Esky 150X, which protocol ?

//****************************************************************************
//  ESky protocol for models since 2014 (150, 300, 150X, ...)
//****************************************************************************
// 
//  Relating threads (in order of relevance):
//
//    https://www.deviationtx.com/forum/6-general-discussions/6446-esky-150x-which-protocol
//    https://www.deviationtx.com/forum/builds/2458-devo10-esky-protocol-draft
//    https://www.deviationtx.com/forum/3-feedback-questions/4007-esky150-protocol-and-devo-6-8s
//
//  Comment:
//
//    Analysis based on SPI captures from SeByDocky on his 150 (TX_ADDR = 
//    710A31F4) and Käseknigger on his 150X (TX_ADDR = C6F3D602). Data format 
//    by a picture from Iamlawrence3c3c, which he got from the manufacturer, 
//    and further SPI analysis.
//    (https://static.rcgroups.net/forums/attachments/5/3/3/5/5/1/a9467524-85-esky%20mini%20transceiver%20protocol.JPG)
//
//****************************************************************************
//  General protocol features:
//****************************************************************************
//
//  Chip used        : nRF24L01 (stock uses compatible Beken clone BK242x)
//  Data rate        : 2Mbps
//  Payload size     : 15Bytes
//  Address size     : 4 Bytes
//  Data direction   : Always TX->RX (NO ACK)
//  No Data Channels : 7
//  Resolution of Data Channels: 
//    CH1-4 & CH6    : 12 bits (where only 10 bits are effectively used)
//    CH5            : 1 bit (implemented in this protocol as 2bits)
//    CH7            : 2 bits
//  Channel assignment :
//    CH1            : Throttle
//    CH2            : Aileron
//    CH3            : Elevator
//    CH4            : Rudder
//    CH5            : Flight Mode
//    CH6            : Aux 1
//    CH7            : Aux 2 (switch)
//
//****************************************************************************
// Binding protocol
//****************************************************************************
//
//  Comment:
//
//    After chip initialization, the TX sends its unique TX_ADDRESS continuously 
//    in a special data packet on RF channel 1. For sending this packet it uses a 
//    special binding TX_ADDRESS. The receiver will store the unique TX_ADDRESS 
//    permanently, so binding is only necessary once per model.
//
//  Binding RF Channel: 1
//  Binding TX address: 0x73, 0x73, 0x74, 0x63  ("sstc")
//  Binding packet send rate: every 21ms (stock), 2ms (in this implementation)
//
//  Binding data packet format (15 Bytes):
//    Unique TX_Address (4 Bytes)
//    Binding TX_Address (4 Bytes)
//    Unique TX_Address (4 Bytes)
//    Filler 0 Bytes (3 Bytes)
//
//****************************************************************************
// Data protocol
//****************************************************************************
//
//  Comment:
//
//    The RX seems to go through all channels to find one, where it receives 
//    a valid data packet from the bound TX_Address. Then it seems to use the 
//    two indicated channels in this packet for reception.
//    The data packets always hop between these 2 different frequencies. 
//    These are seemingly fixed to 0x22 and 0x4A on the stock implementation. 
//    But any other frequencies also seem to work, as long as the 2nd channel 
//    is the first+40. Therefore this implementation uses channels derived 
//    from the TX_Address.
//
//  Data TX address: The TX_Address which the model has been bound to.
//  Data packet send rate : every 4.8ms (stock 150), 4.4ms (stock 150X), 4.8ms implemented
//  No of frequency channels : 2 (stock seems to use always channels 0x22 and 0x4A)
//
//  Data packet format (15Bytes):
//    First RF sending channel (1 Byte)
//    Second RF sending channel (1 Byte)
//    CH1-7 information (see above linked picture for format) (8 Bytes)
//    Throttle Trim value (1 Byte)
//    Aileron Trim value (1 Byte)
//    Elevator Trim value (1 Byte)
//    Rudder Trim value (1 Byte)
//    Checksum (all other values summed up) (1 byte)
//
//  Data channel value range (12 bit channels CH1-4 & CH6):
//    From 1000 to 2000 with midpoint at 1500.
//    Channel values are servo time in ms of common PWM servo signal.
//    Data channels CH2 and CH4 are reversed.
//
//  Data channel value range (1 and 2 bit channels CH5 & CH7):
//    These are channels for switches, so they just have the values possible.
//    If older 4 channel models are used, these channels have to be 0 for
//    compatibility reasons.
//
//  Trim value range:
//    From 0x9C (-100) to 0x64 (100) (signed 8bit int value)
//    Stock makes step of 4, which yields 25 trim steps in both directions.
//    As devo includes the trims in the normal channel outputs, trim values 
//    have to be 0 in this implementation.
//
//****************************************************************************