Intercepting DCS control commands?

MTH has structured the DCS command packet with checksums and counters to preclude users from generating their own commands to the TIU.

Ostensibly this is to avoid the cost of supporting software inquiries from users.  (More skeptical minds might wonder if it is to perpetuate the "DCS can control TMCC but TMCC can't control DCS" marketing theme.)

Regardless of the reason, at present the only way to control the TIU via computer is to look at the serial output from the remote in response to a particular command sent to a particular engine.  You can then play that command back to the TIU and it will respond as if it received the command from a tethered remote.

So the approach is to record a lot of commands generated by the remote in response to a key press, and build a library of unique commands that can then be sent to the TIU.

Professor, Can I assume the main function of the TIU is to simply modulate the signal from the handheld with RF or does it alter that signal in some way like stripping or adding code? I am mainly interested in the codes that that the engine receives.

Plan "B" if the signal proves to difficult to decode would be to try and build a bandpass filter to determine the whistle from the other sounds produced. Obviously not ideal as that would have to be optimized for each engine.

Pete

I don't think anyone has attempted to reproduce the signal the TIU transmits via the rails... that would be substantially more complex than the TIU-remote communication, which is plain serial.

There is some general discussion of TIU transmission in the DCS patent, but probably not enough to replicate the system:  http://www.protosound2.com/dcs/Patent.pdf