Typhoon H / ST-16 controller : Can it be re-purposed?

[dylanfm]

Just trying to understand some of this post ( way out of my league) what I am trying to find out if I could put a Yuneec flight controller in a 550s frame and run it with the ST16 ????

I think there is a little more to it than that. I'm pretty sure that in addition to the the yuneec flight controller and receiver you will also need at least the yuneec GPS/Compass module. I'm pretty sure when I was testing stuff with my spare receiver that the H wouldn't do anything other than beep and flash until I plugged the GPS back in. It is possible that checks for other components being plugged in also (Obstacle avoidance? lights? landing gear?) and that it may not power up properly if it detects a problem (ie they are missing) with those components.

Even if it i does work, then I have no idea how well it will fly considering that the PIDs aren't tune-able for this new frame/motor/prop combination (at least not that I have been able to figure out).

All that being said, I am planning on trying it myself when I get around to it. I have a spare FC, RX, GPS, and Obs avoidance sensor as well as the alternate frame I want to try this on.It is just sitting in a long list of projects that I have in mind.

I think it would be technically easier to created a version of cleanflight (or a variant) that accepts the serial protocol I described earlier and then build your own hex or quad with off the shelf parts. If somebody was good at programming I'm sure it could be done. It even looks like the cleanflight has some provisions for people to make their own custom serial protocol modules. I'm just not that person.

Dylan

 

[Gunit]

Yes you are right it needs the other sensors too, my bad sorry for not all the info...

 

[Ximo]

I'm very interested in this research.

Thanks to the information that dylanfm have searched, we know that it's a CC2530 based zigbee protocol. So, perhaps it will be easier sniffing the radio packets, because the drone can fly while you capture data.

I just bought a CC2531 usb dongle for do it: Wireless Zigbee CC2531 Sniffer Bare Board Packet Protocol Analyzer Module USB Interface Dongle Capture Packet Module-in Integrated Circuits from Electronic Components & Supplies on Aliexpress.com | Alibaba Group

I will research in this url and I will post any advance: PACKET-SNIFFER SmartRF Protocol Packet Sniffer | TI.com

 

[dylanfm]

I'm very interested in this research.

Thanks to the information that dylanfm have searched, we know that it's a CC2530 based zigbee protocol. So, perhaps it will be easier sniffing the radio packets, because the drone can fly while you capture data.

I just bought a CC2531 usb dongle for do it: Wireless Zigbee CC2531 Sniffer Bare Board Packet Protocol Analyzer Module USB Interface Dongle Capture Packet Module-in Integrated Circuits from Electronic Components & Supplies on Aliexpress.com | Alibaba Group

I will research in this url and I will post any advance: PACKET-SNIFFER SmartRF Protocol Packet Sniffer | TI.com

I thought about getting a zigbee module and trying to figure the protocol like that. I'm not really sure that it will be easier than just using a spare Yuneec RX but you are right that if you need to see data while it is in flight or if you want to be able to make your own Yuneec Tx or Rx out of zigbee modules then packet sniffing will probably be required. I would guess/hope that Yuneec does something the data between the Tx and the Rx to encrypt, encode, and/or compress it which might make it much harder to interpret than just looking at the output of the receiver.

This may be obvious but I should point out that you can get spare Yuneec H receivers on ebay fairly frequently for <$5. I just picked up my 3rd one for $0.99+$3 shipping yesterday. Look for the seller "BrighterBrands". They seem to part out a TH on ebay about once a week and the RXs seem to get no bids fairly often.

I haven't been doing much work on this at all lately. Because I feel I have enough data to decode and use most of the sticks and buttons on the transmitter, the last time I spent anytime on it was trying to figure out the checksum byte(s) or how the TH knows it got valid, un-corrupted, data from the RX. I still suspect that the checksum is the last bytes in the packet but I have figured out how to decode it yet. It is possible that it is somewhere else in the packet or that the packets that I tried to calculate the checksums on were corrupted, but most likely I think I just haven't figured out how to do it yet.

This week I have been thinking about a project that could use the Yuneec rx and the St16 without caring about the checksum values. It isn't a flying or dangerous project so I could deal with occasional bad packets other ways. I need to design and make the hardware for this project, but if I build it I will post the details to this forum.

 

[radbis]

Hi there,

I'm thinking about buying a used ST-16 or ST-24 to use it with the drone of my production. Today I found your thread. I also read that Pixhawk was doing something in this direction.
And that's how I found this code:
ardupilot/ArduCopter-3.5/modules/PX4Firmware/src/lib/rc/ Source Tree - Woboq Code Browser
and here
ArduPilot/PX4Firmware

I have hope that it will help something and both controllers share same packets structure
if someone succeeds, let us know.
Regards

 

[dylanfm]

Hi there,

I'm thinking about buying a used ST-16 or ST-24 to use it with the drone of my production. Today I found your thread. I also read that Pixhawk was doing something in this direction.
And that's how I found this code:
ardupilot/ArduCopter-3.5/modules/PX4Firmware/src/lib/rc/ Source Tree - Woboq Code Browser
and here
ArduPilot/PX4Firmware

I have hope that it will help something and both controllers share same packets structure
if someone succeeds, let us know.
Regards

This is a great find! I don't know if the ST-24 and ST-16 use the same protocol or not, but if they do that link to the ArduPilot FW will help a lot. I feel I have every thing about the ST-16 protocol figured out well enough to decode it except I have been struggling with figuring out the checksum and I have been struggling with it for months. From looking at the Ardupilot code, if I'm reading it right, it looks like it might be somesort of crc8. I have already tried CRC8, but there are lots of ways of doing so maybe I did it wrong. I will be looking at this more over the weekend. Also If I get time I will dig around on the FCC website to try to figure out if the ST24 and/or the ST16+ use the same zigbee module as the ST16.

 

[radbis]

At the moment,
I just think that maybe ZigBee is just a medium and it does not affect what is given to its and what it has to pass on. Maybe it does not make sense to catch data on another ZigBee receiver, but just plug in directly in front of the zigbee module with the UART2USB cable and capture the frames on the computer and try to decode with code in python for example.
I still think that if it is a module like in the pictures below, it might be possible (if we know nothing about it or is hard to find another to a pair) to exchange it for XBee paired on the other side with a similar XBee or eg a 100-channels long range HC-12 433MHz modules or LoRa modules. All of them have mostly 4 wires (VCC, GND, TX and RX).
ST24 Smart Transmitter Teardown Internal Photos 14050003-FCC-E1-Rev1 YUNEEC International (China) Co., Ltd.
use of HC-12 on TX and RX sides for Arduino RC
RC Plane Transmitter Receiver Arduino Part 1 of 2

XBee for 28 miles range
XBee-Pro 900 XSC S3B Wire - WRL-11634 - SparkFun Electronics
and one of many shields for Arduino
SparkFun XBee Shield - WRL-12847 - SparkFun Electronics

And one question more: do you think that price of $100 is a good for a factory refurbished ST-24?

 

[dylanfm]

Looking at the Ardupilot code it sure looks like the ST24 protocol is similar to the ST16. Specifically it looks like the ST16 packet matches what they have defined as a "ChannelData12" packet in the FW. The "ChannelData24" packet looks similar except with 24 RC channels vs 12. So it looks to me like the FW is written to decode either ST16 or ST24 data.

I'm copying the list of what I had figured out about the protocol from earlier this thread with some updates base of additional stuff I have figured out and/or assumptions based on the ST24 protocol (updates in Red).


The Yuneec ST10, ST16, the Wizard wand, the Typhoon H, Q500, and Blade Chroma all seem to use the same transmitter/receiver module = SR24
2. The SR24 is a CC2530 based Zigbee module.
3. The connection to the SR24 is: pin 1- Black wire, GND; Pin 2 - White wire, +3V; Pin 3 - Gray wire, serial data in; Pin 4 - Yellow wire, serial data out.
4. After attaching it to a typhoon H to bind it, I captured the serial output data using a logic analyzer module
5. From the logic analyzer data, the serial connection is 115.2Kbps 8N1, LSB first.
6. The data output is one 46 byte data frame followed by two 27 byte data frames.
7. Each data frame starts with the same two bytes: 0x55, 0x55
8. The next byte indicates the length of the rest of the bytes left in the packet (total size of the packet minus 2 header bytes and 1 length byte). Either 0x18 (24 bytes) or 0x2B( 43bytes)
8b. Byte 4 seems to indicate if it is a 46 or 27 byte frame: 46bytes=0x03 .... 27bytes=0x00
9. Bytes 5,6, seem to be a counter of the number of packets or a clock based on they always go up and that is how these bytes are described in the ST24 protocol.
9b. Byte 7 is probably an RSSI value based the description in the ST24 protocol.
9c. Byte 8 in the ST24 protocol is described as "Number of UART packets sent since reception of last RF frame (this tells something about age / rate)". In all the data I collected this byte was always 0 but maybe that is because my receiver wasn't hooked to the H and I never "armed" it by trying to start the motors?
10. The last byte if each frame (byte 46 or 27) always varies and is probably a CRC8 of all the bytes in the packet except for the first 2 header bytes and the crc byte itself based on the ST24 protocol
11. I believe all the channel info is encoded in bytes 9-26 with each channel represented by 12 bits. The channel data from analyzing the data captures after manipulating the controls, looking at the exported model file on ST16 and comparing that to the ST16 mixer and HW monitor is in this order:
T,A,E,R, Smart/Angle/Home switch, Smart/angle/home switch (duplicated for some reason? Or maybe it changes after the H is armed?), Camera tilt Slider, Pan Knob , TiltMode Switch, pan mode switch, landing Gear switch, Aux Button.
12. Bytes 30-27 of the 46 byte packets is the Latitude of the ST16 transmitter to 7 decimal places.
13. Byte 34-31 of the 46 byte packets is Longitude of the ST16 transmitter to 7 decimal places
14. I captured the binding sequence and successfully put the a receiver into binding mode by sending the data below repeated 5 times into the receiver over the serial line:
The binding data looks like this: 0x55,0x55,0x8,0x4,0x0,0x0,0x42,0x49,0x4E,0x44,0xB0

 

[radbis]

WOW, great job

 

[dylanfm]

At the moment,
I just think that maybe ZigBee is just a medium and it does not affect what is given to its and what it has to pass on. Maybe it does not make sense to catch data on another ZigBee receiver, but just plug in directly in front of the zigbee module with the UART2USB cable and capture the frames on the computer and try to decode with code in python for example.
I still think that if it is a module like in the pictures below, it might be possible (if we know nothing about it or is hard to find another to a pair) to exchange it for XBee paired on the other side with a similar XBee or eg a 100-channels long range HC-12 433MHz modules or LoRa modules. All of them have mostly 4 wires (VCC, GND, TX and RX).
ST24 Smart Transmitter Teardown Internal Photos 14050003-FCC-E1-Rev1 YUNEEC International (China) Co., Ltd.
use of HC-12 on TX and RX sides for Arduino RC
RC Plane Transmitter Receiver Arduino Part 1 of 2

XBee for 28 miles range
XBee-Pro 900 XSC S3B Wire - WRL-11634 - SparkFun Electronics
and one of many shields for Arduino
SparkFun XBee Shield - WRL-12847 - SparkFun Electronics

And one question more: do you think that price of $100 is a good for a factory refurbished ST-24?

I think it is probably a little more difficult that just turning on a zigbee module and reading the data that comes out of it. The ST16 and H's receiver have to be bound to each other other wise they won't listen to what the other one is saying. It is possible that the binding sequence that I posted in my previous post could be fed into the zigbee and it would put it into binding mode but i'm a little skeptical. I have played with/researched other RF transceiver modules a little bit and it seems like usually there is a lot of configuration that can happen in the FW to customize them for a specific use. Some RF modules you can capture their configuration using the OEM software and then write it to new module, but I also think it is pretty common that the configuration FW can be locked by the supplier so it can't be read. I think unless you can read the config from an existing zigbee module that has been programmed by Yuneec then you will never be able to figure out how to get a zigbee module to connect to a yuneec product, but I could be wrong.

If you wanted to replace the zigbee module in the ST24 with one of the alternatives you list I think it would work, but seems like a lot of effort to me.

Rather than trying to reprogram a zigbee or replace it I would just buy a typhoon H receiver off of ebay when they are selling for cheap. I have bought 3 of them from ebay, each was less that $5 with shipping.

So far as the price of the ST-24, at $100 I think that is an ok price. I don't remember seeing a used, new, or refurbed ST24 ever (not that I have specifically been looking), but the ST16s I see of Ebay are always a lot more than that.

However, I think the real catch is why do you want the ST24? If you just want a 24 channel radio that makes sense. But if you want it primarily for the built in "tablet" and/or video screen then you may be disappointed. Or you at least need to research what cameras you can view on the ST24. I know for the ST16 you are pretty much limited to the CGO3 and CGO3+. I spent a lot of time trying to hack the ST16 to allow it to connect to the MK58 module (which is a yuneec AV transmitter uses on the Q500 to connect to a Gopro) but came to the conclusion it couldn't be done (there is another thread on the forum somewhere about that). If the ST24 can't connect to the MK58, then you are limited to having to figure out how to mount and control the CGO3 or some other Yuneec supported camera on your custom quad. That is what I'm trying to do also (FYI it looks like the pan and tilt signals into the CGO3 are a PPM protocol) but it is another project. If the number of channels isn't critical, then I would consider getting an ST10+ instead. It supports the MK58 module which I think would make it much more flexible for a DIY drone. I have been keeping my eye out for a cheap one of those on ebay for testing. I have seen quite a few go for <$70 and I have just missed buying a few at ~$50.

 

[radbis]

It was just thinking that I could buy a nice controller and convert it. German eBay seller has them for 89 Euro.
But actually it is not worth for me to go this way, I think.
As for pairing two modules, you're right. I totally missed the problem out with modules FW's.
I'm a programmer and an electronics technician. So I will build a controller myself. Something similar to Q2 from Quantum Robotics in Illinois
If you will need some help with code or something else then let me know.

 

[dylanfm]

It was just thinking that I could buy a nice controller and convert it. German eBay seller has them for 89 Euro.
But actually it is not worth for me to go this way, I think.
As for pairing two modules, you're right. I totally missed the problem out with modules FW's.
I'm a programmer and an electronics technician. So I will build a controller myself. Something similar to Q2 from Quantum Robotics in Illinois
If you will need some help with code or something else then let me know.

I don't really know how "nice" of a controller the ST24 or ST16 really is. Building your own controller would be a fun and cool project. I was going to try to build using the ArUni board (ARUni, AR Universal board - RC Groups) but they seem to have been discontinued. I finally gave up waiting on those boards and just bought a trananis x9D and a multi-protocol radio module from banggood.

Thanks for the offer to help with coding, I may take you up on that if I can't figure it out. I have an electronics background also but my programming skills are not great. My first goal is to program a microcontroller to (probably the ESP8266) to convert the serial protocol output of the typhoon H's receiver into a PPM type output that I can feed into most flight controllers. After that I would like to try and figure out how to add the protocol to the cleanflight flightcontroller firmware so that I don't have to bother with an extra microcontroller in addition to the flight controller.

 

[dylanfm]

So I took the ST24 code from the PX4 firmware git hub and added it to my Arduino library folder. It took me longer than it probably should have to figure out how to call the function from the library but I think I got it. This code runs on an ESP8266 and outputs a PPM signal.

 

[Gurusonwheels]

So I took the ST24 code from the PX4 firmware git hub and added it to my Arduino library folder. It took me longer than it probably should have to figure out how to call the function from the library but I think I got it. This code runs on an ESP8266 and outputs a PPM signal.

keep up good work ...

 

[AH-1G]

Guys, it great to read what you have accomplished up to this point, I just wish my feeble brain was wired to understand coding.

 

[dylanfm]

I still need to figure out the control input(s) to the CGO3+. With this crappy portable Oscope I have with me right now it looks like it is two pulses separated by a short low pulse and then repeated every ~20ms. The 2nd pulse varies in width with the camera tilt slider. I assume the first pulse is for the gimbal pan but I can't seem to get it for change with the pan knob. It looks like the pulses are bigger than the typical 1-2ms pulses you would expect for a PPM type signal but I can't tell by how much with this oscope. They might be as much as 4ms. I tried capturing the pulses with an Arduino but when I did that it looked like there were all sorts of extra pulses. I may have to wait until I have a better Oscope available to figure this out.

 

[Ottershaw57]

I hope you guys succeed. It really bugs me that this controller cannot be used with other drones.

 

[dylanfm]

I hope you guys succeed. It really bugs me that this controller cannot be used with other drones.

It can be done:
Typhantoom

Whether it is a good idea or not is another question. The ST16 isn't really that great of a radio when you think about it. It has bad POTS (I've never had another radio that needed the pots cleaned ever) and limited mixing. The only cool thing about it is the built in video screen but that is pretty limited to which cameras can be used with it (CGO3 and CGO3+). I guess the radios built in GPS and capability of transmitting the radio's position to the drone is pretty cool also. I have bought a ST10 radio to play with because it can use a few more cameras (the MK58 module, the CGO1, etc).

 

[InspLOhpro]

Hello all,

I am interested in knowing if I can do any of the following:
1. Bind to other receivers?
2. Purchase a Yuneec receiver, bind it to the ST-16, and use it with a third party flight controller (like a Pixhawk)?
3. Anything else beyond its original intended purposes (flight and buddy mode)?

Thanks in advance for your replies!

Has there ever been any progress with this. I purchased an extra GS just for this reason.

 

[dylanfm]

Has there ever been any progress with this. I purchased an extra GS just for this reason.

I got a TH receiver to talk to a 3rd party flight controller (a DJI phantom FC) through microcontroller that converts the output to PPM. The Code is in post #33. There is a link to a video of a Phantom 2 with CGO3+ attached to it being controlled by an ST-16 in post #38.

I think that is the extent of the work. At some point I still want to program a microcontroller to output SBUS and/or convert the telemetry data out from a 3rd party FC into the format that can be transmitted back to the ST-16. Someday I might get around to it.

Dylan