Virtually all of the information in this document was provided by hammer22. So Thanks! DSM2: DSM2 data packets consist of 7 channels each. The packets are formatted as 16bit MSB-1st values. Data can be either 10 or 11 bits. 6-channel DSM2 = 10bit 8-channel DSM2 = 11bit All DSMx appears to be 11bit A packet consists of a Tx ID + up to 7 channels of data, each 16bit data value is defined as: 10bit: a 0 bbbb cccccccccc 11bit: a bbbb ccccccccccc a: 0 for 1st data packet, 1 for 1st channel in 2nd data packet bbbb: the channel number of this packet cc..: 10 or 11bit channel data (MSB 1st) The channel data will be 0xffff if the specific channel slot is unused Channel assignment appears to be: 0: Throttle 1: Aileron 2: Elevator 3: Rudder 4: Gear 5: Aux1 6: Aux2 7: Aux3 Data packets are defined as: aa bb cccc dddd eeee ffff gggg hhhh iiii aa: If DSM2: 0xff - mfgid[2], if DSMX mfgid[2] bb: If DSM2: 0xff - mfgid[3] + offset, if DSMX mfgid[3] + offset (see binding) cccc: Channel dddd: Channel eeee: Channel ffff: Channel gggg: Channel hhhh: Channel iiii: Channel Each packet is sent twice, once on channel 'a' and 4msec later on channel 'b' If there are more than 7 channels to transmit, the upper channels are transmitted using the same packet format 11mec after the low-channel packet. New channel data is transmitted each 22msec. For example: 0msec: Transmit channels 0-7 on channel 'a' 4msec: Transmit channels 0-7 on channel 'b' 11msec: Transmit channels 8-14 on channel 'a' 15msec: Transmit channels 8-14 on channel 'b' 22msec: Transmit channels 0-7 on channel 'a' New SOP(8 bytes) and Data (16 bytes) codes are sent before each packet. Binding: The bind packet is as follows: aa bb cc dd aa bb cc dd eeee ff gg hh ii jjjj aa : 0xff - mfgid[0] bb : 0xff - mfgid[1] cc : 0xff - mfgid[2] dd : 0xff - mfgid[3] + offset eeee : 384 + sum of bytes 0 through 7 ff : Unknown (value = 0x01) gg : # of channels being transmitted hh : Transmitter capabilities : HP6DSM (DSM2): 0x01 : DX6i (DSMX): 0xA2 : DX8 (DSM2): 0x12 : DX8 (DSMX): 0xB2 : DM9 (DSM2): 0x02 # of packets (1 if num-channels < 8, 2 if num-channels >= 8) for DSM2 ii : Unknown (value = 0x00) jjjj : eeee + sum of bytes 8 through 13 The bind channel can be any odd channel between 0x01 and 0x4f The SOP and CRC are set as below for the chosen bind channel The DATA code is 32 bytes. The 1st 16 bytes are as defined below for the bind channel. The 2nd 16 bytes are always: D7A154B15E89AE86 C69422FE48E6574E Once the Rx detects that the bind packet is no longer being sent, it will transmit a confirmation on the same channel using the following 16byte DATA code: 98881BE430790384 060C12181E247110 It is not required that the Tx receives or acts upon this packet The confirmation data is: aa bb cc dd ee ff gg hh ii jj aa: byte[0] of bind packet bb: byte[1] of bind packet cc: byte[2] of bind packet dd: byte[3] of bind packet ee: byte[10] of bind packet (always 0x01) ff: # of supported channels(?) AR7000=0x07, AR6010=0x07, AR6210=0x07 gg: requested packet type AR6210 connected to HP6DSM(DSM2): 0x01 (DSM2 requested) AR7000 connected to DX6i (DSMX): 0x01 (DSM2 requested) AR6010 connected to DX6i (DSMX): 0xA2 (DSMX requested) hh: byte[13] of bind packet (always 0x00) SOP/Data/CRC code selection: There is one set of SOP, Data, and CRC codes for each transmit channel. The SOP and DATA codes come from the Cypress recommended SOP table. the codes are documented here: http://www.cypress.com/?docID=15229 They are organized in 5 rows of 9 columns with the content of each 'cell' being an 8-byte PN code The row is determined by the transmit channel as: row = channel modulo 5 The columns are determined from the mfgid as follows: sop-col = (mfgid[0] + mfgid[1] + mfgid[2] + 2) & 0x07 data-col0 = 7 - sop-col data-col1 = data-col0 + 1 The crc for channel 'a' is NOT(mfgid[1] << 8 + mfgid[0]) The crc for channel 'b' is (mfgid[1] << 8 + mfgid[0]) Here is the table (note that I've transposed rows and columns to make it easier to read) Note: Values are LSB 1st 0 1 2 3 4 0 03BC6E8AEFBDFEF8 83F7A82D7A4464D3 405632D90FD95D97 C0908FBB7C8E2B8E E1D631265FBD4093 1 8817133B2DBF06D6 3F2C4EAA71487AC9 8E4AD0A9A7FF20CA 8069268008F849E7 DC68089997AEAF8C 2 F1943021A11C88A9 17FF9E213690C782 4C979DBFB83DB5BE 7D2D4954D08040C1 C30E01160E3206BA 3 D0D28EBC822FE3B4 BC5D9A5BEE7F42EB 0C5D24309FCA6DBD B6F2E61B805A36B4 E08301FAAB3E8FAC 4 8CFA479B83A566D0 24F5DDF87A7774E7 501433DEF17895AD 42AE9C1CDA6705F6 5CD59CB8469C7D84 5 07BD9F26C8310FB8 3D707C94DC84AD95 0C3CFAF9F0F210C9 9B75F7E0148DB580 F1C6FE5C9DA54FB7 6 EF039589B471619D 1E6AF037527B11D4 F4DA06DBBF4E6FB3 BF5498B9B7305A88 58B5B3DD0E28F1B0 7 40BA97D5864FCCD1 62F52BAAFC33BFAF 9E08D1AE595EE8F0 35D1FC9723D4C988 5F303B569645F4A1 8 D7A154B15E89AE86 405632D90FD95D97 C0908FBB7C8E2B8E E1D631265FBD4093 03BC6E8AEFBDFEF8 The DSM-X channel hopping algorithm was found by Alexandr Alexandrov and Sergey Gimaev. Channel hopping DSM-X uses a 23-channel hopping sequence. The sequence is based upon a unique Tx ID. The channel hopping algorithm uses an LSR and is computed as follows. id_tmp = ID = negate(CYRF MFGID + model #) foreach idx in (0 .. 22): ok = 0 while(ok is 0): id_tmp = id_tmp * 0x0019660D + 0x3C6EF35F ## Randomization next_ch = ((id_tmp >> 8) MODULO 0x49) + 3 ## Use least-significant byte and must be larger than 3 if (next_ch is odd and ID is odd OR next_ch is even and ID is even) AND none of the values in the 'ch' array are equal to next_ch: if 3 <= tmp < 28 and the number of channels in ch that are between 3 and 28 is < 8 OR 28 <= tmp < 52 and the number of channels in ch that are between 28 and 52 is < 7 OR 53 <= tmp and the number of channels in ch that are greater than 53 is < 8: ok = 1 ch[idx] = next_ch The X-Plus channels structure was decoded by Cesco and vlad_vy. Channel numbers 0 to 11 are normal, with data resolution 11bit (2048). Channel 12 carries the X-Plus channels, with data resolution 9bit (512). Channel transfer structure: packet 1 -> 1 5 2 4 6 10 12 packet 2 -> 0 7 3 8 9 11 12 X-Plus data format each 16bit X-Plus data value is defined as: a bbbb cc ddddddddd a: always 0 bbbb: the channel number, always 12 cc: X-Plus channel number, low 2 bits, third bit defined by packet number, 1st packet = 0, second packet = 1 dd..: X-Plus channel data, 9 bits, 256 is midpoint The channel data will be 0xffff if the specific X-Plus channel slot is unused. 1 to 2 X-Plus channels, every 22ms 3 to 4 X-Plus channels, every 44ms 5 to 6 X-Plus channels, every 66ms 7 to 8 X-Plus channels, every 88ms