HMI Servo Programmer

[Fritzoid]

I seems that while you were all out at RoboGames, Hitec was quietly posting a bunch of new stuff on their robotics site. Check out the downloads section at

http://www.hitecrobotics.com/

Now a lot of this stuff here is old but not everything, there are some new RoboBasic templates for example. But the real gem is the HMI Servo Programmer found in the software section. There is an english version of their manual in the User Manual section too.

The program runs on Windows and can connect to your servos using the MC3024 or a custom-built serial cable the specs for which are now available. I've used the program successfully to read and write to the servos using the MC3024 option and the standard communications cable. The program is a little quirky but it does work

[i-Bot]

At last !

The only problem I see is that it will not write configuration to version 1.08 servos. Most RN1 servos are 1.08. Doesn't upgrade the servo firmware either.

PC cable mode works fine too.

Should make the folks happy who bought lots of the expensive 5990

Great to see it is free!

[Fritzoid]

I'm not sure about the write configuration issue. True, if you press Save Servo you get an error message and the same with the Reset menu option. But if you press Not Connect the updated configuration seems to stick. Maybe it's just in the controller memory

A port trace shows command 0xF1 as the servo selection response. It probably retreives data from a servo into controller memory. Next a bunch of 0xF7's to return selected memory bytes to the PC.

I'm looking at the RoboBasic source code again to see what's going down.

I also found that 0xF4 is a servo move command

[i-Bot]

The PDF servo information does not include the commands to read and write both RAM and EEPROM on the servo.

I think your config changes are not being written out to EEPROM. The EEPROM write is only done when a 1.1 servo is connected. I checked this with a 5990.

The 0xD0 serial command looks to put the C3024 into a mode where the PC can write HMI command through to the selected servo.

[DirtyRoboto]

Well spotted fritzoid. Thanks for posting your find up.

Marcus.

Ps Check out the new Template. It has Moves like "Upstair" and "Breakdance" Along with "RUN"

Hmm, I need to get Takeshi back to factory setup!!!
_________________
In servo's we trust!

[Fritzoid]

I went back to my notes (my earlier post was from memory) and I found the command codes as follows:

0xF1 - read storage byte
0xF4 - write storage byte
0xF6 - move servo

0xD0 - unknown servo command (retreive data ?)

The values for D-gain, DeadZone, and P-gain appear in storage three different times. One for each of the so-called "performance groups". This is probably what the 100us, 150us and 200us pulse signals select. All one my servos have equal settings for all three. Also the manual implies that the servo must be power sequenced for the changes to take effect.

The storage locations are requested in the following order

0x07 - high byte of center postion
0x08 - low byte of center postiton
0x13 - left limit
0x14 - right limit
0x03 - D-gain
0x02 - Deadzone
0x01 - P-gain low byte ?
0x00 - P-gain high byte ?
0x1B - unknown 0x29 (address of servo ID??)
0x29 - unknown (servo ID ??)
0x2C - unknown (varies from servo to servo)
0x22 - second performance group
0x21 deadzone
0x20 P-gain
0x1F
0x27 - third performance group
0x26 deadzone
0x25 P-gain
0x24

[i-Bot]

EEprom location 1B is 28 for froward operation, and 29 for reverse.
Location 2c is a checksum, so the sum of all locations from 0 to 0x2C add up to 0 mod 256.

There are some major erros in the Hitec specification ( checksum, setting motor position). Use the following until fixed.

http://robosavvy.com/site/Builders/i-Bot/HSR8498_serial.pdf

[Fritzoid]

Thanks for the info i-Bot.

There's something strange going on here! If you press one of the servo radio buttons, the program sends the following string to the MR3024.

0xF7,0x00,0x00,servo#

where servo# if the servo number values are 0x00 to 0x1F.

The first byte of the response is the firmware level i.e. 0x6C for level 108.

Looking at the source code (taken from your files section) the path for the 0xF7 command is pretty straightforward. It should return the data byte at hex location 0x0000 regardless of what servo# is! Yet it returns 0x6c if the servo exists and 0x00 if it does not.

Also, the 0xD0 command seems to bit-bang a serial 0xD0 command down to the servo OK but it returns zeroes and is only issued at entry to the Servo Programmer.

Nothing really adds-up for the other commands either!

How can this thing work?

Something's not right here

[srobot]

Nice finds.

--srobot

PS - Say hi to the 4,000 post in Robonova-1 & Hitec
_________________
Dell Latitude D520, Windows XP, 4 GB RAM, 80 GB HDD, Intel Core 2 Duo. The power that's needed!

RIBO Labs, Springing Robotic Development to a New Level

[i-Bot]

The 0xD0 command shifts the C3204 into talkthrough mode and then sedns the 0xD0 command to servo as below. It is not clear if the actual 0xD0 command does anything on the servo, but after that the controller stays in the talkthrough mode.
In talkthrough mode the C3024 receives 4 bytes from the PC. It then sends an 0x80 header, then the first 3 bytes from the PC, and finally a calculated checksum, to the servo number which is in byte 4 from the PC.
The 2 servo response bytes are then sent back to the PC.
C3024 will stay in talkthrough mode until an 0x 6F is received in byte 1.

It also appears that the servos respond to either 0xE? or 0xF? in the same way, so an 0xF4 is the same as an 0xE4. So commands should be according to file I posted, in either case.

Nice to be able to talk through the C3024 in HMI, but a bit slow due to the 9600 link to PC.

[Fritzoid]

I missed the fact that the 0xD0 and 0xD1 commands stay in the loop! But not before I had disassembled the latest download and compared it to the source listing byte-by-byte. Then I went a litter farther, writing a small program which switches the RN into serial mode and throws some test commands at it. Some results so far...

1. 0xFA commands must be sent 4 times to stop IM command fetching. The MR3024 responds with 3 and sometimes 4 0xFA echos.

2. It takes 2 0xD0 commands in a row to get the ball rolling. The first one returns no data the second responds twice for a total of 4 0x00s. Sometimes the controller responds 0xB0 0xB0 and you can't get into serial mode without a power reset.

3. Even after sending a 0x6F the RN seems oblivious to input from the IR remote control.

4. 0xFn and 0xEn commands are not entirely equivalent. Here's a list of the commands I've tried so far...

0xF1 - Reads servo configuration data. Format 0xF1,addr,0x00,servo#.
Here addr is a one-byte data offset and servo# is a one-byte servo number. Data found from 0x00 to 0x2D. Returns one byte of data and one byte 0x03.

0xF2 - Writes configuration data!!! Format 0xF2,addr,data,servo#. Here addr is a one-byte offset, data is the new data byte and servo# is the selected servo number. This one is not for the faint of heart as the effect of changing the configuration without changing the checksum is unknown!!! Returns two bytes of 0x03.

0xF3 - Reads servo RAM. Format 0xF3,addr,0x00,servo#. Similar to 0xF1 except that the data comes from a different place.

0xF4 - Possibly writes to servo RAM. Format 0xF4,addr,data,servo#. Similar to the 0xF2 command. More investigation needed on this one.

0xF5 - Read servo position. Format 0xF5,0x00,0x00,servo#. This seems to be returning the target position rather than the current position. Response is two bytes of position data.

0xF6 - Move servo to position. Format 0xF6,poshi,poslo,servo#. Here poshi the the high-order byte of the position and poslo is the low-order byte. Returns two bytes of 0x03.

0xF7 - Read servo software level. Format 0xF7,0x00,0x00,servo#. Returns the one-byte software version number followed by 0x00. The current servo version is 1.08 encoded as 0x6C in the response.

0xF8 - Read current and voltage. Format 0xF8,0x00,0x00,servo#. Returns two bytes of data. This command needs more investigation to verify the results.

0xF9 - Unknown. Format 0xF9,0x00,0x00,servo#. Returns two bytes of 0x00. If this were like 0xE9 then it would return the current position but all I've seen is zeroes.

There's probably a lot more yet to be discovered

[Sazabi]

It looks like those address are:
0x81,0x80 - low,high bytes of P-Gain (first one always bigger, but I don't know which one is low and which is high).
0x82 - DeadZone.
0x83 - D-Gain.
0x87 - center
0x88 - center
0x93 - left
0x94 - right
As i gues those are for different servp pref,but why they appear as a 1 pref for me - i don't know.
Btw, any body with ver1.10 hsr8498, could you make flash memory dump plz so we could reprogram ours v1.08 servos?