Trying to receive LT8900 frames with my NRF24L01

[kinsi55]

First off: This is pretty off-topic to this repo, I just hope someone here would be able to help me out since it seems related :D

I have a 2.4GHz remote which uses a LT8900 chip. I have sniffed its SPI communication to figure out its registers, this is them:

/** REG 32 (0b00100000)
   * 010      PREAMBLE_LEN      = 3 bytes
   * 11       SYNCWORD_LEN      = 64 Bits
   * 000      TRAILER_LEN       = 4 bits
   * 00       DATA_PACKET_TYPE  = NRZ law data
   * 00       FEC_TYPE          = No FEC
   * 000      BRCLK_SEL         = keep low
   * 0        Reserved
   */
  /**
   * REG 41 (0b00101001)
   * 1        CRC_ON            = TRUE
   * 0        SCRAMBLE_ON       = FALSE
   * 1        PACK_LENGTH_EN    = LT8900 regards first byte of payload as packet length descriptor byte.
   * 1        FW_TERM_TX        = When FIFO write point equals read point, LT8900 will terminate TX when FW handle packet length.
   * 0        AUTO_ACK          = After receive, do not send ACK or NACK; just go to IDLE.
   * 1        PKT_FIFO_POLARITY = PKT flag, FIFO flag Active low
   * 00       Reserved
   * 00000000 CRC_INITIAL_DATA  = Initialization constant for CRC calculation.
  */
  /** REG 7 (0b00000111)
   * 0000000  Reserved
   * 0/1      TX_EN
   * 0        RX_EN
   * 1001100  RF_PLL_CH_NO      = 76
   */

Syncword:

  // SYNCWORD (39-36)
  //0b10000000
  //0b00000011

  //0b01011010
  //0b01011010

  //0b10100101
  //0b10100101

  //0b00000011
  //0b10000000

Based off the NRF & LT documentation, I'd need to set the Channel to 78 which I have done

// NRF: F 0 = 2400 + RF_CH [MHz]
  // LT9800: The on-air frequency will be: f = 2402 + RF_PLL_CH_NO.
  radio.setChannel((2402-2400) + 76);

Now I have disabled AutoAck, Retries and CRC and set the data rate to 1MBPS, however no matter what I try as the address for the reading pipe, with no setup do I actually receive messages whenever I press a button on the remote - at best I get nothing, at worst I just get random messages unrelated to my keypresses.

I am aware that the preamble of the remote is set to 3 bytes, so I tried prepending either 0xAA or 0x55 to the Syncword but to no avail so I am kinda stuck now.

Any help would be appreciated, much thanks!

[kinsi55]

I got desperate and soldered my own MCU to the remotes LT Chip and I'm really out of ideas now. I am literally "forging" my own packets on the sender by sending { 0b10101010, 0xFF, 0x00, 0x00, 0x00, 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 } and having 0xFF, 0x00, 0x00, 0x00, 0xFF as the address on the nRF receiver, but still, nothing is received

[pascallanger]

What's the bitrate ?

[kinsi55]

Its 1mbps

[kinsi55]

Ok so I have no clue what it is that I did, but I am now able to receive the packets I manually constructed/sent. This should hopefully be able to give me enough clues to receive the remotes packets also.

[kinsi55]

I cracked the code, I think - For the one person who will stumble upon this thread in 10 years:

The LT chips have a configurable trailer after the syncword bytes, by default this one is 4 bits long - We can simply account for this by making the 0 bytes of the trailer part of the syncword / by adding 4 0 bits into the syncword

Furthermore, every byte sent by the LT chips is sent in reverse order, so when setting the address on the receiver, every byte needs to be reversed compared to the original syncword

Given these criteria, this is the syncword setup on the sender (LT)

uint8_t x[] = {
  0x02,
  0x02,
  0x02,
  0x02,
  0x02,
  0x02,
  0xFF,
  0x03,
};

lt.setSyncWordLength(0x11);
lt.setSyncWord(u64_from_can_msg(x));

And this is the corresponding address configuration on the receiver (nRF)

uint8_t x[] = {
  0x03,
  0xFF,
  0x02,
  0x02,
  0x02,

  // We only use 5 Bytes
  0x00,
  0x00,
  0x00,
};

for(int i = 0; i < sizeof(x); i++)
  x[i] = reverseByte(x[i]);

radio.setAddressWidth(5);
auto addr = u64_from_can_msg(x) >> 4;
radio.openReadingPipe(0, addr);

Figuring this out was extremely annoying to say the least.

[pascallanger]

Everything you are saying is already in the lt8900 emu layer documented on this GitHub.

[pascallanger]

You have TX and RX emulation as it was used in a rc motorcycle.

[kinsi55]

Oh, well that is good to know and something I should've probably checked 😅 Thanks for the hardsup

[kinsi55]

One more thing I'm curious about - The chip on the remote is an LT8900, not 8910, so it should only support 1mbps.

However, register 44 is set to 100 (00000100 00000000) which is entirely undocumented, but accepted by the chip - Do you have any clue what this might mean?

When I replicate this with in my sender code, my receiver doesnt receive anything anymore.

EDIT: Nevermind I got hex / dec / binary confused, it gets set to 250 kbps which is supported by the nRF but for some reason will not receive anything either. More things to look into I guess.

[kinsi55]

One more question if you dont mind, the receiver module I have is not a NRF24L01+ but rather its clone, Si24R1

Now I have replicated all the registers of the remote, including the syncword on my replicated transmitter (LT):

lt.writeRegister(37, 0b1010010110100101);
lt.writeRegister(38, 0b0101101001011010);
lt.writeRegister(39, 0b0000001110000000);

lt.setChannel(76);

lt.writeRegister(9,  0b0100100000000000);
lt.writeRegister(23, 0b1000000000000101);
lt.writeRegister(32, 0b0101100000000000);
lt.writeRegister(34, 0b0010000000000000);
lt.writeRegister(35, 0b0001000000000000);
lt.writeRegister(41, 0b1011010000000000);
lt.writeRegister(42, 0b0000110110110000);

lt.writeRegister(44, 0b0000010000000000);
lt.writeRegister(45, 0b0000010101010010);

lt.setDataRate(LT8900::LT8910_250KBPS);

And adapted your emulation layer code on the receiver - And this works fine, if I use 1Mbps as the transfer rate, if I switch to 250kbps tho which is used by the remote I dont receive anything anymore all-else-equal. Are you aware of any differences between 1mbps and 250kbps or could this just be an incompatability of the cloned receiver?

[kinsi55]

I have now bought an original nRF chip and.. It still doesnt work. I guess 250kbps just isnt on-air compatible.

[pascallanger]

If you have a CC2500 you can try to adjust slightly the frequency and bitrate which you can't do with a NRF. FYI, the NRF is also struggling to emulate the XN297 at 250K, this is why I'm using the CC2500 for that job if present on the module.

[kinsi55]

I see. The reason I tried to use an nRF from the beginning is that I was unable to find a breakout board for the LT chip - I have however now found one for the 8920 and ordered that - Hopefully that should solve my problems, if not you just gave me another thing to try 😅 Thanks for all the help.