Engine RAM Mapping

11 views
Skip to first unread message

Mark DiVecchio

unread,
Feb 21, 2019, 8:49:19 PM2/21/19
to Remote Train Control
With the help of a few of you, I've been able to figure out how to access the RAM memory in the engine and what some of those memory locations mean.

Some words on my web page and a link to the current version of a document that writing.


Mark



Paul Reynolds

unread,
Feb 21, 2019, 8:58:35 PM2/21/19
to remote-tra...@googlegroups.com
>>> “I figured this out just by looking at the RS-232 stream over the radio. No code disassembly, no logic analyzers, no opening up of Remotes or TIU's.

I'd say this disclaimer will keep you in good stead.

Paul R.

--
You received this message because you are subscribed to the Google Groups "Remote Train Control" group.
To unsubscribe from this group and stop receiving emails from it, send an email to remote-train-con...@googlegroups.com.
To post to this group, send email to remote-tra...@googlegroups.com.
Visit this group at https://groups.google.com/group/remote-train-control.
To view this discussion on the web visit https://groups.google.com/d/msgid/remote-train-control/8ed94163-bc5a-4c25-a050-8744e69c998b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Eric Linz

unread,
Feb 22, 2019, 1:40:27 PM2/22/19
to remote-tra...@googlegroups.com
Mark,

I have dumped the TIU firmware S record data and looked through the .text data before the code sections and found a couple extra q commands.  I have included some other text strings found around the q codes, it could be related, or it could be part of data needed by another function.  Stuff in ( ) is the converted code to ram address and position using your description for the format.

Following the text "Attempting recovery":

q7F88 (addr/pos=0x11/1)

q1F88 (addr/pos=0x10/0; this and the one above used together?)

q7F89 (addr/pos=0x13/1)

q1F89 (addr/pos=0x12/0; this and the one above used together?)


Following the text "LASH-UP ENGINE"

q3E10 (addr/pos=0x321/0; used by itself?)

q3E11 (addr/pos=0x323/0; used by itself?)

Followed by text:

EXTERNAL MIC OFF

EXTERNAL MIC ON


It also looks like your addr->q conversion can go up to 14bit addresses. Have you tried reading 16K, or does it return errors for those? Did you notice a copy of the Ixxx softkey data in there too?


Eric



For more options, visit https://groups.google.com/d/optout.


--
Eric Linz
--
There used to be a street named after Chuck Norris, but it was changed because nobody crosses Chuck Norris and lives. 
Reply all
Reply to author
Forward
0 new messages