|
|
基于DEVO 7E 源代码在这里 有兴趣可以直接找其他资料
https://bitbucket.org/PhracturedBlue/deviation
https://bitbucket.org/sunvsuv/deviationfor6810/overview
技术比较复杂
硬件基于STM32F100 12864点阵 支持A7015 CC2500 24l01 CY6836 等主流无线模块 带2Mflash
软件 基于HID 大容量存储器 DUP升级 GUI
这个是他们猜出来的DSM2无线遥控协议，这个比较牛，得分析好久
DSM2:
DSM2 data packets consist of 7 channels each. the packets are formatted as 16bit MSB-1st values
Data can be either 10 or 11 bits.
6-channel DSM2 = 10bit
8-channel DSM2 = 11bit
All DSMx appears to be 11bit
A packet consists of a Tx ID + upto 7 channels of data
each 16bit data value is defined as:
10bit:
a 0 bbbb cccccccccc
11bit:
a bbbb ccccccccccc
a: 0 for 1st data packet, 1 for 1st channel in 2nd data packet
bbbb: the channel number of this packet
cc..: 10 or 11bit channel data (MSB 1st)
The channel data will be 0xffff if the specific channel slot is unused
Channel assignment appears to be:
0: Throttle
1: Aileron
2: Elevator
3: Rudder
4: Gear
5: Aux1
6: Aux2
7: Aux3
Data packets are defined as:
aa bb cccc dddd eeee ffff gggg hhhh iiii
aa: If DSM2: 0xff - mfgid[2], if DSMX mfgid[2]
bb: If DSM2: 0xff - mfgid[3] + offset, if DSMX mfgid[3] + offset (see binding)
cccc: Channel
dddd: Channel
eeee: Channel
ffff: Channel
gggg: Channel
hhhh: Channel
iiii: Channel
Each packet is sent twice, once on channel 'a' and 4msec later on channel 'b'
If there are more than 7 channels to transmit, the upper channels are transmitted using the same
packet format 11mec after the the low-channel packet.
New channel data is transmitted each 22msec
For example:
0msec: Transmit channels 0-7 on channel 'a'
4msec: Transmit channels 0-7 on channel 'b'
11msec: Transmit channels 8-14 on channel 'a'
15msec: Transmit channels 8-14 on channel 'b'
22msec: Transmit channels 0-7 on channel 'a'
New SOP(8 bytes) and Data (16 bytes) codes are sent before each packet.
Binding:
The bind packet is as follows:
aa bb cc dd aa bb cc dd eeee ff gg hh ii jjjj
aa : 0xff - mfgid[0]
bb : 0xff - mfgid[1]
cc : 0xff - mfgid[2]
dd : 0xff - mfgid[3] + offset
eeee : 384 + sum of bytes 0 through 7
ff : Unknown (value = 0x01)
gg : # of channels being transmitted
hh : Transmitter capabilities
: HP6DSM (DSM2): 0x01
: DX6i (DSMX): 0xA2
: DX8 (DSM2): 0x12
: DX8 (DSMX): 0xB2
: DM9 (DSM2): 0x02
# of packets (1 if num-channels < 8, 2 if num-channels >= 8) for DSM2
ii : Unknown (value = 0x00)
jjjj : eeee + sum of bytes 8 through 13
The bind channel can be any odd channel between 0x01 and 0x4f
The SOP and CRC are set as below for the chosen bind channel
the DATA code is 32 bytes. The 1st 16 bytes are as defined below for the bind channel.
The 2nd 16 bytes are always:
D7A154B15E89AE86 C69422FE48E6574E
Once the Rx detectes that the bind packet is no longer being sent, it
will transmit a confirmation on the same channel using the fillowing 16byte DATA code:
98881BE430790384 060C12181E247110
It is not required that the Tx receives or acts upon this packet
The confirmation data is:
aa bb cc dd ee ff gg hh ii jj
aa: byte[0] of bind packet
bb: byte[1] of bind packet
cc: byte[2] of bind packet
dd: byte[3] of bind packet
ee: byte[10] of bind packet (always 0x01)
ff: # of supported channels(?)
AR7000=0x07, AR6010=0x07, AR6210=0x07
gg: requested packet type
AR6210 connected to HP6DSM(DSM2): 0x01 (DSM2 requested)
AR7000 connected to DX6i (DSMX): 0x01 (DSM2 requested)
AR6010 connected to DX6i (DSMX): 0xA2 (DSMX requested)
hh: byte[13] of bind packet (always 0x00)
SOP/Data/CRC code selection:
there is one set of SOP, Data, and CRC codes for each transmit channel.
The SOP and DATA codes come from the Cypress recommended SOP table. the codes are documented here:
http://www.cypress.com/?docID=15229
They are organized in 5 rows of 9 columns with the contenst of each 'cell' being an 8-byte PN code
The row is determined by the transmit channel as:
row = channel modulo 5
The columns are determined from the mfgid as follows:
sop-col = (mfgid[0] + mfgid[1] + mfgid[2] + 2) & 0x07
data-col0 = 7 - sop-col
data-col1 = data-col0 + 1
The crc for channel 'a' is NOT(mfgid[1] << 8 + mfgid[0])
The crc for channel 'b' is (mfgid[1] << 8 + mfgid[0])
Here is the table (note that I've transposed rows and columns to make it easier to read)
Note: Values are LSB 1st
0 1 2 3 4
0 03BC6E8AEFBDFEF8 83F7A82D7A4464D3 405632D90FD95D97 C0908FBB7C8E2B8E E1D631265FBD4093
1 8817133B2DBF06D6 3F2C4EAA71487AC9 8E4AD0A9A7FF20CA 8069268008F849E7 DC68089997AEAF8C
2 F1943021A11C88A9 17FF9E213690C782 4C979DBFB83DB5BE 7D2D4954D08040C1 C30E01160E3206BA
3 D0D28EBC822FE3B4 BC5D9A5BEE7F42EB 0C5D24309FCA6DBD B6F2E61B805A36B4 E08301FAAB3E8FAC
4 8CFA479B83A566D0 24F5DDF87A7774E7 501433DEF17895AD 42AE9C1CDA6705F6 5CD59CB8469C7D84
5 07BD9F26C8310FB8 3D707C94DC84AD95 0C3CFAF9F0F210C9 9B75F7E0148DB580 F1C6FE5C9DA54FB7
6 EF039589B471619D 1E6AF037527B11D4 F4DA06DBBF4E6FB3 BF5498B9B7305A88 58B5B3DD0E28F1B0
7 40BA97D5864FCCD1 62F52BAAFC33BFAF 9E08D1AE595EE8F0 35D1FC9723D4C988 5F303B569645F4A1
8 D7A154B15E89AE86 405632D90FD95D97 C0908FBB7C8E2B8E 88E1D631265FBD40 03BC6E8AEFBDFEF8
The DSM-X channel hopping algorithm was found by Alexandr Alexandrov and Sergey Gimaev.
Channel hopping
DSM-X uses a 23-channel hopping sequence. The sequence is based upon a unique Tx ID.
The channel hopping algorithm uses an LSR and is computed as follows.
id_tmp = ID = negate(CYRF MFGID + model #)
foreach idx in (0 .. 22):
ok = 0
while(ok is 0):
id_tmp = id_tmp * 0x0019660D + 0x3C6EF35F ## Randomization
next_ch = ((id_tmp >> 8) MODULO 0x49) + 3 ## Use least-significant byte and must be larger than 3
if (next_ch is odd and ID is odd OR next_ch is even and ID is even)
AND none of the values in the 'ch' array are equal to next_ch:
if 3 <= tmp < 28 and the number of channels in ch that are between 3 and 28 is < 8
OR 28 <= tmp < 52 and the number of channels in ch that are between 28 and 52 is < 7
OR 53 <= tmp and the number of channels in ch that are greater than 53 is < 8:
ok = 1
ch[idx] = next_ch
|
阿莫论坛20周年了！感谢大家的支持与爱护！！
一只鸟敢站在脆弱的枝条上歇脚，它依仗的不是枝条不会断，而是自己有翅膀，会飞。
|
发表于 2013-8-30 11:56:02
楼主
