Since Horizon Hobby introduced the Spektrum DX6 spread spectrum
radio control system in mid-2005, it has been a spectacular hit
everywhere it is seen. Every review extols the virtues of a system
that is totally immune to interference from both inband channels
and from electrical noise.
Spektrum DX6 components
(also includes charger)
battery not included)
Disclaimer: This website is not
in any way affiliated with Horizon Hobby, the distributor for the
Spektrum DX6 radio control system. This website's sole purpose is
to promote the exceptional ingenuity and out-of-the-box thinking
that went into creating this system. We owe a debt of gratitude
to the folks at Horizon Hobby for their initiative. They are also
responsible for the magnificent
Blade CP helicopter, which I also own.
Attn: There is
a newly written section below on the operation of the Cypress Wireless
USB ICs below. Be sure to read it to clear up a lot of questions
people have about the operation of this system!
sells a capacitor to the receiver that prevent a possible lock-up
condition when high current draw servos are used (as with for a
sail for a boat). Part number
here for a very cool method for greatly extending the transmitter
operation time by making a simple replacement of the linear regulator
with a switching supply that is a direct solder-in replacement.
Compliments of Dimension Engineering.
here to download the user's manual. It contains all the programming
If you happen to be an RF engineer or
hobbyist, please visit my
What makes the Spektrum DX6 radio control system so unique is
that it is the first commercially available system that, number
one, it operates in the unlicensed 2.4 GHz frequency band and, that
number two, it employs spread spectrum digital encoding to effect
the control signaling. The 2.4 GHz unlicensed band is one of several
ranges of frequencies that the U.S. Federal Communications Commission
(FCC) has reserved
for operation of a class of devices designated as Industrial, Scientific,
and Medical (ISM). It happens to be the band on which the vast majority
of computer wireless LANs (WLANs) operate (IEEE802.11b/c/g/n), as
well as all of the available Bluetooth devices. Microwave ovens,
wireless security systems, and a host of other products also run
in the 2.4 GHz band.
So, with all those systems competing for usage in the same bandwidth,
why are there no serious interference problems? The answer is in
the spread spectrum encoding-modulation and demodulation-decoding
schemes. Radio systems like the traditional 72 MHz band versions
modulate servo positional information onto carrier tones tuned to
discrete frequencies (pulse-position modulation, PPM, and pulse-coded
modulation, PCM). While the intelligence is digitally encoded, the
effect is to cause only a relatively small deviation in the carrier
frequency off of its center frequency. There are a total of 50 ranging
from 72.010 MHz (ch 11) to 72.990 MHz (ch 60), with 20 kHz (0.020
MHz) spacing between channels. Each transmitter must be careful
not to modulate its signal far enough in to an adjacent channel
to the point that interference is experienced.
spread spectrum systems occupy a wide bandwidth (often 1 MHz or
more) and digitally “spread” the encoded signal out across the entire
band through modulation. The digital information is encrypted with
a sort of security code that makes it unique, and the receiver must
decrypt the message using the same code. Depending upon the instantaneous
digital code value (millions of possible codes), the transmitter
frequency is tuned (modulated) to a specific frequency within the
Accordingly, there are as many possible
frequencies to tune to in the band as there are digital codes (millions).
Since each data bit makes up only a small portion of the total message,
the transmitter broadcasts on each frequency for a short period
This pseudorandom assignment of frequencies accounts for the “spread”
part of spread spectrum since it spreads the signal over a wide
spectrum of frequencies. In the receiver, the information is demodulated
and decoded and the individual bits are reassembled into a recognizable
string of data that is sent to the appropriate servos (or motor
electronic speed controller, ESC).
Additional digital bits
are added to the data stream, and are used to enable the automatic
correction of a certain number of missing bits that arrive at the
receiver – this is called error detection and correction. Bits can
be missed in the receiver for many reasons, chief of which are low
signal level (separation between transmitter and receiver too great)
and interference from another radio system. So, if a data stream
that is a couple thousand bits long is missing a few valid bits,
the microprocessor can determine what the correct value (“1” or
“0”) should be. This is where the spread spectrum scheme provides
its immunity to interference. The probability of two or more transmitters
broadcasting a single bit at exactly the same frequency within the
broad bandwidth is extremely low. However, if they do, then each
affected system’s receiver is capable of “filling in” the missing
information and the signal gets processed as if no problem existed.
Your servos never get issued incorrect commands.
DX6 transmitter spectrum analyzer plots were made on a
Schwarz instrument. As can be seen, there are two signals, one
at 2433 MHz and the other at 2473 MHz, that are separated by 40
MHz. The signals are sent alternately. Zooming in on the 2433 MHz
signal reveal that it has about a 830 kHz bandwidth. Carrier suppression
is not the greatest as it can be seen protruding above the spread
spectrum waveform in the center. The 2473 MHz signal is similar
to the one shown here.
The FCC describes two fundamental
types of spread spectrum methods: frequency-hopping spread spectrum
(FHSS) and direct-sequence spread spectrum (DSSS). The Spektrum
DX6 radio control system employs DSSS. The Federal Communications
Commission (FCC) requires all manufacturers of equipment that is
capable of generating radio frequency (RF) energy, whether intentional
(a valid signal) or unintentional ("noise"), to submit products
to an approved testing laboratory to validate that they conform
to FCC guidelines. Such products carry an FCC approval identification
sticker, and on the sticker is an FCC ID number.
FCC maintains a public database of all submissions, with great detail
as to the test methods and results, as well as photographs of the
inside and outside of the products. The inside photos are of particular
interest, since they usually provide a pretty good image of the
printed circuit boards (PCBs) and in some cases, enough clarity
to make out component part numbers.
The binding process has been a mystery since it was first introduced.
Here are excerpts from the Spektrum DX6 user's manual:
- When the transmitter is turned on, the system scans the 2.4GHz
band, finds an open channel and locks on that channel. Next the
transmitter scans for a second open channel and, when found, transmits
on that second open channel. The system is now transmitting simultaneously
on two 2.4GHz channels, giving two paths of security.
Each AR6000 receiver features patented DuaLink (pat pend) technology
and is actually two receivers in one, hence the dual antennas. When
turned on, the first receiver scans the 2.4GHz band until it finds
the specific transmitter’s code (called GUID) that it has been programmed
to recognize (see binding page 24) and locks on that signal. Then
the second receiver scans the 2.4GHz band, finds the second transmitted
code that it’s been programmed to recognize and locks on that signal.
This whole process takes less than 5 seconds. The receiver is then
locked to that transmitter via two independent channels, and is
virtually immune to model generated or outside interference."
Keep that in mind while reading the next section.
Cypress CYWUSB6953 & CYWUSB6935
Cypress pulled the full datasheet for the
CYWUSB6953 transceiver, which is the one used in both the transmitter
and the receiver, and replaced it with a partial version. The original
had an extensive functional description of the entire chip. Now,
it refers the reader to the datasheet for the CYWUSB6935 transceiver
for a functional description of the RF section. I have included
links to both IC datasheets below (under the photos).
of discussion has taken place about the frequency and operation
of the transmitter. Here is a quote from the datasheet, "The CYWUSB6935
contains a 2.4-GHz radio transceiver, a GFSK modem, and a dual DSSS
reconfigurable baseband. The radio and baseband are both code- and
frequency-agile. Forty-nine spreading codes selected for optimal
performance (Gold codes) are supported across 78 1-MHz channels
yielding a theoretical spectral capacity of 3822 channels." I guess
that settles it.
The datasheet specifies a maximum output
power of 0 dBm (1 mW). However, the RF PCB of the transmitter has
a SiGe SE2526A front-end module, which is described as follows,
"SiGe Semiconductor's SE2526A is a complete RF front end integrating
a high-performance power amplifier, power detector, transmit/receive
switch, diversity switch and harmonic filtering into a compact chip-scale
device that is fully matched to 50ohm. The SE2526A replaces up to
40 components typically required for the RF front-end, thereby simplifying
the design of wireless systems. Unigen's Juno-LPA modules,
based on Cypress Semiconductor Corp's WirelessUSB LR (CYWUSB6935)
radio-system-on-a-chip device and SiGe's SE2526A, are able to transmit
and receive wireless signals over a range up to 1km." ...and that
So, what we have here is a basic short-range
wireless SoC (System-on-Chip) mated to a front-end module that has
a power amplifier (PA) to boost the output power for longer ranges,
and a built-in antenna switch to route the RF energy either from
the CYWUSB6953 RF Out port through the PA and to the antenna, or
from the antenna to the RF In port on the CYWUSB6953. In doing so,
it allows the transmitter to "listen" for active transmitter channels
via its receiver RSS (received signal strength) function and assign
transmit channels on only clear frequencies.
open the question about exactly how the receiver, which contains
two identical CYWUSB6953 circuits, goes about binding with the transmitter
and detecting the operating frequencies. Does the receiver transmit
a low-level signal out to the transmitter so that the two can arbitrate
clear channels of operation? That possibility was suggested by a
person who wrote to me recently (thanks to Mr. Rod W.). The answer
is that I still do not know for certain, but an alternate solution
is proposed next.
From the description given in the user's
manual (see excerpt above), it seems that during the binding process
the receiver listens for a special signal from the transmitter that
tells it what the GUID (basically an encoding sequence) of that
transmitter is. The binding operation is separate from the receiver
power-up process. My guess is that all transmitters use a certain
channel to send their GUIDs so the receivers know to always go there
to learn them when binding. Then, during power-up, the two receiver
channels use that GUID code when searching for which two frequencies
the transmitter has chosen. In that manner, it is never necessary
for the receiver to broadcast any information back to the transmitter.
OK, so where do the 4.2 billion possible codes come from? 4.2
billion is roughly the number of unique codes available in a 32-bit
binary system, which is likely the code length used by the Spektrum
DX6, compliments of the Wireless USB IC. Recall that the IC was
originally designed to operate in a very dense RF environment with
data security being a high priority. The more bits that are used
to encode data, the more difficult it is to hack (decode, intercept,
pirate, etc.). A lot of data intercepting schemes rely on brute
force processing to basically try every possible code sequence possible
until the correct one is stumbled upon. It takes a long time to
try 4.2 billion codes, even at modern computing speeds. Still, stories
have appeared recently about the relative ease with which the standard
40-bit (1.1 trillion combinations) encryption on RFID devices can
be cracked using just a laptop computer. For another reference point,
the encryption scheme used for the https:// secure websites uses
128 bits, which represents 3.4x10^38 (that's 34 followed by 37 zeros)
possible unique codes.
The Spektrum DX6 transmitter carries an FCC ID number of
R8KUGWR2USXXXX. The hyperlink attached to the FCC ID number
is the page on the FCC website that contains links to all the
available documents on the transmitter. The
internal photographs document shows a wireless spread spectrum
module manufactured by Uniden (Fremont, CA). This is somewhat
odd, because it appears that only the module itself has been
qualified, and not the entire transmitter - which itself has
digital circuitry that could radiate unintentionally in excess
of the allowable limits. This module and radio system operates
in the 2.4 GHz Industrial-Scientific-Medicine (ISM) band, which
is unlicensed and is the same band as the wireless LAN (WLAN)
products that are used for personal computers.
shown here of the RF PCB removed from my transmitter and the
one submitted to the FCC for the qualification tests are essentially
the same. The main differences are the much smaller crystal
oscillator unit and the elimination of one of the coaxial connectors.
Spektrum DX6 AR6000 Receiver
Spektrum DX6 Receiver
Receiver PCB Assembly
Spektrum DX6 AR6000 Receiver
Spektrum DX6 Receiver
case is held together with double-sided foam tape attached to
the upper and lower PC boards, and then a little silicon glue
at the two antenna exit points to provide strain relief. Inside,
there are two printed circuit boards (PCBs). One has two duplicate
circuits for the spread spectrum receivers and a "motherboard"
that contains the signal decoder and servo drivers. Cypress
Semiconductor model CYWUSB6953 "WirelessUSB™ PRoC™ Flash Programmable
MCU Radio" integrated circuits (ICs) are used (see online
datasheet), along with 13 MHz oscillators. The Cypress IC
is capable of performing both the transmit and the receive function,
making it extremely versatile.
There does not appear
to be a preamplifier used on the receiver front-end, so the
exceptional range of 1,500 feet or more is provided pretty spectacular.
Even though these types of direct sequence spread spectrum (DSSS)
systems in the ISM band (2.4 GHz), like wireless local networks
(WLANs) and Bluetooth systems are typically advertised for operation
over relatively short ranges (300 feet or so), the range is
for a given minimum data rate.
At greater ranges, the
error rates increase and more packets of data are lost and must
be resent, or the system data rate must be slowed down. Radio
control system data rates need only be in the tens of kilohertz
realm and not in the tens of megahertz realm, so the operational
range is extended. There is a
Factoid that I wrote for my RF Cafe website that describes
the large number of WLAN networks I was able to detect in a
Podunk town in West Virginia, where the houses hosting the WLAN
routers were 100-300 feet away.
According to the datasheet,
receive mode current is 61.3 mA. I measured the current draw
of the external Electronic Speed Control (ElectricFly ESC-10)
AR6000 receiver (motor off, servos idle) and got 80.3 mA @ 4.88
V. The current was measured between the NiMH battery pack (9.6
V, 650 >mAh) and the ESC, and the voltage was measured across
the positive and negative pins of the receiver channel 6 pins.
At some point, I will measure it without the ESC, but for this
measurement all I had on-hand was a 7.2 V Li-Poly battery pack
in my Li'l Poke airplane.
One interesting specification
is the electrostatic discharge (ESD) ratings, which are only
500 V on the RF (antenna) pins and 1,500 V on all other (power
and control) pins. The de facto industry standard for silicon
devices is 2,000 V minimum, with 4,000 V being typically
seen. A static charge of 500 V can easily accumulate on the
human body simply by walking across a carpeted floor or even
combing the hair with a plastic comb. If such a charge finds
a discharge path through one of the two antennas, the even could
(and likely would) cause a failure in the IC. Accordingly, extreme
care should be exercised to avoid contact with the ends of the
antenna wires. Placing a small dollop of silicon (e.g., tub
caulk) on the ends of the antennas will actually provide a little
extra protection since it will prevent direct contact with the
copper wire inside the insulation.
Someone wrote asking about how to convert the left gimbal throttle
stick to be self-centering like the other three axis. Unfortunately,
the conversion requires the installation of both a spring and a
plastic lever that rests against two pins on the stick axis. From
what I have read on the forums, getting Horizon Hobby to provide
replacement parts for the Spektrum DX6 system is like trying to
get blood out of a turnip, as the saying goes. It seems everyone
has had to come up with a work-around for broken antennas, cables,
and anything else. About the only thing to do is to remove one of
the existing levels and attempts to replicate it in plastic or metal.
It probably would not be really hard to do, but would be time-consuming.
The pictures below are close-ups of the gimbal centering assembly.
The top one is with the stick centered, and the bottom one is with
the stick in a maximum deflection position.
Gimbal Centering Mechanism with
Stick in Center Position
Gimbal Centering Mechanism with Stick in Center Position