Controlling a FPV receiver tuner module

Ok Dan, here you go. 😉

A short summary of my attempts to control the tuner modules of widely spread 1.3GHz FPV receivers.

The description covers the receivers coming with two sets shown below:

1.3 GHz Wireless AV Receiver

The first one is a 23 channel receiver, the second a 4 channel only.

Both receivers are equipped with the same tuner module which uses a TA1322FN down converter. The tuner module is driven by a micro-controller via I2C bus. Details about the internal I2C bus protocol can be found in the TA1322FN datasheet.

The tuner module is set by a single 4 byte data frame in both receivers.
The following is an example from the 4 channel receiver setting the receiving frequency to 1080Mhz:

Data frame send to tuner: 0xC2 0x30 0xBC 0x8E

Split up in accordance with the datasheet:

ADDR   1   1   0   0   0   0   1   0   = 0xC2
                          MA1 MA0 R/W
DIV1   0   0   1   1   0   0   0   0   = 0x30
          N14 N13 N12 N11 N10 N09 N08
DIV2   1   0   1   1   1   1   0   0   = 0xBC
      N07 N06 N05 N04 N03 N02 N01 N00
CTRL   1   0   0   0   1   1   1   0   = 0x8E
           CP  T1  T0 TS2 TS1 TS0  OS

ADDR = tuner module I2C address
DIV1 & DIV2 = PLL divider
CTRL = PLL control byte

Band switch byte is not send and therefore not used.
From the control byte the PLL is set to:
– 50uA charge pump current
– normal operation mode & charge pump on
– reference divider 1/64 resulting in 62.5 KHz reference frequency

The divider is set to 12476. With the following math it´s possible to calculate the reception frequency:
fosc = 2 x fr x divider = 2 x 62.5 KHz x 12476 = 1559.5 MHz

To high? No, you must subtract the 1. IF with 480 MHz, so 1559.5 MHz – 480 MHz = 1079.5 MHz

The 23channel receiver uses a slightly different data frame 0xC2 0x30 0xC8 0x8E which results in a reception frequency of 1081 MHz.

For my tests I used a USB-I2C interface. The USB-ISS from is very handy for this purpose and supports not only I2C but also other bus types.

VS2010 Source code for PC based MFC program is attached to this post. The program will just let you set the reception frequency in a range from 850 MHz to 2200 MHz.

FPV Receiver tuner control
FPV Receiver tuner control
Version: 1.0
207.6 KB

Corona RP8D1 – Reverse Engineering

Due to my special interests in a customized RC transmitter and receiver system I started with reverse engineering of a Corona RP8D1 35MHz receiver.

The RP8D1 is my favourite candidate cause it´s a double superheterodyne receiver, uses a PLL synthesizer and is controller by an AVR ATmega88V.

Interesting fact about the micro-controller:

Corona obviously has been changed the controller type on actual receiver boards. The first receiver I bought in mid 2010 uses the mentioned ATmega88V.
Two newer receiver, bought in January 2011, are using a controller marked “225K01” with manufacturer “QRG”.

Fact is the PCB layout is 100% identical on both receivers so must be the pin-out of the different controllers!

So the 225K01 is either a clone or some official AVR derivative, already contacted Atmel for details.

Used components, followed by pictures and the controller pin-out:

  • Controller AVR ATmega88V on mid 2010 board
  • Controller QRG 225K01 on 2011 boards
  • Rohm BU2630 Dual PLL
  • Rohm BH4126 Wideband IF Detector
  • Philips SA616DK High Performance Mixer FM IF System

Board top layer:
Corona RP8D1 Top Layer

Board top layer, filter and crystal removed:

RP8D1 Top Layer with filter and crystal removed

A word about the second LED (PLL lock detect) on the RP8D1: The LED will signal the status of the PLL control loop. If the LED lights the PLL is out of sync, that means the synthesizer can not set the receiving frequency correctly. For normal operation the LED shall be always off.

Board bottom layer:
There is a typo in the picture, the controller type is 225K01.

RP8D1 Bottom Layer

The RSSI signal can be picked up for external use easily on one of the resistors instead of removing the filter and wiring to the SA616 pin 5.

Receiver board with AVR ATmega88V controller:

RP8D1 with ATmega88V

Receiver board with QRG 225K01 controller:

RP8D1 with QRG 225K01 controller

Controller pin-out:

Pin Name Function
1 PD3 Bind button input
2 PD4 Bind LED output
4 VCC VCC 3.3V
6 VCC VCC 3.3V
7 XTAL1 Crystal 8MHz
8 XTAL2 Crystal 8MHz
9 PD5 Not connected
10 PD6/AIN0 PPM sum signal input
11 PD7/AIN1 DC 1.46V
12 PB0 Channel 1 PPM output
13 PB1 Channel 2 PPM output
14 PB2 Channel 3 PPM output
15 PB3 Channel 4 PPM output
16 PB4 Channel 5 PPM output
17 PB5 Channel 6 PPM output
18 AVCC AVCC 3.26V
19 ADC6 Not connected
20 AREF AREF 3.26V
22 ADC7 Not connected
23 PC0/ADC0 RSSI signal input
24 PC1/ADC1 PPM signal threshold for analog comparator, level set by ext. voltage divider
25 PC2 PLL CE signal output
26 PC3 PLL DATA signal output
27 PC4 PLL CLK signal output
28 PC5 Not connected
29 PC6 Channel 9 PPM output
30 PD0 Channel 8 PPM output
31 PD1 Channel 7 PPM output
32 PD2 Not connected

Unfortunately pin PC6, the RESET input, is used as IO pin, this means the ISP serial interface is disabled and one can´t dump the flash and EEPROM content. (Already tried 😉 ) Therefore only parallel programming is the way to go which is quite complicated due to the MLF package and required number of wiring connections.

Or maybe there is a hidden boot loader, the USART pins are available on the channel sockets, just need to find out how to activate boot mode if exists.

I made a HV programming adapter and tried to dump the flash of the controller. Unfortunately the memory protection fuse is set, so that´s not an option.
The boot reset fuse isn´t set so there is no bootloader installed.

A fact: The QRG 225K01 is definately an ATmega88 since the signature bytes match in AVR-Studio.

Some more work to do. In any case a firmware for the AVR can must be programmed from scratch.