CEVA chillcrestlabs HCOMM User manual

March 5, 2014 1000-2984 Revision 0.3.2 1 / 54
© 2019, CEVA, Inc. All rights reserved www.ceva-dsp.com
HCOMM Reference Manual
Document Number:
1000-2984
Document Revision:
0.3.2
Date:
March 5, 2014

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 2 / 54
Table of Contents
LIST OF FIGURES ........................................................................................................................ 4
1 INTRODUCTION ............................................................................................................. 5
1.1 Reserved Values ............................................................................................................................ 5
1.2 Revision History ............................................................................................................................ 5
2 SENSORS ........................................................................................................................... 6
2.1.1 Linear Accelerometers .............................................................................................................. 6
2.1.2 Angular Velocity Sensors (Gyroscopes) ................................................................................... 6
2.1.3 Magnetometers .......................................................................................................................... 6
2.1.4 Ambient Light Sensors .............................................................................................................. 6
2.1.5 Pressure Sensors ........................................................................................................................ 6
2.1.6 Proximity Sensors ..................................................................................................................... 6
3 HCOMM HUB OPERATION .......................................................................................... 7
3.1 Operating Modes ........................................................................................................................... 7
3.1.1 Full Motion ............................................................................................................................... 7
3.1.2 Wake-on-Motion ....................................................................................................................... 7
3.1.3 Sleep .......................................................................................................................................... 7
3.1.4 Notify-on-Motion ...................................................................................................................... 7
3.1.5 Full Motion On .......................................................................................................................... 7
3.2 Host Interfaces ............................................................................................................................... 7
3.3 Device Firmware Upgrade ............................................................................................................ 8
4 HCOMM OVERVIEW ..................................................................................................... 9
5 HCOMM PACKETS ....................................................................................................... 10
5.1 Inbound Packets .......................................................................................................................... 10
5.1.1 Mouse Packet (Class 0x02) ..................................................................................................... 10
5.1.2 DataIn Packet (Class 0x05) ..................................................................................................... 10
5.1.2.1 FRS Write Response (Subclass 0x06) ............................................................................... 11
5.1.2.2 Freespace Data Mode Control V2 Response (Subclass 0x14) .......................................... 12
5.1.2.3 Sensor Period Response (Subclass 0x17) .......................................................................... 13
5.1.3 DataInLong Packet (Class 0x06) ............................................................................................ 14
5.1.3.1 FRS Read Response (Subclass 0x08) ................................................................................ 15
5.1.3.2 Product ID Response (Subclass 0x09) .............................................................................. 15
5.1.4 DataInBLE Packet (Class 0x08) ............................................................................................. 16
5.1.4.1 BLE FRS Read Response (Subclass 0x15) ....................................................................... 17
5.1.4.2 BLE Product ID Response (Subclass 0x16) ...................................................................... 18
5.1.5 MotionEngine Output (Class 0x26) ........................................................................................ 18
5.1.6 DCE Out V2 (Class 0x27) ...................................................................................................... 37
5.1.7 DCE Out V3 (Class 0x28) ...................................................................................................... 38
5.1.8 DCE Out V4 (Class 0x29) ...................................................................................................... 40
5.1.8.1 DCE Out V4 - AG (Subclass 0x00) .................................................................................. 40
5.1.8.2 DCE Out V4 – M (Subclass 0x01) .................................................................................... 41
5.2 Outbound Packets ........................................................................................................................ 41
5.2.1 DataOut Packet (Class 0x07) .................................................................................................. 42
5.2.1.1 FRS Write Request (Subclass 0x06) ................................................................................. 42
5.2.1.2 FRS Write Data (Subclass 0x07) ...................................................................................... 42
5.2.1.3 FRS Read Request (Subclass 0x08) .................................................................................. 43
5.2.1.4 Product ID Request (Subclass 0x09) ................................................................................. 44
5.2.1.5 Activity Classification Notification (Subclass 0x12) ........................................................ 44
5.2.1.6 Freespace Data Mode Control V2 Request (Subclass 0x14) ............................................ 44

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 3 / 54
5.2.1.7 Sensor Period Request (Subclass 0x16) ............................................................................ 46
5.2.1.8 Button Motion Suppression Request (Subclass 0x17) ...................................................... 47
6 FSP FLASH RECORD SYSTEM .................................................................................. 49
6.1 Record Types ............................................................................................................................... 49
6.2 Device Records ............................................................................................................................ 49
6.2.1 Tracking Number .................................................................................................................... 49
6.2.2 Static Calibration Data ............................................................................................................ 50
6.2.3 Enable ...................................................................................................................................... 50
6.2.4 Product Records ...................................................................................................................... 50
6.2.4.1 MotionEngine Orientation ................................................................................................. 50
6.2.4.2 MotionEngine Power Management ................................................................................... 50
6.2.4.3 MotionEngine Angular Position Smoothing ..................................................................... 51
7 REFERENCES ................................................................................................................ 53
8 LEGAL STATEMENTS ................................................................................................. 54

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 4 / 54
List of Figures
Figure 1: Document History ............................................................................................................ 5
Figure 2: Summary of Operating Modes ......................................................................................... 7
Figure 3: HCOMM Packet Format .................................................................................................. 9
Figure 4: Mouse Movement Packet ............................................................................................... 10
Figure 5: DataIn Packet ................................................................................................................. 11
Figure 6: FRS Write Response Packet ........................................................................................... 11
Figure 7: Freespace Data Mode Control V2 Response Packet ...................................................... 12
Figure 8: Sensor Period Response .................................................................................................. 13
Figure 9: DataInLong Packet ......................................................................................................... 14
Figure 10: FRS Read Response Packet ......................................................................................... 15
Figure 11: Product ID Response Packet ........................................................................................ 16
Figure 12: DataInBLE Packet ........................................................................................................ 17
Figure 13: BLE FRS Read Response Packet ................................................................................. 17
Figure 14: BLE Product ID Response Packet ................................................................................ 18
Figure 15: MotionEngine Output Packet, Format 0 ...................................................................... 21
Figure 16: MotionEngine Output Packet, Format 1 ...................................................................... 24
Figure 17: MotionEngine Output Packet, Format 2 ...................................................................... 26
Figure 18: MotionEngine Output Packet, Format 3 ...................................................................... 29
Figure 19: MotionEngine Output Packet, Format 4 ...................................................................... 34
Figure 20: Channel ID Definitions for Format 4 ........................................................................... 37
Figure 21: DCE Out V2 Packet ..................................................................................................... 37
Figure 22: DCE Out V3 Packet ..................................................................................................... 38
Figure 23 - DCE Out V4 Packet ..................................................................................................... 40
Figure 24 - DCE Out v4 Class ........................................................................................................ 40
Figure 25: DCE Out V4 Packet ..................................................................................................... 41
Figure 26: DataOut Packet ............................................................................................................. 42
Figure 27: FRS Write Request Packet ........................................................................................... 42
Figure 28: FRS Write Data Packet ................................................................................................ 43
Figure 29: FRS Read Request Packet ............................................................................................ 43
Figure 30: Product ID Request Packet ........................................................................................... 44
Figure 31: Activity Classification Notification ............................................................................. 44
Figure 32: Freespace Data Mode Control V2 Request Packet ...................................................... 45
Figure 33: Sensor Period Request ................................................................................................... 46
Figure 34: Button Motion Suppression Request ............................................................................ 47
Figure 35: FSP Record Types ........................................................................................................ 49
Figure 36: Tracking Number Record ............................................................................................. 49
Figure 37: MotionEngine Orientation Record ............................................................................... 50
Figure 38: MotionEngine Power Management Record ................................................................. 50
Figure 39: Angular Position Smoothing Record ........................................................................... 52

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 5 / 54
1 Introduction
CEVA’s Hillcrest Labs business unit’s Freespace® MotionEngine™ is a complete
solution for the creation of in-air pointing and motion control devices for a broad range of
applications including pointing remote controls, body motion trackers, head mounted
displays (HMDs), and mobile and tablet sensor fusion products. The solution includes
the core motion sensing technology, multiple reference designs, development tools,
manufacturing solutions, design expertise and intellectual property necessary to develop
and produce superior motion control products.
An HCOMM hub is an implementation of Hillcrest’s Freespace motion control solutions.
An FSM-9 is an example of an HCOMM hub. An HCOMM hub contains both
MotionEngine® and MotionHub. MotionEngine is Hillcrest’s proprietary motion and
sensor processing software. MotionHub is Hillcrest’s sensor management software.
HCOMM is the messaging protocol used to communicate with and control an HCOMM
hub. An HCOMM hub is incorporated into a larger product and controlled by the
processor of that product.
1.1 Reserved Values
All values marked “Reserved”, “reserved”, “RESERVED” or some abbreviation thereof
must be set to 0 when they are produced. All such reserved values must be ignored when
they are consumed.
All unspecified values of parameters are reserved and must not be used.
1.2 Revision History
Revision
Date
Description
0.3
x
Clarified sensor period request in section 5.2.1.7. Added
clarifications to the MotionEngine power management record
in section 6.2.4.2. Added defaults values for angular position
smoothing record values in section 6.2.4.3. Added
MotionEngine Output Format 3 to section 5.1.5. Changed
reference to RF-on-motion to Notify-on-motion. In section
6.2.4.3 changed parameter description from signed to
unsigned. Added default values for parameters to sections
6.2.4.1 and 6.2.4.2. Clarified meanings of activity
classification and power management flags in section 5.1.5.
Added MotionEngine Output Format 4 to section 5.1.5. Added
fusion tick to MotionEngine Output Format 2 in section 5.1.5.
Fixed scale factor for angular position in MEOut Format 1 in
Figure 16. Added tilt detector.
0.2
03/13/2013
Added FRS records in section 6.2.4. Revised DCE Out V4
packet in section 5.1.8.
0.1
02/08/2013
First draft.
Figure 1: Document History

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 6 / 54
2 Sensors
MotionEngine works with a variety of sensors including accelerometers, gyroscopes,
magnetometers, ambient light sensors, pressure sensors and proximity sensors.
2.1.1 Linear Accelerometers
MotionEngine uses a three axis linear accelerometer. The accelerometer is used for
inclinometer functions, orientation compensation, wake-on-motion and other fusion
operations. MotionEngine works with a variety of accelerometers. It uses calibration data
provided at system design time or during production to obtain the best performance from
the actual accelerometer being used.
2.1.2 Angular Velocity Sensors (Gyroscopes)
MotionEngine uses a three axis angular velocity sensor or gyroscope. The gyroscope
measures rotation about the X, Y and Z axes of the hub. Angular velocity is an input used
to produce cursor motion output, general motion output and other fused outputs.
MotionEngine works with a variety of gyroscopes. It uses calibration data provided at
system design time or during production to obtain the best performance from the actual
gyroscope being used.
2.1.3 Magnetometers
MotionEngine uses a three axis magnetometer. The magnetometer measures the Earth’s
magnetic field and is used to determine absolute orientation. Absolute orientation can be
thought of as determining which direction is north. MotionEngine works with a variety of
magnetometers. It uses calibration data provided at system design time to obtain the best
performance from the actual magnetometer being used.
2.1.4 Ambient Light Sensors
Future feature
2.1.5 Pressure Sensors
Future feature
2.1.6 Proximity Sensors
Future feature

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 7 / 54
3 HCOMM Hub Operation
This section describes the operating modes of an HCOMM hub.
3.1 Operating Modes
The FSP has several operating modes for power management. They are summarized in
Figure 2.
Mode
Sensors
Outputs
Full Motion (FM)
On
Motion
Wake on Motion (WM)
Accelerometer in WM
Activity classification
Sleep(SL)
Off
None
Full Motion ON (FMON)
On
Motion
Notify on Motion (NM)
Accelerometer in WM
Activity classification
Figure 2: Summary of Operating Modes
Operating modes are changed by the FSP power management system or by a control
packet from the host.
3.1.1 Full Motion
Full motion mode is used when motion output is desired. While in full motion, if the hub
detects that it has becomes motionless (still) it will enter wake-on-motion.
3.1.2 Wake-on-Motion
In wake on motion mode, the accelerometer is used to detect large movements, such as a
user picking up the device from a table, and causes the hub to enter full motion mode.
Wake on motion is a low power mode with minimal motion sensing.
3.1.3 Sleep
Sleep mode is a very low power mode. No motion sensing is performed in sleep mode.
3.1.4 Notify-on-Motion
In NM on motion mode, the accelerometer is used to detect large movements, such as a
user picking up the device from a table. The host processor is notified when motion is
detected. Unlike WM, the hub remains in NM even after detecting motion. It is the
responsibility of the host to change the operating mode of the hub when it is in NM. NM
on motion is a low power mode with minimal motion sensing.
3.1.5 Full Motion On
Full motion on mode is used when motion output is desired, even if the hub detects that it
has becomes motionless (still). The hub will not transition from FMON into WM. It is the
responsibility of the host to change the operating mode of the hub when it is in FMON.
3.2 Host Interfaces
The host device connects to a hub via a physical interface. Supported interfaces include
SPI and USB.

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 8 / 54
The hub exchanges packets with a host using the Hillcrest communication protocol
(HCOMM). Over SPI it uses HCOMM SPI, and over USB it uses HCOMM USB. The
hub sends packets formatted as USB HID reports for mouse and vendor-specific usages.
3.3 Device Firmware Upgrade
The hub supports in-field device firmware upgrade (DFU). DFU can be used to add new
features and fix bugs. New firmware is provided to the hub in the form of an encrypted
binary image.

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 9 / 54
4 HCOMM Overview
The Hillcrest communication protocol (HCOMM) provides a data passing scheme that
can be used over all physical interfaces, including the system host.
As HCOMM packets are transported through a system they may transition into another
system domain, such as USB HID. The HID domain has requirements that packets of a
given class contain a class-specific HID report ID and have a consistent, pre-determined
length. See Reference 1 and Reference 2 for more information regarding USB HID.
HCOMM packets are structured in such a manner as to be compatible with HID. The
HCOMM class is synonymous with the HID report ID. HCOMM packets may need to be
lengthened when transitioning into the HID domain and may need to be shortened when
transitioning from the HID domain, as is the case if the stated length of the HCOMM
packet is less than the maximum length of the class of the packet.
The format of HCOMM packets is shown in Figure 3.
Byte
Bit7
Bit6
Bit5
Bit4
Bit3
Bit2
Bit1
Bit0
0
Class
1
Length
2
Reserved
Reserved
Destination
3
Reserved
Reserved
Source
4-N
Data
Figure 3: HCOMM Packet Format
Class:
indicates what sort of information this packet contains; this field is
synonymous with the HID report ID
Length:
the length of the bytes to be sent using HCOMM, including the Class
and Length bytes; all bytes specified by the length are significant
and data-bearing. This length may be less than or equal to the
maximum class length.
Destination:
contains the address of the packet recipient
Source
contains the address of the packet originator
Data
payload data
The addresses used by HCOMM packets are:
• 0 – host. This is typically a PC but could be the control processor connected to the
hub
• 1 – dongle.
• 4 – hub.

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 10 / 54
5 HCOMM Packets
This section describes all HCOMM packet payloads.
All fields greater than 8 bits wide use network byte ordering (little-endian byte ordering)
unless otherwise specified.
5.1 Inbound Packets
This section covers packets that are sent from a hub to a host.
5.1.1 Mouse Packet (Class 0x02)
This packet is a HID mouse packet with 8 buttons and a scroll wheel.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x02
1
Length
2
Destination
3
Source
4
Button 8
Button 7
Button 6
Button 5
Button 4
Button 3
Button 2
Button 1
5
Delta X
6
Delta Y
7
Delta Wheel
Figure 4: Mouse Movement Packet
Button n:
0 – not pressed
1 – pressed
Delta X:
change in pointer location along the x-axis in dimensionless units
called mickeys. X positive moves the pointer right.
Delta Y:
change in pointer location along the y-axis in dimensionless units
called mickeys. Y positive moves the pointer down.
Delta
wheel:
scroll wheel motion in detents (up is positive).
5.1.2 DataIn Packet (Class 0x05)
This packet is used as a container for command, control, status, testing and debugging
information. Each packet contains a subclass. The subclass determines the type of

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 11 / 54
information carried by the DataIn packet. All subclass values are reserved with the
exception of those described in this section.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x05
1
Length
2
Destination
3
Source
4
Subclass
5-11
Payload
Figure 5: DataIn Packet
Subclass:
identifies the specific type of information being carried within the
DataIn packet
Payload:
the remaining report payload, up to 7 bytes
5.1.2.1 FRS Write Response (Subclass 0x06)
This packet is sent to indicate status of the write operation of the flash record system
(FRS). See section 6 for details of the flash record system.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x05
1
Length
2
Destination
3
Source
4
Subclass = 0x06
5
Status/Error
6
Word Offset LSB
7
Word Offset MSB
Figure 6: FRS Write Response Packet
Status/Error:
0 – word received
1 – unrecognized FRS type
2 – busy
3 – write completed
4 – write mode entered or ready
5 – write failed
6 – data received while not in write mode
7 – invalid length
8 – record valid (the complete record passed internal validation
checks)
9 – record invalid (the complete record failed internal validation
checks)
10 – device error (DFU flash memory device unavailable)
Word Offset:
the number of words offset from the beginning of the record

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 12 / 54
5.1.2.2 Freespace Data Mode Control V2 Response (Subclass 0x14)
This packet reports the configuration of the generation of Freespace motion packets and
the operating mode of the device.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x05
1
Length
2
Destination
3
Source
4
Subclass = 0x14
5
Operating Mode Actual
Output
Status
Operating Mode Requested
Operating
Status
6
Packet Select
7
Format Select
8
FF7
FF6
FF5
FF4
FF3
FF2
FF1
FF0
9-11
Reserved
Figure 7: Freespace Data Mode Control V2 Response Packet
Operating Status
0 – indicates a response to an operating mode update request
1 – indicates a response to an operating mode status request
Operating Mode Requested
Requests a change to the specified operating mode. The hub
will enter the requested mode if allowed. The hub may leave
the requested operating mode autonomously.
0 – Full Motion
1 – Sleep
2 – Deprecated
3 – Deprecated
4 – Full Motion On
5 – Notify-on-Motion
Output Status
0 – indicates a response to a packet and format selection
update request
1 – indicates a response to a packet and format selection status
request
Operating Mode Actual
The operating mode the device is currently in. The actual
operating mode is reported independently of the requested
operating mode. The actual operating mode reports the
operating modes discussed in section 3.1.
0 – Full Motion
1 – Wake-on-Motion
2 – Reserved
3 – Sleep
4 – Reserved
5 – Notify-on-Motion
Packet select
Select the output packet sent by the FSP to report motion data.
0 – none
1 – Mouse

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 13 / 54
2 – Reserved
3 – Reserved
4 – Reserved
5 – DCE out
6 – Reserved
7 – SuperSDA
8 – MotionEngine Output
9 – MotionEngine Output and Mouse
10-255 – reserved
Format Select
Select the format of the MotionEngine Output packet. See
5.1.5 for details.
FF7 – FF0
Format Flags – used to enable various portions of a
MotionEngine Output packet. See 5.1.5 for details.
5.1.2.3 Sensor Period Response (Subclass 0x17)
This packet reports the sample period for a given sensor, including the sensor fusion
operation. Sensor fusion is the operation of producing a motion output by using the inputs
from several sensors. Sensor fusion may be performed at a rate different from the sample
period of the sensors.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x05
1
Length
2
Destination
3
Source
4
Subclass = 0x17
5
Reserved
6
Sensor
7
Reserved
8
Period LSB
9
…
10
…
11
Period MSB
Figure 8: Sensor Period Response
Sensor
The sensor for which the period is being reported.
0 – accelerometer
1 – gyroscope
2 – magnetometer
3 – ambient light sensor
4 – pressure sensor
5 – proximity sensor
6 – sensor fusion
7 – step detector
8 – tap detector
9 – humidity sensor

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 14 / 54
10 – ambient temperature sensor
11 – significant motion detector
12 – shake detector
13 – screen rotation accelerometer
14 – flip detector
15 – pickup detector
16 – stability detector
17 – personal activity classifier
18 – sleep detector
19 – gravity
20 – linear acceleration
21 – rotation vector
22 – game rotation vector
23 – geo magnetic rotation vector
24 – step counter
25 – gyroscope uncalibrated
26 – magnetometer uncalibrated
27 – tilt detector
28 – pocket detector
29 – circle detector
30-255 – reserved
Period
Sensor period in microseconds.
5.1.3 DataInLong Packet (Class 0x06)
This packet is used as a container for command, control, status, testing and debugging
information. This packet is used when more data needs to be sent than the DataIn packet
can accommodate. The DataIn packet is more power efficient, however, and can be sent
more reliably over certain communication links, such as an RF link. Each packet
contains a subclass. The subclass determines the type of information carried by the
DataInLong packet. All subclass values are reserved with the exception of those
described in this section.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x06
1
Length
2
Destination
3
Source
4
Subclass
5-21
Payload
Figure 9: DataInLong Packet
Subclass:
identifies the specific type of information being carried within the
DataInLong packet
Payload:
the remaining report payload, up to 17 bytes

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 15 / 54
5.1.3.1 FRS Read Response (Subclass 0x08)
This packet is sent to convey an FRS record or portion of a record.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x06
1
Length
2
Destination
3
Source
4
Subclass = 0x08
5
Data Length
Status
6
Word Offset LSB
7
Word Offset MSB
8-19
Data
20
FRS Type LSB
21
FRS Type MSB
Figure 10: FRS Read Response Packet
Data Length:
the number of data words contained within the message, typically 3
words.
Status:
0 – no error
1 – unrecognized FRS type
2 – busy
3 – read record completed
4 – offset out of range
5 – record empty
6 – read block completed (if block size requested)
7 – read block completed and read record completed (if block size
requested)
8 – device error (DFU flash memory device unavailable)
Word Offset:
the number of words offset from the beginning of the record
Data:
between 0 and 3 32-bit words of data from and FRS record.
FRS Type:
indicates to which type of FRS record the data belongs (see
Section 6.1)
5.1.3.2 Product ID Response (Subclass 0x09)
The product ID response carries information that identifies software running on the FSP
and FSP unique ID information. This packet is sent automatically when an FSP boots and
in response to a product ID request (Section 5.2.1.4).

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 16 / 54
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x06
1
Length
2
Destination
3
Source
4
Subclass = 0x09
5
InvalidSN
Startup
Device Class
6
SW Version Major
7
SW Version Minor
8
SW Part Number LSB
9
SW Part Number …
10
SW Part Number …
11
SW Part Number MSB
12
SW Build Number LSB
13
SW Build Number …
14
SW Build Number …
15
SW Build Number MSB
16
Serial Number LSB
17
Serial Number …
18
Serial Number …
19
Serial Number MSB
20
SW Version Patch LSB
21
SW Version Patch MSB
Figure 11: Product ID Response Packet
InvalidSN:
0 –serial number is valid
1 – serial number is invalid; retry until valid
Startup:
0 – device has not just started up
1 – device has just started up. This bit self clears after the first
time this message is sent.
Device Class:
0 – device type not known
1 – non-data-generating device
2 – data-generating device
3 – reserved
SW Version:
software version major (8 bits).minor (8 bits).patch (16 bits)
SW Part Number:
32-bit value representing the software part number
SW Build Number:
32-bit software build number
Serial Number:
32-bit serial number. Also referred to as a tracking number.
5.1.4 DataInBLE Packet (Class 0x08)
This packet is used as a container for command, control, status, testing and debugging
information. This packet is sized to fit in a Bluetooth Low Energy packet payload. Each
packet contains a subclass. The subclass determines the type of information carried by
the DataInBLE packet. All subclass values are reserved with the exception of those
described in this section.

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 17 / 54
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x08
1
Length
2
Destination
3
Source
4
Subclass
5-19
Payload
Figure 12: DataInBLE Packet
Subclass:
identifies the specific type of information being carried within the
DataInBLE packet
Payload:
the remaining report payload, up to 15 bytes
5.1.4.1 BLE FRS Read Response (Subclass 0x15)
This packet is sent to convey an FRS record or portion of a record.
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x08
1
Length
2
Destination
3
Source
4
Subclass = 0x15
5
Data Length
Status
6
Word Offset LSB
7
Word Offset MSB
8-15
Data
16-17
Reserved
18
FRS Type LSB
19
FRS Type MSB
Figure 13: BLE FRS Read Response Packet
Data Length:
the number of data words contained within the message.
Status:
0 – no error
1 – unrecognized FRS type
2 – busy
3 – read record completed
4 – offset out of range
5 – record empty
6 – read block completed (if block size requested)
7 – read block completed and read record completed (if block size
requested)
8 – device error (DFU flash memory device unavailable)
Word Offset:
the number of words offset from the beginning of the record
Data:
between 0 and 2 32-bit words of data from and FRS record.
FRS Type:
indicates to which type of FRS record the data belongs (see
Section 6.1)

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 18 / 54
5.1.4.2 BLE Product ID Response (Subclass 0x16)
The product ID response carries information that identifies software running on the FSP
and FSP unique ID information. This packet is sent automatically when an FSP boots and
in response to a product ID request (Section 5.2.1.4).
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x08
1
Length
2
Destination
3
Source
4
Subclass = 0x16
5
InvalidSN
Startup
Device Class
6
SW Version Major
7
SW Version Minor
8
SW Part Number LSB
9
SW Part Number …
10
SW Part Number …
11
SW Part Number MSB
12
Serial Number LSB
13
Serial Number …
14
Serial Number …
15
Serial Number MSB
16
SW Build Number LSB
17
SW Build Number MSB
18
SW Version Patch LSB
19
SW Version Patch MSB
Figure 14: BLE Product ID Response Packet
InvalidSN:
0 – serial number is valid
1 – serial number is invalid; retry until valid
Startup:
0 – device has not just started up
1 – device has just started up. This bit self clears after the first
time this message is sent.
Device Class:
0 – device type not known
1 – non-data-generating device
2 – data-generating device
3 – reserved
SW Version:
software version major (8 bits).minor (8 bits).patch (16 bits)
SW Part Number:
32-bit value representing the software part number
SW Build Number:
16-bit software build number
Serial Number:
32-bit serial number. Also referred to as a tracking number.
5.1.5 MotionEngine Output (Class 0x26)
This packet conveys the Motion Engine output. It has a flexible format. Format selection
is controlled by the Data Mode Control V2 Request. See 5.2.1.6. The format flags bits are
used to enable various portions of the packet. If a particular flag is set then that portion of

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 19 / 54
the output is present. If it is not set then that portion is not present. If a portion of the
output is not present then the remaining fields are moved ahead in the packet to fill in the
gap left by the missing portion. In other words, the packet is packed. Trailing zeros are
omitted. By using the format flags, an application can tailor the MotionEngine output to
best suit its needs as well as minimize HCOMM packet sizes and communication times.
Some formats and some feature flags may not be supported on a specific platform. Also,
some platforms may have a size limitation and therefore are unable to support the full 54
bytes of the MotionEngine Output message. If more feature flags are enabled than will fit
into a platform’s message size limit then only the ones that fit will actually be set. The
others will be ignored. The priority of setting flags starts from FF0 (highest) down to FF6
(lowest).
Motion outputs are formatted as 16-bit, 2’s complement, fixed-point. The binary point of
each type of data is different and is specified in the field descriptions below. The binary
point is indicated by Qn where n is the number of fractional bits. Thus, Q10 indicates 1
sign bit, 5 integer bits and 10 fractional bits.
The Format 0 packet is shown below.

1000-2984 Revision 0.3.2 HCOMM Reference Manual
www.ceva-dsp.com © 2019 CEVA, Inc. All rights reserved 20 / 54
Bit
Byte
7
6
5
4
3
2
1
0
0
Class = 0x26
1
Length
2
Destination
3
Source
4
Format Select = 0
5
FF7
FF6
FF5
FF4
FF3
FF2
FF1
FF0
6
Sequence Number LSB
7
…
8
…
9
Sequence Number MSB
FF0 Section
10
Button8
Button7
Button6
Button5
Button4
Button3
Button2
Button1
11
Pointer Delta X
12
Reserved
13
Pointer Delta Y
14
Reserved
15
Delta Wheel
FF1 Section
16
Linear Acceleration X LSB
17
Linear Acceleration X MSB
18
Linear Acceleration Y LSB
19
Linear Acceleration Y MSB
20
Linear Acceleration Z LSB
21
Linear Acceleration Z MSB
FF2 Section
22
Linear Acceleration No Gravity X LSB
23
Linear Acceleration No Gravity X MSB
24
Linear Acceleration No Gravity Y LSB
24
Linear Acceleration No Gravity Y MSB
26
Linear Acceleration No Gravity Z LSB
27
Linear Acceleration No Gravity Z MSB
FF3 Section
28
Angular Velocity X LSB
29
Angular Velocity X MSB
30
Angular Velocity Y LSB
31
Angular Velocity Y MSB
32
Angular Velocity Z LSB
33
Angular Velocity Z MSB
FF4 Section
34
Magnetometer X LSB
35
Magnetometer X MSB
36
Magnetometer Y LSB
37
Magnetometer Y MSB
38
Magnetometer Z LSB
39
Magnetometer Z MSB