I've been playing with a V911 transmitter which contains the A7105 FSK Tx/Rx chip. This transmitter uses 3-wire SPI to send data which makes it easy to look at. The V911 is compatible with the Turnigy 9X/FlySky FS-TH9X, though it is only a 4-channel heli. Initial analysis shows that all channel data is sent in 22-byte frames every ~1.5ms The data in the frame is apparently not encrypted, and each channel is sent as a 16bit little-endian word. The A7105 Data sheet can be found here: After power-on, the following steps are initiated: 1) A7105 is reset send (0x00, 0x00) 2) Send 32bit address to address 0x06: 0x5475c52a 3) Program the A7105 control registers as follows: Code: 0x00: --, 42, 00, 14, 00, --, --, 00, 00, 00, 00, 01, 21, 05, 00, 50 0x10: 9e, 4b, 00, 02, 16, 2b, 12, 00, 62, 80, 80, 00, 0a, 32, c3, 0f 0x20: 13, c3, 00, --, 00, 00, 3b, 00, 17, 47, 80, 03, 01, 45, 18, 00 0x30: 01, 0f, -- 4) Put the A7105 into the 'Standby' state (Strobe = 0xa0) 5) Write '1' to address 0x02 to start the IF Filter Bank calibration 6) Poll address 0x02 until it returns '0' indicating calibration is complete 7) Read IF calibration info from Address 0x22 8) Write VCO Current calibration to 0x24 (value = 0x13) 9) Write VCO Bank calibration limits to 0x26 (value = 0x3b) 10) Write channel to Address 0x0f (value = 0x00) 11) Write '2' to address 0x02 to start VCO bank Calibration 12) Poll address 0x02 until it returns '0' indicating calibration is complete 13) Read VCO calibration from Address 0x25 (test for success?) 14) Write channel to Address 0x0f (value = 0xa0) 15) Write '2' to Address 0x02 to start VCO bank Calibration 16) Poll address 0x02 until it returns '0' indicating calibration is complete 17) Read VCO calibration from Address 0x25 (test for success?) 18) Write manual VCO Bank calibration to Address 0x25 (value = 0x08) ??? 19) Put the A7105 into the 'Standby' state (Strobe = 0xa0) 20) Start sending frames as follows Frames are sent each 1.46ms. Each frame consists of sending a 'FIFO Write Pointer Reset' (Strobe = 0xe0), 22 bytes of data, setting the channel (via the 0x0f register) and then sending 'TX mode' (Strobe = 0x0d) to actually initiate the transfer The frame data is not encrypted, and is 16-bit little endian. the data appears to be as follows. Fo each channel the minimum value I observed was ~ 0x03e8 and the maximum was ~ 0x07ca. TX1 TX2 word 1: 0xaa05/0x5505 word 2/3: 32bit ID (littel endian) word 4: aileron (ch1) word 5: elevator (ch2) word 6: throttle (ch3) word 7: rudder (ch4) word 8: (ch5) word 9: (ch6) word 10: (ch7) word 11: (ch8) Word 1 is 0xaa05 until 3 seconds have elapsed and the throttle has been broughtto its minimum value. It then changes to 0x5505 at the same time that the Tx starts cycling between channels Word 2 and 3 are the Transmitter's Unique ID (thanks zeza from RCGroups) zeza has confirmed channels 5-8 on a Turnigy 9x (Thanks!) The Tx channel will be 01 until initialization is done and the throttle is brought to 0. At ~ 3 seconds, data is transmitted on multiple channels. Channel ordering is dependent on Transmitter ID as follows: Tx2: ID = 0x70000002 Channels =0a, 5a, 50, a0, 14, 64, 46, 96, 1e, 6e, 3c, 8c, 28, 78, 32, 82 Tx1: ID = 0x200001f3 Channels =79, 29, 6f, 1f, 83, 33, 65, 25, 8d, 3d, 5b, 0b, 97, 47, 51, 01 The sequence is based on one of 16 base sequences indexed via 'ID mod 16': 00: 0x0a 0x5a 0x14 0x64 0x1e 0x6e 0x28 0x78 0x32 0x82 0x3c 0x8c 0x46 0x96 0x50 0xa0 01: 0xa0 0x50 0x96 0x46 0x8c 0x3c 0x82 0x32 0x78 0x28 0x6e 0x1e 0x64 0x14 0x5a 0x0a 02: 0x0a 0x5a 0x50 0xa0 0x14 0x64 0x46 0x96 0x1e 0x6e 0x3c 0x8c 0x28 0x78 0x32 0x82 03: 0x82 0x32 0x78 0x28 0x8c 0x3c 0x6e 0x1e 0x96 0x46 0x64 0x14 0xa0 0x50 0x5a 0x0a 04: 0x28 0x78 0x0a 0x5a 0x50 0xa0 0x14 0x64 0x1e 0x6e 0x3c 0x8c 0x32 0x82 0x46 0x96 05: 0x96 0x46 0x82 0x32 0x8c 0x3c 0x6e 0x1e 0x64 0x14 0xa0 0x50 0x5a 0x0a 0x78 0x28 06: 0x50 0xa0 0x28 0x78 0x0a 0x5a 0x1e 0x6e 0x3c 0x8c 0x32 0x82 0x46 0x96 0x14 0x64 07: 0x64 0x14 0x96 0x46 0x82 0x32 0x8c 0x3c 0x6e 0x1e 0x5a 0x0a 0x78 0x28 0xa0 0x50 08: 0x50 0xa0 0x46 0x96 0x3c 0x8c 0x28 0x78 0x0a 0x5a 0x32 0x82 0x1e 0x6e 0x14 0x64 09: 0x64 0x14 0x6e 0x1e 0x82 0x32 0x5a 0x0a 0x78 0x28 0x8c 0x3c 0x96 0x46 0xa0 0x50 0a: 0x46 0x96 0x3c 0x8c 0x50 0xa0 0x28 0x78 0x0a 0x5a 0x1e 0x6e 0x32 0x82 0x14 0x64 0b: 0x64 0x14 0x82 0x32 0x6e 0x1e 0x5a 0x0a 0x78 0x28 0xa0 0x50 0x8c 0x3c 0x96 0x46 0c: 0x46 0x96 0x0a 0x5a 0x3c 0x8c 0x14 0x64 0x50 0xa0 0x28 0x78 0x1e 0x6e 0x32 0x82 0d: 0x82 0x32 0x6e 0x1e 0x78 0x28 0xa0 0x50 0x64 0x14 0x8c 0x3c 0x5a 0x0a 0x96 0x46 0e: 0x46 0x96 0x0a 0x5a 0x50 0xa0 0x3c 0x8c 0x28 0x78 0x1e 0x6e 0x32 0x82 0x14 0x64 0f: 0x64 0x14 0x82 0x32 0x6e 0x1e 0x78 0x28 0x8c 0x3c 0xa0 0x50 0x5a 0x0a 0x96 0x46 The column is advanced one on each packet The channel itself is modified by channel = base_channel - (id & 0xff) / 16