Re: PPM2IR - RC Transmitter Module based on ATtiny25
Reply #1 –
1. IR transmission protocol reverse engineering

I didn't really want to disassemble the transmitter and connect to it from inside ( it wasn't mine and metal-plastic screws don't work well when they are this "crappy") so I decided to use a non invasive method to capture the transmission protocol. I made a simple circuit including a photo transistor and a resistor, powered it up with a single LiPo cell and connected to the Logic Sniffer.
I would also like to mention, that just after I finished working on reverse engineering the IR transmission scheme I found it on a RC forum.. so I could have saved myself one evening.. but it was fun to work on it anyway, so I don't regret it :)

The resistor was selected big enough to smooth the 38KHz carrier frequency and leave just the data blocks on the output.

Once the test circuit was completed I made a series of recording including all possible combination of input one after another. Single frame transmission scheme was quite easy to guess and now was the time to decode the data.


Example frame captured during the initial analysis. It begins with a preamble ( high level for 3,6ms then low level for 1ms), then 32 data bits each taking 1ms and coded by pulse length ( "1" - 0,3ms high & 0,7ms low, a "0" - 0,7ms high & 0,3ms low). The last bit is the stop bit "1".
During the further analysis I assumed, as it turned out correctly :), that each frame consists of four, somehow related, 8-bit words. I prepared a shell script to convert the captured data into 4 column CSV file which I could later import into Google Docs Spreadsheet. I know I could have used something more geeky like GNU Plot but the spreadsheet was just enough.

As you can see in this screen shot I have already identified the throttle byte and partly computed the check sum. I found charts really useful when it came to finding relations between input and produced frames. It took some guessing and after about an hour it was ready to be implemented :)
Eventually I was able to reproduce the entire frame as follows:
MSB transmitted first
--|--B3--------------
31| 0 fixed
30| MSB throttle
29| ...
28| ...
27| ...
26| ...
25| ...
24| LSB throttle
--|--B2--------------
23| MSB rudder
22| ...
21| ...
20| LSB rudder
19| MSB forward/backward
18| ...
17| ...
16| LSB forward/backward
--|--B1--------------
15| FLAG 1 - rudder left, 0 - rudder right
14| FLAG 1 - backward, 0 - forward
13| FLAG 1 - trim left, 0 - trim right
12| MSB trim
11| ...
10| ...
09| ...
08| LSB trim
--|--B0--------------
07| MSB CHANNEL, A - 11
06| LSB CHANNEL
05| MSB CRC
04| ...
03| ... CRC = (0x0F + B3 + B2 + B1) & 0x3F
02| ...
01| ...
00| LSB CRC
--|------------------
The next part will cover the test circuit and micro controller selection.