Plantraco Protocol
Copyright David Lancaster 2008
http://darkith.dyndns.org/~darkith/html/iz9.shtml
Commerical/for-profit use of this information forbidden without permission.

Physical signalling:
FSK
60khz bandwidth
0 = Fc
1 = Fc + 60khz

CHANNEL 1 904.4775 HFX900 Air Model 1 and 2
CHANNEL 2 915.9975 HFX900 Air Model 1 and 2
CHANNEL 3 927.5175 HFX900 Air Model 1 and 2
CHANNEL 4 912.1575 HFX900 Air Model 2 Only
CHANNEL 5 923.6775 HFX900 Air Model 2 Only
CHANNEL 6 908.3175 HFX900 Air Model 2 Only

CHANNEL 1 868.105 HFX868
CHANNEL 2 868.385 HFX868
CHANNEL 3 869.910 HFX868

Unarmed broadcasting:
Frame every 16 ms
Broadcast frame, plus cycles through regular channel frames (so model 1 rxes can lock on?)
Throttle channel will stay at "00" until armed (Air Model 2)

Armed:
Cycles through regular channel frames

If no changes, repeats slowly

If a channel is changing, repeats that channel rapidly (every 16ms?) with other channels very rarely (if at all)

Frame Format:
Data sent as frames
6 bytes (48bits)
All frames have 2 bytes of preamble "AAAA" to help the RX bit recovery clock lock on, then 2 bytes containing the fixed value "2DD4" which is the synchronization start word for the Integration IA4320 buffer.  The actual data is contained in the final 2 bytes.  There appears to be a bug in the Plantraco transmitter code which results in the transmit signal being left high if the last bit in the frame is a "1".  This results in 0.75 - 1.0 ms of logic high signal.  

AAAA2DD4XXXX
12ms long
6*8/.012 = 4000 bps

Broadcast frame (unarmed AM2 only):
--------------------------
AAAA2DD40101 

Data frame:
--------------------------
AAAA2DD4xxxx (hex bytes)

<xxxx> 4 bytes of data:  (shown in bits)
0000 0yyy | dddd dddd

<yyy> = channel code (3 bits)
	ail = 101
	ele = 110
	rud = 011
	thr = 010

<dddd dddd> = channel value (8 bits)
--------------------------
AIL, ELE, RUD:
Signed byte, positive for right/down, negative for left/up
MSB indicates direction (1=left/up, 0=right/down)
64 values each side of center  at "00"
C0 <-> FF|00|01 <-> 40

THR
MSB indicates positive throttle, but channel will go slightly "negative" (probably go farther negative on centering throttle?
C0 <-> FF|00|01 <-> 0A