|
631
|
1 OSTC hwos Tech Firmware COMM Mode Documentation
|
|
|
2 ===============================================
|
|
|
3
|
|
|
4 Remarks: - timeouts restart on each received byte
|
|
|
5 - 3 byte start address and 3 byte length are expected in network byte format (big endian)
|
|
|
6
|
|
|
7
|
|
|
8 comm_mode_selection_loop: ## entry point when COMM Mode is started ##
|
|
|
9
|
|
|
10 try to receive 1 byte, timeout after 4 minutes
|
|
|
11 received 0xBB -> goto comm_download_mode
|
|
|
12 received 0xAA -> goto comm_service_mode_check
|
|
|
13 timeout -> send 0xFF
|
|
|
14 quit comm mode
|
|
|
15
|
|
|
16
|
|
|
17 comm_service_mode_check: ## received start byte for service mode, await service key ##
|
|
|
18
|
|
|
19 send 0x4B
|
|
|
20 |
|
|
|
21 | Attention: do not send the next 3 bytes in one batch, wait for
|
|
|
22 | the echo of each byte before sending the next one
|
|
|
23 |
|
|
|
24 try to receive 1 byte (upper byte of comm service key), timeout after 400 ms
|
|
|
25 echo received byte
|
|
|
26 try to receive 1 byte (high byte of comm service key), timeout after 400 ms
|
|
|
27 echo received byte
|
|
|
28 try to receive 1 byte (low byte of comm service key), timeout after 400 ms
|
|
|
29 echo received byte
|
|
|
30 service key correct -> enable comm_service_mode, goto comm_command_loop
|
|
|
31 service key not correct -> goto comm_mode_selection_loop
|
|
|
32 timeout -> goto comm_mode_selection_loop
|
|
|
33
|
|
|
34
|
|
|
35 comm_download_mode: ## received start byte for download mode ##
|
|
|
36
|
|
|
37 send 0xBB
|
|
|
38 goto comm_command_loop
|
|
|
39
|
|
|
40
|
|
|
41 comm_command_loop: ## wait for a command ##
|
|
|
42
|
|
|
43 if comm_service_mode is enabled -> send 0x4C
|
|
|
44 else -> send 0x4D
|
|
|
45
|
|
|
46 try to receive 1 byte, timeout after 2 minutes
|
|
|
47
|
|
|
48 timeout -> send 0xFF and quit comm mode
|
|
|
49 received 0x6E -> goto comm_show_text n show a text on the screen
|
|
|
50 received 0x69 -> goto comm_identify i send ID: serial, firmware, and custom text
|
|
|
51 received 0x6A -> goto comm_hardware_descriptor j send ID: hardware descriptor byte
|
|
|
52 received 0x60 -> goto comm_feature_and_hardware ' send ID: more detailed information
|
|
|
53 received 0x6D -> goto comm_send_headers_short m send all headers in compact format
|
|
|
54 received 0x61 -> goto comm_send_headers_full a send all headers is full format
|
|
|
55 received 0x66 -> goto comm_send_dive f send header and profile for one dive
|
|
|
56 received 0x62 -> goto comm_set_time b set the real time clock
|
|
|
57 received 0x63 -> goto comm_set_custom_text c write a new custom text
|
|
|
58 received 0x72 -> goto comm_read_option r read an option value
|
|
|
59 received 0x77 -> goto comm_write_option w write an option value (into RAM)
|
|
|
60 received 0x78 -> goto comm_option_reset_all x reset all option values to their factory default
|
|
|
61 received 0xFF -> send 0xFF and quit comm mode
|
|
|
62
|
|
|
63 the following commands are only evaluated if comm_service_mode is enabled:
|
|
|
64
|
|
|
65 received 0x23 -> goto comm_reset_battery_gauge # reset the battery gauge registers
|
|
|
66 received 0x22 -> goto comm_erase_complete_logbook " reset all logbook pointers and the logbook
|
|
|
67 received 0x20 -> goto comm_read_range ' ' read a memory range from the external FLASH
|
|
|
68 received 0x40 -> goto comm_erase_4kb @ erase one 4 kB block - Warning: no confirmation or built-in safety here...
|
|
|
69 received 0x42 -> goto comm_erase_range4kb B erase a range of 4 kB blocks - Warning: no confirmation or built-in safety here...
|
|
|
70 received 0x30 -> goto comm_write_range_stream 0 write a stream of bytes starting at ext_flash_address:3 until timeout
|
|
|
71 received 0x31 -> goto comm_write_range_block 1 write a block of 256 bytes starting at ext_flash_address:3 (only available with FW >= 3.08)
|
|
|
72 received 0x50 -> goto comm_firmware_update P initiate firmware update
|
|
|
73 received 0xC1 -> goto comm_cold_start start low-level bootloader
|
|
|
74
|
|
|
75
|
|
|
76
|
|
|
77 comm_set_time: ## set the real time clock ##
|
|
|
78
|
|
|
79 send 0x62
|
|
|
80 try to receive 6 bytes in sequence: hour, minute, second, month, day, year, timeout 400 ms
|
|
|
81 timeout -> goto comm_command_loop
|
|
|
82 else -> set RTC, goto comm_command_loop
|
|
|
83
|
|
|
84
|
|
|
85 comm_show_text: ## write a 15 char text to the OSTC display ##
|
|
|
86
|
|
|
87 send 0x6E
|
|
|
88 try to receive 16 characters, timeout 400 ms
|
|
|
89 print whatever has been received to the display
|
|
|
90 goto comm_command_loop
|
|
|
91
|
|
|
92
|
|
|
93 comm_identify: ## reply serial, firmware and custom text ##
|
|
|
94
|
|
|
95 send 0x69
|
|
|
96 send 1 byte serial number, low byte
|
|
|
97 send 1 byte serial number, high byte
|
|
|
98 send 1 byte firmware version, major
|
|
|
99 send 1 byte firmware version, minor
|
|
|
100 send 60 byte custom text
|
|
|
101 goto comm_command_loop
|
|
|
102
|
|
|
103
|
|
|
104 comm_hardware_descriptor: ## reply short hardware descriptor ##
|
|
|
105
|
|
|
106 send 0x6A
|
|
|
107 send 1 byte hardware descriptor
|
|
|
108 goto comm_command_loop
|
|
|
109
|
|
|
110
|
|
|
111 comm_feature_and_hardware: ## reply detailed hardware descriptor ##
|
|
|
112
|
|
|
113 send 0x60
|
|
|
114 send 0x00
|
|
|
115 send 1 byte hardware descriptor
|
|
|
116 send 0x00
|
|
|
117 send 0x00
|
|
|
118 send 0x00
|
|
|
119 goto comm_command_loop
|
|
|
120
|
|
|
121
|
|
|
122 comm_send_headers_short: ## send short version of dive headers ##
|
|
|
123
|
|
|
124 send 0x6D
|
|
|
125 send 256 x 16 bytes (extract from the headers)
|
|
|
126 goto comm_command_loop
|
|
|
127
|
|
|
128
|
|
|
129 comm_send_headers_full: ## send complete dive headers ##
|
|
|
130
|
|
|
131 send 0x61
|
|
|
132 send 256 x 256 bytes
|
|
|
133 goto comm_command_loop
|
|
|
134
|
|
|
135
|
|
|
136 comm_send_dive: ## send one full dive ##
|
|
|
137
|
|
|
138 send 0x66
|
|
|
139 try to receive 1 byte (dive index), timeout 400 ms
|
|
|
140 timeout -> goto comm_command_loop
|
|
|
141 no profile data available -> goto comm_command_loop
|
|
|
142 else -> send 256 byte dive header (begins with 0xFAFA)
|
|
|
143 send ??? byte dive profile (ends with 0xFDFD)
|
|
|
144 goto comm_command_loop
|
|
|
145
|
|
|
146
|
|
|
147 comm_option_reset_all: ## reset all options to factory default ##
|
|
|
148
|
|
|
149 send 0x78
|
|
|
150 reset all option values to default
|
|
|
151 goto comm_command_loop
|
|
|
152
|
|
|
153
|
|
|
154 comm_set_custom_text: ## set custom text ##
|
|
|
155
|
|
|
156 send 0x63
|
|
|
157 try to receive 60 byte, timeout 400 ms
|
|
|
158 clear complete old custom text
|
|
|
159 store the 0...60 bytes that have been received as new custom text
|
|
|
160 goto comm_command_loop
|
|
|
161
|
|
|
162
|
|
|
163 comm_reset_battery_gauge: ## reset battery gauge ##
|
|
|
164
|
|
|
165 (no acknowledge send)
|
|
|
166 reset battery registers and battery gauge chip
|
|
|
167 goto comm_command_loop
|
|
|
168
|
|
|
169
|
|
|
170
|
|
|
171 comm_erase_complete_logbook: ## erase complete Logbook ##
|
|
|
172
|
|
|
173 (no acknowledge send)
|
|
|
174 erase complete logbook
|
|
|
175 goto comm_command_loop
|
|
|
176
|
|
|
177
|
|
|
178 comm_cold_start: ## start bootloader (cold start) ##
|
|
|
179
|
|
|
180 (no acknowledge send)
|
|
|
181 backup crucial data from RAM to EEPROM
|
|
|
182 jump into the bootloader/cold start
|
|
|
183
|
|
|
184
|
|
|
185 comm_firmware_update: ## initiate firmware update ##
|
|
|
186
|
|
|
187 send 0x50
|
|
|
188 try to receive 5 byte checksum, timeout 400 ms
|
|
|
189 timeout -> send 0xFF, goto comm_command_loop
|
|
|
190 checksum faulty -> send 0xFF, goto comm_command_loop
|
|
|
191 else -> send 0x4C
|
|
|
192 backup crucial data from RAM to EEPROM
|
|
|
193 jump into bootloader/FW update
|
|
|
194
|
|
|
195
|
|
|
196 comm_erase_range4kb: ## erase a memory range ##
|
|
|
197
|
|
|
198 send 0x42
|
|
|
199 try to receive 3 byte start address, timeout 400 ms
|
|
|
200 try to receive 1 byte block count, timeout 400 ms
|
|
|
201 any timeout -> goto comm_command_loop
|
|
|
202 else -> erase FLASH from start address, range block_count x 4 kByte
|
|
|
203 goto comm_command_loop
|
|
|
204
|
|
|
205
|
|
|
206 comm_erase_4kb: ## erase one 4 kB block ##
|
|
|
207
|
|
|
208 (no acknowledge send)
|
|
|
209 try to receive 3 byte start address, timeout 400 ms
|
|
|
210 timeout -> goto comm_command_loop
|
|
|
211 else -> erase FLASH from start address, range 4 kByte
|
|
|
212 goto comm_command_loop
|
|
|
213
|
|
|
214
|
|
|
215 comm_write_range_stream: ## write a stream of bytes to the FLASH ##
|
|
|
216
|
|
|
217 send 0x30
|
|
|
218 try to receive 3 byte start address, timeout 400 ms
|
|
|
219 timeout -> goto comm_command_loop
|
|
|
220 else -> loop {try to receive 1 byte, write byte to FLASH } until timeout
|
|
|
221 |
|
|
|
222 | Attention: Do not send the bytes too fast as the OSTC needs
|
|
|
223 | some time for each byte to write it to the FLASH.
|
|
|
224 |
|
|
|
225 | Bytes will be received and written to FLASH until a timeout occurs,
|
|
|
226 | i.e. to end the writing stop sending and await the timeout to trigger.
|
|
|
227 |
|
|
|
228 timeout -> goto comm_command_loop
|
|
|
229
|
|
|
230
|
|
|
231 comm_write_range_block: ## write a block of 256 bytes to the FLASH ##
|
|
|
232 (only available with FW >= 3.08)
|
|
|
233 send 0x31
|
|
|
234 try to receive 3 byte start address, timeout 400 ms
|
|
|
235 timeout -> goto comm_command_loop
|
|
|
236 low byte of start address <> 0 -> goto comm_command_loop
|
|
|
237 else -> try to receive 256 byte, timeout 400 ms
|
|
|
238 timeout -> goto comm_command_loop
|
|
|
239 else -> write the 256 byte to FLASH
|
|
|
240 goto comm_command_loop
|
|
|
241
|
|
|
242
|
|
|
243 comm_read_range: ## read a range from FLASH ##
|
|
|
244
|
|
|
245 send 0x20
|
|
|
246 try to receive 3 byte start address, timeout 400 ms
|
|
|
247 try to receive 3 byte length, timeout 400 ms
|
|
|
248 any timeout -> goto comm_command_loop
|
|
|
249 else -> loop {read 1 byte from FLASH, send 1 byte } until #length bytes done
|
|
|
250 goto comm_command_loop
|
|
|
251
|
|
|
252
|
|
|
253 comm_read_option: ## read an option value ##
|
|
|
254
|
|
|
255 send 0x72
|
|
|
256 try to receive 1 byte option index, timeout 400 ms
|
|
|
257 timeout -> goto comm_command_loop
|
|
|
258 index = 0x10 - 0x19 -> send 4 bytes in sequence O2%, He%, type, change depth
|
|
|
259 goto comm_command_loop
|
|
|
260 index = 0x1A - 0x1E -> send 2 bytes in sequence setpoint cbar, change depth
|
|
|
261 goto comm_command_loop
|
|
|
262 index = 0x1F - 0xXX -> send 1 byte option value (0xXX last index in use, depends on FW version)
|
|
|
263 goto comm_command_loop
|
|
|
264 else -> goto comm_command_loop
|
|
|
265
|
|
|
266
|
|
|
267 comm_write_option: ## write an option value ##
|
|
|
268
|
|
|
269 send 0x77
|
|
|
270 try to receive 1 byte option value, timeout 400 ms
|
|
|
271 timeout -> goto comm_command_loop
|
|
|
272 |
|
|
|
273 | Attention: do not send the option values too fast after the option index,
|
|
|
274 | as the OSTC does not know how many bytes will follow after the
|
|
|
275 | index before it has actually evaluated the index!
|
|
|
276 | This is a flaw in the protocol design...
|
|
|
277 |
|
|
|
278 index = 0x10 - 0x19 -> try to receive 4 byte in sequence O2%, He%, type, change depth
|
|
|
279 timeout -> goto comm_command_loop
|
|
|
280 else -> update option
|
|
|
281 goto comm_command_loop
|
|
|
282 index = 0x1A - 0x1E -> try to receive 2 bytes in sequence setpoint cbar, change depth
|
|
|
283 timeout -> goto comm_command_loop
|
|
|
284 else -> update option
|
|
|
285 goto comm_command_loop
|
|
|
286 index = 0x1F - 0xXX -> try to receive 1 byte option value (0xXX last index in use, depends on FW version)
|
|
|
287 timeout -> goto comm_command_loop
|
|
|
288 else -> update option
|
|
|
289 goto comm_command_loop
|
|
|
290 else -> goto comm_command_loop
|
