Your Name
4 years ago
19 changed files with 1915 additions and 35 deletions
Split View
Diff Options
-
+36 -35Phantom3Standard_BadCamera/docs/10.log
-
BINPhantom3Standard_BadCamera/docs/10.pdf
-
+16 -0Phantom3Standard_BadCamera/docs/11.aux
-
+283 -0Phantom3Standard_BadCamera/docs/11.log
-
BINPhantom3Standard_BadCamera/docs/11.pdf
-
+184 -0Phantom3Standard_BadCamera/docs/11.tex
-
+182 -0Phantom3Standard_BadCamera/docs/11.tex~
-
+14 -0Phantom3Standard_BadCamera/docs/11.toc
-
+17 -0Phantom3Standard_BadCamera/docs/12.aux
-
+285 -0Phantom3Standard_BadCamera/docs/12.log
-
BINPhantom3Standard_BadCamera/docs/12.pdf
-
+191 -0Phantom3Standard_BadCamera/docs/12.tex
-
+184 -0Phantom3Standard_BadCamera/docs/12.tex~
-
+15 -0Phantom3Standard_BadCamera/docs/12.toc
-
+17 -0Phantom3Standard_BadCamera/docs/14.aux
-
+285 -0Phantom3Standard_BadCamera/docs/14.log
-
BINPhantom3Standard_BadCamera/docs/14.pdf
-
+191 -0Phantom3Standard_BadCamera/docs/14.tex
-
+15 -0Phantom3Standard_BadCamera/docs/14.toc
+ 36
- 35
Phantom3Standard_BadCamera/docs/10.log
View File
BIN
Phantom3Standard_BadCamera/docs/10.pdf
View File
+ 16
- 0
Phantom3Standard_BadCamera/docs/11.aux
View File
| @ -0,0 +1,16 @@ | |||
| \relax | |||
| \@writefile{toc}{\contentsline {section}{\numberline {1}Overview}{1}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {2}Let's try a Logic Analyzer}{1}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Drone Mobile App}{2}} | |||
| \@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces Open Bench Logic Sniffer\relax }}{2}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.1}Open Bench Logic Sniffer}{2}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.2}Abandoned Project?}{3}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Setup Cont...}{3}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Basic Test}{3}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {3}Drone Logic Sniffing}{4}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.1}I2C Decode}{4}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Tapping into Main Wires}{7}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {3.2.1}Confirming Baudrate from an oscilloscope}{8}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Open Bench Logic Sniffer Review}{8}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Other Approaches to troubleshooting the Drone}{8}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {4}References}{9}} | |||
+ 283
- 0
Phantom3Standard_BadCamera/docs/11.log
View File
| @ -0,0 +1,283 @@ | |||
| This is pdfTeX, Version 3.14159265-2.6-1.40.17 (TeX Live 2016/Debian) (preloaded format=pdflatex 2019.8.17) 25 JUN 2020 08:49 | |||
| entering extended mode | |||
| restricted \write18 enabled. | |||
| %&-line parsing enabled. | |||
| **/home/layoutdev/Desktop/code/documentation_general/Repairs_2019/Phantom3Stand | |||
| ard_BadCamera/docs/11.tex | |||
| (/home/layoutdev/Desktop/code/documentation_general/Repairs_2019/Phantom3Standa | |||
| rd_BadCamera/docs/11.tex | |||
| LaTeX2e <2017/01/01> patch level 3 | |||
| Babel <3.9r> and hyphenation patterns for 3 language(s) loaded. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/article.cls | |||
| Document Class: article 2014/09/29 v1.4h Standard LaTeX document class | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/size11.clo | |||
| File: size11.clo 2014/09/29 v1.4h Standard LaTeX file (size option) | |||
| ) | |||
| \c@part=\count79 | |||
| \c@section=\count80 | |||
| \c@subsection=\count81 | |||
| \c@subsubsection=\count82 | |||
| \c@paragraph=\count83 | |||
| \c@subparagraph=\count84 | |||
| \c@figure=\count85 | |||
| \c@table=\count86 | |||
| \abovecaptionskip=\skip41 | |||
| \belowcaptionskip=\skip42 | |||
| \bibindent=\dimen102 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/graphicx.sty | |||
| Package: graphicx 2014/10/28 v1.0g Enhanced LaTeX Graphics (DPC,SPQR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/keyval.sty | |||
| Package: keyval 2014/10/28 v1.15 key=value parser (DPC) | |||
| \KV@toks@=\toks14 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/graphics.sty | |||
| Package: graphics 2016/10/09 v1.0u Standard LaTeX Graphics (DPC,SPQR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/trig.sty | |||
| Package: trig 2016/01/03 v1.10 sin cos tan (DPC) | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics-cfg/graphics.cfg | |||
| File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration | |||
| ) | |||
| Package graphics Info: Driver file: pdftex.def on input line 99. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics-def/pdftex.def | |||
| File: pdftex.def 2017/01/12 v0.06k Graphics/color for pdfTeX | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/infwarerr.sty | |||
| Package: infwarerr 2016/05/16 v1.4 Providing info/warning/error messages (HO) | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ltxcmds.sty | |||
| Package: ltxcmds 2016/05/16 v1.23 LaTeX kernel commands for general use (HO) | |||
| ) | |||
| \Gread@gobject=\count87 | |||
| )) | |||
| \Gin@req@height=\dimen103 | |||
| \Gin@req@width=\dimen104 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/caption/caption.sty | |||
| Package: caption 2016/02/21 v3.3-144 Customizing captions (AR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/caption/caption3.sty | |||
| Package: caption3 2016/05/22 v1.7-166 caption3 kernel (AR) | |||
| Package caption3 Info: TeX engine: e-TeX on input line 67. | |||
| \captionmargin=\dimen105 | |||
| \captionmargin@=\dimen106 | |||
| \captionwidth=\dimen107 | |||
| \caption@tempdima=\dimen108 | |||
| \caption@indent=\dimen109 | |||
| \caption@parindent=\dimen110 | |||
| \caption@hangindent=\dimen111 | |||
| ) | |||
| \c@ContinuedFloat=\count88 | |||
| ) (./11.aux) | |||
| \openout1 = `11.aux'. | |||
| LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| (/usr/share/texlive/texmf-dist/tex/context/base/mkii/supp-pdf.mkii | |||
| [Loading MPS to PDF converter (version 2006.09.02).] | |||
| \scratchcounter=\count89 | |||
| \scratchdimen=\dimen112 | |||
| \scratchbox=\box26 | |||
| \nofMPsegments=\count90 | |||
| \nofMParguments=\count91 | |||
| \everyMPshowfont=\toks15 | |||
| \MPscratchCnt=\count92 | |||
| \MPscratchDim=\dimen113 | |||
| \MPnumerator=\count93 | |||
| \makeMPintoPDFobject=\count94 | |||
| \everyMPtoPDFconversion=\toks16 | |||
| ) (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/pdftexcmds.sty | |||
| Package: pdftexcmds 2016/05/21 v0.22 Utility functions of pdfTeX for LuaTeX (HO | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifluatex.sty | |||
| Package: ifluatex 2016/05/16 v1.4 Provides the ifluatex switch (HO) | |||
| Package ifluatex Info: LuaTeX not detected. | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifpdf.sty | |||
| Package: ifpdf 2016/05/14 v3.1 Provides the ifpdf switch | |||
| ) | |||
| Package pdftexcmds Info: LuaTeX not detected. | |||
| Package pdftexcmds Info: \pdf@primitive is available. | |||
| Package pdftexcmds Info: \pdf@ifprimitive is available. | |||
| Package pdftexcmds Info: \pdfdraftmode found. | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/epstopdf-base.sty | |||
| Package: epstopdf-base 2016/05/15 v2.6 Base part for package epstopdf | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/grfext.sty | |||
| Package: grfext 2016/05/16 v1.2 Manage graphics extensions (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/kvdefinekeys.sty | |||
| Package: kvdefinekeys 2016/05/16 v1.4 Define keys (HO) | |||
| )) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/kvoptions.sty | |||
| Package: kvoptions 2016/05/16 v3.12 Key value format for package options (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/kvsetkeys.sty | |||
| Package: kvsetkeys 2016/05/16 v1.17 Key value parser (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/etexcmds.sty | |||
| Package: etexcmds 2016/05/16 v1.6 Avoid name clashes with e-TeX commands (HO) | |||
| Package etexcmds Info: Could not find \expanded. | |||
| (etexcmds) That can mean that you are not using pdfTeX 1.50 or | |||
| (etexcmds) that some package has redefined \expanded. | |||
| (etexcmds) In the latter case, load this package earlier. | |||
| ))) | |||
| Package epstopdf-base Info: Redefining graphics rule for `.eps' on input line 4 | |||
| 38. | |||
| Package grfext Info: Graphics extension search list: | |||
| (grfext) [.png,.pdf,.jpg,.mps,.jpeg,.jbig2,.jb2,.PNG,.PDF,.JPG,.JPE | |||
| G,.JBIG2,.JB2,.eps] | |||
| (grfext) \AppendGraphicsExtensions on input line 456. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/latexconfig/epstopdf-sys.cfg | |||
| File: epstopdf-sys.cfg 2010/07/13 v1.3 Configuration of (r)epstopdf for TeX Liv | |||
| e | |||
| )) | |||
| Package caption Info: Begin \AtBeginDocument code. | |||
| Package caption Info: End \AtBeginDocument code. | |||
| (./11.toc | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <10.95> on input line 3. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <8> on input line 3. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <6> on input line 3. | |||
| ) | |||
| \tf@toc=\write3 | |||
| \openout3 = `11.toc'. | |||
| [1 | |||
| {/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}] | |||
| <../pics/Ols-cover.jpg, id=9, 414.04688pt x 254.45062pt> | |||
| File: ../pics/Ols-cover.jpg Graphic file (type jpg) | |||
| <use ../pics/Ols-cover.jpg> | |||
| Package pdftex.def Info: ../pics/Ols-cover.jpg used on input line 30. | |||
| (pdftex.def) Requested size: 207.02292pt x 127.22499pt. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <9> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <5> on input line 40. | |||
| Overfull \hbox (48.02994pt too wide) in paragraph at lines 40--41 | |||
| \OT1/cmr/m/n/10.95 The github[] repo https://github.com/GadgetFactory/OpenBench | |||
| -Logic-Sniffer/issues | |||
| [] | |||
| [2 <../pics/Ols-cover.jpg>] | |||
| Overfull \hbox (25.35847pt too wide) in paragraph at lines 46--48 | |||
| []\OT1/cmr/m/n/10.95 http://dangerousprototypes.com/docs/Logic[]Sniffer[]quick[ | |||
| ]start[]guide Linked | |||
| [] | |||
| LaTeX Font Info: Try loading font information for OMS+cmr on input line 58. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/omscmr.fd | |||
| File: omscmr.fd 2014/09/29 v2.5h Standard LaTeX font definitions | |||
| ) | |||
| LaTeX Font Info: Font shape `OMS/cmr/m/n' in size <10.95> not available | |||
| (Font) Font shape `OMS/cmsy/m/n' tried instead on input line 58. | |||
| [3] | |||
| Missing character: There is no â in font cmti10! | |||
| Missing character: There is no € in font cmti10! | |||
| Missing character: There is no ™ in font cmti10! | |||
| [4] | |||
| <../pics/logic_analyze_i2c_decode.png, id=25, 747.54282pt x 546.54187pt> | |||
| File: ../pics/logic_analyze_i2c_decode.png Graphic file (type png) | |||
| <use ../pics/logic_analyze_i2c_decode.png> | |||
| Package pdftex.def Info: ../pics/logic_analyze_i2c_decode.png used on input lin | |||
| e 93. | |||
| (pdftex.def) Requested size: 373.7705pt x 273.27026pt. | |||
| Overfull \hbox (30.7705pt too wide) in paragraph at lines 93--94 | |||
| [][] | |||
| [] | |||
| [5 <../pics/logic_analyze_i2c_decode.png (PNG copy)>] | |||
| <../pics/logic_analyze_i2c_decode2.png, id=30, 743.77875pt x 542.025pt> | |||
| File: ../pics/logic_analyze_i2c_decode2.png Graphic file (type png) | |||
| <use ../pics/logic_analyze_i2c_decode2.png> | |||
| Package pdftex.def Info: ../pics/logic_analyze_i2c_decode2.png used on input li | |||
| ne 99. | |||
| (pdftex.def) Requested size: 371.88846pt x 271.01183pt. | |||
| Overfull \hbox (28.88846pt too wide) in paragraph at lines 99--100 | |||
| [][] | |||
| [] | |||
| [6 <../pics/logic_analyze_i2c_decode2.png (PNG copy)>] | |||
| <../pics/drone_to_gimbal_sample_uart.png, id=34, 767.86874pt x 558.58687pt> | |||
| File: ../pics/drone_to_gimbal_sample_uart.png Graphic file (type png) | |||
| <use ../pics/drone_to_gimbal_sample_uart.png> | |||
| Package pdftex.def Info: ../pics/drone_to_gimbal_sample_uart.png used on input | |||
| line 118. | |||
| (pdftex.def) Requested size: 383.93343pt x 279.29276pt. | |||
| Overfull \hbox (40.93343pt too wide) in paragraph at lines 118--119 | |||
| [][] | |||
| [] | |||
| [7 <../pics/drone_to_gimbal_sample_uart.png (PNG copy)>] | |||
| Overfull \hbox (98.19418pt too wide) in paragraph at lines 132--135 | |||
| []\OT1/cmr/m/n/10.95 http://web.archive.org/web/https:// re-verseengi-neer-ing. | |||
| stackexchange.com/questions/12523 | |||
| [] | |||
| [8] | |||
| Overfull \hbox (98.19418pt too wide) in paragraph at lines 172--175 | |||
| []\OT1/cmr/m/n/10.95 http://web.archive.org/web/https:/ /re-verseengi-neer-ing. | |||
| stackexchange.com/questions/12523 | |||
| [] | |||
| Overfull \hbox (2.77704pt too wide) in paragraph at lines 178--179 | |||
| []\OT1/cmr/m/n/10.95 http://blog.tuckerosman.com/2017/12/reverse-engineering-dj | |||
| i-phantom- | |||
| [] | |||
| [9] (./11.aux) ) | |||
| Here is how much of TeX's memory you used: | |||
| 2614 strings out of 494945 | |||
| 42065 string characters out of 6181032 | |||
| 97838 words of memory out of 5000000 | |||
| 5897 multiletter control sequences out of 15000+600000 | |||
| 9155 words of font info for 32 fonts, out of 8000000 for 9000 | |||
| 14 hyphenation exceptions out of 8191 | |||
| 39i,8n,39p,1418b,228s stack positions out of 5000i,500n,10000p,200000b,80000s | |||
| </usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/c | |||
| mbx10.pfb></usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmbx12. | |||
| pfb></usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr10.pfb></u | |||
| sr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr6.pfb></usr/share | |||
| /texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr8.pfb></usr/share/texlive | |||
| /texmf-dist/fonts/type1/public/amsfonts/cm/cmr9.pfb></usr/share/texlive/texmf-d | |||
| ist/fonts/type1/public/amsfonts/cm/cmsy10.pfb></usr/share/texlive/texmf-dist/fo | |||
| nts/type1/public/amsfonts/cm/cmti10.pfb> | |||
| Output written on 11.pdf (9 pages, 391289 bytes). | |||
| PDF statistics: | |||
| 72 PDF objects out of 1000 (max. 8388607) | |||
| 47 compressed objects within 1 object stream | |||
| 0 named destinations out of 1000 (max. 500000) | |||
| 21 words of extra memory for PDF output out of 10000 (max. 10000000) | |||
BIN
Phantom3Standard_BadCamera/docs/11.pdf
View File
+ 184
- 0
Phantom3Standard_BadCamera/docs/11.tex
View File
| @ -0,0 +1,184 @@ | |||
| \documentclass[11pt]{article} | |||
| %Gummi|065|=) | |||
| \usepackage{graphicx} | |||
| \usepackage{caption} | |||
| \title{\textbf{Phantom 3 Drone Repair / Diagnosis}} | |||
| \author{Steak Electronics} | |||
| \date{} | |||
| \begin{document} | |||
| %\maketitle | |||
| \textbf{Phantom 3 Drone Repair / Diagnosis} | |||
| \tableofcontents | |||
| \section{Overview} | |||
| User reports drone is unable to sync to mobile phone. Upon testing drone, I find that the gimbal is not able to get a proper level base. It continously moves around. | |||
| \section{Let's try a Logic Analyzer} | |||
| Unfortunately a lot of my work in not in notes, although I thought I had written it down, but in any case... I've looked at this drone a bit already. The issues are likely in the camera / gimbal assembly. The price of a new assembly is \$200 on ebay, and extremely expensive. The drone used is about \$240 or \$300 on ebay now (Jan - June 2019). | |||
| The pin connector that goes to the gimbal board from the drone is about 8 pins. Not bad. The ribbon connector on the gimbal, that goes to the camera is some obscene 50+ pin, double stacked monster. Not easy to decipher without schematics. There are a few motors on the camera board, which all seem to work. The issue is with the self test of the gimbal, at which point the drone never stabilizes. The user reported that he had a crash, but he also reported that he replaced the gimbal board. | |||
| \subsection{Drone Mobile App} | |||
| Looking at the drone in detail, it relies on a mobile phone app to work with the drone. This app doesn't work on my old phone. I tried an Ipad model one, and that didn't work either. The only phone I was able to get the app to work on was a more recent apple phone (that I do not own). So, right away we are having trouble interfacing to this device. The future doesn't bode well for this drone. What will 10 years in the future be like? | |||
| I've somewhat given up on any interest in repairing this. It's a black box, and cheaply made. Instead, I'm going to tap into the 8 wires going hetween the drone and the gimbal and just take a look. I've needed an excuse to use my Logic Analyzer for a while, and here's a good one. Let's see what / if we can learn, if anything. | |||
| \begin{center} | |||
| \includegraphics[scale=0.5]{../pics/Ols-cover.jpg} | |||
| \captionof{figure}{Open Bench Logic Sniffer} | |||
| \end{center} | |||
| \subsubsection{Open Bench Logic Sniffer} | |||
| The Open Bench Logic Sniffer is the first result that comes up when you search for Open Source Logic Analyzer. It's from 2010 by Dangerous Prototypes whom also made the Bus Pirate. | |||
| First off, I need a case for this board. It's exposed. I found two on thingiverse. Let's fire up the 3d printer and get one of those made. Looking at the two cases, they are nothing more than bottoms for the boards. Helpful, but I would've liked a top on these. A bit too rushed. (see cad folder). I'll just throw some electrical tape on the bottom, about as good as the cases. | |||
| \subsubsection{Abandoned Project?} | |||
| The github\footnote{Not a fan} repo https://github.com/GadgetFactory/OpenBench-Logic-Sniffer/issues seems to be quiet. Is the project abandoned? | |||
| \subsection{Setup Cont...} | |||
| Let's get this thing. Running. On devuan ascii (d9), follow the quick start guide here: | |||
| http://dangerousprototypes.com/docs/Logic\_Sniffer\_quick\_start\_guide | |||
| Linked from the main logic sniffer page. | |||
| It looks like the Sump program runs as a shell script (without any installation), so you can follow that page where they link to here: | |||
| http://www.lxtreme.nl/ols/ | |||
| and download the latest client. Then extract, untar and run the program. Unfortunately there is no verifcation of the tar files that I see. A bit shady. A package for a distribution is warranted here... Also looks like the Sump client is customized for Open Bench Logic Sniffer, and as a result, hasn't been updated as the project has been somewhat quiet... | |||
| \subsection{Basic Test} | |||
| The demonstrations section shows some basic tests. They use a bus pirate, but instead, you can just plug in an Arduino Uno (much easier). Here's what you do. | |||
| \begin{itemize} | |||
| \item Plug in Arduino, set it to Serial Read example, confirm that some data is being spit out. | |||
| \item Plug in TX of UART on Uno to pin 0-7 of the OLS (open logic sniffer). Also, obviously you'll need to tie the grounds together. | |||
| \item Set the sampling frequency to be lower than the 200MHz default. Lower sampling frequency means longer sampling times, but less detail. | |||
| \item Do a sample, then go into UART decode mode in the menus, choose auto detect speed, and run a sample, making sure to assign the TX pin of the UART decode to whatever your TX pin is connected to in OLS (this is somewhat obvious, so just fool around with the program until you get it). | |||
| \item Note that what speed works for your given application may vary. With a 9600 baud UART, I can do 50KHz sampling and get everything, but 5KHz returns garbage. Again, the lower the sampling rate, the longer the sample. | |||
| \end{itemize} | |||
| Everything should work. The decoding on the main time line view is poor, but the UART printout works reasonably well in its own menu.\footnote{Although export is limited, which I will get to.} | |||
| Some things to do: enable side measurement window. And go to preferences - theme - Logic Sniffer. Looks better. | |||
| I think I've seen enough, let's try to connect it to the Drone. | |||
| \section{Drone Logic Sniffing} | |||
| I was looking at the feet of the drone, and noticed something I had not seen before. There are two wires (antennas or thermocouples) on two legs, and then on a third, there was a board, with four wires going to it. The wires appear to be I2C, as there is a GND, and an SDA, SCL wire. I plugged the OLS into this, and started recording, but then the battery died. I did realize that in order to get the sampling rate right, you'll have to first probe with an Oscilloscope, and at least look at the signal first. Then after you have an idea of what you are dealing with, you program OLS and go after decoding. | |||
| \subsection{I2C Decode} | |||
| The pins on the board indicate SDA and SCL, which is I2C. Using the Open Logic Sniffer, at 2MHz speed, I am able to get 12ms of sampling. Unfortunately, this is not enough to read more than one packet. The packets are sent from the Phantom at a rate of one per every 20ms. Thus, the limitations of this speed show up. | |||
| Another drawback, is that it's not seamless to re-sample, when using OLS. In order to get I2C decoding, I have to begin capture, then go into the measurement menus, and click analyze. In order to get a 2nd sample, I have to close that analyation window, and click begin capture again, and then open a new I2C decode window.\footnote{And if you aren't using the default pins, e.g. in an SPI protocol decode, you have to change all the pin values again...} The workflow, is poor for this use case. Ideally, I could capture, and re-analyze in the I2C window (perhaps one button), without needing to click through menus. | |||
| The limited sampling issue is addressed on the Dangerous Prototypes website: | |||
| \emph{"The major difference is that the OLS has a limited number of samples, while the hobby USB analyzers can theoretically take infinite samples. Most of our debugging is done with the first few hundred samples, so this feature isn’t usually important to our work, your situation may be different. Future versions of the OLS will definitely have more sample storage, and we can work an infinite sampling mode into a future firmware update too."} | |||
| Seems that they acknowledge this as a flaw. | |||
| In any case, I'll have to get a Saleae, I think... In order to do further testing. I'll buy one used. I don't wish to use a clone, and I can't afford to pay \$150 for one. | |||
| Seems like the OLS is more a demonstration of making an Open Source Logic Sniffer, rather than an actual developed open source logic sniffer. At least in this scenario of 2MHz speeds with packets being burst. Perhaps it works better for slow sampling rates. | |||
| Anyways, what did we find? First off, you must get the sampling rate right. At 1MHz there were decoding errors, but at 2MHz, no errors. | |||
| See this picture of an example packet capture: | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode.png} | |||
| Exporting it, results in a csv file that lacks the binary output... Not sure why. It does have ascii. Another limited option. \footnote{I don't have a problem with this product being undeveloped, but I do have a problem with the way its touted as a working product. Call a spade a spade. This is an open source project that is in development. By no way is it mature enough to be sold to the average hobbyist. They are too eager to tout the product as an open source logic analyzer. Well, it is, but it's not finished... It's an in-development open source logic analyzer. Basic functionalities in the software and hardware are lacking. Don't sugar coat it. Call a spade a spade. Maybe it's my fault for not realizing the company is called Dangerous Prototypes. I mean, it's in the name... Prototypes. Though the bus pirate is generally considered mature enough for the hobbyist. The problem is that if you search Open Source Logic Analyzer (as I did) this shows up as the main result. In defenes of the Logic Analyzer, it is still good for what it is. Perhaps if development hadn't stopped, they would've been able to fully develop the missing features.} From the output, we can see what is likely a bit being written from the Phantom main board, before the sensor on the leg sends out the data. | |||
| Let's compare a 2nd sample, and correlate. | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode2.png} | |||
| Here we can see that the write code is ascii 60, address is 3, then the return data is a number, followed by a 0, a number followed by 255 (0xFF), another number, another 0xFF, and then a final number before closing the connection. Clearly the foot part is some kind of sensor, maybe vibration to detect a landing. | |||
| \subsection{Tapping into Main Wires} | |||
| To tap into the wires, I will use a sharp exacto blade\footnote{Exacto 11SS blades}, to slice the insulation off, then connect the logic probe to the exposed wiring. | |||
| Being careful not to cut the wiring, I peeled off the insulation. One mistake I made, was making a straight line of cuts. It would've been better to stagger, or offset the cuts, to avoid shorts. Actually, I can still do that. The Ground pin, is pin 1. | |||
| Let's check the signals with a scope to make sure they aren't over 7V, otherwise, I will break my OLS. | |||
| Pins 1 being ground, I'm not sure what 2 is. Pins 3, and 4 are 12V. Yikes!!! Can't connect there. Pin 5 appears to be data. Pin 6 is about 3.3V. Pin 7 is some kind of data. Pin 8 is about 3.3v. Looks like we only need pin 5 and 7. | |||
| The motors are getting stinky and hot, being unconnected to the drone, and trying endlessly to run. There doesn't appear to be a failsafe in the firmware to stop the motors from burning themselves out. I have to power the drone off after a couple of minutes. | |||
| Let's analyze pins 5 and 7. | |||
| \includegraphics[scale=0.5]{../pics/drone_to_gimbal_sample_uart.png} | |||
| It appears to be a UART at 115200. RX and TX between the drone and the gimbal board. | |||
| What is it sending? It's too hard to get this via sampling with the OLS. I'd be better off connecting the drone to my laptop and using a USB-to-Serial adapter. Let's do that, now that I know the baudrate. | |||
| \subsubsection{Confirming Baudrate from an oscilloscope} | |||
| How to confirm the baudrate? Get a sample of a bit on the UART on the scope, find its timing, and contrast with the speed. | |||
| I have a High signal that is 10us roughly. 10us is 0.000010 seconds. 1 / 115200 is 0.000008 seconds. The numbers line up. 1 second == 1,000 milli == 1,000,000 micro == 1,000,000,000 nano == 1,000,000,000,000 pico seconds. \footnote{Almost seems like these should be named neg-thousand, or neg-million, neg-billion, and neg-trillion... Or similar. Would that not be simpler?} | |||
| Unfortunately, the UART is all garbage, or at least not decipherable. Samples in resources. It's possible there is too much capacitance on the line, or something is hurting the signal, as per: | |||
| http://web.archive.org/web/https:// | |||
| reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \subsection{Open Bench Logic Sniffer Review} | |||
| Overall, it's a good project, but I would like to see in a project like this: | |||
| \begin{itemize} | |||
| \item A) Not abandon it, or if it's abandoned, indicate that development has slowed down in an obvious place. | |||
| \item B) Tout it as what it is, an in-development open source logic sniffer. They should emphasize that basic functions are lacking. Tell the whole story. | |||
| \item C) Would've like to see them personally sell it. I feel that other companies have benefitted more from their products than they have. | |||
| \end{itemize} | |||
| %In defense of the Open Bench Logic Sniffer, how do I get the source code, a small FPGA, and put my own logic sniffer into my product? Something to try. | |||
| \subsection{Other Approaches to troubleshooting the Drone} | |||
| There is a USB port. I bet I could get debugging info out of that if I had the right tool. There is also a USB port on the camera gimbal. Clearly, I am missing a tool that I need to do the job. There must be an easier way. | |||
| As a concluding note, I gave it a try, and I made some progress, but no cigar here. I can always try again later. | |||
| \section{References} | |||
| http://dangerousprototypes.com/docs/Open\_Bench\_Logic\_Sniffer | |||
| \vspace{0.2in} | |||
| https://github.com/o-gs/dji-firmware-tools/issues/109 | |||
| \vspace{0.2in} | |||
| http://web.archive.org/web/https:/ | |||
| /reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \vspace{0.2in} | |||
| http://blog.tuckerosman.com/2017/12/reverse-engineering-dji-phantom-3.html - relevant tags include: ``not worth the time invested'' Comes to the same conclusion I did, although perhaps a step ahead of my efforts. What neither of us did, was identify the accelerometer IC, and reverse engineer the bitstream (Accelerometers are almost always digital. There are analog ones I learned later, but those are more expensive, so probably not used here). In this project, if I had had some previous experience buying / testing accelerometers, I would've been better off to deal with this repair. | |||
| \vspace{0.2in} | |||
| \end{document} | |||
+ 182
- 0
Phantom3Standard_BadCamera/docs/11.tex~
View File
| @ -0,0 +1,182 @@ | |||
| \documentclass[11pt]{article} | |||
| %Gummi|065|=) | |||
| \usepackage{graphicx} | |||
| \usepackage{caption} | |||
| \title{\textbf{Phantom 3 Drone Repair / Diagnosis}} | |||
| \author{Steak Electronics} | |||
| \date{} | |||
| \begin{document} | |||
| %\maketitle | |||
| \textbf{Phantom 3 Drone Repair / Diagnosis} | |||
| \tableofcontents | |||
| \section{Overview} | |||
| User reports drone is unable to sync to mobile phone. Upon testing drone, I find that the gimbal is not able to get a proper level base. It continously moves around. | |||
| \section{Let's try a Logic Analyzer} | |||
| Unfortunately a lot of my work in not in notes, although I thought I had written it down, but in any case... I've looked at this drone a bit already. The issues are likely in the camera / gimbal assembly. The price of a new assembly is \$200 on ebay, and extremely expensive. The drone used is about \$240 or \$300 on ebay now (Jan - June 2019). | |||
| The pin connector that goes to the gimbal board from the drone is about 8 pins. Not bad. The ribbon connector on the gimbal, that goes to the camera is some obscene 50+ pin, double stacked monster. Not easy to decipher without schematics. There are a few motors on the camera board, which all seem to work. The issue is with the self test of the gimbal, at which point the drone never stabilizes. The user reported that he had a crash, but he also reported that he replaced the gimbal board. | |||
| \subsection{Drone Mobile App} | |||
| Looking at the drone in detail, it relies on a mobile phone app to work with the drone. This app doesn't work on my old phone. I tried an Ipad model one, and that didn't work either. The only phone I was able to get the app to work on was a more recent apple phone (that I do not own). So, right away we are having trouble interfacing to this device. The future doesn't bode well for this drone. What will 10 years in the future be like? | |||
| I've somewhat given up on any interest in repairing this. It's a black box, and cheaply made. Instead, I'm going to tap into the 8 wires going hetween the drone and the gimbal and just take a look. I've needed an excuse to use my Logic Analyzer for a while, and here's a good one. Let's see what / if we can learn, if anything. | |||
| \begin{center} | |||
| \includegraphics[scale=0.5]{../pics/Ols-cover.jpg} | |||
| \captionof{figure}{Open Bench Logic Sniffer} | |||
| \end{center} | |||
| \subsubsection{Open Bench Logic Sniffer} | |||
| The Open Bench Logic Sniffer is the first result that comes up when you search for Open Source Logic Analyzer. It's from 2010 by Dangerous Prototypes whom also made the Bus Pirate. | |||
| First off, I need a case for this board. It's exposed. I found two on thingiverse. Let's fire up the 3d printer and get one of those made. Looking at the two cases, they are nothing more than bottoms for the boards. Helpful, but I would've liked a top on these. A bit too rushed. (see cad folder). I'll just throw some electrical tape on the bottom, about as good as the cases. | |||
| \subsubsection{Abandoned Project?} | |||
| The github\footnote{Not a fan} repo https://github.com/GadgetFactory/OpenBench-Logic-Sniffer/issues seems to be quiet. Is the project abandoned? | |||
| \subsection{Setup Cont...} | |||
| Let's get this thing. Running. On devuan ascii (d9), follow the quick start guide here: | |||
| http://dangerousprototypes.com/docs/Logic\_Sniffer\_quick\_start\_guide | |||
| Linked from the main logic sniffer page. | |||
| It looks like the Sump program runs as a shell script (without any installation), so you can follow that page where they link to here: | |||
| http://www.lxtreme.nl/ols/ | |||
| and download the latest client. Then extract, untar and run the program. Unfortunately there is no verifcation of the tar files that I see. A bit shady. A package for a distribution is warranted here... Also looks like the Sump client is customized for Open Bench Logic Sniffer, and as a result, hasn't been updated as the project has been somewhat quiet... | |||
| \subsection{Basic Test} | |||
| The demonstrations section shows some basic tests. They use a bus pirate, but instead, you can just plug in an Arduino Uno (much easier). Here's what you do. | |||
| \begin{itemize} | |||
| \item Plug in Arduino, set it to Serial Read example, confirm that some data is being spit out. | |||
| \item Plug in TX of UART on Uno to pin 0-7 of the OLS (open logic sniffer). Also, obviously you'll need to tie the grounds together. | |||
| \item Set the sampling frequency to be lower than the 200MHz default. Lower sampling frequency means longer sampling times, but less detail. | |||
| \item Do a sample, then go into UART decode mode in the menus, choose auto detect speed, and run a sample, making sure to assign the TX pin of the UART decode to whatever your TX pin is connected to in OLS (this is somewhat obvious, so just fool around with the program until you get it). | |||
| \item Note that what speed works for your given application may vary. With a 9600 baud UART, I can do 50KHz sampling and get everything, but 5KHz returns garbage. Again, the lower the sampling rate, the longer the sample. | |||
| \end{itemize} | |||
| Everything should work. The decoding on the main time line view is poor, but the UART printout works reasonably well in its own menu.\footnote{Although export is limited, which I will get to.} | |||
| Some things to do: enable side measurement window. And go to preferences - theme - Logic Sniffer. Looks better. | |||
| I think I've seen enough, let's try to connect it to the Drone. | |||
| \section{Drone Logic Sniffing} | |||
| I was looking at the feet of the drone, and noticed something I had not seen before. There are two wires (antennas or thermocouples) on two legs, and then on a third, there was a board, with four wires going to it. The wires appear to be I2C, as there is a GND, and an SDA, SCL wire. I plugged the OLS into this, and started recording, but then the battery died. I did realize that in order to get the sampling rate right, you'll have to first probe with an Oscilloscope, and at least look at the signal first. Then after you have an idea of what you are dealing with, you program OLS and go after decoding. | |||
| \subsection{I2C Decode} | |||
| The pins on the board indicate SDA and SCL, which is I2C. Using the Open Logic Sniffer, at 2MHz speed, I am able to get 12ms of sampling. Unfortunately, this is not enough to read more than one packet. The packets are sent from the Phantom at a rate of one per every 20ms. Thus, the limitations of this speed show up. | |||
| Another drawback, is that it's not seamless to re-sample, when using OLS. In order to get I2C decoding, I have to begin capture, then go into the measurement menus, and click analyze. In order to get a 2nd sample, I have to close that analyation window, and click begin capture again, and then open a new I2C decode window.\footnote{And if you aren't using the default pins, e.g. in an SPI protocol decode, you have to change all the pin values again...} The workflow, is poor for this use case. Ideally, I could capture, and re-analyze in the I2C window (perhaps one button), without needing to click through menus. | |||
| The limited sampling issue is addressed on the Dangerous Prototypes website: | |||
| \emph{"The major difference is that the OLS has a limited number of samples, while the hobby USB analyzers can theoretically take infinite samples. Most of our debugging is done with the first few hundred samples, so this feature isn’t usually important to our work, your situation may be different. Future versions of the OLS will definitely have more sample storage, and we can work an infinite sampling mode into a future firmware update too."} | |||
| Seems that they acknowledge this as a flaw. | |||
| In any case, I'll have to get a Saleae, I think... In order to do further testing. I'll buy one used. I don't wish to use a clone, and I can't afford to pay \$150 for one. | |||
| Seems like the OLS is more a demonstration of making an Open Source Logic Sniffer, rather than an actual developed open source logic sniffer. At least in this scenario of 2MHz speeds with packets being burst. Perhaps it works better for slow sampling rates. | |||
| Anyways, what did we find? First off, you must get the sampling rate right. At 1MHz there were decoding errors, but at 2MHz, no errors. | |||
| See this picture of an example packet capture: | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode.png} | |||
| Exporting it, results in a csv file that lacks the binary output... Not sure why. It does have ascii. Another limited option. \footnote{I don't have a problem with this product being undeveloped, but I do have a problem with the way its touted as a working product. Call a spade a spade. This is an open source project that is in development. By no way is it mature enough to be sold to the average hobbyist. They are too eager to tout the product as an open source logic analyzer. Well, it is, but it's not finished... It's an in-development open source logic analyzer. Basic functionalities in the software and hardware are lacking. Don't sugar coat it. Call a spade a spade. Maybe it's my fault for not realizing the company is called Dangerous Prototypes. I mean, it's in the name... Prototypes. Though the bus pirate is generally considered mature enough for the hobbyist. The problem is that if you search Open Source Logic Analyzer (as I did) this shows up as the main result. In defenes of the Logic Analyzer, it is still good for what it is. Perhaps if development hadn't stopped, they would've been able to fully develop the missing features.} From the output, we can see what is likely a bit being written from the Phantom main board, before the sensor on the leg sends out the data. | |||
| Let's compare a 2nd sample, and correlate. | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode2.png} | |||
| Here we can see that the write code is ascii 60, address is 3, then the return data is a number, followed by a 0, a number followed by 255 (0xFF), another number, another 0xFF, and then a final number before closing the connection. Clearly the foot part is some kind of sensor, maybe vibration to detect a landing. | |||
| \subsection{Tapping into Main Wires} | |||
| To tap into the wires, I will use a sharp exacto blade\footnote{Exacto 11SS blades}, to slice the insulation off, then connect the logic probe to the exposed wiring. | |||
| Being careful not to cut the wiring, I peeled off the insulation. One mistake I made, was making a straight line of cuts. It would've been better to stagger, or offset the cuts, to avoid shorts. Actually, I can still do that. The Ground pin, is pin 1. | |||
| Let's check the signals with a scope to make sure they aren't over 7V, otherwise, I will break my OLS. | |||
| Pins 1 being ground, I'm not sure what 2 is. Pins 3, and 4 are 12V. Yikes!!! Can't connect there. Pin 5 appears to be data. Pin 6 is about 3.3V. Pin 7 is some kind of data. Pin 8 is about 3.3v. Looks like we only need pin 5 and 7. | |||
| The motors are getting stinky and hot, being unconnected to the drone, and trying endlessly to run. There doesn't appear to be a failsafe in the firmware to stop the motors from burning themselves out. I have to power the drone off after a couple of minutes. | |||
| Let's analyze pins 5 and 7. | |||
| \includegraphics[scale=0.5]{../pics/drone_to_gimbal_sample_uart.png} | |||
| It appears to be a UART at 115200. RX and TX between the drone and the gimbal board. | |||
| What is it sending? It's too hard to get this via sampling with the OLS. I'd be better off connecting the drone to my laptop and using a USB-to-Serial adapter. Let's do that, now that I know the baudrate. | |||
| \subsubsection{Confirming Baudrate from an oscilloscope} | |||
| How to confirm the baudrate? Get a sample of a bit on the UART on the scope, find its timing, and contrast with the speed. | |||
| I have a High signal that is 10us roughly. 10us is 0.000010 seconds. 1 / 115200 is 0.000008 seconds. The numbers line up. 1 second == 1,000 milli == 1,000,000 micro == 1,000,000,000 nano == 1,000,000,000,000 pico seconds. \footnote{Almost seems like these should be named neg-thousand, or neg-million, neg-billion, and neg-trillion... Or similar. Would that not be simpler?} | |||
| Unfortunately, the UART is all garbage, or at least not decipherable. Samples in resources. It's possible there is too much capacitance on the line, or something is hurting the signal, as per: | |||
| http://web.archive.org/web/https:// | |||
| reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \subsection{Open Bench Logic Sniffer Review} | |||
| Overall, it's a good project, but I would like to see in a project like this: | |||
| \begin{itemize} | |||
| \item A) Not abandon it, or if it's abandoned, indicate that development has slowed down in an obvious place. | |||
| \item B) Tout it as what it is, an in-development open source logic sniffer. They should emphasize that basic functions are lacking. Tell the whole story. | |||
| \item C) Would've like to see them personally sell it. I feel that other companies have benefitted more from their products than they have. | |||
| \end{itemize} | |||
| %In defense of the Open Bench Logic Sniffer, how do I get the source code, a small FPGA, and put my own logic sniffer into my product? Something to try. | |||
| \subsection{Other Approaches to troubleshooting the Drone} | |||
| There is a USB port. I bet I could get debugging info out of that if I had the right tool. There is also a USB port on the camera gimbal. Clearly, I am missing a tool that I need to do the job. There must be an easier way. | |||
| As a concluding note, I gave it a try, and I made some progress, but no cigar here. I can always try again later. | |||
| \section{References} | |||
| http://dangerousprototypes.com/docs/Open\_Bench\_Logic\_Sniffer | |||
| \vspace{0.2in} | |||
| https://github.com/o-gs/dji-firmware-tools/issues/109 | |||
| \vspace{0.2in} | |||
| http://web.archive.org/web/https:/ | |||
| /reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \vspace{0.2in} | |||
| \end{document} | |||
+ 14
- 0
Phantom3Standard_BadCamera/docs/11.toc
View File
| @ -0,0 +1,14 @@ | |||
| \contentsline {section}{\numberline {1}Overview}{1} | |||
| \contentsline {section}{\numberline {2}Let's try a Logic Analyzer}{1} | |||
| \contentsline {subsection}{\numberline {2.1}Drone Mobile App}{2} | |||
| \contentsline {subsubsection}{\numberline {2.1.1}Open Bench Logic Sniffer}{2} | |||
| \contentsline {subsubsection}{\numberline {2.1.2}Abandoned Project?}{3} | |||
| \contentsline {subsection}{\numberline {2.2}Setup Cont...}{3} | |||
| \contentsline {subsection}{\numberline {2.3}Basic Test}{3} | |||
| \contentsline {section}{\numberline {3}Drone Logic Sniffing}{4} | |||
| \contentsline {subsection}{\numberline {3.1}I2C Decode}{4} | |||
| \contentsline {subsection}{\numberline {3.2}Tapping into Main Wires}{7} | |||
| \contentsline {subsubsection}{\numberline {3.2.1}Confirming Baudrate from an oscilloscope}{8} | |||
| \contentsline {subsection}{\numberline {3.3}Open Bench Logic Sniffer Review}{8} | |||
| \contentsline {subsection}{\numberline {3.4}Other Approaches to troubleshooting the Drone}{8} | |||
| \contentsline {section}{\numberline {4}References}{9} | |||
+ 17
- 0
Phantom3Standard_BadCamera/docs/12.aux
View File
| @ -0,0 +1,17 @@ | |||
| \relax | |||
| \@writefile{toc}{\contentsline {section}{\numberline {1}Overview}{1}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {2}Let's try a Logic Analyzer}{1}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Drone Mobile App}{1}} | |||
| \@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces Open Bench Logic Sniffer\relax }}{2}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.1}Open Bench Logic Sniffer}{2}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.2}Abandoned Project?}{2}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Setup Cont...}{2}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Basic Test}{3}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {3}Drone Logic Sniffing}{3}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.1}I2C Decode}{4}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Tapping into Main Wires}{6}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {3.2.1}Confirming Baudrate from an oscilloscope}{7}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Open Bench Logic Sniffer Review}{8}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Other Approaches to troubleshooting the Drone}{8}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Conclusion}{8}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {4}References}{9}} | |||
+ 285
- 0
Phantom3Standard_BadCamera/docs/12.log
View File
| @ -0,0 +1,285 @@ | |||
| This is pdfTeX, Version 3.14159265-2.6-1.40.17 (TeX Live 2016/Debian) (preloaded format=pdflatex 2019.8.17) 25 JUN 2020 08:53 | |||
| entering extended mode | |||
| restricted \write18 enabled. | |||
| %&-line parsing enabled. | |||
| **/home/layoutdev/Desktop/code/documentation_general/Repairs_2019/Phantom3Stand | |||
| ard_BadCamera/docs/12.tex | |||
| (/home/layoutdev/Desktop/code/documentation_general/Repairs_2019/Phantom3Standa | |||
| rd_BadCamera/docs/12.tex | |||
| LaTeX2e <2017/01/01> patch level 3 | |||
| Babel <3.9r> and hyphenation patterns for 3 language(s) loaded. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/article.cls | |||
| Document Class: article 2014/09/29 v1.4h Standard LaTeX document class | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/size11.clo | |||
| File: size11.clo 2014/09/29 v1.4h Standard LaTeX file (size option) | |||
| ) | |||
| \c@part=\count79 | |||
| \c@section=\count80 | |||
| \c@subsection=\count81 | |||
| \c@subsubsection=\count82 | |||
| \c@paragraph=\count83 | |||
| \c@subparagraph=\count84 | |||
| \c@figure=\count85 | |||
| \c@table=\count86 | |||
| \abovecaptionskip=\skip41 | |||
| \belowcaptionskip=\skip42 | |||
| \bibindent=\dimen102 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/graphicx.sty | |||
| Package: graphicx 2014/10/28 v1.0g Enhanced LaTeX Graphics (DPC,SPQR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/keyval.sty | |||
| Package: keyval 2014/10/28 v1.15 key=value parser (DPC) | |||
| \KV@toks@=\toks14 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/graphics.sty | |||
| Package: graphics 2016/10/09 v1.0u Standard LaTeX Graphics (DPC,SPQR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/trig.sty | |||
| Package: trig 2016/01/03 v1.10 sin cos tan (DPC) | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics-cfg/graphics.cfg | |||
| File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration | |||
| ) | |||
| Package graphics Info: Driver file: pdftex.def on input line 99. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics-def/pdftex.def | |||
| File: pdftex.def 2017/01/12 v0.06k Graphics/color for pdfTeX | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/infwarerr.sty | |||
| Package: infwarerr 2016/05/16 v1.4 Providing info/warning/error messages (HO) | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ltxcmds.sty | |||
| Package: ltxcmds 2016/05/16 v1.23 LaTeX kernel commands for general use (HO) | |||
| ) | |||
| \Gread@gobject=\count87 | |||
| )) | |||
| \Gin@req@height=\dimen103 | |||
| \Gin@req@width=\dimen104 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/caption/caption.sty | |||
| Package: caption 2016/02/21 v3.3-144 Customizing captions (AR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/caption/caption3.sty | |||
| Package: caption3 2016/05/22 v1.7-166 caption3 kernel (AR) | |||
| Package caption3 Info: TeX engine: e-TeX on input line 67. | |||
| \captionmargin=\dimen105 | |||
| \captionmargin@=\dimen106 | |||
| \captionwidth=\dimen107 | |||
| \caption@tempdima=\dimen108 | |||
| \caption@indent=\dimen109 | |||
| \caption@parindent=\dimen110 | |||
| \caption@hangindent=\dimen111 | |||
| ) | |||
| \c@ContinuedFloat=\count88 | |||
| ) (./12.aux) | |||
| \openout1 = `12.aux'. | |||
| LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| (/usr/share/texlive/texmf-dist/tex/context/base/mkii/supp-pdf.mkii | |||
| [Loading MPS to PDF converter (version 2006.09.02).] | |||
| \scratchcounter=\count89 | |||
| \scratchdimen=\dimen112 | |||
| \scratchbox=\box26 | |||
| \nofMPsegments=\count90 | |||
| \nofMParguments=\count91 | |||
| \everyMPshowfont=\toks15 | |||
| \MPscratchCnt=\count92 | |||
| \MPscratchDim=\dimen113 | |||
| \MPnumerator=\count93 | |||
| \makeMPintoPDFobject=\count94 | |||
| \everyMPtoPDFconversion=\toks16 | |||
| ) (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/pdftexcmds.sty | |||
| Package: pdftexcmds 2016/05/21 v0.22 Utility functions of pdfTeX for LuaTeX (HO | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifluatex.sty | |||
| Package: ifluatex 2016/05/16 v1.4 Provides the ifluatex switch (HO) | |||
| Package ifluatex Info: LuaTeX not detected. | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifpdf.sty | |||
| Package: ifpdf 2016/05/14 v3.1 Provides the ifpdf switch | |||
| ) | |||
| Package pdftexcmds Info: LuaTeX not detected. | |||
| Package pdftexcmds Info: \pdf@primitive is available. | |||
| Package pdftexcmds Info: \pdf@ifprimitive is available. | |||
| Package pdftexcmds Info: \pdfdraftmode found. | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/epstopdf-base.sty | |||
| Package: epstopdf-base 2016/05/15 v2.6 Base part for package epstopdf | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/grfext.sty | |||
| Package: grfext 2016/05/16 v1.2 Manage graphics extensions (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/kvdefinekeys.sty | |||
| Package: kvdefinekeys 2016/05/16 v1.4 Define keys (HO) | |||
| )) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/kvoptions.sty | |||
| Package: kvoptions 2016/05/16 v3.12 Key value format for package options (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/kvsetkeys.sty | |||
| Package: kvsetkeys 2016/05/16 v1.17 Key value parser (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/etexcmds.sty | |||
| Package: etexcmds 2016/05/16 v1.6 Avoid name clashes with e-TeX commands (HO) | |||
| Package etexcmds Info: Could not find \expanded. | |||
| (etexcmds) That can mean that you are not using pdfTeX 1.50 or | |||
| (etexcmds) that some package has redefined \expanded. | |||
| (etexcmds) In the latter case, load this package earlier. | |||
| ))) | |||
| Package epstopdf-base Info: Redefining graphics rule for `.eps' on input line 4 | |||
| 38. | |||
| Package grfext Info: Graphics extension search list: | |||
| (grfext) [.png,.pdf,.jpg,.mps,.jpeg,.jbig2,.jb2,.PNG,.PDF,.JPG,.JPE | |||
| G,.JBIG2,.JB2,.eps] | |||
| (grfext) \AppendGraphicsExtensions on input line 456. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/latexconfig/epstopdf-sys.cfg | |||
| File: epstopdf-sys.cfg 2010/07/13 v1.3 Configuration of (r)epstopdf for TeX Liv | |||
| e | |||
| )) | |||
| Package caption Info: Begin \AtBeginDocument code. | |||
| Package caption Info: End \AtBeginDocument code. | |||
| (./12.toc) | |||
| \tf@toc=\write3 | |||
| \openout3 = `12.toc'. | |||
| <../pics/Ols-cover.jpg, id=1, 414.04688pt x 254.45062pt> | |||
| File: ../pics/Ols-cover.jpg Graphic file (type jpg) | |||
| <use ../pics/Ols-cover.jpg> | |||
| Package pdftex.def Info: ../pics/Ols-cover.jpg used on input line 30. | |||
| (pdftex.def) Requested size: 207.02292pt x 127.22499pt. | |||
| [1 | |||
| {/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}] | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <10.95> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <8> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <6> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <9> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <5> on input line 40. | |||
| Overfull \hbox (48.02994pt too wide) in paragraph at lines 40--41 | |||
| \OT1/cmr/m/n/10.95 The github[] repo https://github.com/GadgetFactory/OpenBench | |||
| -Logic-Sniffer/issues | |||
| [] | |||
| Overfull \hbox (25.35847pt too wide) in paragraph at lines 46--48 | |||
| []\OT1/cmr/m/n/10.95 http://dangerousprototypes.com/docs/Logic[]Sniffer[]quick[ | |||
| ]start[]guide Linked | |||
| [] | |||
| [2 <../pics/Ols-cover.jpg>] | |||
| LaTeX Font Info: Try loading font information for OMS+cmr on input line 58. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/omscmr.fd | |||
| File: omscmr.fd 2014/09/29 v2.5h Standard LaTeX font definitions | |||
| ) | |||
| LaTeX Font Info: Font shape `OMS/cmr/m/n' in size <10.95> not available | |||
| (Font) Font shape `OMS/cmsy/m/n' tried instead on input line 58. | |||
| [3] | |||
| Missing character: There is no â in font cmti10! | |||
| Missing character: There is no € in font cmti10! | |||
| Missing character: There is no ™ in font cmti10! | |||
| [4] | |||
| <../pics/logic_analyze_i2c_decode.png, id=26, 747.54282pt x 546.54187pt> | |||
| File: ../pics/logic_analyze_i2c_decode.png Graphic file (type png) | |||
| <use ../pics/logic_analyze_i2c_decode.png> | |||
| Package pdftex.def Info: ../pics/logic_analyze_i2c_decode.png used on input lin | |||
| e 93. | |||
| (pdftex.def) Requested size: 373.7705pt x 273.27026pt. | |||
| Overfull \hbox (30.7705pt too wide) in paragraph at lines 93--94 | |||
| [][] | |||
| [] | |||
| <../pics/logic_analyze_i2c_decode2.png, id=27, 743.77875pt x 542.025pt> | |||
| File: ../pics/logic_analyze_i2c_decode2.png Graphic file (type png) | |||
| <use ../pics/logic_analyze_i2c_decode2.png> | |||
| Package pdftex.def Info: ../pics/logic_analyze_i2c_decode2.png used on input li | |||
| ne 99. | |||
| (pdftex.def) Requested size: 371.88846pt x 271.01183pt. | |||
| Overfull \hbox (28.88846pt too wide) in paragraph at lines 99--100 | |||
| [][] | |||
| [] | |||
| [5 <../pics/logic_analyze_i2c_decode.png (PNG copy)>] [6 <../pics/logic_analyze | |||
| _i2c_decode2.png (PNG copy)>] | |||
| <../pics/drone_to_gimbal_sample_uart.png, id=34, 767.86874pt x 558.58687pt> | |||
| File: ../pics/drone_to_gimbal_sample_uart.png Graphic file (type png) | |||
| <use ../pics/drone_to_gimbal_sample_uart.png> | |||
| Package pdftex.def Info: ../pics/drone_to_gimbal_sample_uart.png used on input | |||
| line 118. | |||
| (pdftex.def) Requested size: 383.93343pt x 279.29276pt. | |||
| Overfull \hbox (40.93343pt too wide) in paragraph at lines 118--119 | |||
| [][] | |||
| [] | |||
| [7 <../pics/drone_to_gimbal_sample_uart.png (PNG copy)>] | |||
| Overfull \hbox (98.19418pt too wide) in paragraph at lines 132--135 | |||
| []\OT1/cmr/m/n/10.95 http://web.archive.org/web/https:// re-verseengi-neer-ing. | |||
| stackexchange.com/questions/12523 | |||
| [] | |||
| [8] | |||
| Overfull \hbox (98.19418pt too wide) in paragraph at lines 173--176 | |||
| []\OT1/cmr/m/n/10.95 http://web.archive.org/web/https:/ /re-verseengi-neer-ing. | |||
| stackexchange.com/questions/12523 | |||
| [] | |||
| Overfull \hbox (2.77704pt too wide) in paragraph at lines 179--180 | |||
| []\OT1/cmr/m/n/10.95 http://blog.tuckerosman.com/2017/12/reverse-engineering-dj | |||
| i-phantom- | |||
| [] | |||
| [9] (./12.aux) ) | |||
| Here is how much of TeX's memory you used: | |||
| 2616 strings out of 494945 | |||
| 42089 string characters out of 6181032 | |||
| 96838 words of memory out of 5000000 | |||
| 5898 multiletter control sequences out of 15000+600000 | |||
| 9323 words of font info for 33 fonts, out of 8000000 for 9000 | |||
| 14 hyphenation exceptions out of 8191 | |||
| 39i,8n,39p,1418b,282s stack positions out of 5000i,500n,10000p,200000b,80000s | |||
| </usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/c | |||
| mbx10.pfb></usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmbx12. | |||
| pfb></usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr10.pfb></u | |||
| sr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr6.pfb></usr/share | |||
| /texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr8.pfb></usr/share/texlive | |||
| /texmf-dist/fonts/type1/public/amsfonts/cm/cmr9.pfb></usr/share/texlive/texmf-d | |||
| ist/fonts/type1/public/amsfonts/cm/cmsy10.pfb></usr/share/texlive/texmf-dist/fo | |||
| nts/type1/public/amsfonts/cm/cmti10.pfb></usr/share/texlive/texmf-dist/fonts/ty | |||
| pe1/public/amsfonts/cm/cmtt10.pfb> | |||
| Output written on 12.pdf (9 pages, 403634 bytes). | |||
| PDF statistics: | |||
| 76 PDF objects out of 1000 (max. 8388607) | |||
| 50 compressed objects within 1 object stream | |||
| 0 named destinations out of 1000 (max. 500000) | |||
| 21 words of extra memory for PDF output out of 10000 (max. 10000000) | |||
BIN
Phantom3Standard_BadCamera/docs/12.pdf
View File
+ 191
- 0
Phantom3Standard_BadCamera/docs/12.tex
View File
| @ -0,0 +1,191 @@ | |||
| \documentclass[11pt]{article} | |||
| %Gummi|065|=) | |||
| \usepackage{graphicx} | |||
| \usepackage{caption} | |||
| \title{\textbf{Phantom 3 Drone Repair / Diagnosis}} | |||
| \author{Steak Electronics} | |||
| \date{} | |||
| \begin{document} | |||
| %\maketitle | |||
| \textbf{Phantom 3 Drone Repair / Diagnosis} | |||
| \tableofcontents | |||
| \section{Overview} | |||
| User reports drone is unable to sync to mobile phone. Upon testing drone, I find that the gimbal is not able to get a proper level base. It continously moves around. | |||
| \section{Let's try a Logic Analyzer} | |||
| Unfortunately a lot of my work in not in notes, although I thought I had written it down, but in any case... I've looked at this drone a bit already. The issues are likely in the camera / gimbal assembly. The price of a new assembly is \$200 on ebay, and extremely expensive. The drone used is about \$240 or \$300 on ebay now (Jan - June 2019). | |||
| The pin connector that goes to the gimbal board from the drone is about 8 pins. Not bad. The ribbon connector on the gimbal, that goes to the camera is some obscene 50+ pin, double stacked monster. Not easy to decipher without schematics. There are a few motors on the camera board, which all seem to work. The issue is with the self test of the gimbal, at which point the drone never stabilizes. The user reported that he had a crash, but he also reported that he replaced the gimbal board. | |||
| \subsection{Drone Mobile App} | |||
| Looking at the drone in detail, it relies on a mobile phone app to work with the drone. This app doesn't work on my old phone. I tried an Ipad model one, and that didn't work either. The only phone I was able to get the app to work on was a more recent apple phone (that I do not own). So, right away we are having trouble interfacing to this device. The future doesn't bode well for this drone. What will 10 years in the future be like? | |||
| I've somewhat given up on any interest in repairing this. It's a black box, and cheaply made. Instead, I'm going to tap into the 8 wires going hetween the drone and the gimbal and just take a look. I've needed an excuse to use my Logic Analyzer for a while, and here's a good one. Let's see what / if we can learn, if anything. | |||
| \begin{center} | |||
| \includegraphics[scale=0.5]{../pics/Ols-cover.jpg} | |||
| \captionof{figure}{Open Bench Logic Sniffer} | |||
| \end{center} | |||
| \subsubsection{Open Bench Logic Sniffer} | |||
| The Open Bench Logic Sniffer is the first result that comes up when you search for Open Source Logic Analyzer. It's from 2010 by Dangerous Prototypes whom also made the Bus Pirate. | |||
| First off, I need a case for this board. It's exposed. I found two on thingiverse. Let's fire up the 3d printer and get one of those made. Looking at the two cases, they are nothing more than bottoms for the boards. Helpful, but I would've liked a top on these. A bit too rushed. (see cad folder). I'll just throw some electrical tape on the bottom, about as good as the cases. | |||
| \subsubsection{Abandoned Project?} | |||
| The github\footnote{Not a fan} repo https://github.com/GadgetFactory/OpenBench-Logic-Sniffer/issues seems to be quiet. Is the project abandoned? | |||
| \subsection{Setup Cont...} | |||
| Let's get this thing. Running. On devuan ascii (d9), follow the quick start guide here: | |||
| http://dangerousprototypes.com/docs/Logic\_Sniffer\_quick\_start\_guide | |||
| Linked from the main logic sniffer page. | |||
| It looks like the Sump program runs as a shell script (without any installation), so you can follow that page where they link to here: | |||
| http://www.lxtreme.nl/ols/ | |||
| and download the latest client. Then extract, untar and run the program. Unfortunately there is no verifcation of the tar files that I see. A bit shady. A package for a distribution is warranted here... Also looks like the Sump client is customized for Open Bench Logic Sniffer, and as a result, hasn't been updated as the project has been somewhat quiet... | |||
| \subsection{Basic Test} | |||
| The demonstrations section shows some basic tests. They use a bus pirate, but instead, you can just plug in an Arduino Uno (much easier). Here's what you do. | |||
| \begin{itemize} | |||
| \item Plug in Arduino, set it to Serial Read example, confirm that some data is being spit out. | |||
| \item Plug in TX of UART on Uno to pin 0-7 of the OLS (open logic sniffer). Also, obviously you'll need to tie the grounds together. | |||
| \item Set the sampling frequency to be lower than the 200MHz default. Lower sampling frequency means longer sampling times, but less detail. | |||
| \item Do a sample, then go into UART decode mode in the menus, choose auto detect speed, and run a sample, making sure to assign the TX pin of the UART decode to whatever your TX pin is connected to in OLS (this is somewhat obvious, so just fool around with the program until you get it). | |||
| \item Note that what speed works for your given application may vary. With a 9600 baud UART, I can do 50KHz sampling and get everything, but 5KHz returns garbage. Again, the lower the sampling rate, the longer the sample. | |||
| \end{itemize} | |||
| Everything should work. The decoding on the main time line view is poor, but the UART printout works reasonably well in its own menu.\footnote{Although export is limited, which I will get to.} | |||
| Some things to do: enable side measurement window. And go to preferences - theme - Logic Sniffer. Looks better. | |||
| I think I've seen enough, let's try to connect it to the Drone. | |||
| \section{Drone Logic Sniffing} | |||
| I was looking at the feet of the drone, and noticed something I had not seen before. There are two wires (antennas or thermocouples) on two legs, and then on a third, there was a board, with four wires going to it. The wires appear to be I2C, as there is a GND, and an SDA, SCL wire. I plugged the OLS into this, and started recording, but then the battery died. I did realize that in order to get the sampling rate right, you'll have to first probe with an Oscilloscope, and at least look at the signal first. Then after you have an idea of what you are dealing with, you program OLS and go after decoding. | |||
| \subsection{I2C Decode} | |||
| The pins on the board indicate SDA and SCL, which is I2C. Using the Open Logic Sniffer, at 2MHz speed, I am able to get 12ms of sampling. Unfortunately, this is not enough to read more than one packet. The packets are sent from the Phantom at a rate of one per every 20ms. Thus, the limitations of this speed show up. | |||
| Another drawback, is that it's not seamless to re-sample, when using OLS. In order to get I2C decoding, I have to begin capture, then go into the measurement menus, and click analyze. In order to get a 2nd sample, I have to close that analyation window, and click begin capture again, and then open a new I2C decode window.\footnote{And if you aren't using the default pins, e.g. in an SPI protocol decode, you have to change all the pin values again...} The workflow, is poor for this use case. Ideally, I could capture, and re-analyze in the I2C window (perhaps one button), without needing to click through menus. | |||
| The limited sampling issue is addressed on the Dangerous Prototypes website: | |||
| \emph{"The major difference is that the OLS has a limited number of samples, while the hobby USB analyzers can theoretically take infinite samples. Most of our debugging is done with the first few hundred samples, so this feature isn’t usually important to our work, your situation may be different. Future versions of the OLS will definitely have more sample storage, and we can work an infinite sampling mode into a future firmware update too."} | |||
| Seems that they acknowledge this as a flaw. | |||
| In any case, I'll have to get a Saleae, I think... In order to do further testing. I'll buy one used. I don't wish to use a clone, and I can't afford to pay \$150 for one. | |||
| Seems like the OLS is more a demonstration of making an Open Source Logic Sniffer, rather than an actual developed open source logic sniffer. At least in this scenario of 2MHz speeds with packets being burst. Perhaps it works better for slow sampling rates. | |||
| Anyways, what did we find? First off, you must get the sampling rate right. At 1MHz there were decoding errors, but at 2MHz, no errors. | |||
| See this picture of an example packet capture: | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode.png} | |||
| Exporting it, results in a csv file that lacks the binary output... Not sure why. It does have ascii. Another limited option. \footnote{I don't have a problem with this product being undeveloped, but I do have a problem with the way its touted as a working product. Call a spade a spade. This is an open source project that is in development. By no way is it mature enough to be sold to the average hobbyist. They are too eager to tout the product as an open source logic analyzer. Well, it is, but it's not finished... It's an in-development open source logic analyzer. Basic functionalities in the software and hardware are lacking. Don't sugar coat it. Call a spade a spade. Maybe it's my fault for not realizing the company is called Dangerous Prototypes. I mean, it's in the name... Prototypes. Though the bus pirate is generally considered mature enough for the hobbyist. The problem is that if you search Open Source Logic Analyzer (as I did) this shows up as the main result. In defenes of the Logic Analyzer, it is still good for what it is. Perhaps if development hadn't stopped, they would've been able to fully develop the missing features.} From the output, we can see what is likely a bit being written from the Phantom main board, before the sensor on the leg sends out the data. | |||
| Let's compare a 2nd sample, and correlate. | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode2.png} | |||
| Here we can see that the write code is ascii 60, address is 3, then the return data is a number, followed by a 0, a number followed by 255 (0xFF), another number, another 0xFF, and then a final number before closing the connection. Clearly the foot part is some kind of sensor, maybe vibration to detect a landing. | |||
| \subsection{Tapping into Main Wires} | |||
| To tap into the wires, I will use a sharp exacto blade\footnote{Exacto 11SS blades}, to slice the insulation off, then connect the logic probe to the exposed wiring. | |||
| Being careful not to cut the wiring, I peeled off the insulation. One mistake I made, was making a straight line of cuts. It would've been better to stagger, or offset the cuts, to avoid shorts. Actually, I can still do that. The Ground pin, is pin 1. | |||
| Let's check the signals with a scope to make sure they aren't over 7V, otherwise, I will break my OLS. | |||
| Pins 1 being ground, I'm not sure what 2 is. Pins 3, and 4 are 12V. Yikes!!! Can't connect there. Pin 5 appears to be data. Pin 6 is about 3.3V. Pin 7 is some kind of data. Pin 8 is about 3.3v. Looks like we only need pin 5 and 7. | |||
| The motors are getting stinky and hot, being unconnected to the drone, and trying endlessly to run. There doesn't appear to be a failsafe in the firmware to stop the motors from burning themselves out. I have to power the drone off after a couple of minutes. | |||
| Let's analyze pins 5 and 7. | |||
| \includegraphics[scale=0.5]{../pics/drone_to_gimbal_sample_uart.png} | |||
| It appears to be a UART at 115200. RX and TX between the drone and the gimbal board. | |||
| What is it sending? It's too hard to get this via sampling with the OLS. I'd be better off connecting the drone to my laptop and using a USB-to-Serial adapter. Let's do that, now that I know the baudrate. | |||
| \subsubsection{Confirming Baudrate from an oscilloscope} | |||
| How to confirm the baudrate? Get a sample of a bit on the UART on the scope, find its timing, and contrast with the speed. | |||
| I have a High signal that is 10us roughly. 10us is 0.000010 seconds. 1 / 115200 is 0.000008 seconds. The numbers line up. 1 second == 1,000 milli == 1,000,000 micro == 1,000,000,000 nano == 1,000,000,000,000 pico seconds. \footnote{Almost seems like these should be named neg-thousand, or neg-million, neg-billion, and neg-trillion... Or similar. Would that not be simpler?} | |||
| Unfortunately, the UART is all garbage, or at least not decipherable. Samples in resources. It's possible there is too much capacitance on the line, or something is hurting the signal, as per: | |||
| http://web.archive.org/web/https:// | |||
| reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \subsection{Open Bench Logic Sniffer Review} | |||
| Overall, it's a good project, but I would like to see in a project like this: | |||
| \begin{itemize} | |||
| \item A) Not abandon it, or if it's abandoned, indicate that development has slowed down in an obvious place. | |||
| \item B) Tout it as what it is, an in-development open source logic sniffer. They should emphasize that basic functions are lacking. Tell the whole story. | |||
| \item C) Would've like to see them personally sell it. I feel that other companies have benefitted more from their products than they have. | |||
| \end{itemize} | |||
| %In defense of the Open Bench Logic Sniffer, how do I get the source code, a small FPGA, and put my own logic sniffer into my product? Something to try. | |||
| \subsection{Other Approaches to troubleshooting the Drone} | |||
| There is a USB port. I bet I could get debugging info out of that if I had the right tool. There is also a USB port on the camera gimbal. Clearly, I am missing a tool that I need to do the job. There must be an easier way. | |||
| As a concluding note, I gave it a try, and I made some progress, but no cigar here. I can always try again later. | |||
| \subsection{Conclusion} | |||
| Need the right tools for the job. Either a good oscope, or logic analyzer (Salae) which I did not have. 2nd, I needed some experience at least testing and trying out a accelerometer (and also buying one online\footnote{Buying one, would indicate to me that they are sold as digital and analog, but mostly digital for the lower price.}). That would've helped me a lot here. | |||
| \section{References} | |||
| http://dangerousprototypes.com/docs/Open\_Bench\_Logic\_Sniffer | |||
| \vspace{0.2in} | |||
| https://github.com/o-gs/dji-firmware-tools/issues/109 | |||
| \vspace{0.2in} | |||
| http://web.archive.org/web/https:/ | |||
| /reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \vspace{0.2in} | |||
| http://blog.tuckerosman.com/2017/12/reverse-engineering-dji-phantom-3.html - relevant tags include: ``not worth the time invested'' Comes to the same conclusion I did, although perhaps a step ahead of my efforts. What neither of us did, was identify the accelerometer IC, and reverse engineer the bitstream (Accelerometers are almost always digital. There are analog ones I learned later, but those are more expensive, so probably not used here). In this project, if I had had some previous experience buying / testing accelerometers, I would've been better off to deal with this repair. | |||
| \vspace{0.2in} | |||
| \begin{verbatim} | |||
| https://git.steakelectronics.com/adminguy/ | |||
| Electronics_Projects_2020/src/branch/master/ | |||
| Attiny_Solar_Energy_Harvest | |||
| \end{verbatim} | |||
| Project where I later bought and tested an accelerometer. | |||
| \end{document} | |||
+ 184
- 0
Phantom3Standard_BadCamera/docs/12.tex~
View File
| @ -0,0 +1,184 @@ | |||
| \documentclass[11pt]{article} | |||
| %Gummi|065|=) | |||
| \usepackage{graphicx} | |||
| \usepackage{caption} | |||
| \title{\textbf{Phantom 3 Drone Repair / Diagnosis}} | |||
| \author{Steak Electronics} | |||
| \date{} | |||
| \begin{document} | |||
| %\maketitle | |||
| \textbf{Phantom 3 Drone Repair / Diagnosis} | |||
| \tableofcontents | |||
| \section{Overview} | |||
| User reports drone is unable to sync to mobile phone. Upon testing drone, I find that the gimbal is not able to get a proper level base. It continously moves around. | |||
| \section{Let's try a Logic Analyzer} | |||
| Unfortunately a lot of my work in not in notes, although I thought I had written it down, but in any case... I've looked at this drone a bit already. The issues are likely in the camera / gimbal assembly. The price of a new assembly is \$200 on ebay, and extremely expensive. The drone used is about \$240 or \$300 on ebay now (Jan - June 2019). | |||
| The pin connector that goes to the gimbal board from the drone is about 8 pins. Not bad. The ribbon connector on the gimbal, that goes to the camera is some obscene 50+ pin, double stacked monster. Not easy to decipher without schematics. There are a few motors on the camera board, which all seem to work. The issue is with the self test of the gimbal, at which point the drone never stabilizes. The user reported that he had a crash, but he also reported that he replaced the gimbal board. | |||
| \subsection{Drone Mobile App} | |||
| Looking at the drone in detail, it relies on a mobile phone app to work with the drone. This app doesn't work on my old phone. I tried an Ipad model one, and that didn't work either. The only phone I was able to get the app to work on was a more recent apple phone (that I do not own). So, right away we are having trouble interfacing to this device. The future doesn't bode well for this drone. What will 10 years in the future be like? | |||
| I've somewhat given up on any interest in repairing this. It's a black box, and cheaply made. Instead, I'm going to tap into the 8 wires going hetween the drone and the gimbal and just take a look. I've needed an excuse to use my Logic Analyzer for a while, and here's a good one. Let's see what / if we can learn, if anything. | |||
| \begin{center} | |||
| \includegraphics[scale=0.5]{../pics/Ols-cover.jpg} | |||
| \captionof{figure}{Open Bench Logic Sniffer} | |||
| \end{center} | |||
| \subsubsection{Open Bench Logic Sniffer} | |||
| The Open Bench Logic Sniffer is the first result that comes up when you search for Open Source Logic Analyzer. It's from 2010 by Dangerous Prototypes whom also made the Bus Pirate. | |||
| First off, I need a case for this board. It's exposed. I found two on thingiverse. Let's fire up the 3d printer and get one of those made. Looking at the two cases, they are nothing more than bottoms for the boards. Helpful, but I would've liked a top on these. A bit too rushed. (see cad folder). I'll just throw some electrical tape on the bottom, about as good as the cases. | |||
| \subsubsection{Abandoned Project?} | |||
| The github\footnote{Not a fan} repo https://github.com/GadgetFactory/OpenBench-Logic-Sniffer/issues seems to be quiet. Is the project abandoned? | |||
| \subsection{Setup Cont...} | |||
| Let's get this thing. Running. On devuan ascii (d9), follow the quick start guide here: | |||
| http://dangerousprototypes.com/docs/Logic\_Sniffer\_quick\_start\_guide | |||
| Linked from the main logic sniffer page. | |||
| It looks like the Sump program runs as a shell script (without any installation), so you can follow that page where they link to here: | |||
| http://www.lxtreme.nl/ols/ | |||
| and download the latest client. Then extract, untar and run the program. Unfortunately there is no verifcation of the tar files that I see. A bit shady. A package for a distribution is warranted here... Also looks like the Sump client is customized for Open Bench Logic Sniffer, and as a result, hasn't been updated as the project has been somewhat quiet... | |||
| \subsection{Basic Test} | |||
| The demonstrations section shows some basic tests. They use a bus pirate, but instead, you can just plug in an Arduino Uno (much easier). Here's what you do. | |||
| \begin{itemize} | |||
| \item Plug in Arduino, set it to Serial Read example, confirm that some data is being spit out. | |||
| \item Plug in TX of UART on Uno to pin 0-7 of the OLS (open logic sniffer). Also, obviously you'll need to tie the grounds together. | |||
| \item Set the sampling frequency to be lower than the 200MHz default. Lower sampling frequency means longer sampling times, but less detail. | |||
| \item Do a sample, then go into UART decode mode in the menus, choose auto detect speed, and run a sample, making sure to assign the TX pin of the UART decode to whatever your TX pin is connected to in OLS (this is somewhat obvious, so just fool around with the program until you get it). | |||
| \item Note that what speed works for your given application may vary. With a 9600 baud UART, I can do 50KHz sampling and get everything, but 5KHz returns garbage. Again, the lower the sampling rate, the longer the sample. | |||
| \end{itemize} | |||
| Everything should work. The decoding on the main time line view is poor, but the UART printout works reasonably well in its own menu.\footnote{Although export is limited, which I will get to.} | |||
| Some things to do: enable side measurement window. And go to preferences - theme - Logic Sniffer. Looks better. | |||
| I think I've seen enough, let's try to connect it to the Drone. | |||
| \section{Drone Logic Sniffing} | |||
| I was looking at the feet of the drone, and noticed something I had not seen before. There are two wires (antennas or thermocouples) on two legs, and then on a third, there was a board, with four wires going to it. The wires appear to be I2C, as there is a GND, and an SDA, SCL wire. I plugged the OLS into this, and started recording, but then the battery died. I did realize that in order to get the sampling rate right, you'll have to first probe with an Oscilloscope, and at least look at the signal first. Then after you have an idea of what you are dealing with, you program OLS and go after decoding. | |||
| \subsection{I2C Decode} | |||
| The pins on the board indicate SDA and SCL, which is I2C. Using the Open Logic Sniffer, at 2MHz speed, I am able to get 12ms of sampling. Unfortunately, this is not enough to read more than one packet. The packets are sent from the Phantom at a rate of one per every 20ms. Thus, the limitations of this speed show up. | |||
| Another drawback, is that it's not seamless to re-sample, when using OLS. In order to get I2C decoding, I have to begin capture, then go into the measurement menus, and click analyze. In order to get a 2nd sample, I have to close that analyation window, and click begin capture again, and then open a new I2C decode window.\footnote{And if you aren't using the default pins, e.g. in an SPI protocol decode, you have to change all the pin values again...} The workflow, is poor for this use case. Ideally, I could capture, and re-analyze in the I2C window (perhaps one button), without needing to click through menus. | |||
| The limited sampling issue is addressed on the Dangerous Prototypes website: | |||
| \emph{"The major difference is that the OLS has a limited number of samples, while the hobby USB analyzers can theoretically take infinite samples. Most of our debugging is done with the first few hundred samples, so this feature isn’t usually important to our work, your situation may be different. Future versions of the OLS will definitely have more sample storage, and we can work an infinite sampling mode into a future firmware update too."} | |||
| Seems that they acknowledge this as a flaw. | |||
| In any case, I'll have to get a Saleae, I think... In order to do further testing. I'll buy one used. I don't wish to use a clone, and I can't afford to pay \$150 for one. | |||
| Seems like the OLS is more a demonstration of making an Open Source Logic Sniffer, rather than an actual developed open source logic sniffer. At least in this scenario of 2MHz speeds with packets being burst. Perhaps it works better for slow sampling rates. | |||
| Anyways, what did we find? First off, you must get the sampling rate right. At 1MHz there were decoding errors, but at 2MHz, no errors. | |||
| See this picture of an example packet capture: | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode.png} | |||
| Exporting it, results in a csv file that lacks the binary output... Not sure why. It does have ascii. Another limited option. \footnote{I don't have a problem with this product being undeveloped, but I do have a problem with the way its touted as a working product. Call a spade a spade. This is an open source project that is in development. By no way is it mature enough to be sold to the average hobbyist. They are too eager to tout the product as an open source logic analyzer. Well, it is, but it's not finished... It's an in-development open source logic analyzer. Basic functionalities in the software and hardware are lacking. Don't sugar coat it. Call a spade a spade. Maybe it's my fault for not realizing the company is called Dangerous Prototypes. I mean, it's in the name... Prototypes. Though the bus pirate is generally considered mature enough for the hobbyist. The problem is that if you search Open Source Logic Analyzer (as I did) this shows up as the main result. In defenes of the Logic Analyzer, it is still good for what it is. Perhaps if development hadn't stopped, they would've been able to fully develop the missing features.} From the output, we can see what is likely a bit being written from the Phantom main board, before the sensor on the leg sends out the data. | |||
| Let's compare a 2nd sample, and correlate. | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode2.png} | |||
| Here we can see that the write code is ascii 60, address is 3, then the return data is a number, followed by a 0, a number followed by 255 (0xFF), another number, another 0xFF, and then a final number before closing the connection. Clearly the foot part is some kind of sensor, maybe vibration to detect a landing. | |||
| \subsection{Tapping into Main Wires} | |||
| To tap into the wires, I will use a sharp exacto blade\footnote{Exacto 11SS blades}, to slice the insulation off, then connect the logic probe to the exposed wiring. | |||
| Being careful not to cut the wiring, I peeled off the insulation. One mistake I made, was making a straight line of cuts. It would've been better to stagger, or offset the cuts, to avoid shorts. Actually, I can still do that. The Ground pin, is pin 1. | |||
| Let's check the signals with a scope to make sure they aren't over 7V, otherwise, I will break my OLS. | |||
| Pins 1 being ground, I'm not sure what 2 is. Pins 3, and 4 are 12V. Yikes!!! Can't connect there. Pin 5 appears to be data. Pin 6 is about 3.3V. Pin 7 is some kind of data. Pin 8 is about 3.3v. Looks like we only need pin 5 and 7. | |||
| The motors are getting stinky and hot, being unconnected to the drone, and trying endlessly to run. There doesn't appear to be a failsafe in the firmware to stop the motors from burning themselves out. I have to power the drone off after a couple of minutes. | |||
| Let's analyze pins 5 and 7. | |||
| \includegraphics[scale=0.5]{../pics/drone_to_gimbal_sample_uart.png} | |||
| It appears to be a UART at 115200. RX and TX between the drone and the gimbal board. | |||
| What is it sending? It's too hard to get this via sampling with the OLS. I'd be better off connecting the drone to my laptop and using a USB-to-Serial adapter. Let's do that, now that I know the baudrate. | |||
| \subsubsection{Confirming Baudrate from an oscilloscope} | |||
| How to confirm the baudrate? Get a sample of a bit on the UART on the scope, find its timing, and contrast with the speed. | |||
| I have a High signal that is 10us roughly. 10us is 0.000010 seconds. 1 / 115200 is 0.000008 seconds. The numbers line up. 1 second == 1,000 milli == 1,000,000 micro == 1,000,000,000 nano == 1,000,000,000,000 pico seconds. \footnote{Almost seems like these should be named neg-thousand, or neg-million, neg-billion, and neg-trillion... Or similar. Would that not be simpler?} | |||
| Unfortunately, the UART is all garbage, or at least not decipherable. Samples in resources. It's possible there is too much capacitance on the line, or something is hurting the signal, as per: | |||
| http://web.archive.org/web/https:// | |||
| reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \subsection{Open Bench Logic Sniffer Review} | |||
| Overall, it's a good project, but I would like to see in a project like this: | |||
| \begin{itemize} | |||
| \item A) Not abandon it, or if it's abandoned, indicate that development has slowed down in an obvious place. | |||
| \item B) Tout it as what it is, an in-development open source logic sniffer. They should emphasize that basic functions are lacking. Tell the whole story. | |||
| \item C) Would've like to see them personally sell it. I feel that other companies have benefitted more from their products than they have. | |||
| \end{itemize} | |||
| %In defense of the Open Bench Logic Sniffer, how do I get the source code, a small FPGA, and put my own logic sniffer into my product? Something to try. | |||
| \subsection{Other Approaches to troubleshooting the Drone} | |||
| There is a USB port. I bet I could get debugging info out of that if I had the right tool. There is also a USB port on the camera gimbal. Clearly, I am missing a tool that I need to do the job. There must be an easier way. | |||
| As a concluding note, I gave it a try, and I made some progress, but no cigar here. I can always try again later. | |||
| \section{References} | |||
| http://dangerousprototypes.com/docs/Open\_Bench\_Logic\_Sniffer | |||
| \vspace{0.2in} | |||
| https://github.com/o-gs/dji-firmware-tools/issues/109 | |||
| \vspace{0.2in} | |||
| http://web.archive.org/web/https:/ | |||
| /reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \vspace{0.2in} | |||
| http://blog.tuckerosman.com/2017/12/reverse-engineering-dji-phantom-3.html - relevant tags include: ``not worth the time invested'' Comes to the same conclusion I did, although perhaps a step ahead of my efforts. What neither of us did, was identify the accelerometer IC, and reverse engineer the bitstream (Accelerometers are almost always digital. There are analog ones I learned later, but those are more expensive, so probably not used here). In this project, if I had had some previous experience buying / testing accelerometers, I would've been better off to deal with this repair. | |||
| \vspace{0.2in} | |||
| \end{document} | |||
+ 15
- 0
Phantom3Standard_BadCamera/docs/12.toc
View File
| @ -0,0 +1,15 @@ | |||
| \contentsline {section}{\numberline {1}Overview}{1} | |||
| \contentsline {section}{\numberline {2}Let's try a Logic Analyzer}{1} | |||
| \contentsline {subsection}{\numberline {2.1}Drone Mobile App}{1} | |||
| \contentsline {subsubsection}{\numberline {2.1.1}Open Bench Logic Sniffer}{2} | |||
| \contentsline {subsubsection}{\numberline {2.1.2}Abandoned Project?}{2} | |||
| \contentsline {subsection}{\numberline {2.2}Setup Cont...}{2} | |||
| \contentsline {subsection}{\numberline {2.3}Basic Test}{3} | |||
| \contentsline {section}{\numberline {3}Drone Logic Sniffing}{3} | |||
| \contentsline {subsection}{\numberline {3.1}I2C Decode}{4} | |||
| \contentsline {subsection}{\numberline {3.2}Tapping into Main Wires}{6} | |||
| \contentsline {subsubsection}{\numberline {3.2.1}Confirming Baudrate from an oscilloscope}{7} | |||
| \contentsline {subsection}{\numberline {3.3}Open Bench Logic Sniffer Review}{8} | |||
| \contentsline {subsection}{\numberline {3.4}Other Approaches to troubleshooting the Drone}{8} | |||
| \contentsline {subsection}{\numberline {3.5}Conclusion}{8} | |||
| \contentsline {section}{\numberline {4}References}{9} | |||
+ 17
- 0
Phantom3Standard_BadCamera/docs/14.aux
View File
| @ -0,0 +1,17 @@ | |||
| \relax | |||
| \@writefile{toc}{\contentsline {section}{\numberline {1}Overview}{1}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {2}Let's try a Logic Analyzer}{1}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.1}Drone Mobile App}{1}} | |||
| \@writefile{lof}{\contentsline {figure}{\numberline {1}{\ignorespaces Open Bench Logic Sniffer\relax }}{2}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.1}Open Bench Logic Sniffer}{2}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {2.1.2}Abandoned Project?}{2}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.2}Setup Cont...}{2}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {2.3}Basic Test}{3}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {3}Drone Logic Sniffing}{3}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.1}I2C Decode}{4}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.2}Tapping into Main Wires}{6}} | |||
| \@writefile{toc}{\contentsline {subsubsection}{\numberline {3.2.1}Confirming Baudrate from an oscilloscope}{7}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.3}Open Bench Logic Sniffer Review}{8}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.4}Other Approaches to troubleshooting the Drone}{8}} | |||
| \@writefile{toc}{\contentsline {subsection}{\numberline {3.5}Conclusion}{8}} | |||
| \@writefile{toc}{\contentsline {section}{\numberline {4}References}{9}} | |||
+ 285
- 0
Phantom3Standard_BadCamera/docs/14.log
View File
| @ -0,0 +1,285 @@ | |||
| This is pdfTeX, Version 3.14159265-2.6-1.40.17 (TeX Live 2016/Debian) (preloaded format=pdflatex 2019.8.17) 25 JUN 2020 08:54 | |||
| entering extended mode | |||
| restricted \write18 enabled. | |||
| %&-line parsing enabled. | |||
| **/home/layoutdev/Desktop/code/documentation_general/Repairs_2019/Phantom3Stand | |||
| ard_BadCamera/docs/14.tex | |||
| (/home/layoutdev/Desktop/code/documentation_general/Repairs_2019/Phantom3Standa | |||
| rd_BadCamera/docs/14.tex | |||
| LaTeX2e <2017/01/01> patch level 3 | |||
| Babel <3.9r> and hyphenation patterns for 3 language(s) loaded. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/article.cls | |||
| Document Class: article 2014/09/29 v1.4h Standard LaTeX document class | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/size11.clo | |||
| File: size11.clo 2014/09/29 v1.4h Standard LaTeX file (size option) | |||
| ) | |||
| \c@part=\count79 | |||
| \c@section=\count80 | |||
| \c@subsection=\count81 | |||
| \c@subsubsection=\count82 | |||
| \c@paragraph=\count83 | |||
| \c@subparagraph=\count84 | |||
| \c@figure=\count85 | |||
| \c@table=\count86 | |||
| \abovecaptionskip=\skip41 | |||
| \belowcaptionskip=\skip42 | |||
| \bibindent=\dimen102 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/graphicx.sty | |||
| Package: graphicx 2014/10/28 v1.0g Enhanced LaTeX Graphics (DPC,SPQR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/keyval.sty | |||
| Package: keyval 2014/10/28 v1.15 key=value parser (DPC) | |||
| \KV@toks@=\toks14 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/graphics.sty | |||
| Package: graphics 2016/10/09 v1.0u Standard LaTeX Graphics (DPC,SPQR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics/trig.sty | |||
| Package: trig 2016/01/03 v1.10 sin cos tan (DPC) | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics-cfg/graphics.cfg | |||
| File: graphics.cfg 2016/06/04 v1.11 sample graphics configuration | |||
| ) | |||
| Package graphics Info: Driver file: pdftex.def on input line 99. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/graphics-def/pdftex.def | |||
| File: pdftex.def 2017/01/12 v0.06k Graphics/color for pdfTeX | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/infwarerr.sty | |||
| Package: infwarerr 2016/05/16 v1.4 Providing info/warning/error messages (HO) | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ltxcmds.sty | |||
| Package: ltxcmds 2016/05/16 v1.23 LaTeX kernel commands for general use (HO) | |||
| ) | |||
| \Gread@gobject=\count87 | |||
| )) | |||
| \Gin@req@height=\dimen103 | |||
| \Gin@req@width=\dimen104 | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/caption/caption.sty | |||
| Package: caption 2016/02/21 v3.3-144 Customizing captions (AR) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/caption/caption3.sty | |||
| Package: caption3 2016/05/22 v1.7-166 caption3 kernel (AR) | |||
| Package caption3 Info: TeX engine: e-TeX on input line 67. | |||
| \captionmargin=\dimen105 | |||
| \captionmargin@=\dimen106 | |||
| \captionwidth=\dimen107 | |||
| \caption@tempdima=\dimen108 | |||
| \caption@indent=\dimen109 | |||
| \caption@parindent=\dimen110 | |||
| \caption@hangindent=\dimen111 | |||
| ) | |||
| \c@ContinuedFloat=\count88 | |||
| ) | |||
| No file 14.aux. | |||
| \openout1 = `14.aux'. | |||
| LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 9. | |||
| LaTeX Font Info: ... okay on input line 9. | |||
| (/usr/share/texlive/texmf-dist/tex/context/base/mkii/supp-pdf.mkii | |||
| [Loading MPS to PDF converter (version 2006.09.02).] | |||
| \scratchcounter=\count89 | |||
| \scratchdimen=\dimen112 | |||
| \scratchbox=\box26 | |||
| \nofMPsegments=\count90 | |||
| \nofMParguments=\count91 | |||
| \everyMPshowfont=\toks15 | |||
| \MPscratchCnt=\count92 | |||
| \MPscratchDim=\dimen113 | |||
| \MPnumerator=\count93 | |||
| \makeMPintoPDFobject=\count94 | |||
| \everyMPtoPDFconversion=\toks16 | |||
| ) (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/pdftexcmds.sty | |||
| Package: pdftexcmds 2016/05/21 v0.22 Utility functions of pdfTeX for LuaTeX (HO | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifluatex.sty | |||
| Package: ifluatex 2016/05/16 v1.4 Provides the ifluatex switch (HO) | |||
| Package ifluatex Info: LuaTeX not detected. | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/ifpdf.sty | |||
| Package: ifpdf 2016/05/14 v3.1 Provides the ifpdf switch | |||
| ) | |||
| Package pdftexcmds Info: LuaTeX not detected. | |||
| Package pdftexcmds Info: \pdf@primitive is available. | |||
| Package pdftexcmds Info: \pdf@ifprimitive is available. | |||
| Package pdftexcmds Info: \pdfdraftmode found. | |||
| ) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/epstopdf-base.sty | |||
| Package: epstopdf-base 2016/05/15 v2.6 Base part for package epstopdf | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/grfext.sty | |||
| Package: grfext 2016/05/16 v1.2 Manage graphics extensions (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/kvdefinekeys.sty | |||
| Package: kvdefinekeys 2016/05/16 v1.4 Define keys (HO) | |||
| )) | |||
| (/usr/share/texlive/texmf-dist/tex/latex/oberdiek/kvoptions.sty | |||
| Package: kvoptions 2016/05/16 v3.12 Key value format for package options (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/kvsetkeys.sty | |||
| Package: kvsetkeys 2016/05/16 v1.17 Key value parser (HO) | |||
| (/usr/share/texlive/texmf-dist/tex/generic/oberdiek/etexcmds.sty | |||
| Package: etexcmds 2016/05/16 v1.6 Avoid name clashes with e-TeX commands (HO) | |||
| Package etexcmds Info: Could not find \expanded. | |||
| (etexcmds) That can mean that you are not using pdfTeX 1.50 or | |||
| (etexcmds) that some package has redefined \expanded. | |||
| (etexcmds) In the latter case, load this package earlier. | |||
| ))) | |||
| Package epstopdf-base Info: Redefining graphics rule for `.eps' on input line 4 | |||
| 38. | |||
| Package grfext Info: Graphics extension search list: | |||
| (grfext) [.png,.pdf,.jpg,.mps,.jpeg,.jbig2,.jb2,.PNG,.PDF,.JPG,.JPE | |||
| G,.JBIG2,.JB2,.eps] | |||
| (grfext) \AppendGraphicsExtensions on input line 456. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/latexconfig/epstopdf-sys.cfg | |||
| File: epstopdf-sys.cfg 2010/07/13 v1.3 Configuration of (r)epstopdf for TeX Liv | |||
| e | |||
| )) | |||
| Package caption Info: Begin \AtBeginDocument code. | |||
| Package caption Info: End \AtBeginDocument code. | |||
| No file 14.toc. | |||
| \tf@toc=\write3 | |||
| \openout3 = `14.toc'. | |||
| <../pics/Ols-cover.jpg, id=1, 414.04688pt x 254.45062pt> | |||
| File: ../pics/Ols-cover.jpg Graphic file (type jpg) | |||
| <use ../pics/Ols-cover.jpg> | |||
| Package pdftex.def Info: ../pics/Ols-cover.jpg used on input line 30. | |||
| (pdftex.def) Requested size: 207.02292pt x 127.22499pt. | |||
| [1 | |||
| {/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}] | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <10.95> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <8> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <6> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <9> on input line 40. | |||
| LaTeX Font Info: External font `cmex10' loaded for size | |||
| (Font) <5> on input line 40. | |||
| Overfull \hbox (48.02994pt too wide) in paragraph at lines 40--41 | |||
| \OT1/cmr/m/n/10.95 The github[] repo https://github.com/GadgetFactory/OpenBench | |||
| -Logic-Sniffer/issues | |||
| [] | |||
| Overfull \hbox (25.35847pt too wide) in paragraph at lines 46--48 | |||
| []\OT1/cmr/m/n/10.95 http://dangerousprototypes.com/docs/Logic[]Sniffer[]quick[ | |||
| ]start[]guide Linked | |||
| [] | |||
| [2 <../pics/Ols-cover.jpg>] | |||
| LaTeX Font Info: Try loading font information for OMS+cmr on input line 58. | |||
| (/usr/share/texlive/texmf-dist/tex/latex/base/omscmr.fd | |||
| File: omscmr.fd 2014/09/29 v2.5h Standard LaTeX font definitions | |||
| ) | |||
| LaTeX Font Info: Font shape `OMS/cmr/m/n' in size <10.95> not available | |||
| (Font) Font shape `OMS/cmsy/m/n' tried instead on input line 58. | |||
| [3] | |||
| Missing character: There is no â in font cmti10! | |||
| Missing character: There is no € in font cmti10! | |||
| Missing character: There is no ™ in font cmti10! | |||
| [4] | |||
| <../pics/logic_analyze_i2c_decode.png, id=26, 747.54282pt x 546.54187pt> | |||
| File: ../pics/logic_analyze_i2c_decode.png Graphic file (type png) | |||
| <use ../pics/logic_analyze_i2c_decode.png> | |||
| Package pdftex.def Info: ../pics/logic_analyze_i2c_decode.png used on input lin | |||
| e 93. | |||
| (pdftex.def) Requested size: 373.7705pt x 273.27026pt. | |||
| Overfull \hbox (30.7705pt too wide) in paragraph at lines 93--94 | |||
| [][] | |||
| [] | |||
| <../pics/logic_analyze_i2c_decode2.png, id=27, 743.77875pt x 542.025pt> | |||
| File: ../pics/logic_analyze_i2c_decode2.png Graphic file (type png) | |||
| <use ../pics/logic_analyze_i2c_decode2.png> | |||
| Package pdftex.def Info: ../pics/logic_analyze_i2c_decode2.png used on input li | |||
| ne 99. | |||
| (pdftex.def) Requested size: 371.88846pt x 271.01183pt. | |||
| Overfull \hbox (28.88846pt too wide) in paragraph at lines 99--100 | |||
| [][] | |||
| [] | |||
| [5 <../pics/logic_analyze_i2c_decode.png (PNG copy)>] [6 <../pics/logic_analyze | |||
| _i2c_decode2.png (PNG copy)>] | |||
| <../pics/drone_to_gimbal_sample_uart.png, id=34, 767.86874pt x 558.58687pt> | |||
| File: ../pics/drone_to_gimbal_sample_uart.png Graphic file (type png) | |||
| <use ../pics/drone_to_gimbal_sample_uart.png> | |||
| Package pdftex.def Info: ../pics/drone_to_gimbal_sample_uart.png used on input | |||
| line 118. | |||
| (pdftex.def) Requested size: 383.93343pt x 279.29276pt. | |||
| Overfull \hbox (40.93343pt too wide) in paragraph at lines 118--119 | |||
| [][] | |||
| [] | |||
| [7 <../pics/drone_to_gimbal_sample_uart.png (PNG copy)>] | |||
| Overfull \hbox (98.19418pt too wide) in paragraph at lines 132--135 | |||
| []\OT1/cmr/m/n/10.95 http://web.archive.org/web/https:// re-verseengi-neer-ing. | |||
| stackexchange.com/questions/12523 | |||
| [] | |||
| [8] | |||
| Overfull \hbox (98.19418pt too wide) in paragraph at lines 173--176 | |||
| []\OT1/cmr/m/n/10.95 http://web.archive.org/web/https:/ /re-verseengi-neer-ing. | |||
| stackexchange.com/questions/12523 | |||
| [] | |||
| Overfull \hbox (2.77704pt too wide) in paragraph at lines 179--180 | |||
| []\OT1/cmr/m/n/10.95 http://blog.tuckerosman.com/2017/12/reverse-engineering-dj | |||
| i-phantom- | |||
| [] | |||
| [9] (./14.aux) ) | |||
| Here is how much of TeX's memory you used: | |||
| 2612 strings out of 494945 | |||
| 42061 string characters out of 6181032 | |||
| 96838 words of memory out of 5000000 | |||
| 5898 multiletter control sequences out of 15000+600000 | |||
| 9323 words of font info for 33 fonts, out of 8000000 for 9000 | |||
| 14 hyphenation exceptions out of 8191 | |||
| 39i,8n,39p,1418b,282s stack positions out of 5000i,500n,10000p,200000b,80000s | |||
| </usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/c | |||
| mbx10.pfb></usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmbx12. | |||
| pfb></usr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr10.pfb></u | |||
| sr/share/texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr6.pfb></usr/share | |||
| /texlive/texmf-dist/fonts/type1/public/amsfonts/cm/cmr8.pfb></usr/share/texlive | |||
| /texmf-dist/fonts/type1/public/amsfonts/cm/cmr9.pfb></usr/share/texlive/texmf-d | |||
| ist/fonts/type1/public/amsfonts/cm/cmsy10.pfb></usr/share/texlive/texmf-dist/fo | |||
| nts/type1/public/amsfonts/cm/cmti10.pfb></usr/share/texlive/texmf-dist/fonts/ty | |||
| pe1/public/amsfonts/cm/cmtt10.pfb> | |||
| Output written on 14.pdf (9 pages, 403634 bytes). | |||
| PDF statistics: | |||
| 76 PDF objects out of 1000 (max. 8388607) | |||
| 50 compressed objects within 1 object stream | |||
| 0 named destinations out of 1000 (max. 500000) | |||
| 21 words of extra memory for PDF output out of 10000 (max. 10000000) | |||
BIN
Phantom3Standard_BadCamera/docs/14.pdf
View File
+ 191
- 0
Phantom3Standard_BadCamera/docs/14.tex
View File
| @ -0,0 +1,191 @@ | |||
| \documentclass[11pt]{article} | |||
| %Gummi|065|=) | |||
| \usepackage{graphicx} | |||
| \usepackage{caption} | |||
| \title{\textbf{Phantom 3 Drone Repair / Diagnosis}} | |||
| \author{Steak Electronics} | |||
| \date{} | |||
| \begin{document} | |||
| %\maketitle | |||
| \textbf{Phantom 3 Drone Repair / Diagnosis} | |||
| \tableofcontents | |||
| \section{Overview} | |||
| User reports drone is unable to sync to mobile phone. Upon testing drone, I find that the gimbal is not able to get a proper level base. It continously moves around. | |||
| \section{Let's try a Logic Analyzer} | |||
| Unfortunately a lot of my work in not in notes, although I thought I had written it down, but in any case... I've looked at this drone a bit already. The issues are likely in the camera / gimbal assembly. The price of a new assembly is \$200 on ebay, and extremely expensive. The drone used is about \$240 or \$300 on ebay now (Jan - June 2019). | |||
| The pin connector that goes to the gimbal board from the drone is about 8 pins. Not bad. The ribbon connector on the gimbal, that goes to the camera is some obscene 50+ pin, double stacked monster. Not easy to decipher without schematics. There are a few motors on the camera board, which all seem to work. The issue is with the self test of the gimbal, at which point the drone never stabilizes. The user reported that he had a crash, but he also reported that he replaced the gimbal board. | |||
| \subsection{Drone Mobile App} | |||
| Looking at the drone in detail, it relies on a mobile phone app to work with the drone. This app doesn't work on my old phone. I tried an Ipad model one, and that didn't work either. The only phone I was able to get the app to work on was a more recent apple phone (that I do not own). So, right away we are having trouble interfacing to this device. The future doesn't bode well for this drone. What will 10 years in the future be like? | |||
| I've somewhat given up on any interest in repairing this. It's a black box, and cheaply made. Instead, I'm going to tap into the 8 wires going hetween the drone and the gimbal and just take a look. I've needed an excuse to use my Logic Analyzer for a while, and here's a good one. Let's see what / if we can learn, if anything. | |||
| \begin{center} | |||
| \includegraphics[scale=0.5]{../pics/Ols-cover.jpg} | |||
| \captionof{figure}{Open Bench Logic Sniffer} | |||
| \end{center} | |||
| \subsubsection{Open Bench Logic Sniffer} | |||
| The Open Bench Logic Sniffer is the first result that comes up when you search for Open Source Logic Analyzer. It's from 2010 by Dangerous Prototypes whom also made the Bus Pirate. | |||
| First off, I need a case for this board. It's exposed. I found two on thingiverse. Let's fire up the 3d printer and get one of those made. Looking at the two cases, they are nothing more than bottoms for the boards. Helpful, but I would've liked a top on these. A bit too rushed. (see cad folder). I'll just throw some electrical tape on the bottom, about as good as the cases. | |||
| \subsubsection{Abandoned Project?} | |||
| The github\footnote{Not a fan} repo https://github.com/GadgetFactory/OpenBench-Logic-Sniffer/issues seems to be quiet. Is the project abandoned? | |||
| \subsection{Setup Cont...} | |||
| Let's get this thing. Running. On devuan ascii (d9), follow the quick start guide here: | |||
| http://dangerousprototypes.com/docs/Logic\_Sniffer\_quick\_start\_guide | |||
| Linked from the main logic sniffer page. | |||
| It looks like the Sump program runs as a shell script (without any installation), so you can follow that page where they link to here: | |||
| http://www.lxtreme.nl/ols/ | |||
| and download the latest client. Then extract, untar and run the program. Unfortunately there is no verifcation of the tar files that I see. A bit shady. A package for a distribution is warranted here... Also looks like the Sump client is customized for Open Bench Logic Sniffer, and as a result, hasn't been updated as the project has been somewhat quiet... | |||
| \subsection{Basic Test} | |||
| The demonstrations section shows some basic tests. They use a bus pirate, but instead, you can just plug in an Arduino Uno (much easier). Here's what you do. | |||
| \begin{itemize} | |||
| \item Plug in Arduino, set it to Serial Read example, confirm that some data is being spit out. | |||
| \item Plug in TX of UART on Uno to pin 0-7 of the OLS (open logic sniffer). Also, obviously you'll need to tie the grounds together. | |||
| \item Set the sampling frequency to be lower than the 200MHz default. Lower sampling frequency means longer sampling times, but less detail. | |||
| \item Do a sample, then go into UART decode mode in the menus, choose auto detect speed, and run a sample, making sure to assign the TX pin of the UART decode to whatever your TX pin is connected to in OLS (this is somewhat obvious, so just fool around with the program until you get it). | |||
| \item Note that what speed works for your given application may vary. With a 9600 baud UART, I can do 50KHz sampling and get everything, but 5KHz returns garbage. Again, the lower the sampling rate, the longer the sample. | |||
| \end{itemize} | |||
| Everything should work. The decoding on the main time line view is poor, but the UART printout works reasonably well in its own menu.\footnote{Although export is limited, which I will get to.} | |||
| Some things to do: enable side measurement window. And go to preferences - theme - Logic Sniffer. Looks better. | |||
| I think I've seen enough, let's try to connect it to the Drone. | |||
| \section{Drone Logic Sniffing} | |||
| I was looking at the feet of the drone, and noticed something I had not seen before. There are two wires (antennas or thermocouples) on two legs, and then on a third, there was a board, with four wires going to it. The wires appear to be I2C, as there is a GND, and an SDA, SCL wire. I plugged the OLS into this, and started recording, but then the battery died. I did realize that in order to get the sampling rate right, you'll have to first probe with an Oscilloscope, and at least look at the signal first. Then after you have an idea of what you are dealing with, you program OLS and go after decoding. | |||
| \subsection{I2C Decode} | |||
| The pins on the board indicate SDA and SCL, which is I2C. Using the Open Logic Sniffer, at 2MHz speed, I am able to get 12ms of sampling. Unfortunately, this is not enough to read more than one packet. The packets are sent from the Phantom at a rate of one per every 20ms. Thus, the limitations of this speed show up. | |||
| Another drawback, is that it's not seamless to re-sample, when using OLS. In order to get I2C decoding, I have to begin capture, then go into the measurement menus, and click analyze. In order to get a 2nd sample, I have to close that analyation window, and click begin capture again, and then open a new I2C decode window.\footnote{And if you aren't using the default pins, e.g. in an SPI protocol decode, you have to change all the pin values again...} The workflow, is poor for this use case. Ideally, I could capture, and re-analyze in the I2C window (perhaps one button), without needing to click through menus. | |||
| The limited sampling issue is addressed on the Dangerous Prototypes website: | |||
| \emph{"The major difference is that the OLS has a limited number of samples, while the hobby USB analyzers can theoretically take infinite samples. Most of our debugging is done with the first few hundred samples, so this feature isn’t usually important to our work, your situation may be different. Future versions of the OLS will definitely have more sample storage, and we can work an infinite sampling mode into a future firmware update too."} | |||
| Seems that they acknowledge this as a flaw. | |||
| In any case, I'll have to get a Saleae, I think... In order to do further testing. I'll buy one used. I don't wish to use a clone, and I can't afford to pay \$150 for one. | |||
| Seems like the OLS is more a demonstration of making an Open Source Logic Sniffer, rather than an actual developed open source logic sniffer. At least in this scenario of 2MHz speeds with packets being burst. Perhaps it works better for slow sampling rates. | |||
| Anyways, what did we find? First off, you must get the sampling rate right. At 1MHz there were decoding errors, but at 2MHz, no errors. | |||
| See this picture of an example packet capture: | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode.png} | |||
| Exporting it, results in a csv file that lacks the binary output... Not sure why. It does have ascii. Another limited option. \footnote{I don't have a problem with this product being undeveloped, but I do have a problem with the way its touted as a working product. Call a spade a spade. This is an open source project that is in development. By no way is it mature enough to be sold to the average hobbyist. They are too eager to tout the product as an open source logic analyzer. Well, it is, but it's not finished... It's an in-development open source logic analyzer. Basic functionalities in the software and hardware are lacking. Don't sugar coat it. Call a spade a spade. Maybe it's my fault for not realizing the company is called Dangerous Prototypes. I mean, it's in the name... Prototypes. Though the bus pirate is generally considered mature enough for the hobbyist. The problem is that if you search Open Source Logic Analyzer (as I did) this shows up as the main result. In defenes of the Logic Analyzer, it is still good for what it is. Perhaps if development hadn't stopped, they would've been able to fully develop the missing features.} From the output, we can see what is likely a bit being written from the Phantom main board, before the sensor on the leg sends out the data. | |||
| Let's compare a 2nd sample, and correlate. | |||
| \includegraphics[scale=0.5]{../pics/logic_analyze_i2c_decode2.png} | |||
| Here we can see that the write code is ascii 60, address is 3, then the return data is a number, followed by a 0, a number followed by 255 (0xFF), another number, another 0xFF, and then a final number before closing the connection. Clearly the foot part is some kind of sensor, maybe vibration to detect a landing. | |||
| \subsection{Tapping into Main Wires} | |||
| To tap into the wires, I will use a sharp exacto blade\footnote{Exacto 11SS blades}, to slice the insulation off, then connect the logic probe to the exposed wiring. | |||
| Being careful not to cut the wiring, I peeled off the insulation. One mistake I made, was making a straight line of cuts. It would've been better to stagger, or offset the cuts, to avoid shorts. Actually, I can still do that. The Ground pin, is pin 1. | |||
| Let's check the signals with a scope to make sure they aren't over 7V, otherwise, I will break my OLS. | |||
| Pins 1 being ground, I'm not sure what 2 is. Pins 3, and 4 are 12V. Yikes!!! Can't connect there. Pin 5 appears to be data. Pin 6 is about 3.3V. Pin 7 is some kind of data. Pin 8 is about 3.3v. Looks like we only need pin 5 and 7. | |||
| The motors are getting stinky and hot, being unconnected to the drone, and trying endlessly to run. There doesn't appear to be a failsafe in the firmware to stop the motors from burning themselves out. I have to power the drone off after a couple of minutes. | |||
| Let's analyze pins 5 and 7. | |||
| \includegraphics[scale=0.5]{../pics/drone_to_gimbal_sample_uart.png} | |||
| It appears to be a UART at 115200. RX and TX between the drone and the gimbal board. | |||
| What is it sending? It's too hard to get this via sampling with the OLS. I'd be better off connecting the drone to my laptop and using a USB-to-Serial adapter. Let's do that, now that I know the baudrate. | |||
| \subsubsection{Confirming Baudrate from an oscilloscope} | |||
| How to confirm the baudrate? Get a sample of a bit on the UART on the scope, find its timing, and contrast with the speed. | |||
| I have a High signal that is 10us roughly. 10us is 0.000010 seconds. 1 / 115200 is 0.000008 seconds. The numbers line up. 1 second == 1,000 milli == 1,000,000 micro == 1,000,000,000 nano == 1,000,000,000,000 pico seconds. \footnote{Almost seems like these should be named neg-thousand, or neg-million, neg-billion, and neg-trillion... Or similar. Would that not be simpler?} | |||
| Unfortunately, the UART is all garbage, or at least not decipherable. Samples in resources. It's possible there is too much capacitance on the line, or something is hurting the signal, as per: | |||
| http://web.archive.org/web/https:// | |||
| reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \subsection{Open Bench Logic Sniffer Review} | |||
| Overall, it's a good project, but I would like to see in a project like this: | |||
| \begin{itemize} | |||
| \item A) Not abandon it, or if it's abandoned, indicate that development has slowed down in an obvious place. | |||
| \item B) Tout it as what it is, an in-development open source logic sniffer. They should emphasize that basic functions are lacking. Tell the whole story. | |||
| \item C) Would've like to see them personally sell it. I feel that other companies have benefitted more from their products than they have. | |||
| \end{itemize} | |||
| %In defense of the Open Bench Logic Sniffer, how do I get the source code, a small FPGA, and put my own logic sniffer into my product? Something to try. | |||
| \subsection{Other Approaches to troubleshooting the Drone} | |||
| There is a USB port. I bet I could get debugging info out of that if I had the right tool. There is also a USB port on the camera gimbal. Clearly, I am missing a tool that I need to do the job. There must be an easier way. | |||
| As a concluding note, I gave it a try, and I made some progress, but no cigar here. I can always try again later. | |||
| \subsection{Conclusion} | |||
| Need the right tools for the job. Either a good oscope, or logic analyzer (Salae) which I did not have. 2nd, I needed some experience at least testing and trying out a accelerometer (and also buying one online\footnote{Buying one, would indicate to me that they are sold as digital and analog, but mostly digital for the lower price.}). That would've helped me a lot here. | |||
| \section{References} | |||
| http://dangerousprototypes.com/docs/Open\_Bench\_Logic\_Sniffer | |||
| \vspace{0.2in} | |||
| https://github.com/o-gs/dji-firmware-tools/issues/109 | |||
| \vspace{0.2in} | |||
| http://web.archive.org/web/https:/ | |||
| /reverseengineering.stackexchange.com/questions/12523 | |||
| /routers-serial-port-only-outputs-garbage | |||
| \vspace{0.2in} | |||
| http://blog.tuckerosman.com/2017/12/reverse-engineering-dji-phantom-3.html - relevant tags include: ``not worth the time invested'' Comes to the same conclusion I did, although perhaps a step ahead of my efforts. What neither of us did, was identify the accelerometer IC, and reverse engineer the bitstream (Accelerometers are almost always digital. There are analog ones I learned later, but those are more expensive, so probably not used here). In this project, if I had had some previous experience buying / testing accelerometers, I would've been better off to deal with this repair. | |||
| \vspace{0.2in} | |||
| \begin{verbatim} | |||
| https://git.steakelectronics.com/adminguy/ | |||
| Electronics_Projects_2020/src/branch/master/ | |||
| Attiny_Solar_Energy_Harvest | |||
| \end{verbatim} | |||
| Project where I later bought and tested an accelerometer. | |||
| \end{document} | |||
+ 15
- 0
Phantom3Standard_BadCamera/docs/14.toc
View File
| @ -0,0 +1,15 @@ | |||
| \contentsline {section}{\numberline {1}Overview}{1} | |||
| \contentsline {section}{\numberline {2}Let's try a Logic Analyzer}{1} | |||
| \contentsline {subsection}{\numberline {2.1}Drone Mobile App}{1} | |||
| \contentsline {subsubsection}{\numberline {2.1.1}Open Bench Logic Sniffer}{2} | |||
| \contentsline {subsubsection}{\numberline {2.1.2}Abandoned Project?}{2} | |||
| \contentsline {subsection}{\numberline {2.2}Setup Cont...}{2} | |||
| \contentsline {subsection}{\numberline {2.3}Basic Test}{3} | |||
| \contentsline {section}{\numberline {3}Drone Logic Sniffing}{3} | |||
| \contentsline {subsection}{\numberline {3.1}I2C Decode}{4} | |||
| \contentsline {subsection}{\numberline {3.2}Tapping into Main Wires}{6} | |||
| \contentsline {subsubsection}{\numberline {3.2.1}Confirming Baudrate from an oscilloscope}{7} | |||
| \contentsline {subsection}{\numberline {3.3}Open Bench Logic Sniffer Review}{8} | |||
| \contentsline {subsection}{\numberline {3.4}Other Approaches to troubleshooting the Drone}{8} | |||
| \contentsline {subsection}{\numberline {3.5}Conclusion}{8} | |||
| \contentsline {section}{\numberline {4}References}{9} | |||