DSM

What is DSM (DSM2/DSMX)

DSM2 and DSMX are widely used radio protocols for 2.4GHz spektrum RC transmitters and receivers. It is also used in the SuperbitRF project as datalink. The protocol makes it possible to have multiple receiver/transmitters in the 2.4GHz spektrum without much interference.

The difference between DSM2 and DSMX

There is only a small difference between DSM2 and DSMX, which is the way they hop between different channels. In the DSM2 protocol the transmitter will choose two random channels, where the transmitter will look for the two best channels in the optimal case. In the DSMX protocol the transmitter and receiver both use the transmitter radio chip ID,which is send during the binding process, for generating 23 channels. Each time the transmitter transmits a packet or the receiver receives a packet they will hop to the next channel.

From this information you can conclude that when you use DSM2, and both the channels that were chosen are getting used by a lot of other users your reception will drop enormously. In the DSMX protocol this problem was solved and makes it possible to have a lot more transmitters/receivers at the same bandwidth.

How does it work

Note that this is reverse engineered and will contain errors.

In general you have three phases, the binding procedure, the syncing procedure and the normal transfer procedure. The transmitter doesn't have a syncing procedure, because it determines the timing for the receiver.

The binding procedure

At the binding procedure both the transmitter and receiver will change to SDR (Single Data Rate) mode, a data code of 64 bits, a SOP (Start Of Packet) Code of 64 bits and disable the CRC Checksum. The transmitter will then choose a random odd channel and starts sending the binding packet at a very high rate. The receiver will start at the first odd channel and waits a bit longer then the rate the transmitters sends at. When it does receive a packet, it will check if it is a valid bind packet and goes to syncing mode. When it doesn't receive a valid packet it will go to the next channel and will repeat this.

During the binding procedure the transmitter also sends the amount of RC channels that it has and in which amount of packets this channels will fit. They will either transmit all the channels in one packet or in two packets after each other.

The syncing procedure

Because the transmitter doesn't have a syncing procedure, the transmitter is already in the transfer procedure. The receiver on the other hand needs to synchronise itself with the transmitter.

TODO

The transfer procedure

TODO

References

Some general information about the DSM2/DSMX protocol.

Definitions

• Channel: The channel in the 2.4GHz band(2.400GHz to 2.483GHz) which is used to transmit or receive. Each channel is 100mHz higher then the previous one starting by 0, and the 2.4GHz band is divided into 98 channels.
• (Transmission) Mode: The mode at which the transmitter, or receiver is sending/receiving. There are four different modes the transmitter/receiver could be in: GFSK(Gaussian Frequency Shift Keying), 8DR(Octal Data Rate), DDR(Double Data Rate), SDR(Single Data Rate). The ones used are 8DR and SDR, in SDR mode one bit is encoded in each derived code symbol transmitted. In 8DR mode eight bits are encoded in each derived code symbol transmitted.
• GFSK: Gaussian Frequency Shift Keying Transfer mode. CYRF6936 in this mode data is transmitted at 1 Mbps, without any DSSS.
• 8DR: Octal Data Rate. CYRF6936 in this mode eight bits are encoded in each derived code symbol transmitted.
• DDR: Double Data Rate. CYRF6936 in this mode two bits are encoded in each derived code symbol transmitted.
• SDR: Single Data Rate. CYRF6936 in this mode one bit is encoded in each derived code symbol transmitted.
• SOP code: Start Of Packet code, are one or two bytes which are added at the start of the packet by the radio chip. These bytes are used to identify if a packet is received at a certain channel.
• Packet length: The packet length(one byte) is send after the SOP code, and only includes the length of the payload data. Because it is one byte the limit of the payload length is 255, but because 8DR and SDR only transmit 16byte packets they will be automatically split up into multiple packets.
• CRC (Checksum): The CRC Checksum are two bytes which are send at the end of the packet to check if the received packet was valid. It can detect the following errors: any one bit error, any two bits error, any odd number of bits in error and an error burst as wide as the checksum itself.
• CYRF6936: A radio chip used in several transmitters and the SuperbitRF project.

Packet example

Here is an image of an example packet including the Preamble, SOP, Length, Payload Data and the CRC.

Binding packet

The binding packet has a length of 16 bytes, the exact size the SDR mode can send at once.

[00] radio chip ID byte 0 (inverted)
[01] radio chip ID byte 1 (inverted)
[02] radio chip ID byte 2 (inverted)
[03] radio chip ID byte 3 (inverted)
[04] radio chip ID byte 0 (inverted)
[05] radio chip ID byte 1 (inverted)
[06] radio chip ID byte 2 (inverted)
[07] radio chip ID byte 3 (inverted)
[08] (sum 00->07 + 384 - 16) MSB
[09] (sum 00->07 + 384 - 16) LSB
[10] 0x01 (not known yet)
[11] number of RC channels
[12] protocol used (0x01:DSM2 1packet, 0x02: DSM2 2packets, 0x10: DSM2 SuperbitRF, 0x11: DSMX SuperbitRF, 0xA2: DSMX 1packet, 0xB2: DSMX 2packets)
[13] 0x00 (not known yet)
[14] (sum 00->13 + 384 - 16) MSB
[15] (sum 00->13 + 384 - 16) LSB

External References

• CYRF6936 Data Sheet
• Deviation Firmware
• Interfacing with the CYRF6936
• RCGorups: DSMX Hacking