Console Commands

Full command inventory from automated deep probe + interactive ? exploration (firmware 02.02.48, captured 2026-02-12). Automated probing finds commands that respond without arguments; interactive ? in each submenu reveals the full set including parameter-requiring commands the probe misses.

Known Console Hazards

ADC scan without arguments on uncalibrated AZ: Targets position 2147483647 (INT_MAX), motor task blocks forever, shell deadlocks. No serial input (CR, Ctrl+C, ESC, q, reboot) can recover — requires hardware power cycle. The firmware shell is single-threaded: UART input is only parsed between command completions, so a blocking motor move prevents all input.

Root q command: Terminates the shell task entirely. Console becomes unresponsive until power cycle.

Root Menu (TRK>)

The root prompt provides access to 12 submenus plus system commands.

Command	Description
?	List available commands (alias: help)
a3981	Enter motor driver submenu
adc	Enter ADC submenu
dipswitch	Enter dipswitch submenu
dvb	Enter DVB tuner submenu
eeprom	Enter EEPROM submenu
gpio	Enter GPIO submenu
latlon	Enter lat/lon calculator submenu
mot	Enter motor control submenu
nvs	Enter non-volatile storage submenu
os	Enter OS submenu
peak	Enter peak/DiSEqC switch submenu
step	Enter stepper motor submenu
reboot	Reboot firmware
stow	Fold dish flat (caution: modified feeds may not survive)
odu	Tunnel to outdoor unit (Trav’ler Pro only)
ngsearch	Enter search submenu (HAL 2.05 only)

Danger

The q command at the root menu terminates the shell task entirely. The console becomes unresponsive and requires a hardware power cycle to recover. Only use q inside submenus to return to the parent menu.

Note

command appeared in automated probe results — this is a false positive. The help parser extracted it from the help [<command>] usage text, where <command> is a parameter placeholder, not an actual command.

---

A3981 Submenu (A3981>) — Allegro Stepper Driver

6 commands. Controls the two A3981 stepper motor driver ICs via SPI.

Command	Description
cm	Current control mode: AZ/EL both report “AUTO” or “HiZ”/“LoZ”
diag	Fault pin status: “AZ DIAG: OK EL DIAG: OK” (or FAULT)
reset	Reset AZ/EL A3981 fault flags
sm	Step size mode: AZ/EL both report “AUTO” or fixed mode
ss	Step size: returns integer (FULL=16, HALF=8, QTR=4, EIGHTH=2, SIXTEENTH=1)
st	Torque level: AZ/EL report “HIGH” (moving) or “LOW” (idle/holding)
? / q	Help / return to TRK>

The step size value is an inverted divisor — 1 means 1/16 microstepping (finest), 16 means full stepping (coarsest). In AUTO mode, the A3981 dynamically adjusts microstepping based on motor speed.

---

ADC Submenu (ADC>) — Analog-to-Digital Converter

5 commands. Hardware-level ADC readings from the LNB signal chain and board ID.

Command	Description
bdid	Board identity: returns “STATIONARY” (Carryout G2 variant)
bdrevid	Board revision: returns “A”
m	Monitor RSSI (streaming, CR-overwrite line, interrupt with q)
rssi	Single-shot RSSI (raw ADC count, ~233-238 noise floor)
scan	AZ sweep with per-position RSSI/Lock/SNR readings
? / q	Help / return to TRK>

The scan command outputs: Motor:<id> Angle:<cdeg> RSSI:<adc> Lock:<0/1> SNR:<dB> Scan Delta:<step>

scan deadlock

Running scan without arguments on an uncalibrated AZ axis targets INT_MAX (2147483647), which deadlocks the shell permanently. The only recovery is a hardware power cycle. Always home the motors before using scan.

---

DIPSWITCH Submenu (DIPSWITCH>)

1 command. Reads physical DIP switch GPIOs and interprets satellite config code.

Command	Description
dipswitch	Read dipswitch: val:<hex32> (raw GPIO) + app_dipswitch:<decimal> (interpreted)
? / q	Help / return to TRK>

Example: val:ffffff01 = all switches OFF/up. app_dipswitch:101 = DISH 110+119+129 degrees W.

---

DVB Submenu (DVB>) — BCM4515 Tuner

38 commands. Controls the Broadcom BCM4515 DVB-S2 tuner and DiSEqC 2.x LNB interface. Help is paginated: ? shows the first page, man shows extended commands.

Signal Measurement

Command	Type	Description
rssi <n>	One-shot	RSSI averaged over n samples. Returns Reads:<n> RSSI[avg: <v> cur: <v>]
snr	Streaming	SNR level (avg + current). Interrupt with q
agc	Streaming	RF/IF AGC + SNR + NID. Interrupt with q
qls	Streaming	Quick lock status at ~100ms intervals: Lock:0 rssi:500 cnt:0
nid	Streaming	Network ID (CR-overwrite display, FFFF = no signal)
stats	Streaming	Accumulated signal statistics (silent when no lock)

Channel Configuration

Command	Type	Description
dis	One-shot	Display channel parameters (frequency, symbol rate, LNB polarity)
e <n> <v>	Write	Edit channel parameter
freqs	One-shot	Tuner frequency list name
range	One-shot	Transponder scan range
t <n>	Write	Select transponder

LNB / Power

Command	Type	Description
lnbdc odu	One-shot	Enable LNA in ODU mode (13V = V-pol; boot default 18V = H-pol)
lnbv	Streaming	Stream LNB voltage readings. Interrupt with q
pwr	One-shot	SDS and DiSEqC core power state

Scanning / Lock

Command	Type	Description
ls	Streaming	Full transponder lock scan. Exits DVB submenu on interrupt
config	One-shot	BCM hardware/firmware version (ID 0x4515, Rev B0, FW v113.37)
diag	One-shot	Multi-block per-transponder diagnostics
table	One-shot	Full 32-transponder scan (~136 seconds)
tablex	Toggle	Extended table mode (on/off)
srch	Toggle	Search transponders mode (on/off)
srch_mode	One-shot	Auto search mode value
shuf	Toggle	Transponder shuffle order (on/off)
def	Write	Reset all params to defaults (silent, no confirmation, no undo)
msw	Write	Modulation switch (format unknown)

Timeout Settings

Command	Type	Description
tabto	Read/Write	Table scan timeouts (acq/nid/sd)
to	Read/Write	Single tune timeouts (acq/nid)

DiSEqC 2.x Commands

Command	Type	Description
di2conf	Read	DiSEqC LNB config register
di2cs	Write	DiSEqC committed switch command
di2id	Read	DiSEqC read LNB hardware ID
di2rcs	Read	DiSEqC read committed switch status
di2sc	Read	DiSEqC switch control
di2stat	Read	DiSEqC read LNB status flags
ovraddr	Read/Write	DiSEqC override address (default 0x11)
pretx	Read/Write	DiSEqC pre-transmit delay (default 15 ms)
rrto	Read/Write	DiSEqC receive reply timeout (default 210 ms)
send <hex>	Write	Raw DiSEqC packet (max 6 bytes, space-delimited hex)
tdthresh	Read/Write	DiSEqC tone detect threshold (default 110)

Other

Command	Description
man	Extended help page
? / q	Help / return to TRK>

Caution

Streaming commands (snr, agc, lnbv, qls, nid, stats) run until CR interrupts them. All stay in the DVB submenu when interrupted except ls, which drops to TRK> (exits the DVB submenu entirely).

Caution

The def command silently resets all channel parameters to defaults with no output, no confirmation, and no undo.

---

EEPROM Submenu (EE>) — K60 FlexNVM/EEPROM

3 commands. Low-level EEPROM access (separate from NVS). The prompt is EE>, not EEPROM>. Most indices read as 0 (unwritten) or fail with val:65793 (0x10101 marker = uninitialized). The firmware primarily uses NVS, not EEPROM, for persistent settings.

Command	Description
ee <idx> [<v>]	Read/write EEPROM value at index. Read: Index:<n> Read value = <v> or Failed to read eeprom index:<n> val:65793
inv <idx>	INVALIDATE EEPROM index (destructive — marks entry invalid, not “inventory”)
def	Restore EEPROM defaults
? / q	Help / return to TRK>

Danger

inv means invalidate, not “inventory”. It destructively marks an EEPROM index as invalid by writing the 0x00010101 sentinel. There is no confirmation prompt. Use def to restore factory defaults if needed.

---

GPIO Submenu (GPIO>)

4 commands. Direct access to K60 GPIO ports A-E. Pin naming: <port><pin> (e.g., B0, E12).

Command	Description
dir <pin>	Query pin direction: returns “INPUT” or “OUTPUT”
r <pin>	Read single GPIO pin value (0 or 1)
regs	Dump ALL GPIO pin states across ports A-E (26+16+20+16+14 = 92 pins)
w <pin> <val>	Write GPIO pin (requires pin name and value)
? / q	Help / return to TRK>

Note

Pins A20-A23 and B12-B15 are not enumerated (not bonded on the 144-LQFP package). E29 shows “Unknown bit E29” in the firmware output.

---

LATLON Submenu (LATLON>)

1 command. Satellite triangulation calculator — computes ground station lat/lon from look angles to two known geostationary satellites. Used for auto-location when GPS is unavailable. Values stored internally as centidegrees.

Command	Description
l <p1> <p2> <p3> <p4>	Calculate lat/lon from 4 parameters (likely AZ/EL pairs for 2 satellites)
? / q	Help / return to TRK>

Output format:

anglesentered = <cdeg1> <cdeg2> <cdeg3> <cdeg4>
Lat = <cdeg>  Lon = <cdeg>

Values are in centidegrees: Lat = 4295 means 42.95 degrees N, Lon = 25655 means 256.55 degrees E (= 103.45 degrees W).

---

MOT Submenu (MOT>) — Motor Control

25 commands. High-level motor control with angle-based positioning.

Position and Movement

Command	Description
a	Show position: Angle[0] (AZ), Angle[1] (EL)
a <id> <deg>	Move motor to absolute angle (0=AZ, 1=EL)
a <id> +/-deg	Relative move (G2 only, undocumented in upstream)
g <az> <el>	Go to AZ/EL (aborts on new input)
h <id>	Home motor to reference position (stall-detect based)
e	Engage motors (energize steppers)
r	Release motors (de-energize steppers)

Information Queries

Command	Description
l	List motors and state (0=AZIMUTH, 1=ELEVATION)
p	Read raw step positions
v	Read motor velocities
ma	Read max acceleration per motor
mv	Max velocity per motor
elminmaxhome	Show EL limits: Min: <v> Max: <v> Home: <v> (NVS values)
ela2s <deg>	Elevation angle to steps converter
els2a <steps>	Elevation steps to angle converter

Scanning

Command	Description
azscan [az_rel] [el_rel] [delay]	AZ sweep: scan relative AZ range at EL steps with delay
azscanwxp [motor] [span_deg] [res_cdeg] [num_xponders]	AZ sweep + transponder cycling (radio telescope mode)

Configuration

Command	Description
pid [motor] [Kp] [Kv] [Ki]	Read or set PID gains for motor control loop
sp [motor] [pos]	Set position (override current position register)
sw [motor] [pos]	Set wrap position (cable wrap reference point)
w [motor] [ON/OFF]	Wrap manager: enable/disable cable wrap protection per motor
vms [motor] [deg_per_rev] [ms]	Velocity move for duration

Testing

Command	Description
life	Motor lifetime/usage stats
motorboth	Simultaneous dual-motor move test
motorlife	Detailed motor life statistics
sd	Stall detection test (motor, direction, timeout)
? / q	Help / return to TRK>

azscanwxp — Radio Telescope Mode

The azscanwxp command performs an azimuth sweep while cycling through DVB transponders at each position. This is the core of Davidson’s winegard-sky-scan project for RF imaging.

Parameter	Type	Units	Description
motor	int	—	Motor ID (0=AZ, 1=EL)
span	float	degrees	Total azimuth sweep range
resolution	int	centidegrees	Step size per position
num_xponders	int	—	Number of transponders to cycle at each position

Example: azscanwxp 0 10 100 3 — sweep 10 degrees on AZ at 1.00 degree steps, checking 3 transponders per position.

Caution

Requires homed motors. Do NOT run on uncalibrated axes — the firmware may target INT_MAX (2147483647 steps) and deadlock the shell.

---

NVS Submenu (NVS>) — Non-Volatile Storage

5 commands. See the NVS Settings page for a full index dump.

Command	Description
d	Dump all NVS values (name/current/saved/default)
d <idx>	Dump single value with details
e <idx>	Read NVS value at index
e <idx> <v>	Write NVS value at index (NOT saved until s)
s	Save pending changes to flash
? / q	Help / return to TRK>

Caution

NVS e <idx> <value> writes values immediately to the in-memory copy. Changes are NOT persisted to flash until you send s. Any unrecognized input is treated as a sequential index read (no error string), which generates false positives during probing but is harmless.

---

OS Submenu (OS>)

2 commands on the Carryout G2 (4 on HAL 0.0.00).

Command	Description	Availability
id	Full MCU/firmware identification (NVS version, System ID, chip)	All variants
reboot	Reboot microcontroller	All variants
tasks	List running tasks	HAL 0.0.00 only
kill <name>	Kill a named task	HAL 0.0.00 only
? / q	Help / return to TRK>	All variants

Note

tasks and kill are not available on the Carryout G2. On the G2, the satellite search is disabled permanently via NVS index 20 instead of killing a running task.

---

PEAK Submenu (PEAK>) — Signal Peak / DiSEqC Switch

6 commands. EchoStar/DiSEqC switch control and LNB polarity-switched RSSI.

Command	Description
pw	Peak signal search (likely requires satellite lock)
psnr	Peak SNR measurement
pxy1	Peak XY single-axis (2D cross-pattern peak search)
rssits	RSSI with LNB toggle switch: alternates H-pol (18V, even transponders) and V-pol (13V, odd transponders). Reports Even_sig = <v>, Odd_sig = <v>. Noise floor: even ~489, odd ~235 (V-pol quieter). Exits submenu on interrupt.
stb	STB (set-top box) control / DiSEqC switch test
ts	EchoStar switch toggle status: SW Status: 0b<binary> <decimal> (all zeros = no switch connected)
? / q	Help / return to TRK>

Caution

The ts command runs indefinitely, probing for a DiSEqC/EchoStar switch by toggling LNB voltage. It cannot be stopped by sending q — the running command consumes all input. Close and reopen the serial port to escape.

---

STEP Submenu (STEP>) — Low-Level Stepper Control

7 commands. Raw stepper API in microstep units (ustep/sec, ustep/sec/msec). MOT wraps STEP with angle-to-step conversion.

Command	Description
e	Engage motor (same as MOT e)
ma	Max acceleration: Accel[0] = 44 / Accel[1] = 28 (ustep/sec/ms). Set: ma [motor] [ustep/sec/ms]
mv	Max velocity: Max Vel [0] = 7222 / Max Vel [1] = 3120 (ustep/sec). Set: mv [motor] [ustep/sec]
p	Goto position in raw step counts: p [motor] [steps]
pid	PID values: Kp=250 Kv=50 (no Ki at STEP level). Set: pid [motor] [Kp] [Kv]
r	Release motors (same as MOT r)
v	Go to velocity (continuous spin): v [motor] [ustep/sec]
? / q	Help / return to TRK>

STEP to MOT Conversion

The relationship between STEP microstep units and MOT degree units:

Parameter	STEP value	MOT value	Conversion factor
AZ velocity	7222 ustep/s	65.0 deg/s	40000 steps/rev / 360 = 111.11 steps/deg
EL velocity	3120 ustep/s	45.0 deg/s	24960 steps/rev / 360 = 69.33 steps/deg
AZ acceleration	44 ustep/s/ms	~396 deg/s^2	x1000 / 111.11
EL acceleration	28 ustep/s/ms	~404 deg/s^2	x1000 / 69.33

---

DiSEqC 2.x Interface

The BCM4515 provides a DiSEqC 2.x controller accessible from the DVB> submenu. DiSEqC (Digital Satellite Equipment Control) uses 22 kHz tone bursts on the coax LNB bias line to control switches, LNB polarity, and band selection.

Timing Parameters (confirmed live)

Command	Value	Description
ovraddr	0x11	Target LNB address (standard first LNB)
rrto	210 ms	Receive reply timeout
pretx	15 ms	Pre-command TX delay
tdthresh	110	Tone detect threshold (0.16 counts/mV)

DiSEqC Status

Command	Function	Status
di2conf	Read LNB config register	RxReplyTimeout (no switch connected)
di2id	Read LNB hardware ID	RxReplyTimeout
di2stat	Read LNB status flags	RxReplyTimeout
di2rcs	Read committed switch status	RxReplyTimeout
di2cs	Configure committed switch	Needs parameters
di2sc	Short circuit test	Untested
send <hex>	Raw DiSEqC packet (max 6 bytes)	Functional

Raw DiSEqC packets use the send command with space-delimited hex bytes. Standard DiSEqC 1.x commands: send E0 10 38 Fx where the last byte selects the switch port (F0-F3 for ports 1-4).

---

Error Messages

Message	Meaning
AZ MOTOR STALLED	Obstruction preventing rotation
EL MOTOR STALLED	Obstruction preventing elevation change
EL Motor Home Failure	Requires EL recalibration via IDU menu
Step to Position EL angle error: 2147483647	INT_MAX sentinel — motor axis uncalibrated/unhomed