Wiki / Devices

LEGO Remote Control (9738)

Status: ✅ protocol confirmed & replicated (an ESP32 + IR LED tower drives a real Scout at good range)

The handheld IR Remote Control for LEGO MINDSTORMS (set/part 9738, remote = BrickLink part x124, 1998–99). It drives an RCX or Scout directly over the same 38 kHz / 2400-baud RCX IR link — it is not a simple consumer-IR carrier. 16 buttons, each a bit in a 16-bit key mask sent with opcode 0xD2.

Protocol

Standard RCX frame; the payload is D2 hi lo (opcode + big-endian 16-bit key mask):

55 FF 00   D2 2D   hi ~hi   lo ~lo   csum ~csum

checksum = (D2 + hi + lo) & 0xFF, sent with its complement.
Example — "Motor A forward" (key 0x0008): 55 FF 00 D2 2D 00 FF 08 F7 DA 25 — matches a real IR capture of the remote byte-for-byte.
No toggle bit. Unlike PC↔RCX command opcodes (which flip bit 0x08 to reject repeats), the remote sends a fixed 0xD2; holding a button just re-sends the identical packet continuously. Fire-and-forget — the brick sends no reply.
It is a true bitmask: several buttons can be encoded at once (e.g. A▲+B▲ = 0x0018), though not every firmware dispatches combinations.

Button map (16-bit key mask)

Confirmed bit-by-bit from the leJOS RemoteControlSensor.inspect() source and a real IR capture.

Bit	Button	On the RCX	On the Scout
`0x0001`	Message 1	send IR message = 1 (read by a running program, e.g. NQC `Message()`)	❓ undocumented
`0x0002`	Message 2	send IR message = 2	❓ undocumented
`0x0004`	Message 3	send IR message = 3	❓ undocumented
`0x0008`	A ▲	Motor A forward	real Motor A ✅
`0x0010`	B ▲	Motor B forward	real Motor B ✅
`0x0020`	C ▲	Motor C forward	⚡ not a motor — Scout emits VLL "forward" on its red LED / Motor-C output → drives a Micro Scout in P-mode ✅
`0x0040`	A ▼	Motor A backward	Motor A backward
`0x0080`	B ▼	Motor B backward	Motor B backward
`0x0100`	C ▼	Motor C backward	⚡ VLL "backward" to the Micro Scout
`0x0200`	P1	select + run program slot 1	❓ no clean mapping (Scout has 1 program slot, not 5)
`0x0400`	P2	program slot 2	❓
`0x0800`	P3	program slot 3	❓
`0x1000`	P4	program slot 4	❓
`0x2000`	P5	program slot 5	❓
`0x4000`	Stop	stop motors and the running program	stop (plausible, unconfirmed)
`0x8000`	Sound	play a beep	beep (plausible, unconfirmed)

Grouping on the faceplate: 6 motor arrows (A/B/C × ▲/▼) · 5 program buttons (P1–P5) · 3 message buttons (Msg 1–3) · Stop · Sound.

RCX vs Scout — what actually happens

RCX obeys every button: motors latch on until Stop, P1–P5 run the 5 downloaded program slots, Msg 1–3 feed a running program, Sound beeps. Works with no program running for motors, but program/message buttons need matching code.
Scout (confirmed by O Falcão + LUGNET/Kollross): accepts motor commands with no program running. A/B = the two real motors. Motor C is repurposed as the VLL LED output — so C▲/C▼ makes the Scout relay VLL forward/backward to a Micro Scout. This means you can puppet a Micro Scout from the remote through the Scout (remote → Scout → Micro Scout), no PC or tower needed.
P1–P5, Msg 1–3, Sound, Stop on the Scout are not documented — the Scout's single-program model has no obvious P1–P5 mapping. Report as unknown, not fact.

Replicate it

Any 38 kHz IR emitter can be the remote — just send the 0xD2 frames. An ESP32 + IR LED generating the 38 kHz carrier drives a real Scout at good range: aim at the Scout's middle IR port (not the light sensor), Scout idle with options OFF. A Web-Serial page can build the 55 FF 00 D2 … frames and stream them to the board (send them without the toggle bit to match the real remote).

Sources

leJOS source RemoteControlSensor.java / Opcode.java (OPCODE_REMOTE_COMMAND = 0xd2, bit-by-bit button map): lejos.sourceforge.io
O Falcão, Decoding RCX IR command protocol (real capture D2 00 08, framing, "2 motors + Scout LED"): ofalcao.pt
LUGNET, Mike Kollross — Scout third motor / MicroScout hack ("Scout accepts motor commands from the remote without a program"; Motor C = VLL): news.lugnet.com
NQC source #define kRCX_Remote 0xd2; RCX opcode table / RCX Internals (Kekoa Proudfoot).