Intro to controlling the Sony PC VisionTouch (A.K.A. "Hacking the CAV") By Dan Zenchelsky (
Intro to controlling the Sony PC VisionTouch
(A.K.A. "Hacking the CAV")
By Dan Zenchelsky (firstname.lastname@example.org)
Version 1.0 -- 03/27/97
There is no doubt that the Sony PC VisionTouch, otherwise known as the CAV, is a GREAT piece of hardware. With the right software support, I think a lot of people would be interested in this product. Unfortunately, Sony has been rather lax in their support of the CAV. Rather than wait an indefinite period of time for them to produce a developer's kit, I decided to sit down and figure out how the CAV device works. This document is a result of that effort.
This document is by no means complete. It provides an overview of the various types of commands that I have been able to discover, as well as a sampling of the specific byte sequences used to perform specific commands. A much more complete list needs to be assembled, and I would greatly appreciate any help in this regard. If you have any updates, questions, or comments, please send them to me using the email address listed above.
DISCLAIMER: ALL INFORMATION PRESENTED HERE WAS OBTAINED BY INTERACTING WITH A CAV-1 UNIT. UNFORTUNATELY, I WAS UNABLE TO GET ANY TECHNICAL INFORMATION FROM SONY REGARDING THIS DEVICE, THEREFORE, THIS DOCUMENT MAY NOT BE COMPLETELY ACCURATE.
Section I. Overview
The CAV unit is an RS232 device that operates at 9600bps (8n1). There is a general format for both commands sent to the unit and responses received from the unit. This format consists of a sequence of bytes terminated in a 0xFF terminating character.
Example sequence --> 0x81 0x07 0x05 0x41 0x02 0x01 0xFF
The first byte in a sequence represents the direction: 0x81 is a command to the device, and 0x90 is status returned.
The second byte represents the complete length of the sequence, including the direction byte, the length byte, and the terminating byte.
The third byte describes the class of device which is to be controlled, and the connector to which the command is sent. Possible values include: 0x00 -- cancel, 0x01 -- pre-programmed infrared, 0x05 -- slink, 0x10 -- learned infrared.
The remaining bytes vary depending on the type of operation.
Section II. Pre-Programmed Infrared
There are two types of IR transmissions that can be done using the CAV hardware. The CAV unit comes with a set of pre-programmed IR sequences that can be used, and there is also an IR learning feature, which is described in Section IV.
To use a pre-programmed IR command, you need to send a sequence of bytes, as defined in section I. The third byte in the sequence, which defines the class of device, should be set to 0x01.
Byte four defines the device number of the unit that you are trying to control. See Appendix I for a partial list of device numbers.
Bytes five and six combine to define which "key to press" (for example, play, stop, etc.) See Appendix II for a partial list of key codes.
For example, the byte sequence for the PLAY button on a SONY CD player is: 0x81 0x07 0x01 0x41 0x02 0x01 0xFF.
After sending a byte sequences, you need to pause for ~50 milliseconds and send the sequence: 0x81 0x05 0x01 0x00 0xFF, which stops the IR transmitter.
Section III. SLINK
Sending basic commands via the SLINK port is very similar to using pre-programming infrared. There are, however, some differences. For SLINK commands, byte three should be set to 0x05. The transmitter stop sequence is also different. For SLINK, you need to use the sequence: 0x81 0x05 0x06 0x00 0xFF.
For example, to send the PLAY command to a SONY CD player via the SLINK port, the sequence is: 0x81 0x07 0x05 0x41 0x02 0x01 0xFF. This should be followed by a ~50 millisecond pause after which you send the sequence: 0x81 0x05 0x06 0x00 0xFF.
There are also more advanced commands that can be sent using SLINK, and since SLINK is a two-way bus, status can be sent from the device to the CAV as well.
See Appendix III for more information about advanced SLINK commands.
Section IV. Learning New Infrared Sequences
The second type of IR transmission that can be done with the CAV unit involves teaching it new IR sequences. The CAV has a certain number of memory locations into which can be stored an IR sequence. Each of these locations has an index number associated with it. When you instruct the CAV to learn a new sequence, you need to tell it which location index to store that sequence in. Likewise, you need to provide the index when you wish to play back the stored sequence.
To learn a new IR sequence, you need to send a sequence of bytes, as defined in section I. The third byte in the sequence, which defines the class of device, should be set to 0x10, the fourth byte should be set to 0x01, and the fifth byte should be set to the index location. For example, the sequence 0x81 0x06 0x10 0x01 0x01 0xFF, instructs the CAV to begin learning a new IR sequence and store it in location number 1.
After sending this command, there are several responses that the CAV may reply back with. The sequence 0x90 0x06 0x10 0x20 0x03 0xFF, signifies that the unit is in the process of receiving an IR transmission. The sequence 0x90 0x06 0x10 0x20 0x01 0xFF signifies that the unit has successfully learned the IR sequence, and the sequence 0x90 0x06 0x10 0x20 0x02 0xFF signifies that it has failed to learn the sequence.
A learn command can be canceled by sending the sequence 0x81 0x05 0x10 0x00 0xFF.
After the CAV has successfully learned an IR sequence, it can be played back by sending a sequence with byte three set to 0x10, byte four set to 0x02, and byte five set to the proper index. For example, the sequence 0x81 0x06 0x10 0x02 0x01 0xFF plays back the IR sequence stored in location number 1.
Appendix I. Device Codes
0x41, "Sony CD Player #1"
0x42, "Sony CD Player #2"
0x43, "Sony CD Player #3"
0x8d, "RCA VCR"
0xbc, "TOSHIBA TV"
Appendix II. IR & SLINK Key Codes
0x01, 0x10, "POWER"
0x02, 0x01, "PLAY"
0x02, 0x02, "STOP"
0x02, 0x03, "PAUSE"
0x02, 0x11, "REWIND"
0x02, 0x12, "FAST_FORWARD"
0x02, 0x13, "SEEK_BACK"
0x02, 0x14, "SEEK_FORWARD"
0x02, 0x15, "TRACK_DOWN"
0x02, 0x16, "TRACK_UP"
0x03, 0x01, "1"
0x03, 0x02, "2"
0x03, 0x03, "3"
0x03, 0x04, "4"
0x03, 0x05, "5"
0x03, 0x06, "6"
0x03, 0x07, "7"
0x03, 0x08, "8"
0x03, 0x09, "9"
0x03, 0x0A, "0"
0x03, 0x21, "CHANNEL_DOWN"
0x03, 0x22, "CHANNEL_UP"
Appendix III. Advanced SLINK Commands and Responses for a SONY CD Changer
The following sequences apply to a SONY CDP-CX250 CD changer. They may or may not apply to any other SONY CD players.
To Play a Specific Track:
> 0x81 0x09 0x05 0x41 0x03 0x42 [disc] [track] 0xFF
< 0x90 0x07 0x05 0x41 0x02 0x01 0xFF -- Play button "pushed"
< 0x90 0x07 0x05 0x41 0x02 0x81 0xFF -- Switching discs
< 0x90 0x07 0x05 0x41 0x02 0x82 0xFF -- Disc loaded
< 0x90 0x0B 0x05 0x41 0x20 0x50 [disc] [track] [minutes] [seconds] 0xFF -- Playing track
< 0x90 0x07 0x05 0x41 0x02 0x84 0xFF -- 30 Second end-of-track warning
To query the current disc:
> 0x81 0x07 0x05 0x41 0x20 0x20 0xFF
< 0x90 0x0c 0x05 0x41 0x20 0x20 0x?? 0x?? 0x?? [current disc] 0x?? 0xFF
To get information about the current disc: (ONLY WORKS FOR THE CURRENT DISC)
> 0x81 0x08 0x05 0x41 0x20 0x44 [current disc] 0xFF
< 0x90 0x0d 0x05 0x41 0x20 0x60 [disc] [track?] [track count] [minutes] [seconds] 0x?? 0xFF
To put the unit in "REMOTE" mode
> 0x81 0x07 0x05 0x41 0x10 0x01 0xFF
< 0x90 0x0c 0x05 0x41 0x20 0x20 0x?? 0x80 0x?? [current disc] 0x?? 0xFF
To take the unit out of "REMOTE" mode
> 0x81 0x07 0x05 0x41 0x10 0x02 0xFF
< 0x90 0x0c 0x05 0x41 0x20 0x20 0x?? 0xc0 0x?? [current disc] 0x?? 0xFF