Corona RP8D1 – Reverse Engineering

Due to my special interests in a customized RC transmitter and receiver system I started with reverse engineering of a Corona RP8D1 35MHz receiver.

The RP8D1 is my favourite candidate cause it’s a double superheterodyne receiver, uses a PLL synthesizer and is controller by an AVR ATmega88V.

Interesting fact about the micro-controller:

Corona obviously has been changed the controller type on actual receiver boards. The first receiver I bought in mid 2010 uses the mentioned ATmega88V.
Two newer receiver, bought in January 2011, are using a controller marked “225K01” with manufacturer “QRG”.

Fact is the PCB layout is 100% identical on both receivers so must be the pin-out of the different controllers!

So the 225K01 is either a clone or some official AVR derivative, already contacted Atmel for details.

Used components, followed by pictures and the controller pin-out:

  • Controller AVR ATmega88V on mid 2010 board
  • Controller QRG 225K01 on 2011 boards
  • Rohm BU2630 Dual PLL
  • Rohm BH4126 Wideband IF Detector
  • Philips SA616DK High Performance Mixer FM IF System

Board top layer:
Corona RP8D1 Top Layer

Board top layer, filter and crystal removed:

RP8D1 Top Layer with filter and crystal removed

A word about the second LED (PLL lock detect) on the RP8D1: The LED will signal the status of the PLL control loop. If the LED lights the PLL is out of sync, that means the synthesizer can not set the receiving frequency correctly. For normal operation the LED shall be always off.

Board bottom layer:
There is a typo in the picture, the controller type is 225K01.

RP8D1 Bottom Layer

The RSSI signal can be picked up for external use easily on one of the resistors instead of removing the filter and wiring to the SA616 pin 5.

Receiver board with AVR ATmega88V controller:

RP8D1 with ATmega88V

Receiver board with QRG 225K01 controller:

RP8D1 with QRG 225K01 controller

Controller pin-out:

Pin Name Function
1 PD3 Bind button input
2 PD4 Bind LED output
3 GND GND
4 VCC VCC 3.3V
5 GND GND
6 VCC VCC 3.3V
7 XTAL1 Crystal 8MHz
8 XTAL2 Crystal 8MHz
9 PD5 Not connected
10 PD6/AIN0 PPM sum signal input
11 PD7/AIN1 DC 1.46V
12 PB0 Channel 1 PPM output
13 PB1 Channel 2 PPM output
14 PB2 Channel 3 PPM output
15 PB3 Channel 4 PPM output
16 PB4 Channel 5 PPM output
17 PB5 Channel 6 PPM output
18 AVCC AVCC 3.26V
19 ADC6 Not connected
20 AREF AREF 3.26V
21 GND GND
22 ADC7 Not connected
23 PC0/ADC0 RSSI signal input
24 PC1/ADC1 PPM signal threshold for analog comparator, level set by ext. voltage divider
25 PC2 PLL CE signal output
26 PC3 PLL DATA signal output
27 PC4 PLL CLK signal output
28 PC5 Not connected
29 PC6 Channel 9 PPM output
30 PD0 Channel 8 PPM output
31 PD1 Channel 7 PPM output
32 PD2 Not connected

Unfortunately pin PC6, the RESET input, is used as IO pin, this means the ISP serial interface is disabled and one can’t dump the flash and EEPROM content. (Already tried 😉 ) Therefore only parallel programming is the way to go which is quite complicated due to the MLF package and required number of wiring connections.

Or maybe there is a hidden boot loader, the USART pins are available on the channel sockets, just need to find out how to activate boot mode if exists.

I made a HV programming adapter and tried to dump the flash of the controller. Unfortunately the memory protection fuse is set, so that’s not an option.
The boot reset fuse isn’t set so there is no bootloader installed.

A fact: The QRG 225K01 is definately an ATmega88 since the signature bytes match in AVR-Studio.

Some more work to do. In any case a firmware for the AVR can must be programmed from scratch.

13 thoughts on “Corona RP8D1 – Reverse Engineering

  1. Hi

    Thanks. This is interesting. Does this mean one can´t get RSSI and PPM signals out of it?

    • Does this mean one can´t get RSSI and PPM signals out of it?

      Why yoou think so? Did you looked at the pictures? One shows the places where you can connect to the RSSI and PPM sum signal.

  2. Sorry. I think I understood wrong. I can see where the PPM sum signal can be connected to. But what about RSSI? Is it somewhere along the purple dotted line? Can you kindly point out the resistors where the RSSI signal can be picked up from without wiring to the SA616 pin 5? Thanks.

    • Pick up the RSSI signal on the bigger component connected to the purple dotted line, in the upper left of the purple arrow.

  3. Hello Michael.

    I have a corona with the ATmega88V controller inside and i tring to get the ppmsum from the pad as the Board bottom layer pic posted. It seems this not work for me i dont know why….

    I’ll try to solder a wire to the #10 pin for get the PPM sum signal input, Maybe this could work??

    Thank you..

    • The sum signal is 3.3V squarewave. Check if your external electronic can handle the lower voltage level.

      Soldering directly to pin 10 makes no sense since the signal is routed through some additional components, so might be even lower.

      May you need a buffer circuit if your external electronic puts to much load on the sum signal.

      • I did it¡¡¡¡

        As you said, the ppmsum signal is very low. With a simple circuit i get the signal to 5V values…

        The Rssi pin works fine too.

        Thanks

  4. In the last picture on this site u can see it on right A226 capacitor under metal shield .
    YJ42

Leave a Reply

Your email address will not be published. Required fields are marked *

Comments will be moderated! Spam deleted immediately!
Before you submit form:
Human test by Not Captcha