/
DSM.txt
181 lines (150 loc) · 6.71 KB
/
DSM.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
Virtually all of the information in this document was provided by hammer22. So Thanks!
DSM2:
DSM2 data packets consist of 7 channels each. The packets are formatted as 16bit MSB-1st values.
Data can be either 10 or 11 bits.
6-channel DSM2 = 10bit
8-channel DSM2 = 11bit
All DSMx appears to be 11bit
A packet consists of a Tx ID + up to 7 channels of data,
each 16bit data value is defined as:
10bit:
a 0 bbbb cccccccccc
11bit:
a bbbb ccccccccccc
a: 0 for 1st data packet, 1 for 1st channel in 2nd data packet
bbbb: the channel number of this packet
cc..: 10 or 11bit channel data (MSB 1st)
The channel data will be 0xffff if the specific channel slot is unused
Channel assignment appears to be:
0: Throttle
1: Aileron
2: Elevator
3: Rudder
4: Gear
5: Aux1
6: Aux2
7: Aux3
Data packets are defined as:
aa bb cccc dddd eeee ffff gggg hhhh iiii
aa: If DSM2: 0xff - mfgid[2], if DSMX mfgid[2]
bb: If DSM2: 0xff - mfgid[3] + offset, if DSMX mfgid[3] + offset (see binding)
cccc: Channel
dddd: Channel
eeee: Channel
ffff: Channel
gggg: Channel
hhhh: Channel
iiii: Channel
Each packet is sent twice, once on channel 'a' and 4msec later on channel 'b'
If there are more than 7 channels to transmit, the upper channels are transmitted using the same
packet format 11mec after the low-channel packet.
New channel data is transmitted each 22msec.
For example:
0msec: Transmit channels 0-7 on channel 'a'
4msec: Transmit channels 0-7 on channel 'b'
11msec: Transmit channels 8-14 on channel 'a'
15msec: Transmit channels 8-14 on channel 'b'
22msec: Transmit channels 0-7 on channel 'a'
New SOP(8 bytes) and Data (16 bytes) codes are sent before each packet.
Binding:
The bind packet is as follows:
aa bb cc dd aa bb cc dd eeee ff gg hh ii jjjj
aa : 0xff - mfgid[0]
bb : 0xff - mfgid[1]
cc : 0xff - mfgid[2]
dd : 0xff - mfgid[3] + offset
eeee : 384 + sum of bytes 0 through 7
ff : Unknown (value = 0x01)
gg : # of channels being transmitted
hh : Transmitter capabilities
: HP6DSM (DSM2): 0x01
: DX6i (DSMX): 0xA2
: DX8 (DSM2): 0x12
: DX8 (DSMX): 0xB2
: DM9 (DSM2): 0x02
# of packets (1 if num-channels < 8, 2 if num-channels >= 8) for DSM2
ii : Unknown (value = 0x00)
jjjj : eeee + sum of bytes 8 through 13
The bind channel can be any odd channel between 0x01 and 0x4f
The SOP and CRC are set as below for the chosen bind channel
The DATA code is 32 bytes. The 1st 16 bytes are as defined below for the bind channel.
The 2nd 16 bytes are always:
D7A154B15E89AE86 C69422FE48E6574E
Once the Rx detects that the bind packet is no longer being sent, it
will transmit a confirmation on the same channel using the following 16byte DATA code:
98881BE430790384 060C12181E247110
It is not required that the Tx receives or acts upon this packet
The confirmation data is:
aa bb cc dd ee ff gg hh ii jj
aa: byte[0] of bind packet
bb: byte[1] of bind packet
cc: byte[2] of bind packet
dd: byte[3] of bind packet
ee: byte[10] of bind packet (always 0x01)
ff: # of supported channels(?)
AR7000=0x07, AR6010=0x07, AR6210=0x07
gg: requested packet type
AR6210 connected to HP6DSM(DSM2): 0x01 (DSM2 requested)
AR7000 connected to DX6i (DSMX): 0x01 (DSM2 requested)
AR6010 connected to DX6i (DSMX): 0xA2 (DSMX requested)
hh: byte[13] of bind packet (always 0x00)
SOP/Data/CRC code selection:
There is one set of SOP, Data, and CRC codes for each transmit channel.
The SOP and DATA codes come from the Cypress recommended SOP table. the codes are documented here:
http://www.cypress.com/?docID=15229
They are organized in 5 rows of 9 columns with the content of each 'cell' being an 8-byte PN code
The row is determined by the transmit channel as:
row = channel modulo 5
The columns are determined from the mfgid as follows:
sop-col = (mfgid[0] + mfgid[1] + mfgid[2] + 2) & 0x07
data-col0 = 7 - sop-col
data-col1 = data-col0 + 1
The crc for channel 'a' is NOT(mfgid[1] << 8 + mfgid[0])
The crc for channel 'b' is (mfgid[1] << 8 + mfgid[0])
Here is the table (note that I've transposed rows and columns to make it easier to read)
Note: Values are LSB 1st
0 1 2 3 4
0 03BC6E8AEFBDFEF8 83F7A82D7A4464D3 405632D90FD95D97 C0908FBB7C8E2B8E E1D631265FBD4093
1 8817133B2DBF06D6 3F2C4EAA71487AC9 8E4AD0A9A7FF20CA 8069268008F849E7 DC68089997AEAF8C
2 F1943021A11C88A9 17FF9E213690C782 4C979DBFB83DB5BE 7D2D4954D08040C1 C30E01160E3206BA
3 D0D28EBC822FE3B4 BC5D9A5BEE7F42EB 0C5D24309FCA6DBD B6F2E61B805A36B4 E08301FAAB3E8FAC
4 8CFA479B83A566D0 24F5DDF87A7774E7 501433DEF17895AD 42AE9C1CDA6705F6 5CD59CB8469C7D84
5 07BD9F26C8310FB8 3D707C94DC84AD95 0C3CFAF9F0F210C9 9B75F7E0148DB580 F1C6FE5C9DA54FB7
6 EF039589B471619D 1E6AF037527B11D4 F4DA06DBBF4E6FB3 BF5498B9B7305A88 58B5B3DD0E28F1B0
7 40BA97D5864FCCD1 62F52BAAFC33BFAF 9E08D1AE595EE8F0 35D1FC9723D4C988 5F303B569645F4A1
8 D7A154B15E89AE86 405632D90FD95D97 C0908FBB7C8E2B8E E1D631265FBD4093 03BC6E8AEFBDFEF8
The DSM-X channel hopping algorithm was found by Alexandr Alexandrov and Sergey Gimaev.
Channel hopping
DSM-X uses a 23-channel hopping sequence. The sequence is based upon a unique Tx ID.
The channel hopping algorithm uses an LSR and is computed as follows.
id_tmp = ID = negate(CYRF MFGID + model #)
foreach idx in (0 .. 22):
ok = 0
while(ok is 0):
id_tmp = id_tmp * 0x0019660D + 0x3C6EF35F ## Randomization
next_ch = ((id_tmp >> 8) MODULO 0x49) + 3 ## Use least-significant byte and must be larger than 3
if (next_ch is odd and ID is odd OR next_ch is even and ID is even)
AND none of the values in the 'ch' array are equal to next_ch:
if 3 <= tmp < 28 and the number of channels in ch that are between 3 and 28 is < 8
OR 28 <= tmp < 52 and the number of channels in ch that are between 28 and 52 is < 7
OR 53 <= tmp and the number of channels in ch that are greater than 53 is < 8:
ok = 1
ch[idx] = next_ch
The X-Plus channels structure was decoded by Cesco and vlad_vy.
Channel numbers 0 to 11 are normal, with data resolution 11bit (2048).
Channel 12 carries the X-Plus channels, with data resolution 9bit (512).
Channel transfer structure:
packet 1 -> 1 5 2 4 6 10 12
packet 2 -> 0 7 3 8 9 11 12
X-Plus data format
each 16bit X-Plus data value is defined as:
a bbbb cc ddddddddd
a: always 0
bbbb: the channel number, always 12
cc: X-Plus channel number, low 2 bits, third bit defined by packet number, 1st packet = 0, second packet = 1
dd..: X-Plus channel data, 9 bits, 256 is midpoint
The channel data will be 0xffff if the specific X-Plus channel slot is unused.
1 to 2 X-Plus channels, every 22ms
3 to 4 X-Plus channels, every 44ms
5 to 6 X-Plus channels, every 66ms
7 to 8 X-Plus channels, every 88ms