Reverse Engineering iLap Racing and Trackmate Racing Transponders

Having been in the hobby for a few years now, I usually see myself enjoying building things more than flying/using them. Here in Albuquerque we have a very active RC enthusiast group called Southwest Pod Racing. Racing has always been the main motivation for most of the people that join our group. Before timing systems were as widespread as they are now, our racing consisted mostly of going around trees and watching who finished first. As the skill level increased, so did the number of close finishes. So now, after joining MultiGP we acquired a gate a timing system that completely changed the way we fly.

The two main sources that I have seen in the multi-rotor world for timing systems was Trackmate Racing and I-LapRC Race Timing System. Having looked at both transponders up close, they appeared to have mostly the same hardware. So, I wanted to take a closer look at how they work so that in the future I may be able to make something of my own and have interoperability between the devices. The first device I looked at was the Trackmate Racing Transponder

Trackmate Racing

These were the first that I took the time to look at. Some of the notable hardware on the device is as follows:


Typical IR protocols use a 38kHz carrier frequency. First thing I did was to put this on the scope and noticed that it was around 460kHz. I believe the standard IR carrier to be 455kHz, so this was close enough.

I started by taking some notes by hand to get an idea of the protocol used. Taking a glace at the capture it looked to be UART communication and judging by the Crystal selection, was operating at 38400 buad (8N1). This in fact proved to be true.


The transponder I looked at had an id of “3420” listed on the front. I started by decoding the data that was being sent.

Carrier present is “0” and idle is “1”, then the bit is:

Grouping the bits into UART-style framing with a “0” start bit, eight data bits, and a “1” stop bit, you have:
0 10110000 1
0 00111010 1
0 10001001 1
0 10100110 1
… followed by idle, a valid state.

UART data is sent LSb first, so reverse the bits in each byte and the data becomes:
b00001101 = 0x0D
b01011100 = 0x5C
b10010001 = 0x91
b01100101 = 0x65

Notice that 0x0D5C is decimal 3420. I had a feeling that the other two bytes would be some sort of CRC checksum in order for this to handle the likely errors it would get. Figuring out the CRC algorithm was my next task.

Reversing CRC Checksum

The hard part about reversing a CRC is that there are so many that exist and even many different polynomials that could be used for the calculation. I searched around and found a handy tool called CRC RevEng that really made this process easy. This tool is “an arbitrary-precision CRC calculator and algorithm finder”. Gathering up a few transponders and using this tool, I came up with the following results:

  • Poly 0x1021
  • Initial state 0xFB1A
  • XORout 0x0000

This appears to be a slight varient of the XModem CRC that is commonly used. Using these options, calculated the checksum for “0x0D5C” to be “0x9165”. Verified on many other transponders that the same options for the crc calculation holds true. There are many freely available libraries for your language of choice. In the short term it’s easy to use an online CRC calculator like this one fromsunshine2k or you can just use RevEng to calculate it for you.


So, for Trackmate Racing transponders, data is sent LSB via 38400 UART with the first two bytes being the tag-id and the second two bytes being a 16-bit checksum.

Some pictures of my completed devices. Made these very quick so the layout isn’t perfect (crystal caps not evenly spaced, etc.)

The code I wrote was pretty crude and lacks proper timing, and I ended up tweaking things while watching the scope. Could probably share this too.

iLap Racing

I have this done, just need to add here

Program a Motorola Radius GM300 with Windows using DOSBox

GM300_Radio &


I scored a few older Motorola GM300 radios off of eBay and thought I got a great deal. This soon changed when I realized the programming options for this old radio were pretty limited. The first two things I ran across was the “Radius GM300 Radio Doctor” over at and the original Motorola Radio Service Software (RSS).

Continue reading Program a Motorola Radius GM300 with Windows using DOSBox

Kenwood TM-D710 GPS DIY

After looking around for awhile I had ended up purchasing a Kenwood TM-D710 dual band radio for my vehicle. I also wanted to get involved in APRS operations and noticed that the D710 didn’t have a built in GPS unit. The other product out there was the Greenlight Labs GPS unit that sold for upwards of ~$120. To me, that seemed pretty excessive for something that only outputted NMEA GPS data. So, I set out to create something of my own and make it open source. After a few revisions, the following is what I ended up with:

Kenwood TM-D710 GPS
Kenwood TM-D710 GPS

Continue reading Kenwood TM-D710 GPS DIY

Software Defined Radio (SDR) on the EzTV645 w/ RTL2832U and FC0013

Due to much of my own issues with setting this USB dongle up, I thought it should take the time and write my own version of the installation. Take note that this installation is for Windows 7, and not linux (if that wasn’t already apparent). I will also list all of my references below, which may end up solving some problems people were having.

 Step 1: Check your device.

First find a place to order the dongle at a reasonable price. I got mine from DealExtreme at a price of just shy under $20. Shipping time wasn’t the best since it’s from overseas, but this was a side project and didn’t really matter much to me.

The first thing you want to do is to check the chipset in your device. Just crack open the plastic outer casing, and look at the 2 flat black chips on the board. The picture below is of mine. It was indeed an EzTV645 device with an RTL2832U and FC0013 tuner. After looking around the net, I discovered that the FC0013 is far inferior when compared to the Elonics E4000 (which the EzTV668 has). Alas, I will still get it working and check it out for myself. Once you have the device in hand, plug it into a free USB slot, and ignore Windows trying to install drivers as we will take care of this in the next step.
Continue reading Software Defined Radio (SDR) on the EzTV645 w/ RTL2832U and FC0013

Reading and annotating research articles on an iPad

After much thought at the end of my first year as a PhD student, I felt the ever increasing need to get more organized. The first order of business was to get organized in such a way that i don’t have to carry much, and to have everything i need readily available. With this in mind, I decided a tablet might just be the way I can accomplish this. With the options I had at the time (May 2012), the different OS choices and the ease of which simple tasks can be repeatedly carried out, I found that the latest gen iPad would be the best bet. To rule out bias, I will admit this is the only apple product I own. I have only had Android phones, and never once even had an iPod (don’t listen to much music any way). Now, on to the quick review.

When I bought the iPad, I had maybe a few weeks left of courses in the semester. This was perfect because I could play around with different apps on the market before fully committing to one. I had a simple bamboo stylus that I picked up from the local store as well, which suited me just fine. Being an engineer, my notes are usually pretty technical, and contained mostly drawings. being able to type in the document wasn’t much of a priority as was fluid writing with a stylus. After looking around for an application that suited my needs, I found one that wasn’t mentioned much (if at all) online, and so I thought it was worthy of this blog post. This application is “Notability“, and can be found in the App Store. At a price of $.99, it is a must have for any note taking or PDF annotation app. Also, on my list of must have apps is iSSH and the Google Chrome web browser. A quick shot of my quick launch menu.


Continue reading Reading and annotating research articles on an iPad

Licensed HAM radio operator

About a month ago I decided to take the plunge and get my Amateur radio license. After studying for a couple of days, I walked in to the exam session and passed both my technician and general exams. After a few days I was then given my call sign KF5RRX. Looked for awhile and finally decided on some equipment as described below.

Yeasu FT-950 HF rig. This thing is simply amazing. I only have a simple inverted V dipole up in the attic of my house and am still amazed at the number of contacts I’ve gotten so far. Also paired this with a very nice Astron RS-354 power supply. Nothing fancy with this as all it has is an on/off switch, but it definitely gets the job done!


Continue reading Licensed HAM radio operator

DLC9 Xilinx Platform USB Cable Problems.

I recently purchased a new board (ML403) and was happy that it came with the USB Programming cable along side with it. Unfortunately I was unable to get it to communicate with the board by using either version 13.1 or 13.4 Xilinx toolchain. My Windows 7 machine found the device drivers just fine (and yes I have admin rights), but the Xilinx tool impact wasn’t able to connect to it. I’ve tried downgrading the drivers a few times by using the site Xilinx Configuration Hardware still to no avail. Also, didn’t find much information on the “write cmdbuffer failed 20000015.” error that I kept getting in impact. Maybe someone else has had this issue before?

I found a few Xilinx knowledge base answers that may help some other people out there with similar problems. None of which fixed my issue
AR #20429
AR #41442
AR #44397
AR #31931

One of my impact log files looked like the following:

iMPACT Version: 13.1

iMPACT log file Started on Mon Mar 26 22:34:56 2012

Welcome to iMPACT
iMPACT Version: 13.1
// *** BATCH CMD : setMode -bs
Enumerating cables. Please wait.
PROGRESS_START - Starting Operation.
Connecting to cable (Usb Port - USB21).
Checking cable driver.
 Driver file xusbdfwu.sys found.
 Driver version: src=1027, dest=1027.
 Driver windrvr6.sys version = WinDriver v10.21 Jungo (c) 1997 - 2010 Build Date: Aug 31 2010 x86_64 64bit SYS14:14:44, version = 1021.
Downloading C:/Xilinx/13.1/ISE_DS/ISE/data/xusbdfwu.hex.
Downloaded firmware version = 1100.
ESN not available for this cable.
Found cable - > write cmdbuffer failed 20000015.
ESN not available for this cable.
write cmdbuffer failed 20000015.
Connecting to cable (Usb Port - USB22).
Checking cable driver.
 Driver file xusbdfwu.sys found.
 Driver version: src=1027, dest=1027.
 Driver windrvr6.sys version = WinDriver v10.21 Jungo (c) 1997 - 2010 Build Date: Aug 31 2010 x86_64 64bit SYS14:14:44, version = 1021.
PROGRESS_END - End Operation.
Elapsed time =     13 sec.
// *** BATCH CMD : setCable -port usb21 -baud -1
Connecting to cable (Usb Port - USB21).
Checking cable driver.
 Driver file xusbdfwu.sys found.
 Driver version: src=1027, dest=1027.
 Driver windrvr6.sys version = WinDriver v10.21 Jungo (c) 1997 - 2010 Build Date: Aug 31 2010 x86_64 64bit SYS14:14:44, version = 1021.
 Cable PID = 0008.
 Max current requested during enumeration is 280 mA.
write cmdbuffer failed 20000015.
Loopback test failed. Sent character = 00, Received character = 0C.
Cable connection failed.

Free daily news sent to a kindle (latest generation)

After looking around the amazon market for daily subscriptions to newspapers, I was disappointed by the cost that came with getting these sent to your kindle. Upon doing some research, i stumbled upon a pretty clever solution over at to accomplish such a task for free. The tool “calibre” is used to download web content, and converts it to the kindle friendly .mobi format. I also set up a cron job to push this content.

ebook-convert /usr/share/calibre/resources/recipes/endgadget.recipe
calibre-smtp --attachment --relay --port 587 --username gmailusername --password "gmailpassword" --encryption-method TLS ""

Terminal commands:

sudo apt-get install calibre
#install should finish successfully
chmod a+x
crontab -e
########## Insert the following into crontab ############
00 8 * * * /home/username/

The above should run the script every day at 8am and send it to your free kindle email address. Take note that your kindle needs to be on wifi (versus 3g) to receive this document free of charge. If you decide to use the email address, you will be charged $.15 per megaByte (rounded up to the nearest MB). Calibre has recipes for a bunch of sites already included in the “/usr/share/calibre/recipes” directory, and doesn’t look trivial to create a new one for a site that isn’t included. Thanks gareth for the suggestion!

First, we need to head on over to to update a few things. On the top, (If you’re not already signed in) Click “Sign in” and log in with your amazon account information.
Once in, click the upper right again and click “Manage Your Kindle”. Now, over on the left hand side click on “Personal Document Settings”. Here, you will need to add the email address that these documents will be coming from (I used my gmail account) in the section labeled “Approved Personal Document E-mail List”. This is Amazon’s way to make sure only the email addresses you specify will be able to send documents. You are now all set up to have content delivered automatically to you kindle!

For an example of a recipe for a site that uses a username and password like the New York Times, create a recipe to use as follows.

import string, re
from calibre import strftime
from import BasicNewsRecipe
from calibre.ebooks.BeautifulSoup import BeautifulSoup

class NYTimes(BasicNewsRecipe):

    title       = 'The New York Times'
    __author__  = 'Kovid Goyal'
    description = 'Daily news from the New York Times'
    timefmt = ' [%a, %d %b, %Y]'
    needs_subscription = True
    remove_tags_before = dict(id='article')
    remove_tags_after  = dict(id='article')
    remove_tags = [dict(attrs={'class':['articleTools', 'post-tools', 'side_tool', 'nextArticleLink clearfix']}),
                dict(id=['footer', 'toolsRight', 'articleInline', 'navigation', 'archive', 'side_search', 'blog_sidebar', 'side_tool', 'side_index']),
                dict(name=['script', 'noscript', 'style'])]
    encoding = 'cp1252'
    no_stylesheets = True
    extra_css = 'h1 {font: sans-serif large;}\n.byline {font:monospace;}'

    def get_browser(self):
        br = BasicNewsRecipe.get_browser()
        if self.username is not None and self.password is not None:
            br['USERID']   = self.username
            br['PASSWORD'] = self.password
        return br

    def parse_index(self):
        soup = self.index_to_soup('')

        def feed_title(div):
            return ''.join(div.findAll(text=True, recursive=False)).strip()

        articles = {}
        key = None
        ans = []
        for div in soup.findAll(True,
             attrs={'class':['section-headline', 'story', 'story headline']}):

             if div['class'] == 'section-headline':
                 key = string.capwords(feed_title(div))
                 articles[key] = []

             elif div['class'] in ['story', 'story headline']:
                 a = div.find('a', href=True)
                 if not a:
                 url = re.sub(r'\?.*', '', a['href'])
                 url += '?pagewanted=all'
                 title = self.tag_to_string(a, use_alt=True).strip()
                 description = ''
                 pubdate = strftime('%a, %d %b')
                 summary = div.find(True, attrs={'class':'summary'})
                 if summary:
                     description = self.tag_to_string(summary, use_alt=False)

                 feed = key if key is not None else 'Uncategorized'
                 if not articles.has_key(feed):
                     articles[feed] = []
                 if not 'podcasts' in url:
                               dict(title=title, url=url, date=pubdate,
        ans = self.sort_index_by(ans, {'The Front Page':-1, 'Dining In, Dining Out':1, 'Obituaries':2})
        ans = [(key, articles[key]) for key in ans if articles.has_key(key)]
        return ans

    def preprocess_html(self, soup):
        refresh = soup.find('meta', {'http-equiv':'refresh'})
        if refresh is None:
            return soup
        content = refresh.get('content').partition('=')[2]
        raw =''+content).read()
        return BeautifulSoup(raw.decode('cp1252', 'replace'))

Also found a place that has a recipe for The Economist. Go check it out over at Lemme know how it works out.

Updated Cadence installation

Due to popular demand, I decided to update my Cadence 6.10 instructions for Ubuntu 10.04. It plays a lot nicer with this latest version of Ubuntu. Before there were problems with Compiz running and launching Cadence. These problems have since been resolved, and works much more smoothly than before. Any comments or suggestions are always welcome!

Where Engineering is my passion.