- Posts: 2631
Eachine E015 Flight Boat Car
24 Oct 2018 09:47 - 07 Nov 2018 10:36 #71481
by goebish
Eachine E015 Flight Boat Car was created by goebish
I was sent this machine to check if I could deviate it (Thanks Fred!) as the range in car/boat mode is no more than 10 meters using the stock transmitter.
Also, the stock controller is pretty bad, I found out that 2/3 of the sticks throw is just dead zone !
Both Tx & Rx have a MCU with built-in 2.4 GHz transceiver, no SPI bus.
(Tx= RW1608, Rx= Sonix SN32F706, according to the datasheet this IC isn't supposed to have a built-in RF transceiver ...)
With SDR I was able to figure out the transceiver is a HS6200: bit.ly/2O0D2pu
Last time I tried to emulate the HS6200 using the nrf24l01 or cyrf6936 (they're the only 2 transceivers we have that can do gfsk @ 1 Mbps) it didn't went too well, remember:
www.deviationtx.com/forum/protocol-devel...-e012?start=20#62970
www.deviationtx.com/forum/protocol-devel...-e012?start=40#63026
but hey, let's try again ....
... and that's a fail
(I decreased packet period after I made this video, that's better now, but still not usable, same as E012)
Same as last time, the HS6200 misses most of the packets that are sent by the nrf24l01 (that's the same the other way round) although they've the same GFSK center frequencies and deviation ...
It won't make its way into nightly builds, but if someone wanna try it anyway here are a few test builds:
www.dropbox.com/sh/9zcfhpj46zwszq2/AADMM...1gSrLl-bDZS89Ta?dl=0
Protocol: E015
CHANNEL5: Arm
CHANNEL6: Led
CHANNEL7: Flip
CHANNEL9: Headless
CHANNEL10: RTH
Source: github.com/goebish/deviation/blob/protoc...ocol/e015_nrf24l01.c
Now I won't waste my time the next time I see a HS6200
Protocol notes:
Also, the stock controller is pretty bad, I found out that 2/3 of the sticks throw is just dead zone !
Both Tx & Rx have a MCU with built-in 2.4 GHz transceiver, no SPI bus.
(Tx= RW1608, Rx= Sonix SN32F706, according to the datasheet this IC isn't supposed to have a built-in RF transceiver ...)
With SDR I was able to figure out the transceiver is a HS6200: bit.ly/2O0D2pu
Last time I tried to emulate the HS6200 using the nrf24l01 or cyrf6936 (they're the only 2 transceivers we have that can do gfsk @ 1 Mbps) it didn't went too well, remember:
www.deviationtx.com/forum/protocol-devel...-e012?start=20#62970
www.deviationtx.com/forum/protocol-devel...-e012?start=40#63026
but hey, let's try again ....
... and that's a fail
(I decreased packet period after I made this video, that's better now, but still not usable, same as E012)
Same as last time, the HS6200 misses most of the packets that are sent by the nrf24l01 (that's the same the other way round) although they've the same GFSK center frequencies and deviation ...
It won't make its way into nightly builds, but if someone wanna try it anyway here are a few test builds:
www.dropbox.com/sh/9zcfhpj46zwszq2/AADMM...1gSrLl-bDZS89Ta?dl=0
Protocol: E015
CHANNEL5: Arm
CHANNEL6: Led
CHANNEL7: Flip
CHANNEL9: Headless
CHANNEL10: RTH
Source: github.com/goebish/deviation/blob/protoc...ocol/e015_nrf24l01.c
Now I won't waste my time the next time I see a HS6200
Protocol notes:
EAchine E015
radio
-----
HS6200, GFSK @ 1Mbps
preamble|5 byte address|2 byte guard|9 bit PCF|scrambled payload|16 bit crc (pcf+payload)
packet period: 9ms
bind & data freq
----------------
2445 MHz
same freq for bind & data, no freq hopping
bind preamble
-------------
0101010101010101 // 0x5555
bind address
------------
53 38 79 54 62 62 62 // raw out of the air (address + 2 guard bytes)
62 54 79 38 53 // reversed for nrf24
bind packet
-----------
00 01 02 03 04 05 06 07 08
18 04 06 53 cb b2 52 89 ab
[00:02] = fixed, firmware date ?
[03] = data guard byte
[03:07] = address for data phase
[08] = sum[03:07] & 0xff
data preamble
-------------
(110)1010101010101010 // 0xaaaa
determined by msb of the raw address
data address
------------
received during bind
89 52 b2 cb 53 53 53 // raw out of the air (address + 2 guard bytes)
53 cb b2 52 89 // reversed for nrf24
data packet
-----------
00 01 02 03 04 05 06 07 08 09
70 70 70 70 20 20 00 00 00 00
[00] = throttle 0-225
[01] = rudder 0-225
[02] = aileron 225-0
[03] = elevator 225-0
[04] = elevator trim 0x3f-0x20-0x00
[05] = aileron trim
[06] = arm flags
0x80 = disarm (toggle to turn off motors)
0x40 = arm (toggle to turn on motors)
[07] = flags
0x80 = flip
0x10 = headless
0x08 = rth
0x04 = leds
0x02 = expert mode
0x01 = intermediate mode
[08] = 0x00
[09] = sum[00:08] & 0xffPlease Log in or Create an account to join the conversation.
03 Nov 2018 14:28 #71529
by goebish
Replied by goebish on topic Eachine E015 Flight Boat Car
After fiddling a bit it seems to work now!
I've to make a few more tests with the E012 as well to confirm what works best.
Thanks Pascal, you were on the right track, once again
I've to make a few more tests with the E012 as well to confirm what works best.
Thanks Pascal, you were on the right track, once again
Please Log in or Create an account to join the conversation.
06 Nov 2018 13:23 #71570
by SeByDocKy
Replied by SeByDocKy on topic Eachine E015 Flight Boat Car
Great news if now all protocols associated with this 2-in-1 MCU/RF chip can be now deviated via the Pascal's trick 
Please Log in or Create an account to join the conversation.
06 Nov 2018 13:34 #71571
by goebish
Replied by goebish on topic Eachine E015 Flight Boat Car
Any protocol that's using a HS6200 transceiver @ 1Mbps actually
I know you were waiting for the E012 protocol, it's in the test build as well!
I know you were waiting for the E012 protocol, it's in the test build as well!
Please Log in or Create an account to join the conversation.
06 Nov 2018 14:16 #71574
by SeByDocKy
I don't own this machine I am just glad of your hard work in general.... another breakthru for RF hacking in general
Replied by SeByDocKy on topic Eachine E015 Flight Boat Car
goebish wrote: Any protocol that's using a HS6200 transceiver @ 1Mbps actually
I know you were waiting for the E012 protocol, it's in the test build as well!
I don't own this machine
I am just glad of your hard work in general.... another breakthru for RF hacking in general Please Log in or Create an account to join the conversation.
07 Nov 2018 09:44 #71602
by goebish
Replied by goebish on topic Eachine E015 Flight Boat Car
Thanks for testing and reporting!
Yes, those are test builds, not all in sync with the latest changes, just wait for the next nightly build
(I don't know why but seems the automated build system has been broken for a few days although "Build passing" is showing, there are no new nightly builds ...)
Yes, those are test builds, not all in sync with the latest changes, just wait for the next nightly build
(I don't know why but seems the automated build system has been broken for a few days although "Build passing" is showing, there are no new nightly builds ...)
Please Log in or Create an account to join the conversation.
Time to create page: 0.058 seconds
-
Home
-
Forum
-
Development
-
Protocol Development
- Eachine E015 Flight Boat Car