I've hacked the hardware details for the JP1 jumper in the RS 15-1994. I've successfully read the internal EEPROM, and monitored its reads/writes while pushing various buttons. I haven't tried writing the EEPROM, but it should be trivial.

There are 2 ICs on the board: U1 is the microcontroller, and U2 is a 2048x8 bit serial EEPROM (ATMEL 24C16N - datasheet available online). Only a few bytes in U2 are used, so I believe that the main code database is stored in a hardwired ROM in U1. U2 holds your customizations (device numbers, macros, key remaps etc.)

JP1 pin definitions:
1 - VCC(U1) (leave unconnected if using batteries)
2 - VCC(U2) (leave unconnected if using batteries)
3 - GND
4 - SDA (U2 data input/output)
5 - input to U1 (unknown function)
6 - SCL (U2 clock)

The SEEPROM is read/written by following the protocol in the datasheet. Until the software memory use is understood, we can't do much more than copy settings from one remote to another. I can already tell that there are various pointers, and it seems like the software calculates a checksum of the entire EEPROM contents after any operation that does a write.

I believe that a devices code upgrade stores the new codes in U2. The easiest way to crack this would be to look at an upgraded remote (maybe the OFA remotes are close enough to be of help).

Well...gee....

Now I know what that WOOSH sound was over my head :)
I understand what you are saying, but would personally not have known where to begin. Must say that I am impressed you simply decided to hack this baby.

I suppose this could evetually lead to a whole new forum...and extension of Rob's site: how to upgrade your own RS-1994. Wonder if this violates any reverse-engineering rules by RS or UEIC?

This news is unbe-friggin-lievable [middle portion censored by Remote Central software] !!!!

The OFA format should be the same, so if you have access to a Producer 8 remote, you could check the EEPROM before and after an upgrade.

I have some info on the 3-pin protocol used in older OFA remotes on my site, if you think that might help shed some light on some of the finer points on the 6-pin protocol, it's in the John Wasser section.

Feel free to drop me a line privately if you like.

Rob.
http://www.hifi-remote.com/

In hacking this puppy, is there any possibility of memory upgrades???

Greg :-)

That might not be as far fetched as you might think. If HW can figure out how to format the EEPROM, it's possible that we might be able to put a larger one in there. This kinda stuff is all way above my abilities, but I'll be really interested to see where he takes this. Maybe we can transplant some of the insides of a C7 with the 1994 so we can at least get a working punch through, a freed up P&P device button and loads of useful device codes that are MIA in the 1994.

I've posted links to this thread in several places, so hopefully some other folk might jump in and help out.

Here are some links to info on my site that might help out:

[Link: hifi-remote.com]
[Link: hifi-remote.com]
[Link: hifi-remote.com]
[Link: hifi-remote.com]

Rob.
http://www.hifi-remote.com/

Hahaha. I'll be darned. A buzz going through the OFA/RS community...is it perhaps possible to perfect a near perfect remote? Join us next time on "Code 90210".

This is pretty cool stuff. I'll be watchin' this thread...would this apply to the C7IQ as well? (which I recently bought...and really like)

The trouble with the C7 is that there isn't a 6-pin connector on it, there's a space for it, there's even holes for the pins. Now, would it work if one where to solder in a connector, who knows?

Rob.

So far, I've determined part of the EEPROM memory map and all keycodes. To make more progress, I'll need access to an upgraded remote (URC8800 or 9800) to see how the upgrade codes are stored.

Or maybe I'll release my software in the hopes that an advanced electonics hobbyist with an upgraded remote can post the memory dump. I've been using a Linux kernel driver I wrote to capture the EEPROM signals through the parallel port. I wrote another program to process the raw signal data and show the Serial-EEPROM operations (read/write address & data, etc.). I'm reluctant to do this though, because parallel port projects aren't for beginners and I don't want someone burning out their PC's parallel port (or remote).

------------------------------------------------------------------------------
RS 15-1994 EEPROM memory map (000-7ff):

000: EEPROM checksum
001: complement of checksum at 000

00a-00b: SAT device number (ex: 03 07 = 3*256+007 = 0775)

00c-00d: TV device number (ex: 10 b3 = 0*256+179 = 0179)
(ex: 14 7b = 4*256+123 = 1147)

00e-00f: VCR device number (ex: 20 43 = 0*256+067 = 0067)
(ex: 21 df = 1*256+223 = 0479)

010-011: CD device number (ex: 33 69 = 3*256+105 = 0873)

012-013: AUX1 device number (ex: 40 c3 = 0*256+195 = 0195)
(ex: 41 87 = 1*256+135 = 0391)

014-015: AUX2 device number (ex: 40 b0 = 0*256+176 = 0176)
(ex: 42 e8 = 2*256+232 = 0744)

016-017: PNP device number (ex: 30 a7 = 0*256+167 = 0167)
(ex: 31 a4 = 1*256+164 = 0420)

01b-0ff: advanced codes (fixed size, 5 bytes each) & macros
1st byte is keycode
3rd-4th bytes are copies of device number

100-105: pointers

3ff-???: learned code data structures (variable size, 13-14 bytes each for my examples)
1st byte is keycode
3rd byte is length of learned code
4th-nth bytes are the learned code

------------------------------------------------------------------------------
RS 15-1994 keycode map:

SLEEP ?

POWER 03
1S 21
2S 22
3S 23
4S 24
ARROW-UP 31
ARROW-DOWN 32
ARROW-LEFT 33
ARROW-RIGHT 34
SELECT 35
MENU 29
GUIDE 28
CENTER 2b
MUTE 08
LAST 13
SCAN ??
PIP 2d
DISPLAY 2a
SWAP 2f
MOVE 2e
VOL+ 04
VOL- 05
CH+ 06
CH- 07
1 15
2 16
3 17
4 19
5 1a
6 1b
7 1c
8 1d
9 1e
0 1f
TV/VIDEO 18
ENTER 12
REW 0b
PLAY 0c
FFWD 0d
REC 10
STOP 0e
PAUSE 0f

Hey HW Hackr,
If you send me an email I can help you out regarding upgraded remotes and I can point you to some work that has been done on the old 3-pin connector that might relate to this.

Rob.

I have a 15-1925 that is modem-upgradable. You could take a 'snapshot' of it, then call in and have it upgraded, then take another snapshot... I don't know if this is any easier than getting before/after snapshots of the 8800/9800...

- Mike

The 15-1925 is perfect becuase it is the only telephone upgradeable remote that also has the 6-pin connector. I also have one of these available.

Rob.
http://www.hifi-remote.com

When you say copy settings from one remote to another, do you mean every setting? ie:learned codes/programmed keys/macros/device codes etc?? If so, why couldn't there be a program that would read the entire memory into the computer, make changes there, then re-submit the entire dump (changes and all)? I've been playing with the idea of chopping up a wireless mic I've got to try and fit its circuit board inside the 15-1994 to control my x10 via homeseer software (www.keware.com). It'd be cool to "backup" the remote before tinkering around inside the case. Also, have you found a way to take it apart without damaging the plastic?

Great job by the way!!

-Randy

Hey Randy,
To answer your question regarding creating software to copy the EEPROM, that's the general idea. If you think you're up to the task by all means give it a go, or at least post any ideas you have to that thread in case someone else can pick up your idea and run with it.

As for opening the case, you do have to be careful but it can be done. You should go around the edge with a thin (but not too sharp) knife, and try and wedge it in between the top and bottom. I forget which side is the "female" side, I think it's the top.

Rob.

If one knew the format of the EEPROM contents then it would be possible to create new in the computer. Mirroring from one device to the next is the first step in achieving this goal. Looks like excellent progress has been made.

Am confused about Randy's comments that he is chopping up a wireless mic to put inside a 1994 to control X-10 from a PC?

Okay, I know nothing about what you all are saying. It's gobeldy-gook to me :)

The bottom line - how far off are we from totally programming the 15-1994?