FrSky SPort protocol specs

from https://www.ordinoscope.net/static/frsky-arduino/FrskySP/doc/html/index.html

It's a master/slave protocol. The RX sends a poll packet every 12ms (4bytes)

2bytes	description
0x7E	poll header
ID	physical ID (1-28) computed with a CRC

The receiver will poll the IDs in sequence to find which one is present. If only one physical ID is found, the receiver will alternate the sensor polling and the search (present sensor, next ID to search, present sensor, next ID and so on). If more sensors are found, the poll sequence returns almost to a normal search pattern.

Sensor behavior

The sensor answers to every pool on its physical ID to announce its presence. If no data can be transmitted (no refresh), the sensor answers by an empty packet and a false CRC (type 0x00, ID 0x0000, value 0x00000000, CRC 0xFF).

byte(s)	descrption
1	type 0x10,0x30,0x31,0x32
2	sensor logical ID
4	value
1	CRC

Types (from betaflight for MSP over Frsky)

• FSSP_DATA_FRAME = 0x10 (Standard Frsky sensor Frame)
• FSSP_MSPC_FRAME_SMARTPORT = 0x30, // MSP client frame
• FSSP_MSPC_FRAME_FPORT = 0x31, // MSP client frame
• FSSP_MSPS_FRAME = 0x32, // MSP server frame (to OpenTX radio 6bytes payload)

Phisycal Sensor ID List

Sensor Ids (from betaflight for MSP over Frsky)

1. FSSP_SENSOR_ID1 = 0x1B,
2. FSSP_SENSOR_ID2 = 0x0D,
3. FSSP_SENSOR_ID3 = 0x34,
4. FSSP_SENSOR_ID4 = 0x67

there are 32 ID's polled by smartport master, remaining 3 bits are crc (according to comments in openTx code)

ID	description
0x00	// Physical ID 1 - Vario2 (altimeter high precision)
0xA1	// Physical ID 2 - FLVSS Lipo sensor (can be sent with one or two cell voltages)
0x22	// Physical ID 3 - FAS-40S current sensor
0x83	// Physical ID 4 - GPS / altimeter (normal precision)
0xE4	// Physical ID 5 - RPM
0x45	// Physical ID 6 - SP2UART(Host)
0xC6	// Physical ID 7 - SPUART(Remote)
0x67	// Physical ID 8 -
0x48	// Physical ID 9 -
0xE9	// Physical ID 10 -
0x6A	// Physical ID 11 -
0xCB	// Physical ID 12 -
0xAC	// Physical ID 13 -
0x0D	// Physical ID 14 -
0x8E	// Physical ID 15 -
0x2F	// Physical ID 16 -
0xD0	// Physical ID 17 -
0x71	// Physical ID 18 -
0xF2	// Physical ID 19 -
0x53	// Physical ID 20 -
0x34	// Physical ID 21 -
0x95	// Physical ID 22 -
0x16	// Physical ID 23 -
0xB7	// Physical ID 24 - IMU ACC (x,y,z)
0x98	// Physical ID 25 -
0x39	// Physical ID 26 - Power Box
0xBA	// Physical ID 27 - Temp
0x1B	// Physical ID 28 - Fuel (ArduPilot/Betaflight)