Fly Electric!

2.4GHz Scanner

This page describes a handheld 2.4GHz scanner. It acts as a simple spectrum analyser but without the vast cost and size. Scanning frequencies is not the simplest thing in the world and it is easy for sampling speed and resolution to generate patterns that are not perfect reflections of reality. This was an attempt to 'see' whats happening over the air but please bear in mind that the data may not be perfect. The Spektrum stuff is solid because I've done more work on that. The following table summarises some (apparent) technical aspects of RC transmissions; see text below for more detailed caveats.

Manufacturer: Transmission
burst duration
of data bursts
Duty cycle
Number of
channels used
Assan 0.9ms 221Hz 20% 1
Futaba 1.8ms 260Hz 0.6%/channel 74
Spektrum DSM2 1.4ms and less 45Hz 6%/channel 2
Spektrum DSMX 1.4ms and less ? ~1%/channel 23
eFlite (DSM2) 1.4ms 51Hz 7%/channel 2
Jeti 1.3ms ?Hz ? 16
Multiplex ? ?Hz ? 38?
RoboCopter 0.2ms 426Hz 9% 1

I have a few pages on 2.4 so look for the links to those pages at the foot of this page.

Each Assan transmission is around 0.9ms in duration. 20 bytes of data payload are transmitted. The frequency of transmission is over 200Hz. It is common for servos to be driven at 50Hz (a pulse every 20ms) and Assan is no different. So at 200Hz they have 4x redundancy in getting new Tx stick positions to their receivers.

My mid-2008 module always defaults to channel 11. It never chooses another channel even if the channel is swamped with a Signal Generator. A Logic Analyzer reveals that the receiver is always configured for that channel even when there is no signal (ie: it never scans). There is also no evidence of the Tx module scanning before it starts transmitting. The 2009 'two channel' versions also appear to always use the same channels even if busy according to this test. Only one aerial is 'active' on dual antennae receivers.

Assan & Wifi

2800 (x0)

This radio transmits much more often (426Hz). Being a helicopter and only having motor controls, it probably benefits from a faster update rate. Only two controls exist so the on duration is much shorter than 'proper' RC equipment (only 0.2ms). It's transmission pattern is regular but 'misses a beat' after every 10 transmissions, presumably to 'do stuff' on the Tx (eg: update trims, check voltages, perhaps measure stick positions, etc).

1400 (x0)

2800 (x0)

Simultaneous transmissions
Both the Assan and RoboCopter radios I have default to channel 11. They can be made to both use that channel and they simply blast away, oblivious of each other once they have chosen their channels. This behaviour is expected to be normal with all brands.

This example shows about 26 Assan bursts and 54 from Robo. About 8 of the Assan transmissions overlap about 9 Robo's. Those 17 transmissions could be compromised but the rest are unaffected. Since the interferance is dispersed, this would have no noticeable effect on control of the model. Even where signals are corrupted, it is common for 2.4 radios to 'hold' servo positions for a while in these conditions.


Jeti Duplex
I've not spent enough time on this one but it is clear that this mid-2009 Jeti hops between 16 channels, 5 apart. Less clear is the timing and pattern.




Spektrum DSM2
Spektrum DSM2 alternates between 2 channels. The channels are often far apart, but surprisingly sometimes adjacent. This is disappointing because they are not making best use of their dual channels (eg: an FPV system could affect both channels). Different channels are selected each time the Tx is powered up (appears random).

The 'usage' mode photo reveals a frequency of 42Hz but more accurate equipment measures this as 45Hz (22ms frame length). This is the same for all Tx's tested including modules. So with it's two channels, it has 2x redundancy. The Dx7SE and DX8 etc can be set to an 11ms frame length to reduce latency.

Transmissions are about 1.4ms in duration. This contains 16 bytes covering servo channels 1 to 7. 9 channel systems have an extra shorter burst for each channel for channels 8 and 9 (see the 'DM9' scan on the right below).


Channels 18 & 60

Channels 13 & 14

DM9 module (extra burst)

Spektrum DSMX
DSMX hops between 23 channels with different transmitters using a different sets of channels. Each transmitter always uses the same set of channels but there appears to be a very large pool of frequency patterns.

23 channels

The eFlite Blade indoor heli radio is Spektrum based. So it also transmits on 2 channels, in this scan 15 and 26. 7% duty cycle, 1.4ms transmissions and 51Hz indicated frequency should probably also be 45Hz as per 'proper' Spektrums.

2800 (x0)


Futaba is harder to analyse because it hops over many frequencies. It uses an unknown hopping pattern and a broader bandwidth so measurement with my simple equipment is tricky. The T6EX, 10C and a module all appear to use 74 channels, from 5 to 78. However, their FCC submission indicates it uses 37, being every 2nd channel between 2 and 74. I think my scanner was swamped for these scans and I need to redo them to show the individual channels in use. This site has more detailed scans.

1024 (6.5s sweep)

4096 (17.5s sweep)

8192 (32s sweep)

32768 (121s sweep)
The scanner's 'usage' mode (below) reveals that all channels are used in a consistent manner. Transmissions occur on each channel every ~285ms (~425 measurements apart x0.042ms x16 stretch setting). So with 74 channels in use, the Tx transmits every 3.8ms (285ms/74). This represents ~260Hz operating cycle, ie: has 5x redundancy to maintain the 50Hz servo pulse chain. Two channels are shown below as examples.

Each transmission is around 1.8ms in duration (42 ON measurements x 0.042ms in photo on the right). Since each channel is used only every 285ms, each channel has a 0.6% duty cycle (1.8/285). This means that Futaba transmissions will have very little effect on other makes. It is believed that systems with over 10 channels have a different 'mode'. So as with Spektrum, they probably have to send a 'top up' burst for the extra channels.

Channel 14
(x16 stretch factor)

Channel 78
(x16 stretch factor)

1.8ms bursts
(no stretch)
It is not common for the scanner to reveal irregular patterns. I think this indicates that the Tx jumps at least a few channels every time. When the pattern is different to those shown above, it is a matching 'shadow' pattern which almost always displays the characteristics of an adjacent channel (ie: the shadow signals are fragmented). Some examples with different 'stretch' factors:

Multiplex seem to hop between every 2nd channel from 2 and 76. I'm not sure what the duty cycle is.


Adjacent channels
In addition to the fragmentation described above, scans of 'adjacent channels' also show a weaker signal strength than the primary channel. Noise rejection and integrity checcking in 2.4 radios will result in adjacent channel traffic being ignored, although they can still corrupt proper signals if strong enough.


Distant 'adjacent'



This FPV (First Person Video) system uses 19 to 20 channels. It is a 10mW version centred on about channel 50. The video is carried in the middle 5 or 6. The 'wings' on the side are believed to be audio and are about 19dB less, thus around 80 times weaker. The risk of corrupting other RC transmissions is therefore greatest in the middle 6.

Solid mode

High/Average mode

Spektrum Analyzer
The transmission patterns in the centre 6 channels vary quite a bit. They can range from solid usage through to almost nothing. So RC reception on those channels is likely be eratic. The risk increases as your model gets closer to the airborne transmitter.

Spektrums use two channels but they can unfortunately be very close together. They also transmit the least frequently (<50Hz). Should a Spektrum radio select both channels within the FPV band, they are at some risk. Assan only uses one channel. Should it be within the FPV band it has only a slightly better chance because it transmits data more often (>200Hz). Channel hopping systems (eg: Futaba) are the only ones with no risk from FPV.

Disclaimer: This is one make of FPV so may not be representative of other makes.

The scanner explained...

'Sweep' mode

The scanner uses the CC2500 RF chip, a Hantronix T6963C-based 128x128 graphical LCD, a PIC 18F2620 and thousands of lines of C code! Being lipo powered, it is fully portable, discreet and self-contained.

The default 'sweep' mode scans a range of channels in succession to reveal activity on the band. The 'Iter' parameter sets the number of measurements performed on each channel before moving to the next. This can range from 2 to 32768 and sets the sweep speed. The fastest scan of all 84 channels is around 0.7s (8.2ms per channel). The slowest sweep takes 2 minutes (1.4s per channel).

The Start and End channel numbers are used to set a range of channels. The tool scans continously, wrapping at the end of each sweep automatically. A progress bar shows where it's at. The 'centre' button can pause the sweep at any time. The scale on the right is in 10dBm intervals. The lowest marker is -110dBm and the highest -10dBm. 'dB' (decibels) is used for convenience elsewhere on this page.

Both the strongest and a simple average of all measurements are calculated for every channel scanned. It is easiest to see 'solid' bars up to the strongest value for each channel. However, a 'High/Average' setting exists to show both measurements. The average represents a very simple approximation of channel usage. For instance, it is easy to see from the middle photo below there is very little WiFi activity in this scan.

Assan & Wifi
'Solid' bars

Assan &Wifi
'High/Average' bars

Assan(ch11) & Robo(ch17)
Channels 0-51
The strongest signal strength ('Hi') and average ('Av') for the 4 strongest channels is shown using text at the top of the screen. The range of decibels measured by this scanner are all negative. So the smaller the number, the stronger the signal. In the photo on the right, channel 11 is stronger than 12, and channel 17 dominates 18. This helps you identify that 11 and 17 are the centre frequencies for these two transmitters. The photo on the right also shows the use of a smaller channel range (0-51).

RC channel spacing is 1MHz and the scanner is set to that. This sets the centre frequency for each of the 84 channels (eg: 2400kHz for channel 0, 2401kHz for 1, etc). The RF chip allows almost any frequency to be set, allowing almost any channel spacing, but only the 1Mhz has been implemented in the scanner so far.

A bandwidth filter exists to focus reception on a narrow/specific frequency spectrum (minimise reception of adjacent channel traffic). Bandwidth can be set between 58 and 812kHz in 15 steps. It is normal for it to be well under the channel spacing. I have chosen 650kHz as the default but this is adjustable. Sensitivity increases as bandwidth is reduced. At the more sensitive settings, the RF chip exhibits some low power 'spurious' signals as the datasheet calls them. These appear on 7 channels and don't appear to influence the scanning of strong signals.

The speed at which data can be received is more relevant for a receiver than a scanner. Nevertheless, this can be ajusted in 14 steps from 1 to 500 kBaud (kbps) and 250kB has been chosen as the default.

LCD contrast is temperature dependant and is set automatically down to 0'C. It can also be changed manually. 2 lipos are used and the voltage appears below the symbol representing the toggle joystick at the top right of the screen. Temperature in 'C appears alongside the voltage. Both are updated every time a button is pressed. An LED exists to give low voltage warnings, and the responsiveness of button presses reduces to also warn of low voltage.

'Usage' mode

This mode scans one channel at a time. It does this either 1400 or 2800 times and stores every measurement as quickly as possible. Each measurement takes 0.042ms. Every measurement is displayed, starting on the top left and going down each column, wrapping to the top of each successive column. 100 measurements appear in every column and the markers on the right are again 10 apart. The Spectrum Analyzer photo on the right confirms the frequency of transmissions.

1400 (x0)

2800 (x0)

2800 (x4)

Spekrum Analyser
The scan duration can be 'stretched' by x0 (no stretch), x2, x4, x8 and x16. This inserts delays between each scan. Fewer 'on' signals will be captured but a longer period covered to pick up patterns and channel usage. The stretch factor is reasonably linear, ie: 1400 x0 takes 59ms, x2 123ms, x4 241ms, x8 478ms, x16 953ms. The longest scan with 2800 measurements and x16 stretch takes 1.9s (2800 x 0.042ms x 16).

Text information at the top of the screen (old version in photos above):
* The strongest signal (-dB) is displayed on the 1st line. This helps confirm you were monitoring an active channel rather than one adjascent. The channel number is displayed because scans of a range of channels are possible.
* The average duty cycle (%) is on the 2nd line. This confirms how 'busy' the channel is and how much room there would be for more users on the channel. The number of 'on' measurements and continuous bursts are also shown on line 2.
* The average frequency and burst duration is on the 3rd line. These will not be accurate if there are gaps in bursts.

More information on 2.4GHz can be found here:
* Overview of 2.4GHz
* 2.4GHz lockout logger Assan diversity and range tests
* 2.4GHz diversity tests Spektrum diversity and range tests
* My 2.4 GHz Receivers
* Spektrum technical FAQs

Top of page
Click on the links above for more info.
Click on the links below for other pages.

Home Art of the Possible Absence of Matter Links Updates Email