g1107 Posted at 9-15 18:43
You're right!I found that I had an error in extracting data.

No problem.
One of the great things about online forums is we can help each other spot errors.
albertr help me realize the motor bus probably wasn't formatted as normal CAN protocol.

Duane Degn Posted at 9-14 10:55
The data I'm getting looks very different.

I converted my logic analyzer capture to some text and get the messages shown below:

I found some new infomation.Maybe related to interaction.
55 0e 04 66 28 0c 00 00 40 00 32 11 ff e9

Based on a lot of statistics, I found some clues.

g1107 Posted at 9-22 18:02
Based on a lot of statistics, I found some clues.[view_image]

I think there are two different types of messages. I think the Motion Controller sends a request with the ID as the 8th byte using a baud of 921.6Kbps. The replies come about 90us after the request. The replies use a different baud. I measured the reply baud at 947Kbps. The replies have the ID at the 7th byte. Each byte starts with a start bit and ends with a stop bit.
From what I've seen, the requests (at 921.6Kbps) consist of:
0x55, 0x16, 0x00, 0x9D, 0xA0, 0x00, 0x00, 0x00, ID + 14 additional bytes

Approximate 90us delay between request and reply.
The replies (at 947Kbps) consist of:
0x55, 0x20, 0x00, 0x1A, 0xA0, 0x01, 0x00, ID + 25 additional bytes

The requests repeat every 2.5ms. The requests cycle through the four motor IDs so each motor receives commands at 100Hz. This is twice the control frequency of common hobby servos.

Duane Degn Posted at 9-22 18:54
I think there are two different types of messages. I think the Motion Controller sends a request with the ID as the 8th byte using a baud of 921.6Kbps. The replies come about 90us after the request. The replies use a different baud. I measured the reply baud at 947Kbps. The replies have the ID at the 7th byte. Each byte starts with a start bit and ends with a stop bit.
From what I've seen, the requests (at 921.6Kbps) consist of:
0x55, 0x16, 0x00, 0x9D, 0xA0, 0x00, 0x00, 0x00, ID + 14 additional bytes

yes，agree。 I will continue to test, and maybe I will get the rule soon.

Previously I've run the motor bus through a RS-485 transceiver chip to get a clean signal for the logic analyzer. I decided to try capturing some traces of the two signal wires using my oscilloscope.
Here's a screen shot of one of these capture attempts.

It's interesting to see how small the voltage swings are on this differential signal.
The oscilloscope traces shows the idle state of the line is at the mid voltage level.

Duane Degn Posted at 9-25 19:52
Previously I've run the motor bus through a RS-485 transceiver chip to get a clean signal for the logic analyzer. I decided to try capturing some traces of the two signal wires using my oscilloscope.
Here's a screen shot of one of these capture attempts.
[view_image]

https://bbs.dji.com/thread-228459-1-1.html

FYI
github.com/tatsuyai713/robomaster_s1_can_hack/

Tatsuya Ishikawa Posted at 9-29 10:27
FYI
github.com/tatsuyai713/robomaster_s1_can_hack/

Fantastic information!
Thank you. I'm looking forward to your instructions about building the hardware.

Tatsuya Ishikawa Posted at 9-29 10:27
FYI
github.com/tatsuyai713/robomaster_s1_can_hack/

nice！！！！

Tatsuya Ishikawa Posted at 9-29 10:27
FYI
github.com/tatsuyai713/robomaster_s1_can_hack/

Very interesting arrangement.
Have you controlled the S1 chassis and gimbal through the Nucleo-F767ZI yet?
Am I right assuming the ROS Nodes only run on the Nucleo-F767ZI and that you have not confirmed whether ROS runs on the S1's Intelligent Controller?
How do you plan mapping the PS4 Controller buttons through the ROS Node? Will you implement all the Services provided by the teleop_twist_joy Node?
http://wiki.ros.org/teleop_twist_joy
Connecting on ROS Nodes running on the S1 will be one BIG breakthrough.

Wow! What a first post! Will be sure to follow up with this!

Duane Degn Posted at 9-7 15:08
One of several things I find puzzling is the microcontroller used in the hit detectors supports CAN up to 1Mbps yet I measure 2Mbps on the CAN Bus. Another thing which I find puzzling is the use of at least two different bit rates used on the M Bus. The following traces were taken by passing the M Bus differential pair through a RS-485 transceiver.
I've previously shared these images in this post.
https://forum.dji.com/forum.php? ... 8&page=1#pid1949641

I don't really know much about programming but it might have something to do w/ not being able to do "trade" deals across countries if it exceeds a certain limit.  They were saying the Inspire 1s at limited to around 40mph but people have got them to 80mph out of the box.  Probably so the government doesn't crack down on them.

Just as the insurance companies and regulators governing the top speed of vehicles to 155mph.  The vehicles that cost a lot of money, to insure for "race" use not just for business, unlimit the speed restriction.  A lot of the owners would never see 155mph for obvious reasons but going faster can be done.  When you mod things yourself you can do it but if they release it unmodded from the factory people will try to achieve a max speed which is dangerous.  

Duane Degn Posted at 9-29 16:31
Fantastic information!
Thank you. I'm looking forward to your instructions about building the hardware.

What are you going to make with the Robomaster S1..?

AntDX316 Posted at 10-2 19:34
What are you going to make with the Robomaster S1..?

I don't think I have any concrete plans for my S1. I just want to be able to control as much of the robot as I can using my own programs.
I'd like to be able use other options for remote control. I've used PlayStation controller, Wii Nunchucks, FrSky radios, Android apps and my own custom controller for robots in the past. I'd like to be able to mix and match various parts of my other robots with the S1. I find the closed software of the S1 very frustrating.
I may try to turn my S1 into a following tripod. I'd like the camera to track me while using additional sensors to avoid obstacles. Right now, I don't know how to implement additional sensors into the robot.

Duane Degn Posted at 10-2 20:35
I don't think I have any concrete plans for my S1. I just want to be able to control as much of the robot as I can using my own programs.
I'd like to be able use other options for remote control. I've used PlayStation controller, Wii Nunchucks, FrSky radios, Android apps and my own custom controller for robots in the past. I'd like to be able to mix and match various parts of my other robots with the S1. I find the closed software of the S1 very frustrating.
I may try to turn my S1 into a following tripod. I'd like the camera to track me while using additional sensors to avoid obstacles. Right now, I don't know how to implement additional sensors into the robot.

DJI should just release a moving tripod with OA and fall off the table protection.

Tatsuya Ishikawa Posted at 9-29 10:27
FYI
github.com/tatsuyai713/robomaster_s1_can_hack/

NIcely done, Tatsuya! Curious if your code would work with S1 intelligent controller and gimbal disconnected?

DId you figure out anything about mysterious red M0 bus connector on S1 motion controller board?

-albertr

This is a little pricey, but may help with the CAN bus investigation:

https://store.protofusion.org/product/canable-pro/

MarkusXL Posted at 10-11 09:04
This is a little pricey, but may help with the CAN bus investigation:

https://store.protofusion.org/product/canable-pro/

The Canable-Pro seems intended for field work where the risks for damaging the attached computer are greater.

I purchased the less expensive basic version of the Canable:
https://store.protofusion.org/product/canable/

It just arrived this week in the mail and I will be integrating it in my development setups for the RoboMaster Development boards and motors and the RoboMaster S1.

Story to follow...

rhoude57 - YUL Posted at 10-11 15:51
The Canable-Pro seems intended for field work where the risks for damaging the attached computer are greater.

I purchased the less expensive basic version of the Canable:

I hope to help you.

The Canable product lists the highest baud as 1Mbps. The black wire CAN Bus uses 2Mbps. The S1 uses hardware which is supposedly limited to 1Mbps so hopefully other hardware (such as Canable) can be driven at the higher 2Mbps baud.

g1107 Posted at 10-11 17:43
I hope to help you.

Many thanks!

Tatsuya Ishikawa Posted at 9-29 10:27
FYI
github.com/tatsuyai713/robomaster_s1_can_hack/

What is the USB board holding the wifi dongle? I see it is connected to the DCDC converter but I also see pins into the dev board, is this just for the purpose of powering and holding the dongle upright? Or this this a communication board. I don't see it listed. I'm am eagerly trying to reverse engineer your solution

I talked about this project at ROSCon JP 2019.
And there are some information in qiita.
https://qiita.com/tatsuyai713/items/aa338d6b07af11bde88a
I'm sorry this information is Japanese only.
I'll make English version ASAP.
Thanks.

This is the slide.
https://www.slideshare.net/mobile/tatsuyaishikawa507/ros-con-jp-2019-lt-tatsuya-ishikawa

Tatsuya Ishikawa Posted at 10-26 10:03
I talked about this project at ROSCon JP 2019.
And there are some information in qiita.
https://qiita.com/tatsuyai713/items/aa338d6b07af11bde88a

I'm sure I'm not the only one looking forward to an English version.
Thanks for sharing.

Here's a clickable link to the slides.

Now we just need to add video stream!

Looking at Tatsuya's code, he was adding his controller board sandwiched between S1's motion controller and S1's intelligent controller, so video stream from existing intelligent controller should still be present in this setup.

-albertr

albertr Posted at 11-27 13:09
Looking at Tatsuya's code, he was adding his controller board sandwiched between S1's motion controller and S1's intelligent controller, so video stream from existing intelligent controller should still be present in this setup.

-albertr

From what I have seen, the Intelligent Controller was completely taken out of the loop and he controlled only the Chassis and Gimbal using the DJI Type A Development Board via the Interface Module.

rhoude57 - YUL Posted at 11-28 13:22
From what I have seen, the Intelligent Controller was completely taken out of the loop and he controlled only the Chassis and Gimbal using the DJI Type A Development Board via the Interface Module.

No sure what you are talking about, but it's clearly not what was done by Tatsuya Ishikawa here:

robomaster_s1_can_hack

-albertr

Ok, had to help my high school student son with debugger to get Tatsuya Ishikawa's code to work on his RMS1. So basically it works as a proof of the concept, but it's quite quirky and very far from production quality.  I'm not sure that it's doable to clean it up,  it's difficult for me to read and understand it as is (although I got my software engineering experience back in 1990's studying using Donald's Knuth's books). I'll try to task my son to rewrite it if he gets time for it.

-albertr

Duane, CAN bus runs @ 1MBbit/s, I'm pretty sure about it, since now I can send and receive messages and control RMS1 from remote computer.

-albertr

justinzak Posted at 2019-10-23 13:19
What is the USB board holding the wifi dongle? I see it is connected to the DCDC converter but I also see pins into the dev board, is this just for the purpose of powering and holding the dongle upright? Or this this a communication board. I don't see it listed. I'm am eagerly trying to reverse engineer your solution

I think that USB board is a just a breakout board to deliever 5VDC @ 0.5A power to Ethernet-Wifi converter he is using.
In later versions, he is drifting towards abandoning ethernet and using USB serial interface instead (and thus switching from STM NUCLEO-F767ZI to MIKROE MINI M4 STM32 board.

-albertr