I2C write/input framing (host→module) for the 0x50/0x54 mailbox protocol

IoT Modules GNSS Module
1

Hello,
I’m using an LC76G (model LC76GABNR12A01S) over I2C on a Waveshare RP2350-Touch-AMOLED-1.75 board (RP2350 MCU, I2C1). I have reading NMEA working reliably using the mailbox protocol:
Write address 0x50, read address 0x54 (7-bit)
Query available length: write 08 00 51 AA 04 00 00 00 to 0x50, then read 4 bytes from 0x54 (little-endian length)
Read data: write 00 20 51 AA + 4-byte requested length to 0x50, then read that many bytes from 0x54
This works well and I get GGA/RMC/GSV/VTG etc.
Now I need to send configuration commands to the module over the same I2C interface — specifically $PAIR050 (fix rate), $PAIR062 (per-message output on/off), and $PAIR070 (static hold). I cannot find the write/input framing for this mailbox protocol anywhere.
Could you please clarify:
What is the exact write header/preamble for sending data to the module (the equivalent of 08 00 51 AA / 00 20 51 AA on the read side)?
Do I need to poll the module’s free RX buffer space before writing, and if so, what is the command/register for that?
What is the length field format and the required minimum delay between I2C transactions for a write?
A short byte-level example of sending one PAIR command (e.g. $PAIR050,200*21\r\n) over I2C would be ideal.
Could you also please send me the current GNSS I2C Application Note that documents this mailbox protocol (I only have the older 2016 MC20 revision, which describes a different 0x10-address scheme)?
Thank you very much

2

Hi @dng

Below are the technical details for the write framing and the polling mechanism you required.

1. Write Header and Preamble

The write sequence consists of two distinct phases. Unlike the read side, which only uses the Configuration Read command (0xAA51 ), the write side uses both Configuration Read and Configuration Write ( 0xAA53 ) .

  • Polling Free Space (Equivalent to 08 00 51 AA ): Write 04 00 51 AA 04 00 00 00 to address 0x50 .
    • Breakdown: 0xAA51 (CR command) | 0x0004 (RX_LEN_REG offset) | 0x00000004 (request 4 bytes).
  • Write Configuration (Equivalent to 00 20 51 AA ): Write 00 10 53 AA + 4-byte length to address 0x50 .
    • Breakdown: 0xAA53 (CW command) | 0x1000 (RX_BUF_REG offset) | 4-byte little-endian length .

2. Polling Free RX Buffer Space

You must poll the module’s free RX buffer space before writing to ensure you do not overflow the module’s 4096-byte input cache.

  • Register: SLAVE_RX_LEN_REG (Offset 0x04 ).
  • Procedure:
    1. Write the polling header (04 00 51 AA 04 00 00 00 ) to 0x50 .
    2. Delay 10 ms .
    3. Read 4 bytes from address 0x54 . This value is a little-endian unsigned integer representing the available bytes in the module’s RX buffer.

3. Length Format and Timing

  • Length Field Format: All length parameters must be 4-byte unsigned integers in little-endian format .
  • Minimum Delay: You must wait at least 10 ms between any I2C transaction (e.g., between writing the configuration and reading the length, or between configuring the write and sending the actual data).

4. Byte-Level Example: Sending $PAIR050,200*21\r\n

Command length: 15 bytes (0x0000000F ).

  1. Poll RX Space: Write 04 00 51 AA 04 00 00 00 to 0x50 .
  2. Wait 10ms , then read 4 bytes from 0x54 . Confirm result is ≥ 15.
  3. Configure Write: Write 00 10 53 AA 0F 00 00 00 to 0x50 .
  4. Wait 10ms , then write data to address 0x58 : 24 50 41 49 52 30 35 30 2C 32 30 30 2A 32 31 0D 0A

For the documentation, please refer to this link:
Quectel_LC26G(AB)&LC26G-T(AA)&LC76G_Series_I2C_Application_Note_V1.2

Best regards,