall off a bit as you move away from the center of the tuned band. It's hard to say how much without actually looking at the circuit in question.

As a last resort, it might be possible to intercept the serial commands to the PLL and inject your own commands. This way you can generate any frequency you want but it may not be reflected correctly by the controller display.

Daniel

Share this post


Link to post
Share on other sites

What is the frequency you want to use? I have a 35MHz 14mz, and it actually will let me TX quite a bit outside of the allowed range here :blink:

BTW, your link is broken. Would be nice to see the inside pics. My guess would be that there is one more layer between, TX talking to a microcontroller in the module, which in turn programs the PLL. Would be quite tricky to work out the communications between all those to make it work.

Edited by Kilrah

Share this post


Link to post
Share on other sites
My guess is that it sends a stream of serial commands to the PLL to generate the frequency. De-tuning would involve careful understanding of the PLL IC since the output is usually the product of a multiple of some fundamental crystal frequency so this isn't as easy as detuning a typical LC or even crystal oscillator.

Probably the best way is to hack the firmware if possible, and you can probably get a few more channels out of that. The other problem with out of band frequencies would be the tuned circuit performance for both the transmitting amplifiers, transmission lines, and the receiver. The performance is likely to fall off a bit as you move away from the center of the tuned band. It's hard to say how much without actually looking at the circuit in question.

As a last resort, it might be possible to intercept the serial commands to the PLL and inject your own commands. This way you can generate any frequency you want but it may not be reflected correctly by the controller display.

Daniel

Yes, if I would know how they communicate, I could perhaps get in between. In this case the value on the screen would be different from what is transmitted.

I think one can replace the TX SW. I was planning of having a look if I cannot find some kind of lookup table, hoping they would use ascii strings like "35.120" to display on the screen along with parameters sent to the RF module. But for this I also need to know what the TX sends to the module in order to find it in the table. But in any case I am reluctant of fiddling with the TX SW.

Thanks,

Frederic

Share this post


Link to post
Share on other sites
What is the frequency you want to use? I have a 35MHz 14mz, and it actually will let me TX quite a bit outside of the allowed range here :blink:

BTW, your link is broken. Would be nice to see the inside pics. My guess would be that there is one more layer between, TX talking to a microcontroller in the module, which in turn programs the PLL. Would be quite tricky to work out the communications between all those to make it work.

Sorry, I fixed the link. I will try to post the pictures here.

The 35Mhz module starts from 34.950 while 34.930 is legal in Belgium and he has a bunch a receivers with that frequency.

Thanks,

Frederic

Edited by FredericG

Share this post


Link to post
Share on other sites

Interesting.

So it looks like there's no "intelligent" part in the module, but directly the PLL. It seems the module's band is defined by a divider formed by the 2 resistors on the top left corner of the second picture above. They are the only components on the logic side that are different on that 72MHz module, my 40MHz one and my 35MHz one. So that would be for the transmitter to moan when the incorrect module is fitted. Then on the RF side quite bit changes, more, fewer or different pads are populated.

So it would be needed to find how the PLL works, a quick search didn't reveal any datasheet. Logic analyzer on what could be a SPI bus to the PLL? But that sounds very tricky. In any case an external processor giving the eventually expected responses to the TX while sending different commands to the PLL might be needed. Hacking the TX firmware would most likely only result on a checksum failure.

Share this post


Link to post
Share on other sites
Interesting.

So it looks like there's no "intelligent" part in the module, but directly the PLL. It seems the module's band is defined by a divider formed by the 2 resistors on the top left corner of the second picture above. They are the only components on the logic side that are different on that 72MHz module, my 40MHz one and my 35MHz one. So that would be for the transmitter to moan when the incorrect module is fitted. Then on the RF side quite bit changes, more, fewer or different pads are populated.

So it would be needed to find how the PLL works, a quick search didn't reveal any datasheet. Logic analyzer on what could be a SPI bus to the PLL? But that sounds very tricky. In any case an external processor giving the eventually expected responses to the TX while sending different commands to the PLL might be needed. Hacking the TX firmware would most likely only result on a checksum failure.

From the other HeliFreak thread I know there is an EEPROM (with an SPI interface if I remember well) that contains a serial number, an area code and a band code. This would allow the TX to identify the module. By changing the band, other subsets of for example 35Mhz become available. So this must be the way the TX recognizes the module.

I do not know anything about PLL's. Is it common for a PLL to have an SPI interface? If this is an PLL with SPI, I would expect it to be connected in parallel with the eeprom and have its own SS.

What do you mean with "sounds very tricky"?

Thanks,

Frederic

Edited by FredericG

Share this post


Link to post
Share on other sites

OK, I've read the thread.

Sounds really really weird then. So if this is an EEPROM, which is sure, the frequency can't be generated in the module... so the PLL would be inside the transmitter, and a single circuit would support all the frequency bands, with the module only housing the filtering/power amp :unsure:

That means any hack would have to be done either by hardware inside the TX, or in the software, but not in the module...

And hacking the module's EEPROM to allow sending in a different band than the intended one like was mentioned in the thread would be possible, but definitely NOT a good idea. The RF circuitry on the 35, 40 and 72 modules is very different.

What I meant by very tricky is what Daniel said earlier. Setting a frequency on a PLL usually means setting several registers with values linked by a fairly complex formula, so just guessing it wouldn't be easy at all.

Share this post


Link to post
Share on other sites
OK, I've read the thread.

Sounds really really weird then. So if this is an EEPROM, which is sure, the frequency can't be generated in the module... so the PLL would be inside the transmitter, and a single circuit would support all the frequency bands, with the module only housing the filtering/power amp :unsure:

It is indeed a strange approach. Each time they invent a new module, they need to update the TX software. They also have 2.4 GHz modules. Does the TX also generates that? It is strange.

I would think that the module communicates to the TX what frequencies it can generate and that the TX just selects one.

That means any hack would have to be done either by hardware inside the TX, or in the software, but not in the module...

And hacking the module's EEPROM to allow sending in a different band than the intended one like was mentioned in the thread would be possible, but definitely NOT a good idea. The RF circuitry on the 35, 40 and 72 modules is very different.

What I meant by very tricky is what Daniel said earlier. Setting a frequency on a PLL usually means setting several registers with values linked by a fairly complex formula, so just guessing it wouldn't be easy at all.

Interesting, I thought that it would be possible to extrapolate from a few know values, but obviously not :huh:

So, we think at least the carrier comes from the TX, would the module do the modulation?

Suppose the TX provides the carrier and the PPM (or PCM), Would it perhaps be doable to take the inside of a crystal-based module (from another radio-type), ignore the carrier from the TX and add an eeprom to make the TX happy?

Thanks,

Frederic

Share this post


Link to post
Share on other sites
It is indeed a strange approach. Each time they invent a new module, they need to update the TX software. They also have 2.4 GHz modules. Does the TX also generates that? It is strange.

I would think that the module communicates to the TX what frequencies it can generate and that the TX just selects one.

Well, to me that sounds lile the most flexible way of doing it.

I don't think the module lists all the frequencies, that wouldn't make sense. It just stores area code/frequency band, like described in the other thread. If you read, they don't have to write an entire frequency table to change module area. Then the correspondence between area code, band and the actual frequency table is in the software. So for example in your case, if you could convince Futaba to add that frequency you want, it would just be a user-side software update away, no need to change or reprogram the module -> no hardware to service.

So, we think at least the carrier comes from the TX, would the module do the modulation?

I've just scoped things a bit. So, the carrier is indeed made in the TX. If the TX is turned on with the module, RF on, and the module is removed, the frequency is still available on one of the transmitter's pins (lower right one on the larger connector). There's no baseband signal on any of the pins, so the modulation must also be done internally.

For 2.4GHz, my guess is that the module is a data modem, and the transmitter talks to it digitally through the SPI interface that is used to access the EEPROM on the "standard" module, no PCM/PPM or other kind of baseband signal used.

Suppose the TX provides the carrier and the PPM (or PCM), Would it perhaps be doable to take the inside of a crystal-based module (from another radio-type), ignore the carrier from the TX and add an eeprom to make the TX happy?

As it isn't the case, I'd do something much simpler: buy a FF9 module on ebay, fit the desired crystal inside, switch your 14MZ to student mode, connect the module to the student port's baseband output, fit it an antenna and there we are :)

But then, it of course pretty much defeats the purpose of having a nice TX like the 14MZ, so I'd make it even simpler, and just buy new RX crystals on other channels ;)

Edited by Kilrah

Share this post


Link to post
Share on other sites
Well, to me that sounds lile the most flexible way of doing it.

I don't think the module lists all the frequencies, that wouldn't make sense. It just stores area code/frequency band, like described in the other thread. If you read, they don't have to write an entire frequency table to change module area. Then the correspondence between area code, band and the actual frequency table is in the software. So for example in your case, if you could convince Futaba to add that frequency you want, it would just be a user-side software update away, no need to change or reprogram the module -> no hardware to service.

Yes, the other thread clearly indicates that there is no frequency-table in the eeprom, that it works differently than I assumed and that RF module has less responsibilities than we thought.

I've just scoped things a bit. So, the carrier is indeed made in the TX. If the TX is turned on with the module, RF on, and the module is removed, the frequency is still available on one of the transmitter's pins (lower right one on the larger connector). There's no baseband signal on any of the pins, so the modulation must also be done internally.

For 2.4GHz, my guess is that the module is a data modem, and the transmitter talks to it digitally through the SPI interface that is used to access the EEPROM on the "standard" module, no PCM/PPM or other kind of baseband signal used.

As it isn't the case, I'd do something much simpler: buy a FF9 module on ebay, fit the desired crystal inside, switch your 14MZ to student mode, connect the module to the student port's baseband output, fit it an antenna and there we are :)

But then, it of course pretty much defeats the purpose of having a nice TX like the 14MZ, so I'd make it even simpler, and just buy new RX crystals on other channels ;)

Yes, I think this leaves us with the options you mention :huh:

Thanks for you help, it's very much appreciated !

Frederic

Edited by FredericG

Share this post


Link to post
Share on other sites

BTW, I was interested in having a look at the circuitry on the 14MZ, where the RF circuitry would be... but I haven't managed to find those disassembled pics I had come across on some forum this summer. If someone remembers where they are, I'd welcome a link :)

Don't feel like opening mine again ;)

Share this post


Link to post
Share on other sites

Mr.Kilrah Would you please take a picture of 35 Mhz circuit including front and back of all module? I really interesting to modify these. If it work It will share you with the pictures. Thanks a lot in advance.

Share this post


Link to post
Share on other sites

I know I had taken some but can't find them anymore... I don't have my 14MZ at hand now, but if you can wait a couple of days (and maybe remind me ;) ) I'll make some again.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×