Skip to content

Let's try figuring out the data stream. #1

@cnlohr

Description

@cnlohr

I've been putting dumps here: https://drive.google.com/drive/folders/1iN0vuhsRMY6tCWZOCC9F4SSBbT9ljmq7?usp=sharing

NOTE DO NOT USE fx3_100MHz_DataCap.dat.tar.gz The data is bad!

Histogram (from 100 MHz FX3 data):
image

vvv C Program for analyzing the FX3 dump.
analyze.txt

Current ideas/questions:
(1) Supersoaker: what if it's a CDMA stream, or other stream of pseudorandom data that specifically prevents repeated codes or subcodes and encodes the position of the rotor.
(2) Why do my charts show a peak at more than 2 codes?
(3) Coding is probably something "like" Manchester. Spread around 6 MHz.

Hint from Alan:

The modulation is quite simple, but sensor group delay might be confusing you a little. Best to probe the laser drive directly if you are completely lost. The data rate is 6 Mbps and the modulation is basically 3/6 MHz FSK, but it includes a pi phase shift on zeros to ensure a minimum frequency. The base station console might give you some hints about what the bitstream is. It is not framed or packetised in any way, so you won't really be helped by capturing more than a few tens of bits. That after all is the entire idea... Or maybe you will... If you can't work out what it is you will need all of it from one sync event, to the next one. Oh and OOTX isn't dead, it just got slower.

Hints we got from Ben:

Ben Jackson	I don't like popcorn but I am baking bread
Ben Jackson	50rpm
Ben Jackson	Charles should make a sampling camera to do ultra-high speed photography of repetitive stuff
Ben Jackson	licensees don't know either
Ben Jackson	yes, that's fine
Ben Jackson	the datasheet has the timings
Ben Jackson	yes, for how to configure the chip
Ben Jackson	the config word isn't that interesting. it's just a way to make adjustments to the chip after the fab. so you would need to know lots of internal details to know what the bits do
Ben Jackson	instead of making a bunch of variants of the chip
Ben Jackson	but once you figure out what it should be, the other values aren't that interesting anymore
Ben Jackson	I think there are updates coming, but I don't know if that's in the update
Ben Jackson	FYI @CNLohr that capture doesn't look right to me
Ben Jackson	it's hard to look at raw analog photodiode signals
Ben Jackson	you need an amplified photodiode with more bw
Ben Jackson	@CNLohr that was re the chat
Ben Jackson	@CNLohr how fast is the ESP sampling?
Ben Jackson	did you look at the datasheet? it should tell you the possible BW of what possible input signals it can process
Ben Jackson	you should probably move the base and the sensor farther apart
Ben Jackson	@MobiusHorizons good idea
Ben Jackson	they don't communicate with each other
Ben Jackson	they're blue while spinning up
Ben Jackson	it is easy to block 2.0 without the blinker
Ben Jackson	there's no clock pin
Ben Jackson	@CNLohr are you sure you powered up and configured the sensor properly?
Ben Jackson	that can make it tricky to just measure the output
Ben Jackson	b/c you still need active config
Ben Jackson	you could have glitched it into sleep mode
Ben Jackson	wait, are you reloading the ESP on every run?
Ben Jackson	and each run it tries to configure the already-configured sensor?
Ben Jackson	@CNLohr beep
Ben Jackson	after you configure the sensor it's in a different mode
Ben Jackson	the initialization sequence won't work then
Ben Jackson	don't drive the D/E lines again after config or you will do unpredictable things
Ben Jackson	so power cycle, send config sequence, D/E go hi-Z and stay hi-Z as long as you want to use it
Ben Jackson	if you have to drive those during a reload you should powercycle the sensor
Ben Jackson	that looks about right for config
Ben Jackson	you sure you are loading those bits in the right order?
Ben Jackson	that looks potentially right
Ben Jackson	he changed TS4231s
Ben Jackson	where it the sensor in front of the base?
Ben Jackson	measure the env timings
Ben Jackson	you probalby have a local reflection
Ben Jackson	a shiny bit right near the sensor
Ben Jackson	like a connector
Ben Jackson	no SUPER local
Ben Jackson	like on the board with the sensor
Ben Jackson	or just move the base way farther away
Ben Jackson	yeah black gaffer tape isn't great for IR
Ben Jackson	sharpie is also terrible in ir
Ben Jackson	the first step to blocking IR is to realize your intuition for what color or transparency things are in IR is shit
Ben Jackson	for not reflecting we have some special matte black optical tape that's black in IR
Ben Jackson	and for blocking transmission you really need foil backed tape
Max Bambusman	@Ben Jackson aluminium duct tape?
Ben Jackson	that will definitely block it
Ben Jackson	but then it's a mirror
Ben Jackson	the tape we use has foil lining but it's black on the outside
Ben Jackson	blue painters tape is almost entirely transparent in IR, fyi
Ben Jackson	@Naters305 it's kind of like interviewing 😉
Naters305	Haha Nice @Ben Jackson
Ben Jackson	I'm going to laugh so hard when you figure out what this bitstream is
Ben Jackson	understanding the bits should be straightforward
Ben Jackson	or rather demodulating them
Ben Jackson	but figuring out what they are might be a crueler challenge than the old wireless protocol
Ben Jackson	@Peter S. Hollander email the VR licensing email (include your account name if it's not obvious) and I can send you some
Ben Jackson	What will his chat thing do if 我说汉语
Ben Jackson	it doesn't like emoticons
Ben Jackson	oh cool it beeps
Ben Jackson	this is super handy
Ben Jackson	unicode characters made your terminal beep
Ben Jackson	they stop transmitting when the motor control loop goes out of spec
Ben Jackson	so in theory if you spun the outside at -50rpm very constantly it would work
Ben Jackson	but your outside motor control loop would need to hold about 200ppm tolerance
Ben Jackson	yeah, I never thought about how hard this would be to reverse engineer from snippets
Ben Jackson	interesting idea
Ben Jackson	or point it into an integrating sphere
Ben Jackson	@CNLohr you didn't forget about power cycling if you want to reconfigure, right?
Ben Jackson	you should just power it with a fet so you can toggle it in the boot sequence
Ben Jackson	@MobiusHorizons the shape of a flashlight beam reflector has the properties you want (i.e. it kind of collimates light)
MobiusHorizons	@Ben Jackson that's pretty much what I was thinking
Ben Jackson	what, you don't want to build an integrating sphere?
Ben Jackson	I love the juxtaposition of how clever an idea that is vs how much it will not help you at all :)
Ben Jackson	how much of a hint do you want
Ben Jackson	the wall would work
Ben Jackson	oh, no, the wall will be more useful
Ben Jackson	wall is strictly a good idea and an improvement over short captures
Ben Jackson	and you will easily figure out 1s vs 0s
Ben Jackson	right
Ben Jackson	I mean having a longer sequence of bits won't help you
Ben Jackson	😃 😃 :)
Ben Jackson	so @Peter S. Hollander has decided to start cutting off his leg with the saw ;-)
Max Bambusman	@Ben Jackson how much do you/steam want the vive to be reverse engineered?
Ben Jackson	when I designed it originally I started by capturing with saleae and decoding w/ python
Ben Jackson	it will export to CSV
Ben Jackson	then I wrote a saleae plugin to demodulate which is fun
Ben Jackson	you typo'd 6MHz as 600kHz at some point
Ben Jackson	the saleae protocol decoders are asynchronous and run in another thread
Ben Jackson	so there can be weird latency
Ben Jackson	I've never tried to use the manchester module
Ben Jackson	it probably would want 6Mhz differential manchester
Ben Jackson	you sure that's not decoding?
Ben Jackson	hmm
Ben Jackson	silicone labs
Ben Jackson	hmmmm
Ben Jackson	try differential manchester, 6MHz, one bit per transfer
Ben Jackson	I wonder if that would work
Ben Jackson	I could find a capture and test
Ben Jackson	maybe it wants 3?
Ben Jackson	does it want 12?
Ben Jackson	it does
Ben Jackson	@CNLohr turn off your unused channels to capture
Ben Jackson	time to 也说汉语
pacccer	@Ben Jackson do we need a higher sample rate?
Ben Jackson	@pacccer I just realized when he was exporting that he had all channels on
Ben Jackson	not sure where he captured
Ben Jackson	@Jernej Jakob right
Ben Jackson	note that the laser line comes out perpendicular to the stripes you see on the lens
Ben Jackson	well you can't take it apart because it's impossible to take apart
Ben Jackson	I'm waiting for ifixit to give it a -1 on the servicability scale
Ben Jackson	1004 is the start of all of our model numbers
Ben Jackson	only for management
Ben Jackson	@CNLohr turn off the unused saleae channels
Ben Jackson	that will unlock higher bw options
Ben Jackson	ohhh non-pro
Ben Jackson	turns out you can tell if your supply chain is compromised if FTDI makes their drivers fail on those devices
Ben Jackson	well if FTDI found out that your devices included counterfeit chips they could sue to prevent you from importing them
Ben Jackson	?
Ben Jackson	I don't care about FTDI
Ben Jackson	what was the capture frequency?
Ben Jackson	that's a good choice
Ben Jackson	I feel like you could get something out of 24MHz the way you're capturing
Ben Jackson	one thing to consider: how would you modulate this if you were doing it?
Ben Jackson	does it make sense if 1's are \"long\" and 0's are \"short\"? that's not a constant bitrate
Ben Jackson	sure, but that's partly down to how you analyzed it
Ben Jackson	your analysis method *adds* phase noise
Ben Jackson	because you add in all phase noise in every edge
Ben Jackson	man this is serious deja vu for me
Ben Jackson	you really want some mulitple of 6 or better 12 or your life is going to be even harder
Ben Jackson	I used 500 :)
Ben Jackson	going to have to go soon
Ben Jackson	if you want to request any specific hints before, now's the time
Ben Jackson	I want to see your reaction when you figure it out, but I think it might take a few more streams...
Ben Jackson	your analysis with your eyes just scrolling along was good
Ben Jackson	your question about bit stuffing already includes an incorrect assumption
Ben Jackson	so the answer is \"mu\"
Ben Jackson	yes
Ben Jackson	although it's DC balanced regardless
Ben Jackson	he's right about \"mu\"
Ben Jackson	the bitstream AND the encoding are both dc balanced
Ben Jackson	you kind of asked about one
Ben Jackson	re: bit stuffing
(I was talking about something ABOUT the signal just naturally works out to make it work out to be right)
Ben Jackson	yes
Ben Jackson	YES
Ben Jackson	oh man you're so close :)
Ben Jackson	got to go, catch up with you all later

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions