Flysky AFHDS 2A, protocol as used i10, i6, iT4,

More
15 Apr 2016 22:54 - 15 Apr 2016 22:54 #46588 by goebish
That's normal, this is 3-wire SPI, Master In (MISO) and Master Out (MOSI) share the same pin (SDIO) ;)
Last edit: 15 Apr 2016 22:54 by goebish.

Please Log in or Create an account to join the conversation.

More
15 Apr 2016 22:56 #46589 by dc59
Hi Goebish,
Thanks for rapid reply,I got it. :cheer:

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 09:27 #46610 by dc59
Hi Gosbish,

Here is my captures from FS-I6 (receiver is FS-IA6B) ,I upgraded a hacked FW to 10 channels; All captured data should have RX voltage telemetry data from 5.02v to 4.96v.
please take a look at these data.

www.mediafire.com/download/gaug8fiu6w2sc6s/FS-I6-SPI-01-03.zip
www.mediafire.com/download/8n5oqlgw6886exh/FS-I6-SPI-04-06.zip

I need some time to study telemetry data capture. :)
Thanks!

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 10:06 #46613 by goebish
Bad captures ;)

Please retry with higher sample rate and/or shorter wires.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 10:12 #46616 by stinkydiver73
Replied by stinkydiver73 on topic Flysky AFHDS 2A, protocol as used i10, i6, iT4,
The SPI clock is 6Mhz as i remember, you must use at least 2x of that for sampling frequency, the next good choice is 16Mhz sample rate.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 10:13 #46617 by dc59
No problem, I will do it both shorter wire length and higher sampling rate.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 10:13 #46618 by goebish
Higher sample rate only should be fine.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 10:18 - 16 Apr 2016 11:12 #46619 by goebish
This is why you need to sample at least at twice the speed of the clock signal:
en.wikipedia.org/wiki/Nyquist%E2%80%93Shannon_sampling_theorem
Last edit: 16 Apr 2016 11:12 by goebish.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 10:30 #46620 by dc59
@stinkydiver73
Thanks!

@Goebish
OK, I'll try 24MHz the max sample rate of my analyzer later.

Please Log in or Create an account to join the conversation.

More
More
16 Apr 2016 11:58 #46626 by goebish
Looks fine, thanks !

As I said I do not have much time to look at that for now, but that will help, for sure :)

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 12:02 #46629 by dc59
No problem at all about time!
Thanks ! :cheer:

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 12:03 - 16 Apr 2016 19:21 #46630 by goebish
Also, if someone else wanna have a look, here's my A7105 decoder python script (based on victzh's nrf24l01 decoder), it's working fine with dc59's .csv files:
gist.github.com/goebish/e6a486a87fba5a233c56

It doesn't look very complex, I think the hardest part will be to figure out the channel hopping sequence for arbitrary txid/rxid (as usual ;)).

edit: I think I figured it already, channels list is sent with bind packets, seems it has nothing to do with txid/rxid (well, hopefully, or I don't see the point to send them along, also I've looked at a ROM / EEPROM dump and I can see the channel list is stored there, next to txid, so there's a good chance it is semi random, not computed from txid, but I need to make tests with an actual RX to confirm that... but perhaps I'm wrong and it relies on a tx_channels table as older AFHDS :(, oh well, worst case I'll have to fire up the jtag probe, openocd and IDA and trace the sequence generation, this is a good opportunity to learn new tricks ...).

this is a bind packet:
150 W_REGISTER(05_FIFO_DATA) BB 44 2A 37 77 FF FF FF FF 01 00 2B 62 1D 50 0F 41 3C 92 71 6C 32 79 58 7F 86 8B FF FF FF FF FF FF FF FF FF FF 00

and channels hopping sequence for data packets is:
2B 62 1D 50 0F 41 3C 92 71 6C 32 79 58 7F 86 8B

TXID is 44 2A 37 77, the 4 following FF are RXID, which is received from the RX later.
(from the 3 differents captures I've seen, txid 3rd byte is 36 or 37, and 4th byte is always 77)

Looks like data packets don't have a checksum or CRC, just
packet type ? (0x58) | txid | rxid | channels data (1000-2000, 16 bit, little endian) | 00

Telemetry packets should be easy to figure out as well:
5223 R_REGISTER(05_FIFO_DATA) AA 44 2A 37 77 25 31 91 41 00 00 F3 01 FE 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

0x01F3 = 499, seems this is your RX voltage (4.99V)
Last edit: 16 Apr 2016 19:21 by goebish.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 18:11 - 16 Apr 2016 18:11 #46639 by SeByDocKy
Replied by SeByDocKy on topic Flysky AFHDS 2A, protocol as used i10, i6, iT4,
Whaoohhh if this protocol is hacked... it will be a fantastic news. All cheap Chinese racers & AP uses thos new AFHDS 2A protocol now ....
Last edit: 16 Apr 2016 18:11 by SeByDocKy.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 19:37 - 16 Apr 2016 19:43 #46643 by midelic
@goebish
I published long time ago Flysky protocol sources for TX and RX.
From what I see it is not much change except telemetry added.I6 and I10 bind with normal Flysky Rx.So it should rely on the same channels table.I think it will be easy to add to main Flysky protocol in deviation.
If you are interested see here for your info.
www.rcgroups.com/forums/showthread.php?t=1921870
Last edit: 16 Apr 2016 19:43 by midelic.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 20:00 - 16 Apr 2016 20:04 #46645 by goebish
They can bind to older RXs, but AFHDS 2A is a new protocol, looks like TXID doesn't match with former table (row + chan offset).
Also, bind is bi-directional, RX sends its ID.
Last edit: 16 Apr 2016 20:04 by goebish.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 20:16 - 16 Apr 2016 20:19 #46647 by midelic
If old Rx working fine with I6 I10 ,tx they should use the same algorithm when calculated hopping channels.
If old RX uses table you can use the same.
The algo was
//random id
chanrow=id%16;
chanoffset=(id & 0xff) / 16;
channel=tx_channels[chanrow][chancol]-chanoffset;//It was minus chanoffset,..... not plus

chancol = (chancol + 1) % 16;

The rx listen on channel-1
Last edit: 16 Apr 2016 20:19 by midelic.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 20:29 - 16 Apr 2016 20:30 #46649 by goebish
Yes, I know this protocol well, but looks like it doesn't match, here are the TXID / channels data I collected:
5a 89 36 77     1d 33 16 0f 64 24 7a 84 59 92 68 45 6e 29 60 51
44 2a 37 77     2b 62 1d 50 0f 41 3c 92 71 6c 32 79 58 7f 86 8b

73 60 36 77     26 1d 78 83 6e 5d 48 4e 74 3f 22 68 8d 7f 96 59 (not sure 26 is really the start of the sequence for this one).

Take the first one:
0x5a893677 % 16 = 7 (8th line of the table)
0x77 / 16 = 7

first value of line 8th line in the table is 0x64
0x64 - 7 != 0x1d

Also, last byte of txid seems to always be 0x77, so channel offset would always be 7, which is unlikely.

Note that I only had a quick look, maybe I got something wrong ;)
Last edit: 16 Apr 2016 20:30 by goebish.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 20:34 #46651 by stinkydiver73
Replied by stinkydiver73 on topic Flysky AFHDS 2A, protocol as used i10, i6, iT4,
The protocol selectable on the tx, AFHDS2A On/Off, can be totally different.

Please Log in or Create an account to join the conversation.

More
16 Apr 2016 20:35 #46652 by midelic
Try
id=0x7736895A

Please Log in or Create an account to join the conversation.

Time to create page: 0.075 seconds
Powered by Kunena Forum