Firmware Variants

Five Winegard dish variants have been documented by Gabe Emerson (KL1FI) / saveitforparts and cdavidson0522. Each runs different firmware with its own serial protocol, motor commands, and boot sequence.

Variant Comparison Table

Detail	HAL 0.0.00	HAL 2.05.003	Trav’ler Pro	Carryout	Carryout G2
Repo	Travler_Rotor	Trav-ler-Rotor-For-HAL-2.05	Travler-Pro-Rotor	Carryout-Rotor	winegard-sky-scan
Connection	RS-485 / RJ-25	RS-485 / RJ-25	USB A-to-A (ttyACM0)	RS-485 / RJ-25	RS-422 / RJ-12 6P6C
Baud rate	57600	57600	57600	57600	115200
Motor submenu	mot	motor	odu then mot	N/A (target + g)	mot
Motor control	a <id> <deg>	a <id> <deg>	a <id> <deg>	g <az> <el> only	a <id> <deg>
Search kill	os -> kill Search	ngsearch -> s -> q	os -> kill Search	N/A	NVS 20 (permanent disable)
Boot signal	NoGPS	NoGPS or No LNB Voltage	undocumented	N/A	Boot Complete then Loc Startup: IDU NOT Present
Min elevation	15 deg	15 deg	12 deg	22 deg	18 deg
Max elevation	90 deg	90 deg	75 deg (hardware cap)	73 deg (NVS 102 override)	65 deg
Position query	a -> AZ = / EL =	a -> AZ = / EL =	a -> AZ = / EL =	raw ints / 100	a -> floats
Tested model	LG-2112	LG-2112	SK2DISH	2003 Carryout	Carryout G2
HAL version	0.0.00	2.05.003	unknown	1.00.065	02.02.48
Prompt char	> (likely)	> (likely)	undocumented	undocumented	TRK> / MOT> / NVS>
Position format	AZ = / EL =	AZ = / EL =	AZ = / EL =	raw ints / 100	Angle[0] = / Angle[1] =
DVB tuner	unknown	unknown	unknown	unknown	BCM4515 (Broadcom)
MCU	unknown	unknown	unknown	unknown	NXP MK60DN512VLQ10
Motor driver	unknown	unknown	unknown	unknown	2x Allegro A3981

Per-Variant Details

HAL 0.0.00

The original Trav’ler firmware found on older LG-2112 units.

• Connection: RS-485 half-duplex via RJ-25 at 57600 baud
• Motor submenu: mot
• Motor commands: a <id> <deg> for individual motor control (0=AZ, 1=EL)
• Search kill: Enter os submenu, then kill Search to terminate the satellite search task
• Boot signal: NoGPS indicates calibration is complete
• Position format: AZ = <val> EL = <val> SK = <val>
• Elevation range: 15 — 90 degrees
• Source: github.com/saveitforparts/Travler_Rotor

HAL 2.05

Updated Trav’ler firmware with a different search kill sequence.

• Connection: RS-485 half-duplex via RJ-25 at 57600 baud
• Motor submenu: motor (note: different from HAL 0.0.00’s mot)
• Motor commands: a <id> <deg> for individual motor control
• Search kill: ngsearch -> s -> q (three-step sequence)
• Boot signal: NoGPS or No LNB Voltage
• Position format: AZ = <val> EL = <val> SK = <val>
• Elevation range: 15 — 90 degrees
• Known issue: Leap-frog elevation bug (modifies target_az instead of target_el in lines 98-105)
• Source: github.com/saveitforparts/Trav-ler-Rotor-For-HAL-2.05

Trav'ler Pro

The Pro model has its own MCU in the IDU, requiring a tunnel command to reach the ODU motor controller.

• Connection: USB A-to-A (appears as ttyACM0)
• Motor submenu: Must first send odu to tunnel to the outdoor unit, then mot
• Motor commands: a <id> <deg> once inside the ODU motor submenu
• Search kill: os -> kill Search (same as HAL 0.0.00)
• Max elevation: 75 degrees (hardware cap, not firmware-configurable)
• Known issue: Same leap-frog elevation bug as HAL 2.05 (copy-pasted code)
• Source: github.com/saveitforparts/Travler-Pro-Rotor

Note

The regular Trav’ler’s IDU is a dumb RS-485 passthrough. The Pro’s IDU has its own MCU, so you must tunnel through it with the odu command before motor commands reach the ODU.

Carryout

The 2003 Carryout uses a completely different motor addressing scheme.

• Connection: RS-485 half-duplex via RJ-25 at 57600 baud
• Motor control: No individual motor addressing. Uses target to enter targeting mode, then g <az> <el> for combined moves
• Search kill: N/A (no documented search kill mechanism)
• Min elevation: 22 degrees (firmware-enforced)
• Max elevation: 73 degrees (firmware default, overridable via NVS 102)
• Position format: Raw integers divided by 100
• No limit switches: Uses motor stalling to detect mechanical boundaries (audible grinding during calibration)
• Cannot query initial position before first move
• DIP switches: All switches to off (up) may disable search mode, but behavior varies by unit
• Source: github.com/saveitforparts/Carryout-Rotor

Carryout G2

The most fully reverse-engineered variant. Over 100 firmware commands mapped across 12 submenus.

• Connection: RS-422 full-duplex via RJ-12 6P6C at 115200 baud
• Motor submenu: mot
• Motor commands: a <id> <deg> (protocol-compatible with the Trav’ler family)
• Search disable: NVS index 20 set to TRUE (permanent, one-time configuration)
• Boot sequence: Bootloader v1.01 -> SPI1 init (A3981 motor drivers) -> SPI2 init (BCM4515 DVB tuner) -> NVS load -> EL home -> AZ home -> TRK> prompt
• Position format: Angle[0] = <az> / Angle[1] = <el> (floats)
• Elevation range: 18 — 65 degrees
• Cable wrap: -423.33 to +23.33 degrees from home (total 446.66 degrees)
• MCU: NXP MK60DN512VLQ10 (Kinetis K60, Cortex-M4, 96 MHz, 512 KB flash, 128 KB RAM)
• Motor drivers: 2x Allegro A3981 (SPI, 1/16 microstep, AUTO mode)
• DVB tuner: BCM4515 (ID 0x4515, Rev B0, firmware v113.37)
• Firmware: Version 02.02.48 (Copyright 2013 - Winegard Company)
• Homing: Explicit h <id> motor home command. Uses stall detection.
• DVB/RSSI: Full signal strength measurement through BCM4515 tuner
• Source: github.com/cdavidson0522/winegard-sky-scan

Caution

When NVS 20 = TRUE (tracker disabled), homing is skipped entirely on boot. Motors stay uncalibrated and AZ position reads as INT_MAX (2147483647). You must run h * in the MOT submenu to home both axes before sending position commands.

Key Variant Differences

• Trav’ler Pro odu command: The Pro’s IDU has its own MCU. You must first tunnel to the ODU with odu before entering the motor submenu. The regular Trav’ler’s IDU is a dumb RS-485 passthrough.

• Carryout uses g not a: The 2003 Carryout has no individual motor addressing. It uses target to enter targeting mode, then g <az> <el> for combined moves. It also cannot query its initial position.

• Carryout has no limit switches: Uses motor stalling to detect mechanical boundaries (audible grinding during calibration).

• Pro has the same leap-frog bug as the regular Trav’ler (copy-pasted code). Fixed in this project’s leapfrog.py.

• NVS d command dumps all NVS values. Confirmed on Pro and Carryout G2; likely available on all variants.

• Carryout G2 uses a not g: Unlike the 2003 Carryout, the G2 uses standard a <id> <deg> motor addressing and the mot submenu — protocol-compatible with the Trav’ler family.

• Carryout G2 is RS-422 full-duplex: Separate TX/RX pairs at 115200 baud via RJ-12 6P6C, vs. RS-485 half-duplex at 57600 on the Trav’ler variants.

• Polarity matters on the G2: A/B (or +/-) labeling is not standardized. Garbled data at the correct baud rate means the RX pair polarity is swapped. Silent failure (no response from dish) means the TX pair polarity is swapped.

• Carryout G2 position format differs: Position query a in MOT> returns Angle[0] = 180.00 / Angle[1] = 45.00 instead of the AZ = / EL = format used by HAL 0.0.00 and HAL 2.05.

• Carryout G2 has h <id> homing: Explicit motor home-to-reference command. Not documented on other variants.

• Carryout G2 has DVB/RSSI: BCM4515 tuner provides signal strength measurement, DVB analysis, DiSEqC 2.x control, and a built-in radio telescope mode (azscanwxp).