Help finding a Secret Menu!

[rockrockmcrock]

Hi guys,

You've been great at helping find some pretty obscure stuff in the past so here's a real puzzler.

I'm a RC hobbiest and I have a radio control transmitter - it's computerised and I know the manufacturer has a hidden service menu on their models for calibrating them.

In newer models this is done by shorting some pins on a memory module port (clock output pulled low).

Mine is an older version and does not have the memory module port - it does have another port for connecting it to a simulator. There are some reports that in the newest versions this simulator port and the memory port have to both be used to get the radio to enter the hidden service mode - so it looks like it could be a candidate.

The pins on the simulator port are:

0 = GROUND
1 = +V batteries (SWITCHED)
2 = PPM Signal OUT
3 = PPM Signal IN
4 = +V (for some transmitters only).
5 = Connecting pin 4 and 5 to each other on some transmitters will stop the HF-transmission and thus the transmitter will not send out any signal through its aerial and just use the simulator cable.

I think pulling pins 2 & 3 low (i.e. short to ground) look like good candidates for triggering the service menu. I understand what a PPM signal is but am not sure if this will do any damage - could it? Also what do you think? Any ideas?

Thanks guys!

 

[(*steve*)]

Maybe mentioning the manufacturer and model number might help people help you.

Connecting the PWM output to ground sounds like a potentially bad theing.

Connecting the PWM input to ground, or connecting the PWM output to the PWM input dound like much safr alternatives to try first though.

 

[rockrockmcrock]

Maybe mentioning the manufacturer and model number might help people help you.

Sorry, the manufacturer is Futaba and the model is a 9VAP - this would also apply to the models 7c etc. Not sure if that helps unless your an RC enthusiast though: http://www.modelflight.regheath.com/mf052/images/9VAP.jpg

Previous access to the Service menu on newer models with a CAMPAC memory port have been made like this: http://web.archive.org/web/20061110083836/home.socal.rr.com/hotweb/futabaserv/


However the 9VAP does not have a memory port (it was the top of the range model, just prior to the introduction of CAMPAC). The solution must be different - the only things I can think of are (a) a combination of button presses at start-up (b) a passive dongle on another port.

Here's the potential port that could be used to trigger the service menu (the Trainer or Sim port: http://www.mftech.de/buchsen_en.htm

And how they are connected for 2 x transmitters operating a trainer system: http://users.belgacom.net/TX2TX/tx2tx/english/tx2txgb7.htm

Connecting the PWM output to ground sounds like a potentially bad theing.
Connecting the PWM input to ground, or connecting the PWM output to the PWM input dound like much safr alternatives to try first though.

The signal out is PPM - I'm presuming there's not much difference with PWM (or PAM types etc. etc.) except how the signal is packaged? A bad idea then?

There is only one other possible port on the TX and that is the RF module port - here you plug in the RF frequency module you wish to use (i.e. 35MHz, 7035MHz etc.). I think this is an unlikely candidate for a dongle: http://www.rcgroups.com/forums/showthread.php?t=387442

 

[(*steve*)]

One reply out there on the net suggests that:

Unfortunately, there is no option in the 9V transmitters menu to switch Modes. This has to be done internally.

I would suggest opening up the device and looking for a DIP switch, or a jumper, or something similar.

 

[rockrockmcrock]

One reply out there on the net suggests that:
I would suggest opening up the device and looking for a DIP switch, or a jumper, or something similar.

Wow - you're good! I've been scouring the net for a month building up info - doubt I could have come up with that idea so fast! If you're not an RC enthusiast yourself then I'm doubly impressed

Unfortunately - the mode change doesn't require acess to the service menu. Information on the net suggests this is usually done by the addition/lack of a resistor on a chip: http://www.model-gadgets.com/info/servmenu/gallery/16_hardware.jpg

Original source information is here (the 9Z was the successor to the 9V): http://www.model-gadgets.com/info/servmenu/9zsm.htm

That doesn't preclude an internal switch for the 9V to enter service mode - although on opening it I found nothing obvious, bar a few test points near the main battery which info suggests (on the 8U and 9Z) are jumpered for several seconds to provide a hard reset.

 

[rockrockmcrock]

OK I'm going to go over the internal PCBs with a fine tooth comb - having read up on PPM it sounds like a dangerous idea to earth the signal.

 

[(*steve*)]

That resistor you point to is actually a link (the "000" on it tells me that).

If your version doesn't have this, then try adding a link here. For extra "cool points" wire in a DIP switch to allow you to switch it one way or the other -- that is, assuming this works.

No, I'm not involved with RC stuff at all. I am just a master at google-fu. Well, not even that. I just googled for "Futaba 9VAP service menu" and the mention of the jumper was on the second hit.

 

[rockrockmcrock]

Hacked it and got in! Big thanks!

That resistor you point to is actually a link (the "000" on it tells me that).

If your version doesn't have this, then try adding a link here. For extra "cool points" wire in a DIP switch to allow you to switch it one way or the other -- that is, assuming this works.

No, I'm not involved with RC stuff at all. I am just a master at google-fu. Well, not even that. I just googled for "Futaba 9VAP service menu" and the mention of the jumper was on the second hit.

A master you are! and I thought I was a google nija....well I am a consultant!

Thanks for your help mate - it wasn't the trainer/sim port, or the resistor, or the dip switch but, finally I hacked it. If you hadn't helped me rule out those alternatives I'd probably be still sitting around scratching my head! But a day or so ago.....fiddle, fiddle...ooo-er....BANG I'm in the service menu!

Big thanks again - I now have a recalibrated transmitter I can use. As the manufacturers will no longer service these sets as they're more than 5 years out of production, I am a very happy man!!

Big thanks

 

[(*steve*)]

Well, let us know how you did it. The next person who has this problem will need to know the solution too... (good job finding it by the way)

 

[rockrockmcrock]

Well, let us know how you did it. The next person who has this problem will need to know the solution too... (good job finding it by the way)

Of course mate! Wouldn't dream of keeping the secret...secret

It is on the PCB....hidden under a &*%$!! sticker... hence will be posting a "how to" at RCGroups. Happy to post it here as well, but perhaps just linking below is more appropriate?

http://www.rcgroups.com/forums/showthread.php?t=1565246

I'm presuming Electronics Point and yourself both don't mind being mentioned in the credits/'reference section ? Credit where credit's due and all that!