Trigger Radio Status Message Injection

Hello my friends, i have modyfied my TH9X (openTX now) and added 3DR radio inside the TX so now i have telemetry on my TX screen. I also have a pinout on my TX and if i want to connect to MP, i use an FTDI cable to my laptop and this works great (Blue tooth module is on the way from china). 

i have read on this forum that:

"Currently the RSSI is added to the heartbeat packet when the GCS sends an outgoing MAVLink heartbeat packet to the drone.  In order to go get the RSSI you either need to send out a MAVLink heartbeat message with MAVLink enabled on the radios or modify the firmware on the radios so that you get it another way." 

So if i wanted to make 3dr radios start injecting RADIO_STATUS messages without connecting to GCS what is the "simplest" HEARTBEAT message i could send through the FTDI connection (with a terminal/arduino/openTX custom code etc) to make it think its connected to GCS? I dont want to send any other command or modify anything on the pixhawk, just make it start sending RADIO_STATUS.

i have searched the codes on github but im not so much of a programmer and i get lost inside the code

and one last question, if i succesfully trick the 3rds into sending these messages with a "fake" heartbeat and then, for some reason, after X minutes  want to connect to GCS will there be a problem? Must i send a "fake" *GCS disconnected* message?

thank you!

You need to be a member of diydrones to add comments!

Join diydrones

Email me when people reply –


          • hello, i have found the solution. 

            its somewhat easy. 

            you need to send a "fake" GCS heartbeat.

            its actually easyer than it sounds.

            3dr SiK firmware looks at each incoming packet and if it contains :

            1st: FE 2nd:09 5th:00

            it assumes its a heartbeat and GCS is connected and injects a "RADIO STATUS" message that contains the RSSI info.

            so you just send this hex string and magic happens.


            beware, you send this 1 time, you get 1 injected message.

            the packet is then ignored from the pixhawk/Flight controller because it doesn't have the correct message numbering nor the correct CRC, so you dont do any harm/dont send any misc command at your FC at anytime.

            do you have 9x and 3dr embeded inside it so you can view telemetry from 9x's screen?

            if so, i have modyfied the OpenTX firmware so it sends this string every 80ms 

            more info at:


            • Thanks Tom,

              I'm not using the radios with pixhawk etc but rather my own telemetry system. It would be great to get the RSSI values in my android app so many thanks for the input! I will try this out the coming days!

              • Tom,

                I have a feeling that I might not understand mavlink completely (is there some framing to take place/CRC etc?)...

                I have set both the radios to:

                S1:SERIAL_SPEED=57 S2:AIR_SPEED=48
                Assuming this is set, and I send the 6 bytes frame you showed above, will the radio then return he RSSI data or do I need to do something extra  ?

                (PS: both radios are connected (green light) and I can pass data between ok)

                • Ok, got it.

                  On the physical line, I need to send:

                  0xFE 0x09 0x4E 0x01 0x01 0x00 0x00 0x00 0x00 0x00 0x02 0x03 0x51 0x04 0x03 0x1C 0x7F

                  This will give the answer back:


                  Now just to decode that, should be ok once I find the description :)

                  • hello, in my case, just sending 

                    0xFE 0x09 0x00 0x00 0x00 0x00

                    gets me the answer!

                    tha telemetry firmware does not care about crc or anything else.

                    the "oh there is a GCS connected lets inject a RADIO_STATUS message" function is this:


                    // check if a buffer looks like a MAVLink heartbeat packet - this
                    // is used to determine if we will inject RADIO status MAVLink
                    // messages into the serial stream for ground station and aircraft
                    // monitoring of link quality
                    static void check_heartbeat(__xdata uint8_t * __pdata buf)
                    if (buf[0] == MAVLINK10_STX &&
                    buf[1] == 9 && buf[5] == 0) {
                    // looks like a MAVLink 1.0 heartbeat
                    seen_mavlink = true;


                    maybe you have different firmware??

                    also, each of the telemetry looks for this packet at the recieved buffer so if you send it from one side, you will get e response from the remote site only

                    in this response 

                    rssi = local rssi (the side that SENT the pack)

                    remrssi = remote rssi (the far side that recieved the pack)

                    noise = local noise (the side that SENT the pack)

                    remnoise = remote noise (the far side that recieved the pack)

                    you get a value wich is the actual db recieved.

                    s1000 datasheet says maximum db value = 217 but this not gonna happen. the max i ever got was 205 so i just to /2 and if i stand just next to the drone i maybe get a 101% rssi value witch i dont bother :)

                    for decoding the answer take a look how openTX does it

                    its not too difficult and nor too easy :)

This reply was deleted.