Reading navigation data directly from Navboard

On A.R. Drones navigation board, the following sensors exist:

• IDG-500 (Dual-axis gyroscope)
• XV-3500CB (Z-axis gyroscope)
• BMA150 (3-axis accelerometer)
• Some ultrasonic stuff

For handling these sensors, a PIC24 is used. This device does the A/D conversion of the gyroscope data and the I2C communication with the BMA150.
Periodically, the sensor data is sent over UART to the mainboard where it is used by program.elf to control the Drone.

So... how to get this data without using program.elf?

First, start the sensor acquisition by calling:

echo -e -n "\1" > /dev/ttyPA2

Now, periodically, the nav boards sends a 0x2E sized frame to UART2.. so read it with:

dd if=/dev/ttyPA2 count=1 bs=46 | hexdump -C

The data seems to have the following format:

struct nav_data_tag
{
  u16 size;                /* +0x00 Size of the following data (0x2C) */
  u16 sequence;            /* +0x02 Sequence number */
  u16 raw_accs[3];         /* +0x04 Raw data of the accelerometers*/
  u16 raw_gyros[3];        /* +0x0A Raw data for the gyros */
  u16 raw_gyros_110[2];    /* +0x10 4.5x Raw data (IDG) */
  u16 uk_0x14;             /* +0x14 Unkown. Maybe accs temperature */
  u16 gyro_temp;           /* +0x16 Gyro temperature (IDG) */
  u16 vrefEpson;           /* +0x18 Gyro v_ref (Epson) */
  u16 vrefIDG;             /* +0x1A Gyro v_ref (IDG) */
  u16 uk_0x1C;             /* Unkown */
  u16 checksum;            /* +0x1E Checksum */
  u16 us_debut_echo;       /* +0x20 Ultrasonic parameter */
  u16 us_fin_echo;         /* +0x22 Ultrasonic parameter */
  u16 us_association_echo; /* +0x24 Ultrasonic parameter */
  u16 us_distance_echo;    /* +0x26 Ultrasonic parameter */
  u16 us_courbe_temps;     /* +0x28 Ultrasonic parameter */
  u16 us_courbe_valeur;    /* +0x2A Ultrasonic parameter */
  u16 us_courbe_ref;       /* +0x2C Ultrasonic parameter */ 
}

I haven't figured out much yet, but here are my first analysis results:

• size: always 0x2C
• sequence: increases every update
• raw_accs: seems to contain the BMA values left-shifted by 2
• raw_gyros: 12-bit A/D converted voltage of the gyros
• raw_gyros_110: gyro values wieth another resolution (see IDG-500 datasheet)
• gyro_temp: 12-bit A/D converted voltage of IDG's temperature sensor
• vrefEpson: 12-bit A/D converted reference voltage of the Epson sensor
• vrefIDG: as vrefEpson, but for IDG sensor
• checksum: checksum (have to figure out how to calculate..
• all others haven't yet figured out what they mean