Model Train Forum banner
Cancel
Create thread New Forums

TMCC signal reverse engineering

Jump to Latest
21 - 40 of 44 Posts
#21 ·
Well, while I suppose you're having some fun with this, I don't see the point in trying to break the system and yet get it to sort of run. Yes, the signal will propagate a short distance at times with improper connections, it'll hardly yield trouble-free operation.

I've operated a bench test track with the Legacy system connected to a layout in the other end of the room. That doesn't mean it's designed to work that way, or that it will yield reliable operation, just that the signal happened to get to the test bench with enough strength to allow some operation.

I file all this under "curious happenings", but I don't spend a lot of time trying to verify how far I can warp the system and still have some semblance of operation.
 
Discussion starter · #22 ·
I got all motivated after reading Adrians! stuff over on the other forum on DCS. I thought: "Let's do something like that with Legacy too."

My original intent was to put a scope on the track and post some squiggly lines. I still intend to do that, I've just not gotten to it.

I got a little side tracked when someone said "oh you can't see the ground side signals because that's what XXX is for..." in an earlier post ... And went on about a 3 to 2 prong plug which turns out I have... so I thought I'd try that, that's easy, etc...

I was originally thinking: "If we gather all the knowledge of legacy in one spot... wouldn't that be useful?"

But so far, the effort has not been very fruitful.
 
#23 ·
Severn said:
I got all motivated after reading Adrians! stuff over on the other forum on DCS. I thought: "Let's do something like that with Legacy too."

My original intent was to put a scope on the track and post some squiggly lines. I still intend to do that, I've just not gotten to it.
Click to expand...
You can measure the Legacy signal in a very similar manner as the DCS signal. Note that Adrian was measuring the TIU signal with no track power, so it's very easy to see the signal. You can do the same thing with Legacy/TMCC, we've had many discussions about it. This summer I'll be getting back to my Legacy signal booster project to enhance TMCC/Legacy signals on really large or multi-level layouts. One of it's features is a port to measure the TMCC signal strength.

TMCC signals are different than the DCS signals as they are a continuous carrier and encoded using FSK at around 3000 BPS.

Here's one of many pictures I've posted in the past.
 
Discussion starter · #26 ·
Discussion starter · #27 ·
With my door stop. I mean scope I measured the signal without track power and it took a single button push. It looked very similar to the pics you posted above. Now if I can figure out how to save a sample.
 
Discussion starter · #29 ·
I made an initial effort to capture the signal and ended up with 2 column csv file. I believe I read that legacy sends a kind "heart beat" out all the time so imagine there's some data in the signal, and so the data. I need to do some more experimenting not to mention read the manual for the logical analyzer. It's a low end Hantek. (note: using a 10x probe)

Snippet from file:

#timebase=400000(ps)
#voltbase=10000000(uV)
#size=40064
2.50E-09 19.2
5.00E-09 20
7.50E-09 20.4
1.00E-08 20
1.25E-08 20.4
1.50E-08 20.8
1.75E-08 20.4
2.00E-08 20.4
2.25E-08 20.4
2.50E-08 20.8
2.75E-08 20.8
3.00E-08 21.2
3.25E-08 21.2
3.50E-08 21.6
3.75E-08 22
4.00E-08 21.6
4.25E-08 22
4.50E-08 22
4.75E-08 23.2
5.00E-08 21.2
5.25E-08 22.8
5.50E-08 22.8
5.75E-08 23.2
6.00E-08 22.8
6.25E-08 23.6
6.50E-08 23.6
6.75E-08 23.6
7.00E-08 23.6
7.25E-08 23.6
7.50E-08 23.6
7.75E-08 24
8.00E-08 24
8.25E-08 24

...
 
#30 ·
I have absolutely no idea what that represents!

You can sign up with Lionel to be an LCS Partner (it's free), and obtain the complete Legacy command specification, much easier than fooling around with the 'scope. ;)

There is no "heart beat" that I know of, but TMCC and Legacy all transmit a continuous 455khz (nominal) frequency carrier. The carrier is modulated using FSK at roughly 3000 BPS to convey the actual command data.
 
Discussion starter · #31 ·
I believe the left column is relative time and the right column is voltage ... I used a 10 x probe so maybe divide voltage by 10. I say that because your pic shows peak to peak at 5 but mine say 50. And that's all I could think of.
Also I'm a member of pcs developers. I wrote some stuff in java which while primitive worked... And I stuck it out on gitlab and done nothing else at all with it in over a year. I could make the project public but its not set that way right now.
 
Discussion starter · #33 ·
I believe a way forward is to get one of the software defined radio "dongles" and attempt to digitize the signal into I-Q data with it. After which the info can fed to one of the above programs to try to retrieve the encoding info.

I poked around last night and found one that goes below 500 mhz, such as here: https://www.sdrplay.com/rsp2/

Many others don't go into khz range for whatever reason. (see variations of the theme of "LTR SDR" with google)

I believe the above only is rx... but I could see an interesting rx--> digitizer --> tx kind of bent pipe application... which might be a novel way to transport the signal somewhere else for remote control.

Not that anyone would want to do this for any particular reason but it seems possible.

Anyway, I've only just had a quick look through the SDR stuff at this time, what I really know about it is limited.
 
#34 ·
I'm confused about why you need to go to that trouble? First off, the amplitude of the signal remains pretty constant, it's the frequency shift that conveys the information. Also, the data is clearly documented in the Lionel documentation that is freely available for both TMCC and Legacy.

I guess I don't know what you're trying to do, but I'm outta' here. ;)
 
Discussion starter · #35 ·
I just thought it would be fun to decode the signal, and the SDR seemed a way to do it. I assume as I said that if this could be done, an appropriate software defined radio could be found/configured to act as the transmitter and send some commands through it. Wouldn't this replicate what Adrian! did with DCS at least from a functional stand point (he built a "DCS spoof" and was able to command an engine with it -- or that's what I got from his post).
That's it -- just understanding how it actually works.
 
#36 ·
Wouldn't it be easier at this point to replace the TMCC control with Bluetooth? Lionel does not own the rights to BT and would have no say in it's availability in the future. Game over.
 
Discussion starter · #37 ·
They support bluetooth control now on the new engines but it's a subset of the TMCC functionality.

But overall, no I'm not interested myself at least in replacing anything. I just thought it'd be great to understand how it really works.

And well, without actually sending a command to the engine from a ... you know, a home brew solution -- I guess I don't think it counts completely and fully and so is then just someone's opinion on how it works.

Given that -- I'm game to get one of those SDR dongles and try that as an approach to fully comprehending the contents of the signal. I put it on my grocery list at least.

This appeals to me because I'm not a hardware person, have limited time -- and it seems like it might yield some results by taking an "integration" approach with hardware and software -- which I can do.

If not, then I guess it'll be novel to see the RF going to unlock the car doors or something...

So what I get is it would have the potential depending on frequency to "see" the following:

blue tooth, legacy rf ... flyer chief stuff?, the DCS remote to tiu (already been done I know)

Etc... Kinda cool really but not necessarily useful in and of itself.
 
#38 ·
I can tell you I have no interest in Bluetooth or WIFI. My experience with both systems is they have lost contact with whatever device they're connected to more times than I like. I may be wrong, but I'm not willing to spend the money to find out.
 
Save
Reply Quote Like Like
Discussion starter · #39 ·
I think some have had trouble with this kind of thing with legacy. That's why grj is working on a legacy signal booster for example. There's been a lot of discussion on that over in the other forum ... Not really my interest but I gather others would buy it if available.
 
21 - 40 of 44 Posts
About this Discussion
43 Replies
6 Participants
Last post:
Severn
Model Train Forum
posts
950K
members
37K
Since
2006
A forum community dedicated to model train owners and enthusiasts. Come join the discussion about brands, various scales, repairs, storage, displays, reviews, accessories, classifieds, and more!
Full Forum Listing
Explore Our Forums
O Scale HO Scale General Model Train Discussion S Scale N Scale