CA00 Control 4 81xxxB00 needs RDF

MaximusPlank · Post by **MaximusPlank** » Thu Jan 01, 2009 4:40 pm

I have a brand new remote (actually mfg'ed circa 1998) that IR id's as a Navigator but none of the upgrades work at all, not a single button. It appears that eventhough the signature is CA00, the navigator CA00 RDF is not setup for this remote.

The remote eeprom can be read using a JP1 parallel cable. I did some experimental raw downloads, scanned pics of the remote and original manual and posted them all in a zip file here: http://www.hifi-remote.com/forums/dload ... le_id=6061

Not sure where to go from here, new RDF needed most likely case but could one of you more experienced people diagnose this please. This is a nice remote and I would like to be able to upgrade it using JP1.

Mfg: UEI
Model: 81xxxB00, UNIWAND Control 4
JP1

mr_d_p_gumby · Post by **mr_d_p_gumby** » Sat Jan 03, 2009 9:20 pm

This remote is definitely not the same as the CA00 Navigator, so it will need a new RDF.

From the IR files you posted, I can't tell too much about the remote. The device-change tests show no difference. I have posted a starter RDF here, but it really isn't much better than the CA00 RDF. It does reflect the only info I was able to determine from your test files. http://www.hifi-remote.com/forums/dload ... le_id=6072

Your notes indicate that it won't let you create a macro even though Setup-995 is accepted. That lets out the easiest way to find out the button numbers, but it is consistent with the Navigator series. They would only allow macros to be created on the multi-macro keys, which are not present on this remote.

The next thing to try is to see if you can create a keymove on the remote. Your notes say it accepts Setup-994. The way to do this would be to start with your base ir file loaded and then create one keymove (noting which button). Then download & save an IR file. Leaving the 1st keymove in the remote, repeat this for a 2nd keymove. After that, create as many keymoves as you can on different buttons, keeping notes on the button name and the order in which you created them. If needed, reload your base file & do more keymoves.

It does not matter what the actual keymove is, as we are only after the button number to which the keymove is assigned.

BTW, you did not include a photo of the other side of the PCB. Does it have any numbers printed near each button? If so, that may give us some clues.

I am not sure if this is a 1st-gen or 2nd-gen 6805 remote (or if it is even a 6805 CPU at all--the photo of the CPU does show the normal Motorola ROM mask number on the chip). Date-wise, it does fall in the gray area between the two generations of 6805 remotes.

When you say "none of the upgrades work at all, not a single button", what does this mean? Which upgrades have you tried?

MaximusPlank · Post by **MaximusPlank** » Mon Jan 05, 2009 3:44 pm

Sorry there is no pic of the soldered side of the circuit board but that side has no markings at all. I should have mentoned that. I've done keymoves and posted them here.
http://www.hifi-remote.com/forums/dload ... le_id=6081

Included in the zip is the RM upgrade I attempted to load and the saved IR file too. When I say that "not a single button works", I mean that the remote led blinks when pushed but the device does not respond. The upgrade has something assigned to every button, even if function is reduntant, point being to hope to discover any working buttons.

Thanks Mike, appreciate your help.

MaximusPlank · Post by **MaximusPlank** » Tue Jan 06, 2009 10:30 am

I decided to take a look and compare the 36 keymove files to see if I could figure out anything like you guys do. The first thing I noticed is that it must be a large time consuming job to discover the unknown, thanks to all you guys for sharing.

The second thing I noticed is that this remote does not clear memory using 981 but... it "does" start writing successive keymoves at the start address again. That seems very strange that it would erase the same way data is erased from a HDD. I doubt it's supposed to do that but then again what do I know.

I extracted all of the keymoves from the IR files and made a list of the 5 hex bytes and what was actually moved, source & destination and posted it here. This may help save some time.
http://www.hifi-remote.com/forums/dload ... le_id=6084

Post by **The Robman** » Tue Jan 06, 2009 12:31 pm

Regarding a 981 reset, all it does is put zeroes at the start of each of the sections which effectively deletes the items in question. Therefore, when we want to get what we call a "virgin image" from a remote, we first load all FFs into the memory and then do a 981 reset, otherwise there's too much junk left in there after a 981 to figure things out.

Capn Trips · Post by **Capn Trips** » Tue Jan 06, 2009 4:57 pm

Rob,

Your last post here has confused me (sorry to digress from the OP's topic). You write that:

The Robman wrote:Regarding a 981 reset, all it does is put zeroes at the start of each of the sections which effectively deletes the items in question.

I understand how this would work, but on my remote (a JP1.3 OCAP), when I do a 981 reset, almost all of the memory fills with FFs except for the leading information about signature and default device setup codes, and two locations, one with a 00 and another with about 6 bytes of non-FFs. Is the 981 behaviour you describe particular to JP1 remotes, or to older remotes only, or what?

mr_d_p_gumby · Post by **mr_d_p_gumby** » Tue Jan 06, 2009 8:05 pm

I've uploaded an updated starter RDF (same link) that includes as much button info as I could extract from your IR files. I made some guesses about some of the buttons; those are named with "__" at the end, so they may or may not be correct. I don't have a guess at this point for the "C" button.

Do you have another learning JP1 remote available? (One way to proceed would involve learning to another remote.)

MaximusPlank wrote:The second thing I noticed is that this remote does not clear memory using 981 but... it "does" start writing successive keymoves at the start address again. That seems very strange that it would erase the same way data is erased from a HDD. I doubt it's supposed to do that but then again what do I know.

It is perfectly normal for the EEPROM-based remotes.

Post by **The Robman** » Tue Jan 06, 2009 9:49 pm

Capn, I haven't verified if they've changed the way a 981 reset works on the new flash remotes, so it could have changed. In traditional JP1 (EEPROM) remotes, the "end of section" marker (or "SectionTerminator" as it's called in the RDFs) is a 00 byte, so when you do a reset, it will but 00 at the beginning of the keymove/macro section and at the beginning of the learning section. At the beginning of the upgrade section (ie, $0100) it would put "01 04 01 04 00 00", with the two zero bytes in that string ending up at address $0104. The two previous pairs are the addresses of the upgrade list and protocol list, so as they both get reset to $0104, they are now pointing to an address that contains zeroes.

Around the time of the 2nd generation of URC-9960 Kameleon, they changed the SectionTerminator to FF (rather than 00), so for remotes like this we would initialize them to all zeroes before doing a 981 so we can see where the FFs get put.

I'll take your word for it that a 981 in a flash remotes actually zeroes out (or FFs out) all of the data, not just the start of sections, but I am surprised to hear it.

MaximusPlank · Post by **MaximusPlank** » Wed Jan 07, 2009 6:14 am

I downloaded the 2nd RDF but it is identical to the 1st. I looked to see if it got posted somewhere else and couldn't find anything by Mike with CA00 in the name. Could you try to upload it again? Please help me if I'm in error.

Yes I do have an 8811 and 8910. Not sure what to do with them though. If you just want me to learn the TV/VCR button then great. I did that with the results as follows: That button is native to 3 modes, Cable - TV and VCR. All 3 came up with the same function/details:
Protocol: Emerson
Device: 40 Subdevice: (none)
OBC: 0
Hex Cmd: FC or FD or FE
EFC: 173 or 165 or 189

I took the liberty to make some changes to the starter RDF. One thing I did is change the "B01" inside to B00. B01 probably leftover from the Navigator RDF.

The second thing I changed is the file name to differentiate each starter - version 2 and the remote description inside to also reflect rdf version 2
RDF file name:
CA00 (Control 4 URC-81000-B00) STARTER2 RDF.rdf
This way you can see the version while selecting "NEW" in IR.

Remote name inside of RDF:
Control 4 URC-81000B00 UniWand (STARTER RDF 2)
This way you can see the version number once loaded in IR.

This is just for my file keeping unless you think it's useful to implement during the creation stage.

The third thing I did was to add a reference to a map for RM, also [attempted] to make the map. I hope somebody can check my work to see if it needs adjustments, ie: the file naming scheme. I loaded map into RM and didn't see any yellow dots on the remote but that's probably because the RDF is not finished yet.

The remote jpg, map and RDF are posted in a zip here: Control_4 RDF_JPG & Map.zip

The reason I jumped ahead and made the map for RM is that I'm assuming there won't be any way to test the RDF without RM working and KM will take some time to get updated. If it wasn't urgent, I'm happy to participate the little bit I can.

About 981 and memory clearing, thanks Rob for your explanation. I went ahead and loaded the starter rdf into IR and then attempted a write to the remote. The write seemed to clear out all the junk from the keymove tests.

mr_d_p_gumby · Post by **mr_d_p_gumby** » Wed Jan 07, 2009 2:45 pm

I'm not sure why the updated RDF did not upload, but I've uploaded it again and was able to download it. I added your changes/corrections this time.
Same llink: http://www.hifi-remote.com/forums/dload ... le_id=6072

MaximusPlank wrote:Yes I do have an 8811 and 8910. Not sure what to do with them though. If you just want me to learn the TV/VCR button then great. I did that with the results as follows:

No, that won't help much. I have to create a special set of upgrades for you to load into the remote. You'll then learn the buttons using these upgrades so we can identify the buttons in each ButtonMap. I'll post them as soon as I get a few moments to create them.

mr_d_p_gumby · Post by **mr_d_p_gumby** » Wed Jan 07, 2009 9:23 pm

I caught an error in the STARTER 2 RDF file where I forgot to update one value. Change this line in the [General] section:

Code: Select all

AdvCodeAddr=$01C..$0FB

I've uploaded an IR file here.
Load this into your Control 4 remote. If it is working, none of the digit buttons or Vol+/Vol-/Mute/Ch+/Ch- buttons should transmit any IR codes. If that looks OK, then learn all the other buttons to your 8811 or 8910. Download IR files of the learned codes, and add notes to indicate the Control 4 remote's button names.

MaximusPlank · Post by **MaximusPlank** » Thu Jan 08, 2009 3:42 pm

Sorry for the delay, I was a bit unsure of the results and took some time to verify.

Ok, I sucessfully downloaded the 2nd rdf and made the correction - AdvCodeAddr=$01C..$0FB. I downloaded the special IR file and loaded into the remote. It is not working like you say, the digit buttons, power and donut are transmitting verified by led blink and cell phone camera. Repeated this but first loaded an empty "NEW" upgrade from IR, then reset using 981, and then reloaded the test IR file with same results.

I went further to verify the known buttons by loading the upgrade posted in the diagnosis section [a cable device] starting from RM. Most of the lower buttons work like you say they should on the exact button programmed in RM (although most are in lower phantom area except transport buttons). The missing are those you already mentioned:
ENT, Last, C-TV/VCR
and missing device buttons from the top of remote: Setup, AUX, TV, VCR, Cable, OEM(a phantom button?)

BTW: I fine tuned the map for RM a bit and placed the new zip file, same url here.

Sorry the IR file isn't working as planned. Should I do/post the learns anyway? I'll do them just in case.

MaximusPlank · Post by **MaximusPlank** » Tue Jan 13, 2009 10:21 pm

Ok, the test learns are done and posted here: http://www.hifi-remote.com/forums/dload ... le_id=6104
I got the IR file to load correctly by removing the remote's batteries for a while, then loading the test file. Whew, feel lucky as I had no idea what was going on.

unclemiltie · Post by **unclemiltie** » Tue Jan 13, 2009 11:03 pm

The Robman wrote:Capn, I haven't verified if they've changed the way a 981 reset works on the new flash remotes, so it could have changed. In traditional JP1 (EEPROM) remotes, the "end of section" marker (or "SectionTerminator" as it's called in the RDFs) is a 00 byte, so when you do a reset, it will but 00 at the beginning of the keymove/macro section and at the beginning of the learning section. At the beginning of the upgrade section (ie, $0100) it would put "01 04 01 04 00 00", with the two zero bytes in that string ending up at address $0104. The two previous pairs are the addresses of the upgrade list and protocol list, so as they both get reset to $0104, they are now pointing to an address that contains zeroes..

Rob

They did change it for the flash-based remotes. Remember, on the old JP1 remotes that the flash was connected with a serial data line so the remote had to be programmed. It was simpler to go ahead and just write the smallest bit you could to "erase" it.

the JP1.3 remotes (at least) have the flash controller in the processor and the flash is in the main address space. ANY update to the flash essentiall does:

1: Read in the current page (if you want to keep it) to RAM
2: erase the page (to FF)
3: combine any new data in RAM with the old data
4: write RAM back

So, when you do a 981 reset, the remote does erase all of the pages so the memory is really empty (except for the pointers that you just mentioned)

-bill

Post by **The Robman** » Tue Jan 13, 2009 11:20 pm

Good to know, thanks.