Flash DJT module with Frsky X series / Multiprotocol fw ?

Choosing an RF Module? What modules work? What is compatible with the 9x?
Post Reply
Flyjp
Posts: 7
Joined: Thu Feb 07, 2019 6:39 pm
Country: France

Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Flyjp »

Hello,

Is it possible to flash an Frsky DJT module with the Multiprotocol firmware ?
Since the DJT contains a STM32F103C8T6 mcu and a cc2500 radio chip I guess someone already checked ?
Is the pinout very different from the multiprotocol modules ?
Also, is it possible to flash a Frsky XJT firmware on it ? DJT lacks SPort though ...
The aim would be to use my DJT with an XM+ receiver.

Thanks

User avatar
Kilrah
Posts: 11107
Joined: Sat Feb 18, 2012 6:56 pm
Country: Switzerland

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Kilrah »

No and no.

The first could theoretically be possible but nobody has worked on it.
Flyjp
Posts: 7
Joined: Thu Feb 07, 2019 6:39 pm
Country: France

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Flyjp »

I started to have a look at the possibility to flash the Multiprotocol on the DJT

First I wanted to confirm that the serial port is on USART1
The pinout of the serial port is the following :
RX232 => SP3232 R1IN | R1OUT => STM32F103 PA10 (USART1_RX)
TX232 => SP3232 T1OUT | T1IN => STM32F103 PA9 (USART1_TX)
I also found the push button and buzzer routing, but didn't manage to get the LEDS and DIP switch.
BUZZER => STM32F103 PB1 edit - corrected
PUSH BUTTON => STM32F103 PB15 edit - corrected
The BOOT0 pin is connected to a resistor tied to GND and there is a pad next to it to pull it up to 3.3V / edit - corrected
PB2/BOOT1 pin seems not connected / edit - corrected

By connecting a FDTI with a RS232 converter on the module I was able to see the telemetry packet on my computer.
I then put the both DIP switches to ON to enter in Frsky firmware upgrade.
In the file https://github.com/JamesCordell/frsky_u ... update.cpp I found that the Frsky program is using 115200bauds.
When in firmware update mode the DJT module is sending the following sequence repeatedly : 47 FA 03 01 01 C9 A6 83 03 0E AF
I installed stm32flash from http://stm32flash.sourceforge.net/ and tried it :
stm32flash /dev/ttyUSB0 -b 115200
But I got no results :
Interface serial_posix: 115200 8E1
Failed to init device.

I tried different baudrates, with the DIP on and off but without success.

Is there a way to compile the Multiprotocol firmware in .frk to upload it with frskyupdate ?
Also I noticed that the Multoprotocol module is using the STM32F103CBT6 which has 128k of ram instead of the STM32F103C8T6 with 64k installed on the DJT module.

Edit : my pin reading was wrong, I corrected it and found that there is a pad to pull the BOOT0 pin to 3.3V !
Last edited by Flyjp on Sat Feb 09, 2019 4:07 pm, edited 1 time in total.
User avatar
Kilrah
Posts: 11107
Joined: Sat Feb 18, 2012 6:56 pm
Country: Switzerland

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Kilrah »

FrSky uses a custom bootloader which takes encrypted frk files over a custom protocol, so you won't be able to use it. Need to either solder to the BOOT0 pin to invoke the built-in ST bootloader or use an ST-Link and erase the chip before reflashing to something else (and permanently lose the ability to revert to the original frsky firmware in the process).
Flyjp
Posts: 7
Joined: Thu Feb 07, 2019 6:39 pm
Country: France

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Flyjp »

Thank you for your answer Kilrah.
When you speak about the ST-Link, it could only erase the STM32, or I could read the flash and restore it later ?
I rectified the pin reading (must have been tired yesterday) and there is a pad to pull BOOT0 to 3.3V.
I soldered the pads together and the behavior changes, the MCU no longer executes the program (no buzzer / RC signal) regardless of the DIP position.
The leds are behaving similarly than when the module has been put in Frsky FW update and then without power cycle the DIP are moved.
This is, when both DIP are OFF both leds are dimmed, when one DIP is ON the green led is dimmed and the other led is off, and vice versa with the red led, and when both DIP are ON both leds are off.
Still, no luck with stm32flash. When I send bytes the MCU always answer 0x00.

User avatar
Kilrah
Posts: 11107
Joined: Sat Feb 18, 2012 6:56 pm
Country: Switzerland

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Kilrah »

The chip's readout protection is of course enabled, so you cannot read the existing contents. Once you manage to connect to the built-in STM bootloader (or use an ST-Link) your only available option will be to erase the chip before being able to do anything else.
Flyjp
Posts: 7
Joined: Thu Feb 07, 2019 6:39 pm
Country: France

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Flyjp »

Thanks for the answer.
At this point I can accept to loose the Frsky uploader, but it would be nice to be able to flash multiprotocol instead of just bricking the module.
I will continue to try to connect to the ST bootloader via USART1 since at the moment I don't have an STlink or JTAG programmer.

In anticipation I investigated the SWD / JTAG pins of the STM32 and found the following :
PA13 (JTMS/SWDIO) => 10k pullup 3.3V
PA14 (JTCK/SWCLK) => 10k pulldown
PA15 (JTDI) => 10k pullup 3.3V + LNA area, multiple vias (?)
PB3 (JTDO) => 10k pullup 3.3V
PB4 (JNTRST) => 10k pullup 3.3V + LNA area, multiple vias (?)
There seems to be some connection with the LNA, maybe an enable pin or something for the range check ?
I didn't find the RF module schematics on Pascal Langer's Github, I wanted to have the LNA reference and see if there is something similar.

Also I checked the CC2500 wiring and found the following :
CC2500 GDO => STM32F103 PA3
CC2500 CSn => STM32F103 PA4 (SPI1_NSS)
CC2500 SCK => STM32F103 PA5 (SPI1_SCK)
CC2500 SO => STM32F103 PA6 (SPI1_MISO)
CC2500 SI => STM32F103 PA7 (SPI1_MOSI)
Standard usage of the SPI1 port, however the CSN pin is different to the one in the Multiprotocol code, but nothing complicated to adapt.

There is a TSSOP8 chip next to the STM32 that seems to be an EEPROM, and is connected like this :
TSSOP8 1 => GND + pullup 3.3V + ??
TSSOP8 2 => GND + pullup 3.3V + ??
TSSOP8 3 => GND + pullup 3.3V + ??
TSSOP8 4 => GND + pullup 3.3V + ??
TSSOP8 5 => STM32F103 PB7 (I2C1_SCL)
TSSOP8 6 => STM32F103 PB6 (I2C1_SDA)
TSSOP8 7 => NC (?)
TSSOP8 8 => 3.3V
On the package it reads 402WT K636 with the ST logo, but I didn't find a corresponding part number or datasheet.
User avatar
Kilrah
Posts: 11107
Joined: Sat Feb 18, 2012 6:56 pm
Country: Switzerland

Re: Flash DJT module with Frsky X series / Multiprotocol fw ?

Post by Kilrah »

You only need SWDIO and SWCLK for the ST-Link.

The TSSOP chip is an EEPROM indeed, you can just ignore it.

Post Reply

Return to “RF MODULES”