2018-03-19 Bernhard "HotKey" Slawik

Reverse-engineering the protocol used by the joystick of Permobil C300 / VR2 drive unit


Physical
========
* use the WHITE wire (which is one of the 4 pins in the joystick connector; its one of the center ones)
* serial, 5V levels, 38400 baud, 1 start bit (LOW), 8 data bits, 1 parity bit (make highs EVEN), 2 stop bits (HIGH)

Connection is tricky (voltage-wise). I got it to work using an oscilloscope to carefully put the signal into OK bounds:

  WHITE (to VR2)
    |
    |
    +----------Diode >|----RX (Pin 10)
    |
    |
   10k
    |
    |
  TX (Pin 11)




What the oscilloscope shows while boot-up:
	* 26us per bit
	
	* joy: ...111 0 11001010 0 11	0 00110101 0 11 111...
	       ...111 s dddddddd P SS	s dddddddd P SS 111...
	which means:
	53	MSB 01010011	LSB 11001010
	AC	MSB 10101100	LSB 00110101
	
	* ctrl: ...111 0 11001110 1 11	0 00000100 1 11	0 10000000 1 11	0 11010110 1 11 111...
	        ...111 s dddddddd P SS	s dddddddd P SS	s dddddddd P SS	s dddddddd P SS 111...
	73	LSB 11001110
	20	LSB 00000100
	1	LSB 10000000
	6B	LSB 11010110
	

Packets
=======

Joystick sends this packet (each is a byte):
	cmd1	buttonState	cmd2	Y	X	checkSum
	
	cmd1:
		0x4A
	
	buttonState:
		0x00	nothing
		0x02	speed-
		0x04	speed+
		0x08	seat
		0x20	horn
		0x40	power-long-pressed
		0xC0	power
	
	cmd2:
		0xA0	standard packet
		0xA2	after beeping?
		0x01	first packet after boot
	
	X, Y:
		00	center
		00..7f	max
		ff..80	min
	
	checkSum:
		* Simple:
			checkSum = 255 - (D0 + D1 + D2 + D3 + D4)
		
		+ Example packets in decimal:
			D0	D1	D2	D3	D4	= D4
			74	0	1	1	0	= 179
			74	0	160	1	0	= 20
			74	0	160	2	0	= 19
			74	4	160	2	0	= 15
			74	0	160	1	0	= 20
			74	192	160	1	0	= 84
			74	64	160	1	0	= 212
			74	2	162	1	0	= 16
	
VR2 responds with a similar packet:
	cmd1	systemState	cmd2	batteryLed	speedLed
	
	cmd1:
		0x54
	
	systemState:
		0x80	booting?
		0xC0	occurs a few seconds after boot
		0x00	ready?
	
	cmd2:
		0xA0	normal
		0xA2	beep1 (press)
		0xA3	beep2 (maximum reached)
	
	batteryLed:
		0x51
		0x61
	
	speedLed:
		0x31
		0x51
		0x71
		0x91
		0xb1


Dump
====

Boot
53 AC	73 20 01 6B 
4A 00 01 01 00 B3	FE 54 80 A0 01 11 79 
4A 00 A0 01 00 14	FE 54 80 A0 01 11 79 
4A 00 A0 01 00 14	FE 54 80 A0 01 11 79 
4A 00 A0 01 00 14	FE 54 80 A0 01 11 79