Esky Radio

First off, a big thank you to Itai N over at RCGroups.com for figuring most of this out!

The Esky 2.4 GHz equipment uses the Nordic NRF2401AG in both the transmitter and receiver. A compatible alternative to this chip is the NRF24L01+ (which is widely available).

The binding process
When you turn the transmitter on, it will start broadcasting binding information for a few seconds. It uses the following settings:

• CRC: 2 bytes
• Address width: 3 bytes
• Address: 0x00 0x00 0x00
• Payload: 13 bytes
• Data rate: 1 Mbit/sec
• Channel: 50

The binding packets contain the following information:

• bytes 0-2: address bytes
• byte 3: band information
• byte 4: unknown, 24 (0x18) on both tested transmitters
• byte 5: unknown, 41 (0x29) on both tested transmitters
• byte 6-12: always 0

The address bytes are the first three bytes of the four byte address the transmitter will send its data packets to. The fourth address byte is always 0xBB. The band information byte (as I call it) gives information about the channels the transmitter will transmit on. This byte increments by one every time you turn the transmitter on. It starts at 10 (0x0A) and goes up until 83 (0x53) after which it overflows to 10. The transmitter uses two bands of channels to transmit on, both bands are 7 channels wide and their first channels are 37 channels apart. With every increment of the band-byte the bands shift 5 channels up until their starting channel goes above 80, then its starting channel will shift back to the start channel of the other band minus 37. This gives the following channels

##: Band1, Band2
10:  7-13, 44-50
11: 12-18, 49-55
12: 17-23, 54-60
13: 22-28, 59-65
14: 27-33, 64-70
15: 32-38, 69-75
16: 37-43, 74-80
17: 42-48, 79-85
18: 47-53, 10-16
19: 52-58, 15-21
20: 57-63, 20-26
21: 62-68, 25-31
22: 67-73, 30-36
23: 72-78, 35-41
24: 77-83, 40-46
25:  8-14, 45-51
26: 13-19, 50-56
27: 18-24, 55-61
28: 23-29, 60-66
29: 28-34, 65-71
30: 33-39, 70-76
31: 38-44, 75-81
32: 43-49, 80-86
33: 48-54, 11-17
34: 53-59, 16-22
35: 58-64, 21-27
36: 63-69, 26-32
37: 68-74, 31-37
38: 73-79, 36-42
39: 78-84, 41-47
40:  9-15, 46-52
41: 14-20, 51-57
42: 19-25, 56-62
43: 24-30, 61-67
44: 29-35, 66-72
45: 34-40, 71-77
46: 39-45, 76-82
47: 44-50,  7-13
48: 49-55, 12-18
49: 54-60, 17-23
50: 59-65, 22-28
51: 64-70, 27-33
52: 69-75, 32-38
53: 74-80, 37-43
54: 79-85, 42-48
55: 10-16, 47-53
56: 15-21, 52-58
57: 20-26, 57-63
58: 25-31, 62-68
59: 30-36, 67-73
60: 35-41, 72-78
61: 40-46, 77-83
62: 45-51,  8-14
63: 50-56, 13-19
64: 55-61, 18-24
65: 60-66, 23-29
66: 65-71, 28-34
67: 70-76, 33-39
68: 75-81, 38-44
69: 80-86, 43-49
70: 11-17, 48-54
71: 16-22, 53-59
72: 21-27, 58-64
73: 26-32, 63-69
74: 31-37, 68-74
75: 36-42, 73-79
76: 41-47, 78-84
77: 46-52,  9-15
78: 51-57, 14-20
79: 56-62, 19-25
80: 61-67, 24-30
81: 66-72, 29-35
82: 71-77, 34-40
83: 76-82, 39-45

Data packets will be send with the following settings:

• CRC: 2 bytes
• Address width: 4 bytes
• Address: 0xBB + 3 bytes from binding packet (you have to sent if over SPI in reverse order, so send packetB2, packetB1, packetB0, 0xBB in that order).
• Payload: 13 bytes
• Data rate: 1 Mbit/sec
• Channel: Based on fourth byte of binding packet, you can just scan all channels until you receive data. Just make sure to listen for 10 milliseconds or so on a channel before moving to the next.

The data packets contain the following information:

• bytes 0-1: channel 1 in milliseconds (High order byte comes first, so do (byte0 << 8) | byte1 to get the value)
• bytes 2-3: channel 2 in milliseconds
• bytes 4-5: channel 3 in milliseconds
• bytes 6-7: channel 4 in milliseconds
• bytes 8-9: channel 5 in milliseconds
• bytes 10-11: channel 6 in milliseconds
• byte 12: This will change with every packet. For the first packet it will be number 6, the seconds packet it will be the first channel it's transmitting on times two, the third packet it will be the second channel it's transmitting on times two.

The channel info byte will have the following values for the matching band byte from the binding packet:

10:  94,  20
11: 104,  30
12: 114,  40
13: 124,  50
14: 134,  60
15: 144,  70
16: 154,  80
17:  16,  90
18:  26, 100
19:  36, 110
20:  46, 120
21:  56, 130
22:  66, 140
23:  76, 150
24:  86, 160
25:  96,  22
26: 106,  32
27: 116,  42
28: 126,  52
29: 136,  62
30: 146,  72
31: 156,  82
32:  18,  92
33:  28, 102
34:  38, 112
35:  48, 122
36:  58, 132
37:  68, 142
38:  78, 152
39:  88,  14
40:  98,  24
41: 108,  34
42: 118,  44
43: 128,  54
44: 138,  64
45: 148,  74
46: 158,  84
47:  20,  94
48:  30, 104
49:  40, 114
50:  50, 124
51:  60, 134
52:  70, 144
53:  80, 154
54:  90,  16
55: 100,  26
56: 110,  36
57: 120,  46
58: 130,  56
59: 140,  66
60: 150,  76
61: 160,  86
62:  22,  96
63:  32, 106
64:  42, 116
65:  52, 126
66:  62, 136
67:  72, 146
68:  82, 156
69:  92,  18
70: 102,  28
71: 112,  38
72: 122,  48
73: 132,  58
74: 142,  68
75: 152,  78
76:  14,  88
77:  24,  98
78:  34, 108
79:  44, 118
80:  54, 128
81:  64, 138
82:  74, 148
83:  84, 158

Esky transmitters appear to transmit 150 packets on both channels every second (so that's 300 packets per second total). However it only transmits 50 unique packets of channel data per second; it will send each data packet three times to both channels. So, for example. If we have a band byte of 10 we get the following six packets:

ch47: <ch1h>,<ch1l>,<ch2h>,<ch2l>,<ch3h>,<ch3l>,<ch4h>,<ch4l>,<ch5h>,<ch5l>,<ch6h>,<ch6l>,6
ch47: <ch1h>,<ch1l>,<ch2h>,<ch2l>,<ch3h>,<ch3l>,<ch4h>,<ch4l>,<ch5h>,<ch5l>,<ch6h>,<ch6l>,94
ch47: <ch1h>,<ch1l>,<ch2h>,<ch2l>,<ch3h>,<ch3l>,<ch4h>,<ch4l>,<ch5h>,<ch5l>,<ch6h>,<ch6l>,20
ch10: <ch1h>,<ch1l>,<ch2h>,<ch2l>,<ch3h>,<ch3l>,<ch4h>,<ch4l>,<ch5h>,<ch5l>,<ch6h>,<ch6l>,6
ch10: <ch1h>,<ch1l>,<ch2h>,<ch2l>,<ch3h>,<ch3l>,<ch4h>,<ch4l>,<ch5h>,<ch5l>,<ch6h>,<ch6l>,94
ch10: <ch1h>,<ch1l>,<ch2h>,<ch2l>,<ch3h>,<ch3l>,<ch4h>,<ch4l>,<ch5h>,<ch5l>,<ch6h>,<ch6l>,20

Also note that after the transmitter has sent the binding packets, it will send one (or more) starting packets. These contain only the value 0xCC in the payload (all thirteen bytes will be identical).

[dvdouden]

To get the list of bands channels, use the following code snippet

#include <stdio.h>

int main(int p_argc, char* p_argv[])
{
    int band1 = 7;
    int band2 = band1 + 37;
    for (int i = 10; i < 84; ++i)
    {
        printf("%2d: %2d-%2d, %2d-%2d\n", i, band1, band1 + 6, band2, band2 + 6);
        band1 += 5;
        band2 += 5;
        if (band2 > 80)
        {
            band2 = band1 - 37;
        }
        if (band1 > 80)
        {
            band1 = band2 - 37;
        }
    }
    return 0;
}

[dvdouden]

To get the list of possible channel numbers, use the following code snippet:

#include <stdio.h>

int main(int p_argc, char* p_argv[])
{
    int channel2 = 10;
    int channel1 = channel2 + 37;
    for (int i = 10; i < 84; ++i)
    {
        printf("%2d: %3d, %3d\n", i, channel1 * 2, channel2 * 2);
        channel1 += 5;
        channel2 += 5;
        if (channel2 > 83)
        {
            channel2 = channel1 - 37;
        }
        if (channel1 > 83)
        {
            channel1 = channel2 - 37;
        }
    }
    return 0;
}