ELRS on the Wire — CRSF, Packet Rates & Range

calendar Jul 13, 2026 · 5 min read · fpv elrs expressLRS crsf protocol packet-rate telemetry range latency lora  ·
Share on: linkedin copy

An ELRS link is really two protocols back to back: an RF air protocol between the handset's TX module and the receiver, and a CRSF serial protocol between the receiver and the flight controller. Setup (bind phrase, domain) lives in ELRS Configuration; the OSD numbers live in RC Telemetry. This snippet is the wire- and packet-level view, and why packet rate trades responsiveness against range.

flowchart LR
    Handset[Radio handset] -->|CRSF over UART| TXmod[TX module]
    TXmod -->|ELRS RF air protocol| RX[Receiver]
    RX -->|CRSF over UART, 420k| FC[Flight controller]
    RX -->|ELRS RF telemetry| TXmod

The CRSF wire (receiver → flight controller)

Between RX and FC the data is CRSF (Crossfire Serial Protocol) over a plain UART — 420 kbaud, 8N1, one start bit and one stop bit per byte. High packet rates (500 Hz+) negotiate a faster baud (e.g. 921600) so the bytes still fit between updates.

Frame format

Every CRSF frame is the same shape and never exceeds 64 bytes:

Byte(s)FieldMeaning
0Sync0xC8 (device address / sync)
1Lengthnumber of bytes that follow — type + payload + CRC (2–62)
2Typeframe type (what the payload is)
3 … n-1Payload0–60 bytes, type-specific
nCRC8over type + payload only, polynomial 0xD5 (DVB-S2)

The CRC deliberately excludes the sync and length bytes, so a corrupted length can't hide a corrupted payload.

Frame types you'll actually see

TypeNameDirectionCarries
0x16RC Channels PackedRX → FC16 channels × 11 bits (the sticks)
0x14Link StatisticsRX → FCRSSI, LQ, SNR, RF mode, TX power
0x08Battery SensorFC → RXvoltage, current, mAh (telemetry uplink)
0x02GPSFC → RXlat/lon, speed, sats
0x1EAttitudeFC → RXroll, pitch, yaw
0x2B/2C/2DLUA parametersboththe on-radio ELRS config menu
0x7A–0x7CMSP over CRSFbothConfigurator traffic through the link

How the sticks are packed (0x16)

The RC frame crams 16 channels of 11 bits into exactly 22 bytes (16 × 11 = 176 bits). 11-bit fields do not line up with 8-bit bytes, so channels straddle byte boundaries:

(Bit 0 is on the right. The bit ruler makes the mismatch clear — ch2 starts mid-byte, ch3 spills into the next byte.) 11 bits = 2048 steps, matching the RC resolution ELRS carries end to end. A whole RC frame is 1 + 1 + 1 + 22 + 1 = 26 bytes → 260 bit-times → ~620 µs at 420 kbaud, which is why 1000 Hz packet rates need the higher CRSF baud.

Ten bytes, the source of every number on your OSD:

1uplink RSSI ant1, uplink RSSI ant2, uplink LQ, uplink SNR,
2active antenna, RF mode, uplink TX power,
3downlink RSSI, downlink LQ, downlink SNR

Uplink = handset → craft (your control link). Downlink = craft → handset (telemetry).

The RF air protocol — packet rate

Over the air, packet rate is how many control packets per second the TX sends. It is the single most consequential ELRS setting because it sets the floor for latency and the ceiling for range at the same time.

2.4 GHz

RateModulationSensitivityAir latencyCharacter
50 HzLoRa−115 dBm~20 msmaximum range / penetration
150 HzLoRa−112 dBm~6.7 msbalanced long-range
250 HzLoRa−108 dBm~4 msdefault; great all-rounder
333 Hz FullLoRa−105 dBm~3 msmore channels, shorter range
500 HzLoRa−105 dBm~2 msfreestyle/racing sweet spot
F1000FLRC−104 dBm~1.5 msracing only; fragile at range

900 MHz

Tops out at 200 Hz, but the low-rate modes reach much deeper: 25 Hz hits −123 dBm and 50 Hz −120 dBm. Lower frequency also diffracts around obstacles better than 2.4 GHz, so 900 MHz is the long-range / behind-terrain band.

Why the trade-off exists

Lower packet rate → each packet is on air longer, using a higher LoRa spreading factor. More energy per bit means the receiver can dig the signal further out of the noise:

  • Sensitivity → range. Every ~6 dB of extra sensitivity roughly doubles free-space range (path loss goes as distance²). 50 Hz (−115 dBm) sits ~10 dB below 500 Hz (−105 dBm) — roughly 3× the range for the same TX power.
  • Sensitivity → penetration. Trees, walls and your own body attenuate the signal by some dB. The extra sensitivity margin is exactly what lets a low rate "punch through" an obstacle that makes a high rate fail-safe.
  • Rate → responsiveness. Responsiveness is just the gap between updates: 1000 Hz = a fresh command every 1 ms; 50 Hz = every 20 ms. Racers feel the difference between 2 ms and 6.7 ms as a tighter stick-to-quad connection; below ~150 Hz the latency becomes perceptible.

You cannot have all three. Fast packets are responsive but fragile; slow packets are tough but laggy. The right answer is dynamic: enable Dynamic Power and let the link drop to a lower rate at the edge of range (set once in the ELRS LUA script).

flowchart TD
    R{Packet rate} -->|High: 500–1000 Hz| Fast[Low latency<br/>Short range<br/>Poor penetration]
    R -->|Low: 25–50 Hz| Slow[High latency<br/>Long range<br/>Great penetration]
    R -->|Mid: 150–250 Hz| Bal[Balanced<br/>Sensible default]

Telemetry ratio

Downlink telemetry (RX → handset) borrows time slots from the uplink. The telemetry ratio 1:n means one telemetry packet per n RC packets:

  • A tighter ratio (1:2) gives fast telemetry but steals slots from control.
  • A looser ratio (1:64, "Std") keeps almost all bandwidth for RC.
  • At low packet rates the total pipe is tiny — even 1:2 at 50 Hz is only ~25 telemetry updates/s, too little for a smooth MAVLink HUD. Raising telemetry bandwidth means raising the packet rate, not just the ratio.

For most flying Std or 1:8–1:16 is right; for GPS/HUD work run 250 Hz+ with 1:2.

What this means in practice

  • CRSF is a checksummed byte protocol on a UART — set the port to Serial RX, provider CRSF, un-inverted; see ELRS Configuration.
  • Packet rate is a three-way trade — responsiveness vs range vs penetration. Pick for the flight, or go dynamic.
  • The OSD numbers come straight from the 0x14 frame — what each one means and which to watch is in RC Telemetry, and getting the antenna right in Antenna Placement.

Related Snippets