Here are some notes on the parts of the Dynamixel protocol that are not available in the documentation.
As they are unsupported by Robotis and the fruit of reverse engineering, they cannot be relied upon, and using information from this page is at your own risks.

===== Firmware Recovery =====

FIXME add info on the recovery protocol

===== Firmware Update =====

FIXME add info on the recovery protocol


===== Bulk Read =====
The MX servos (at least the MX-28) have an interesting functionality that makes reading data from them much faster, even without an USB2AX: bulk read.


The idea is that the host would send a packet that informw every servo on the line about what they are expected to send back, then let the servos send it one after the other. They probably monitor the bus to synchronize and answer in the same order as they are arranged in the bulk_read packet.

**Bulk Read Packet**\\
  <0xFF><0xFF><ID><Length><Instruction><Param 1><Param 2><Param 3><Param 4> ... <Param 3xN+2><Checksum>
  
  ID         : 0xFD
  Length     : 3xN + 4 (N: number of Dynamixel actuators to read from) 
  Instruction: 0x92
  Param 1    : 0x00 
  Param 2    : L1 (L1: length of the data to be read from the 1st Dynamixel actuator)
  Param 3    : The ID of the 1st Dynamixel actuator
  Param 4    : Starting address of the location where the data is to be read from, for the 1st Dynamixel actuator
  Param 5    : L2 (L2: length of the data to be read from the 2nd Dynamixel actuator)
  ... 
  Param 3xN+2: Starting address of the location where the data is to be read from, for the Nth Dynamixel actuator 
  Checksum   : The usual checksum of Dynamixel packets 
  
FIXME


===== Timing =====

Here are some info on the response timing of the AX-12 to different commands. Return Delay Time is zero.

== Time between instruction and status packets ==

Minimum time elapsed between the stop bit of the checksum of the instruction packet and the start bit of the first bytes of the status packet.

^ Command ^ Delay before response (µs)  ^
| PING         | 18 |
| READ_DATA | 22 |
| WRITE_DATA (N bytes) | 24 + N * 6   |

Depending on when the motor-control interrupt fires, these time can increase by up to the duration of that interrupt (see below).

WRITE_DATA to EEPROM memory will answer with the same delay, but then the servo will not answer to another command before many milliseconds (up to 9 **ms** per byte based on the ATMega8 datasheet, though experimental verification put it at around 6 +/-1 ms per byte). 

It seems that for most operations, the status packet is sent after everything has been checked but applied after the status packet.



== Motor-control interrupt ==

The motor control interrupt runs every 1ms on an AX servo, and lasts about 130µs. during that time, no communication can occur, though incoming bytes are not lost. If it occurs in the middle of a packet, then that delay will be observed between two bytes, that would have been otherwise back to back.