Xyloband – part 7 (update)

As mentioned in Part 6 I got my RF transmitter working and spent the rest of that day  (and the next) sending ‘random’ bytes of data at different Baud rates to the transmitter. Some were interesting to listen to on my scanner but there was not even the remotest flicker of lights on the Xyloband (apart that is from the initial flash when power was applied). I started to wonder what to try out next and then started to doubt I’d picked the correct frequency. The bandwidths are small and well controlled in the SRD band so how about if it was 869.2MHz rather than 869.5MHz ?

However, ayelix kindly mentioned the receiver within the Xyloband was the Si4362 and looking at that datasheet confirmed the odd numbers that appeared on my Xyloband’s IC. That made me think….’Why not grab the SPI setup data that is sent from the Atmel microcontroller to the Si4362?’. I’d be able to compare SPI bytes with those on the Si4362 datasheet and hopefully determine some key parameters. I’d then be able to set and forget these in my Xyloband Transmitter project.

So my breadboard just got a little bit more crowded as “SPI Spy” was born. It monitors the SPI SCLK and SDO from a microcontroller and grabs each byte up to a maximum of 512. I can then scroll though the bytes looking at address and contents. There are five buttons: Rewind (to first byte of data), Back One, Forward One, Exit/Reset and Start/Stop. There’s a CD4011 CMOS logic gate to take the 3.3v inputs up to 5v. Why?  If you’ve read my intro blog page I mention I’ve little spare cash. Well I only have one 74HCT573 to act as a buffer on the Xyloband project in order to allow me to run the LCD at 5v and the PIC16F1789 and MRF89XAM8A at 3.3v. Therefore the SPI Spy had to run at 5v but I needed to boost the SCLK and SDO being monitored. Luckily I had a CD4011….maybe I’ll ask Texas Instruments nicely for some samples later in the year.

I’ve grabbed the SPI data successfully from my Xyloband/MRF89XAM8A module and it almost makes sense. I need to spend just a little longer tweaking this as I believe I’m currently missing a byte as the C code takes too long to run and missing the SPI event.


So, that’s where I’m at currently. I need to:

  • Be 100% confident in the SPI Spy.
  • Carefully solder two tag wires to the Xyloband’s RF Receiver IC.
  • Run SPI Spy and interpret from the datasheet.
  • Setup my MRF89XAM8A module accordingly.
  • Then play with the variables that are left.

Things I don’t know:

  • What colours can a Xyloband do? Red,Green, Blue, White, Yellow, Cyan or every hue/saturation? e.g. Is each RGB element assigned its own byte.
  • Do different Xylobands (at the same concert) give different colours. If so perhaps there are several Tx codes. e,g, all bands in group A go to this colour, all bands in group B go to this colour etc.

I’m still assuming the data is a one way push, no handshaking, no clock. Just an asynchronous stream of bytes….perhaps eight in total.

When I get this to work I’ll spend a while returning the ‘technical debt’ on my C code and the upload the source to my Github account so other people can copy/fork the code for their own projects. [Technical Debt is the term I use to professionally describe messy code, eg I owe it some more attention !]


29 thoughts on “Xyloband – part 7 (update)

    • Progman,

      Unfortunately I don’t. If anyone does however, and can grab the program memory from their Xyloband I’d be interested to look through the code and have a crack at disassembling it. I’d assumed Atmel microcontrollers had the ability to protect program code like the PIC range does and that the manufacturer would have set that to protect their design.

      best regards, Rodders.


  1. Awesome progress! I finally got the schematic uploaded:
    Feel free to post a link to that wherever you like.

    With your permission, I’d like to add a “see also” section and link to your blog. Is that ok?

    Since you’re making good progress on sniffing the SPI traffic, I’ll leave that for later. Instead, I will try to get a flash dump from my unit. I don’t have any real atmel debuggers, but I think I can get my raspberry pi or arduino set up as an avrdude programmer. Never worked with atmel micros before, so we’ll see!

    Liked by 1 person

    • ayelix,

      You’ve done some great work there which will definately help us like-minded people get these things working again. Absolutely happy for links both ways between this blog and your Github – but thanks for asking still. If you have a blog/URL, I can link to that as well if you like.

      Similar to you; I’ve never used Atmel before as I started out on PIC and just kept with what I know. If you can progress a flash dump that would really answer a lot of questions. And finally – “SPI Spy” is 100% working now so I just need to solder some wires to my Xyloband and grab the setup bytes….

      best regards,


      • But you realized you are both working on different hardware versions, right?
        Today I finally received a Xyloband (the version used here, with speaker) to start playing around with it, so I can join the club. 🙂 Sadly, the Xyloband is waiting at home and I am currently at work, so I will have to wait some more hours 😉
        I have an Atmel JTAGICE3 available that is compatible with the controller used. However, I am nearly sure that the Security Bit of the controller will be set, so reading back the flash will not be that easy. But you never know, maybe we are (extraordinary) lucky…
        I also planned to check the SPI communication to the radio controller. Thankfully I have a scope with protocol decoding capabilities, so I do not need to build an “SPI spy”. Maybe we can compare the results.
        Did you check where the Testpoints go? Is there maybe an UART connected so that some kind of serial debug output is available?

        Kind regards,


      • Stefan,

        Welcome to the discussion and your comments are really helpful thank you. Sounds like you’ve access to some awesome test kit so I look forward to anything you manage to find out. As a slight update I’ve managed to solder wires to my Xyloband PCB (with difficulty) and read some SPI data out last night. None of it really aligned to anything in the test sheet so I’m either missing bytes or perhaps not sampling the data at the correct point. There’s only a few config flags for the SPI so I’ll try changing them. I didn’t use the testpoints – just soldered to the vias connected to the SCLK and SDI of the Si chip. You may be onto something that the ATmel puts out USART data as well.

        Please keep us all updated and good luck.

        best regards, Rodders.


  2. So much for the Security Bit:
    “Could not activate interface, but found DAP with ID 0xbc11477..

    This usually indicates that the device is locked or in deep sleep. Try to do a chip erase to restore connectivity to the device.” This was expected…
    I connected the JTAGICE3 to the SWD pins (on J100) and nRESET (TP100). So I could probably now erase the chip and start writing my own firmware. However, I would much prefer to use the stock one…

    Pinout of J100 seems to be (probed):
    | 9 7 5 3 1 |
    |10 8 6 4 2 |

    1 = VCC
    2 = AT Pin 20
    3 = AT Pin 32 (SWDIO)
    4 = AT Pin 19
    5 = AT Pin 31 (SWCLK)
    6 = AT Pin 18
    7 = GND
    8 = AT Pin 17
    9 = GND
    10 = GND

    Liked by 1 person

    • Although we have different hardware, I also found the lock bits to be programmed on my unit – readout protection activated. No surprise there, but it sure would have been nice to be able to dump the flash 😛

      Liked by 1 person

  3. I now attached my Logic Analyzer to the SPI bus to sniff the initialization data, which was successful 🙂 The commands seem to match the API found here: http://www.xhl.com.cn/upfile/Image/2012/3/20120324095337.pdf (AN625: Si446x API Descriptions).
    The first command sent is 0x2 (POWER_UP), enabling XTAL and configuring it as 30 MHz (which matches what is on the PCB). After that follow lots of SET_PROPERTY cmds (0x11) which I will have to decode tomorrow. It looks like modulation is set to 2GFSK with Manchester coding.
    This is the command setting up frequency (channel) stuff:
    0x11, 0x40, 0x06, 0x00, 0x38, 0x0f, 0xbb, 0xbb, 0x0d, 0xa7

    Does this match what you see?

    Liked by 1 person

    • Fiddeling around with the WDS from Silicon Labs shows that the frequency parameters above seem to configure a base frequency of 869,5 MHz with 100 kHz channel spacing. I thing the Xyloband uses channel 0.

      Liked by 1 person

      • hi sk

        if you have the crystal 30 MHZ the result
        0x11, 0x40, 0x06, 0x00, 0x38, 0x0f, 0xbb, 0xbb, 0x0d, 0xa7
        API 0x40 0x00 FREQ_INT
        FREQ 0x38, 0x0f, 0xbb, 0xbb = 434.750 Mhz
        STEP CHANNEL 0x0d, 0xa7 = 50 Khz
        best regard

        Liked by 1 person

  4. i m sure for frequency because i have the the transmitter RFM26 SI4432 to simulation on this frequency 434.750 and the modulation 2FSCK and the result on my xyloband is blinking.

    Liked by 1 person

      • yes i have the speaker and the D20, my xyloband is same picture in this website.
        i send on TX BUFFER two byte 01 01.
        the preamble is 0x10
        sync word 0x4b 0xd4
        tx field1 len 0x01
        tx field 2 len 0X3F

        Liked by 1 person

      • Dear progman,

        I now finally have got an RFM26W module (868 MHz version) here. I have it connected to an Teensy 2+ (changed to 3.3 V) and have written some test code.
        So far, I was not successful in getting the Xyloband to do anything, not even trying to read something from the RX FIFO. I think I have the same settings than you.
        However, would you maybe willing to share some sample code that you used to make your band blink? This would be nice!

        Thanks in advance,

        Liked by 1 person

  5. I wrote a small program to parse the initialization data I got via SPI. Mainly the params set are interesting, so I dumped them. This is what is set during initialization on my Xyloband (left is parameter id, right its value):

    0x0 = 0x40
    0x1 = 0x70
    0x2 = 0xa
    0x3 = 0x61
    0x100 = 0x1
    0x101 = 0x18
    0x200 = 0x3
    0x201 = 0xa
    0x202 = 0x9
    0x203 = 0x7
    0x1001 = 0x10
    0x1002 = 0x0
    0x1003 = 0x8
    0x1004 = 0x3e
    0x1005 = 0x0
    0x1006 = 0x0
    0x1007 = 0x0
    0x1008 = 0x0
    0x1100 = 0x1
    0x1101 = 0x4b
    0x1102 = 0xd4
    0x1200 = 0x85
    0x1206 = 0xa
    0x1208 = 0xa
    0x1209 = 0x1
    0x120a = 0x0
    0x120d = 0x0
    0x120e = 0x1
    0x120f = 0x1
    0x1210 = 0x82
    0x1211 = 0x0
    0x1212 = 0x3f
    0x1213 = 0x1
    0x1214 = 0xa
    0x2000 = 0x3
    0x2001 = 0x80
    0x2019 = 0x80
    0x201e = 0x10
    0x201f = 0x10
    0x2022 = 0x1
    0x2023 = 0xab
    0x2024 = 0x1
    0x2025 = 0x9
    0x2026 = 0xde
    0x2027 = 0x0
    0x2028 = 0x99
    0x2029 = 0x2
    0x202a = 0xc2
    0x202b = 0x0
    0x202c = 0x4
    0x202d = 0x36
    0x202e = 0x80
    0x202f = 0x11
    0x2030 = 0x19
    0x2031 = 0x1e
    0x2032 = 0xc0
    0x2035 = 0xe2
    0x2038 = 0x11
    0x2039 = 0x5d
    0x203a = 0x5d
    0x2040 = 0x2a
    0x2041 = 0xc
    0x2042 = 0xa4
    0x2043 = 0x2
    0x2044 = 0xd6
    0x2045 = 0x83
    0x2046 = 0x0
    0x2047 = 0xe1
    0x204c = 0x12
    0x204e = 0x2b
    0x2300 = 0x2c
    0x2301 = 0xe
    0x2302 = 0xb
    0x2303 = 0x4
    0x2304 = 0xc
    0x2305 = 0x73
    0x2306 = 0x3
    0x2307 = 0x5
    0x4000 = 0x38
    0x4001 = 0xf
    0x4002 = 0xbb
    0x4003 = 0xbb
    0x4004 = 0xd
    0x4005 = 0xa7


      • Stefan, Progman,
        For 869.5MHz with a channel spacing of 100KHz the following parameters need to be set

        FREQ_CONTROL_INTE 0x38
        FREQ_CONTROL_FRAC_2/1/0 0x0FBBBB

        For 434.75MHz with a channel spacing of 50KHz the following parameters need to be set

        FREQ_CONTROL_INTE 0x38
        FREQ_CONTROL_FRAC_2/1/0 0x0FBBBB

        To determine the actual frequency you need to examine the parameter FREQ_CONTROL_VCOCONT_RX_ADJ which has the parameter ID of 0x4007.

        In Europe, it is likely that a frequency of 869.5MHz is used because a single transmitter with this frequency can be used with a power rating of up to 500mW which has a range of a few kilometres and this would be suitable for an arena or stadium where the Xylobands are used. A transmitter with a frequency of 434MHz has a much lower power limit and may not have sufficient range for an arena.

        In USA, there may be different regulations on the use of 434MHz which I am not familiar with.

        Liked by 1 person

      • Dipak,

        Great work and I see the very same byte order appearing at the bottom of Stefan’s listing. So I think readers can be certain which of the two frequencies to use depending upon their global location.

        Stefan – I had great difficulty soldering to the PCB so I’ve a question for you. How are you able to capture the SPI on your analyser – do you use a probe and hold that in place for the duration or a IC clip that attached over the IC ? I tried using fine sewing needles in crocodile clips before going for the soldered approach.

        kind regards,



      • Hi!

        I scraped off some of the soldermask mainly on the Vias and then soldered braided wire to them. To that I soldered a simple pinheader. It’s quite delicate and easy to rip off, but I did not want to glue the wire in place.


        Liked by 1 person

  6. Because I was still unsure of the frequency really set (sorry progman!), I worked on a little dumper that actively communicated with the Si4362 via SPI and read back the values of all the parameters in the API PDF. The result is this:

    0x0 = 0x40
    0x1 = 0x70
    0x2 = 0xA
    0x3 = 0x61
    0x4 = 0x0
    0x5 = 0x0
    0x6 = 0x1
    0x7 = 0x60
    0x8 = 0x0
    0x100 = 0x1
    0x101 = 0x18
    0x102 = 0x0
    0x103 = 0x4
    0x200 = 0x3
    0x201 = 0xA
    0x202 = 0x9
    0x203 = 0x7
    0x1000 = 0x8
    0x1001 = 0x10
    0x1002 = 0x0
    0x1003 = 0xCA
    0x1004 = 0x3E
    0x1005 = 0x0
    0x1006 = 0x0
    0x1007 = 0x0
    0x1008 = 0x0
    0x1100 = 0x1
    0x1101 = 0x4B
    0x1102 = 0xD4
    0x1103 = 0x2D
    0x1104 = 0xD4
    0x120A = 0x0
    0x120B = 0x30
    0x120C = 0x30
    0x120D = 0x0
    0x120E = 0x1
    0x120F = 0x1
    0x1200 = 0x85
    0x1206 = 0xA
    0x1208 = 0xA
    0x1209 = 0x1
    0x121A = 0x0
    0x121B = 0x0
    0x121C = 0x0
    0x121D = 0x0
    0x121E = 0x0
    0x121F = 0x0
    0x1210 = 0x82
    0x1211 = 0x0
    0x1212 = 0x3F
    0x1213 = 0x1
    0x1214 = 0xA
    0x1215 = 0x0
    0x1216 = 0x0
    0x1217 = 0x0
    0x1218 = 0x0
    0x1219 = 0x0
    0x122A = 0x0
    0x122B = 0x0
    0x122C = 0x0
    0x122D = 0x0
    0x122E = 0x0
    0x122F = 0x0
    0x1220 = 0x0
    0x1221 = 0x0
    0x1222 = 0x0
    0x1223 = 0x0
    0x1224 = 0x0
    0x1225 = 0x0
    0x1226 = 0x0
    0x1227 = 0x0
    0x1228 = 0x0
    0x1229 = 0x0
    0x1230 = 0x0
    0x1231 = 0x0
    0x1232 = 0x0
    0x1233 = 0x0
    0x1234 = 0x0
    0x200A = 0x0
    0x200B = 0x6
    0x200C = 0xD3
    0x2000 = 0x3
    0x2001 = 0x80
    0x2003 = 0xF
    0x2004 = 0x42
    0x2005 = 0x40
    0x204A = 0xFF
    0x204B = 0xC
    0x204C = 0x12
    0x204D = 0x0
    0x204E = 0x2B
    0x2049 = 0x80
    0x2200 = 0x8
    0x2201 = 0x7F
    0x2202 = 0x0
    0x2203 = 0x5D
    0x300A = 0x0
    0x300B = 0x0
    0x3000 = 0x0
    0x3001 = 0x0
    0x3002 = 0x0
    0x3003 = 0x0
    0x3004 = 0x0
    0x3005 = 0x0
    0x3006 = 0x0
    0x3007 = 0x0
    0x3008 = 0x0
    0x3009 = 0x0
    0x4000 = 0x38
    0x4001 = 0xF
    0x4002 = 0xBB
    0x4003 = 0xBB
    0x4004 = 0xD
    0x4005 = 0xA7
    0x4007 = 0xFF
    0x5000 = 0x4
    0x5001 = 0x1
    0x5002 = 0x0
    0x5041 = 0x3F

    If Dipak is correct, this would indicate 869.5MHz because 0x4007 is definitely 0xff (default value).
    @Progman: Maybe 434.750MHz also works (in short distance) because of the harmonics?


    Liked by 1 person

    • Excellent work Stefan !

      How did you prevent the Atmel SAMD20 communicating to the Si4362 whilst you were trying to read the bytes out ? Or did you just wait until the Atmel stopped sending setup data ?




      • After some time the Xyloband enters some kind of “standby mode” where it only communicates with the radio every couple of seconds. This is more than enough time to read the parameters. I tried holding the D20 in reset to remove it from the bus, but somehow the radio always seem to enter shutdown mode then, even if i add an external pulldown to that pin to keep it from floating.


        Liked by 1 person

    • hi all,
      Thanks stephan,

      i tested on my transmitter for frequency 869.5MHz, the xyloband is blinking.
      the frequency 869.5MHz or 434.750Mhz (harmonics), we have same behavior.

      Liked by 1 person

  7. Hi, not sure if you got the answer yet (I just skimmed the replies) but there are differently configured bands at the same event so they can display different light patterns simultaneously. I read somewhere that you can have up to 4 different “groups”. I just got a band at a private event held recently so I’m eager follow your progress!

    Liked by 1 person

    • Hi Mark,

      Thank you for getting in contact and providing some more info on how these work. I’ve just approved your post so it can appear online for others to read as well. I moved much of the discussion from my blog to http://xylobandhacking.freeforums.net/ which makes sharing of info easier – this site was set up and managed by Ayelix who posted to my blog initially. I definately recommend you follow our joint progress there or better still sign in. There are about4x dedicated people adding to this project so hopefully we’ll get a result soon.




Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s