Welcome to the forum   
Welcome Guest! To enable all features please Login or Register.

Notification

Icon
Error

Share
Options
View
Go to last post in this topic Go to first unread post in this topic
Offline Drese Alain  
#1 Posted : 24 October 2020 09:20:00(UTC)
Drese Alain

Belgium   
Joined: 10/10/2020(UTC)
Posts: 7
Location: Vlaams-Brabant, Zaventem
Hi,

I am trying to discover the address of an MFX locomotive.

According to the CAN CS2 protocol V2, I am sending a packet in hex 00 02 03 00 05 7C FE 5E C9 00 - I receive back 00 03 6F 38 00 00 00 00 00 00 00 00 00 I was expecting a range in data byte 5 after the UID I provided (7C FE 5E C9 mfx UID if found in the backup file of my CS3). I understand that once the range is returned it is to be added to 4000 - which then gives you the address to command the loc.

What am I doing wrong ?

for testing I am using an MS2 and a CC Schnitte device, other lek commands work perfectly fine (speed, sounds, go , stop)

Anyone who can point me to better documentation ?
Offline JohnjeanB  
#2 Posted : 24 October 2020 12:07:54(UTC)
JohnjeanB

France   
Joined: 04/02/2011(UTC)
Posts: 3,084
Location: Paris, France
Hi Alain
With a CS2 (Probably also with a CS3, it is displayed
See here in the red box
MFX Adress.jpg
Sorry this does not answer directly your question but it is a way
Cheers
Jean
Offline fransja  
#3 Posted : 24 October 2020 14:42:27(UTC)
fransja

Netherlands   
Joined: 27/09/2020(UTC)
Posts: 11
Location: Zuid-Holland, Papendrecht
Originally Posted by: Drese Alain Go to Quoted Post
Hi,

I am trying to discover the address of an MFX locomotive.

According to the CAN CS2 protocol V2, I am sending a packet in hex 00 02 03 00 05 7C FE 5E C9 00 - I receive back 00 03 6F 38 00 00 00 00 00 00 00 00 00 I was expecting a range in data byte 5 after the UID I provided (7C FE 5E C9 mfx UID if found in the backup file of my CS3). I understand that once the range is returned it is to be added to 4000 - which then gives you the address to command the loc.

What am I doing wrong ?

for testing I am using an MS2 and a CC Schnitte device, other lek commands work perfectly fine (speed, sounds, go , stop)

Anyone who can point me to better documentation ?


Hi Alain

I am also writing a program to communicate with the CS2/3, and all struggling with this command.
When I send "00 02 cb 12 00 00 40 05 01 00 00 00 00 " (which is max lok 5) I get back "00 00 CB 13 06 43 53 9A 40 30 00 00 00" where the "43 53 9A 40" is the UID of my CS2. I do no know what the "30" means (could not find it in the documentation).
When I look up the mfxuid 0x7dfb67ad and send this like "00 02 cb 13 05 7d fb 67 ad 30 00 00 00" I do not get a reply?
So this command is real mystery.

I have my code (for what it is worth) put on github (https://github.com/fransjacobs/model-railway) may be it will help you with your experiments

Regards,

Frans

Offline Drese Alain  
#4 Posted : 24 October 2020 18:22:41(UTC)
Drese Alain

Belgium   
Joined: 10/10/2020(UTC)
Posts: 7
Location: Vlaams-Brabant, Zaventem
Tx Frans,
Will keep you posted
thanks 1 user liked this useful post by Drese Alain
Offline clapcott  
#5 Posted : 24 October 2020 21:40:52(UTC)
clapcott

New Zealand   
Joined: 12/12/2005(UTC)
Posts: 2,433
Location: Wellington, New_Zealand
Its been a while, and I do not know if there is any more documentation other than what comes with the CS2 out in the wild
ref *.*.*.*/can/de/CMD_1Verwaltung/1_Discovery.html
Note: in the text I see references to
- v2.1 (e.g. mfx configurable accessory decoders) and
- v3.0 (e.g. 40kHz MM detection as well as SX1 support)
however this may not be fully encompassing - and may not imply that the CS2 itself is able to use the commands


A loco UID is readily available by monitoring any port traffic. Local Ids are seen every time a regular ping occurs.
You might also skip the trolling of the backup file and just parse the /config/lokomotive.cs2 file (http from the web server)
(Then, subsequently, monitoring any new loco discovery where the UI will do all the work for you.
There are notes about
"A discovery should only be triggered by the master operator panel. Otherwise, provisions must be made for the simultaneous release of dicovers.")

If you are using a DLC=5 then you need to be specifying a known UID (or local Id) and
- Assuming the UID is a valid one then then "a positive response" is received
- If the UID is not found then a negative response (DLC=0) is normal.

EXAMPLE
00024711 1 20 Full mfx Discovery
cycle 00024711 5 FF FF FF FF 00 Range 0 mfx Discovery
00024711 1 21 MM2 Discovery

ANSWER
Positive with DLC = 5 and (previously) found address
Negative: DLC = 0


If I understand your post, you are requesting a "Range / protocol identifier" as 0 with a DLC=5

This indicates "= Range. Request to recognize the locomotive on the programming track."

Is your target loco on the programing track


Have you tried a DLC=0 = "Detect all protocols". (only from V2.0)
Peter
thanks 2 users liked this useful post by clapcott
Offline Drese Alain  
#6 Posted : 25 October 2020 08:05:12(UTC)
Drese Alain

Belgium   
Joined: 10/10/2020(UTC)
Posts: 7
Location: Vlaams-Brabant, Zaventem
Originally Posted by: clapcott Go to Quoted Post
Its been a while, and I do not know if there is any more documentation other than what comes with the CS2 out in the wild
ref *.*.*.*/can/de/CMD_1Verwaltung/1_Discovery.html
Note: in the text I see references to
- v2.1 (e.g. mfx configurable accessory decoders) and
- v3.0 (e.g. 40kHz MM detection as well as SX1 support)
however this may not be fully encompassing - and may not imply that the CS2 itself is able to use the commands


A loco UID is readily available by monitoring any port traffic. Local Ids are seen every time a regular ping occurs.
You might also skip the trolling of the backup file and just parse the /config/lokomotive.cs2 file (http from the web server)
(Then, subsequently, monitoring any new loco discovery where the UI will do all the work for you.
There are notes about
"A discovery should only be triggered by the master operator panel. Otherwise, provisions must be made for the simultaneous release of dicovers.")

If you are using a DLC=5 then you need to be specifying a known UID (or local Id) and
- Assuming the UID is a valid one then then "a positive response" is received
- If the UID is not found then a negative response (DLC=0) is normal.

EXAMPLE
00024711 1 20 Full mfx Discovery
cycle 00024711 5 FF FF FF FF 00 Range 0 mfx Discovery
00024711 1 21 MM2 Discovery

ANSWER
Positive with DLC = 5 and (previously) found address
Negative: DLC = 0


If I understand your post, you are requesting a "Range / protocol identifier" as 0 with a DLC=5

This indicates "= Range. Request to recognize the locomotive on the programming track."

Is your target loco on the programing track


Have you tried a DLC=0 = "Detect all protocols". (only from V2.0)


Hi Peter,

I am currently testing with the MS2, so no website available.
I noticed when using the ms2 that the two trains registered are 4005 and 4007 ( just by using any function on the locomotive)
These are 2 mfx locomotives currently defined in the MS2.

I read somewhere that you need to get from the MS2 the Sid of each locomotive.
In my case I tried with the UID 7c fe 5e c9 hoping it would return 00 07. But has Frans also mentioned nothing comes back, the next data received is a ping.
I found in an article that you then need to add that value to 4000 hex. This then gives you the ability to command the locomotive.

Is this correct ?
If not how would you advise to find these values ?

Regards
Alain.
Offline clapcott  
#7 Posted : 25 October 2020 09:50:48(UTC)
clapcott

New Zealand   
Joined: 12/12/2005(UTC)
Posts: 2,433
Location: Wellington, New_Zealand
The mfx UID address space is 0x4000 - 0x7FFF

Your 0x4005 and 0x4007 are the UIDs and can be used to issue any commands against
i.e. the MS2 has done all the legwork, just monitor the pings and do not bother with rediscovery and binding.

If you actually want to reread the details (that the ms2 retrieved on auto-discovery) you can use the Read Config command
I would suggest setting your sniffer up and monitoring an auto discovery to see how all the CV number and CV index(offset) are used
(Generally a header CV number and its first couple of index values are read, to determine the count for the remaining indexing retrieval)

mfx currently has a couple of variants (i.e the pre 32 function and post 32 function formats)
Reading the core values will allow you to determine what the variants to use for the function structure.

If you really want to get into this, reviewing the mfxdef.cs will aid in understanding what is going on with the structure


Peter
Offline Drese Alain  
#8 Posted : 25 October 2020 11:39:36(UTC)
Drese Alain

Belgium   
Joined: 10/10/2020(UTC)
Posts: 7
Location: Vlaams-Brabant, Zaventem
Indeed

Issue was my code.
I had a sync issue missing a lot of info.

Each time I now use the stop/ go button I do see a lot of information coming back
and as you said there seems to be info from the available locomotives

Need to further analyse...
Offline Drese Alain  
#9 Posted : 27 October 2020 07:07:40(UTC)
Drese Alain

Belgium   
Joined: 10/10/2020(UTC)
Posts: 7
Location: Vlaams-Brabant, Zaventem
So I think i corrected the issue in the program

When I power-up the MS2, followed by a GO command - the MFX Discovery sequence starts and I find back the locomotive (see file attached - wordpad text file)

When I try to launch the MFX Discovery command myself - it does not react.

I this sequence only visible when you power the device ? or is there a particular sequence to respect ?

in your last post you alluded to the Read Config command, so this means getting a specific CV value - any pointer which one ?

Sniffer.log

PING Command | 0 30 BF 13 0 0 0 0 0 11 12 F1 4 0
PING Command | 0 31 6F 38 8 47 44 FF 28 1 27 0 10 0
Send command : 0 0 3 0 5 0 0 0 0 1 0 0 0
LOC. Discovery | 0 1 6F 38 5 0 0 0 0 1 12 F1 4 0
LOC. verify | 0 3 3 0 6 7F FF FF FF 3 B8 0 10 0
LOC. verify | 0 3 3 0 6 7F FF FF FF 4 DB F1 4 0
LOC. verify | 0 3 3 0 6 7F FF FF FF 5 0 0 10 0
LOC. verify | 0 3 3 0 6 77 FF FF FF 5 F5 F1 4 0
LOC. verify | 0 3 3 0 6 77 FF FF FF 6 0 0 10 0
LOC. verify | 0 3 3 0 6 73 FF FF FF 6 EF F1 4 0
LOC. verify | 0 3 3 0 6 73 FF FF FF 7 C0 0 10 0
LOC. verify | 0 3 3 0 6 73 FF FF FF 8 D4 F1 4 0
LOC. verify | 0 3 3 0 6 73 FF FF FF 9 E1 0 10 0
LOC. verify | 0 3 3 0 6 73 FF FF FF A D2 F1 4 0
LOC. verify | 0 3 3 0 6 73 FF FF FF B F6 0 10 0
LOC. verify | 0 3 3 0 6 73 FF FF FF C EB F1 4 0
LOC. verify | 0 3 3 0 6 73 FF FF FF D FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FF FF FF E 0 F1 4 0
LOC. verify | 0 3 3 0 6 73 FB FF FF E FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FB FF FF F C6 F1 4 0
LOC. verify | 0 3 3 0 6 73 FB FF FF 10 0 0 10 0
LOC. verify | 0 3 3 0 6 73 FA FF FF 10 DC F1 4 0
LOC. verify | 0 3 3 0 6 73 FA FF FF 11 C6 0 10 0
LOC. verify | 0 3 3 0 6 73 FA FF FF 12 0 F1 4 0
LOC. verify | 0 3 3 0 6 73 FA BF FF 12 FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FA BF FF 13 FF F1 4 0
LOC. verify | 0 3 3 0 6 73 FA BF FF 14 0 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AF FF 14 D7 F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AF FF 15 FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AF FF 16 0 F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB FF 16 DE 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB FF 17 EC F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB FF 18 FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB FF 19 0 F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB 7F 19 FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB 7F 1A FF F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB 7F 1B FF 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB 7F 1C E6 F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB 7F 1D 0 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB 77 1D FF F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB 77 1E D0 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB 77 1F CF F1 4 0
LOC. verify | 0 3 3 0 6 73 FA AB 77 20 0 0 10 0
LOC. verify | 0 3 3 0 6 73 FA AB 76 20 FD F1 4 0
LOC. verify | 0 3 3 0 5 73 FA AB 76 20 0 0 10 0
LOC. Bind | 0 4 BF 13 6 73 FA AB 76 0 5 F1 4 0 mfx-uid of the locomotive, 05 is the SID i was looking for





Offline clapcott  
#10 Posted : 27 October 2020 10:14:38(UTC)
clapcott

New Zealand   
Joined: 12/12/2005(UTC)
Posts: 2,433
Location: Wellington, New_Zealand
My first comment is that your sniffer is not suppressing the unused tail of requests/responses.
This makes human readability laborious.
Further there are only 13 bytes in a packet.

I suspect you are misinterpreting the message and overlooking the response bit.
so the 0x30 is a Ping 0x18 + command with DLC=0 = ping to all devices on the network
and 0x31 is a Ping 0x18 + response with DLC=8 and 8 bytes of data

The last 2 bytes being 0x00 0x10 which indicate a response from a TrackBox device type

The next two commands are
0x00 with SUB-Cmd =01 is a command to "System GO" - NOT a discovery
0x01 = Response/Acknowledgement

It is the following 0x03's with DLC=6 are "Discovery responses". and with a Range identifier in the range 0 to 32 (0x00 to 0x20)
(I suspect there may be dropped packets here as I do not see the discovery command 0x02 , and it is expected that each node would have two responses, one without (i.e.=00) and one with a ASK quality value)

As the MS2 does not have a programing track , I am presuming they are a response from the TrackBox. (Sorry I have no played with a MS2 in this sense)
The very last 0x03 DLC=5 indicaes an end to this discovery.

This is followed by the 0x04 with DLC=6 Which is the actual bind (not a verify)
Here I am surprised not to see a 0x05 = Bind response.

Re: manually sending a discovery - if you used the message as per the example , with its 0x01 then nothing will happen.
ALL odd messages are responses

I continue to fail to see why you want or need to do a discovery.
If you delete the loco from the MS2 and sniff the full auto-discovery you will see the extensive use of the Read Config command as the MS2 extracts the data from the decoder.
Peter
Offline Drese Alain  
#11 Posted : 27 October 2020 10:34:43(UTC)
Drese Alain

Belgium   
Joined: 10/10/2020(UTC)
Posts: 7
Location: Vlaams-Brabant, Zaventem
Thanks again for your feedback.
I need to further analyze your comments.
The first 4 bytes is where I beleive I still have a few issues
I will try the auto discovery process as you suggested



Offline fosuna  
#12 Posted : 28 October 2020 21:25:56(UTC)
fosuna

Spain   
Joined: 14/04/2015(UTC)
Posts: 58
Originally Posted by: fransja Go to Quoted Post


... I get back "00 00 CB 13 06 43 53 9A 40 30 00 00 00" where the "43 53 9A 40" is the UID of my CS2. I do no know what the "30" means (could not find it in the documentation).
...



Hi Frans,

I think that the packet "00 00 CB 13 06 43 53 9A 40 30 00 00 00" is not a response one (the response bit is not set), but an order your CS2 send to the CAN bus. In my case, this packet is sent every 10" aprox. by the GFP3. The "30" means the Sub-cmd "Mfx Seek". It is in a table on page 11 of the CAN CS2 Protokoll - 2.0.doc.

In my case also the CS3 (not the GFP!) send every 10" the packet "00 36 hh hh 00 00 00 00 00 00 00 00 00". I do not know exactly what command is de 0x36. According to the märklin document means "Boatloader CAN gebunden "Service"" (see the upper table on page 11). But there is no more information in the manual.

I think the manual is not complete. It would be very useful if we'd have a wired block of the Central Station.

Greetings,

Francisco
Francisco Osuna
https://fosuna.net
thanks 1 user liked this useful post by fosuna
Offline fosuna  
#13 Posted : 29 October 2020 09:39:19(UTC)
fosuna

Spain   
Joined: 14/04/2015(UTC)
Posts: 58
Originally Posted by: clapcott Go to Quoted Post
Its been a while, and I do not know if there is any more documentation other than what comes with the CS2 out in the wild
ref *.*.*.*/can/de/CMD_1Verwaltung/1_Discovery.html
Note: in the text I see references to
- v2.1 (e.g. mfx configurable accessory decoders) and
- v3.0 (e.g. 40kHz MM detection as well as SX1 support)
however this may not be fully encompassing - and may not imply that the CS2 itself is able to use the commands
...


Hi Peter,

The URL you provide "*.*.*.*/can/de/CMD_1Verwaltung/1_Discovery.html", does it belong to your CS2? That 's, does the "*.*.*.*" mean the IP of your CS2? I ask you this because I tried with the IP of my CS3 and it does not exist. Anyway, do you know how I can access the file system of my CS3?

Thank you very much.

Francisco
Francisco Osuna
https://fosuna.net
Offline fransja  
#14 Posted : 30 October 2020 21:57:37(UTC)
fransja

Netherlands   
Joined: 27/09/2020(UTC)
Posts: 11
Location: Zuid-Holland, Papendrecht
Originally Posted by: fosuna Go to Quoted Post

I think that the packet "00 00 CB 13 06 43 53 9A 40 30 00 00 00" is not a response one (the response bit is not set), but an order your CS2 send to the CAN bus. In my case, this packet is sent every 10" aprox. by the GFP3. The "30" means the Sub-cmd "Mfx Seek". It is in a table on page 11 of the CAN CS2 Protokoll - 2.0.doc.

In my case also the CS3 (not the GFP!) send every 10" the packet "00 36 hh hh 00 00 00 00 00 00 00 00 00". I do not know exactly what command is de 0x36. According to the märklin document means "Boatloader CAN gebunden "Service"" (see the upper table on page 11). But there is no more information in the manual.

I think the manual is not complete. It would be very useful if we'd have a wired block of the Central Station.

Greetings,

Francisco


Hi Francisco,

I can confirm that after trying a while the CS2 replies every 10 to 15 seconds or so:
When i send a "ping" is see the following:
00 30 00 03 00 00 00 00 00 00 00 00 00 response -> 00 31 00 03 08 43 53 9A 41 04 02 FF FF
then once every 10 - 15 s
00 30 00 03 00 00 00 00 00 00 00 00 00 response -> 00 31 00 03 08 43 53 9A 41 04 02 FF FF 00 31 CB 13 08 43 53 9A 40 03 51 00 00

So when I read the doc and understand it correctly the "00 31 00 03 08 43 53 9A 41 04 02 FF FF" is response from "CS2-GUI (Master)" (last 2 byes 0xFF 0xFF) with SW version 4.2 and UID 43 53 9A 41

The "00 31 CB 13 08 43 53 9A 40 03 51 00 00" is the response from the "Gleis Format Prozessor 60213,60214 / Booster 60173, 60174" (last 2 byes 0x00 0x00) with SW version 3.51

As I am using TCP to communicate with the CS 2 I send now in my program every 250 ms the "ping" command.
As reply I get the above 2 responses plus sometimes a S88 event.
(00 23 CB 12 08 00 00 00 13 01 00 00 16) which is contact 19 (m2 port 3) from 1 to 0 for 160 ms

So I am geting further, do no yet understand everything!
But I learn mor and more also thik to the forum replies! Thanks

Regards,

Frans
thanks 1 user liked this useful post by fransja
Offline clapcott  
#15 Posted : 02 November 2020 07:17:17(UTC)
clapcott

New Zealand   
Joined: 12/12/2005(UTC)
Posts: 2,433
Location: Wellington, New_Zealand
Originally Posted by: fosuna Go to Quoted Post
The URL you provide "*.*.*.*/can/de/CMD_1Verwaltung/1_Discovery.html", does it belong to your CS2?

Yes, accessing the CS2 with a Web browser offers a section for CAN documentation.

The same library is certainly not obviously available on the CS3 (via the help or via the web server) and I do not know if it is hidden somewhere like the libraries for the WebApp

Edited by user 03 November 2020 20:36:14(UTC)  | Reason: Not specified

Peter
Users browsing this topic
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.

| Powered by YAF.NET | YAF.NET © 2003-2024, Yet Another Forum.NET
This page was generated in 0.817 seconds.