Wiki / Protocols
RCX opcode table
The full RCX command set sent over the RCX IR protocol (two-way IR via the tower). Source: *Kekoa Proudfoot, RCX Internals*** + opcodes (mralligator) — check exact argument bit-layouts there.
How opcodes work
- Each command byte is followed by its complement in the frame; the payload ends with
checksum, ~checksum. - Opcode bit 0x08 is a toggle that flips between consecutive commands so the RCX ignores accidental repeats — that's why each opcode shows as a pair (e.g.
0x12 / 0x1a). - A reply opcode = the bitwise complement of the request (
0x12→0xed,0x1a→0xe5). - Requests get a reply; bytecode opcodes (no reply) only run inside a downloaded program.
Requests (PC ↔ RCX, act immediately)
| Opcode | Command | Args |
|---|---|---|
| 0x10 | Alive / ping | — |
| 0x12 | Get Value | source, argument → short |
| 0x13 | Set Motor Power | motors, source, power 0–7 |
| 0x16 | Set Motor Direction | code (bits: A/B/C, 0x40 flip, 0x80 fwd) |
| 0x21 | Set Motor On/Off | code (bits: A/B/C, 0x40 off, 0x80 on) |
| 0x23 | Play Tone | frequency (Hz, short), duration (1/100 s) |
| 0x51 | Play Sound | sound 0–5 |
| 0x14 | Set Variable | index 0–31, source, value |
| 0x24 | Add to Variable | index, source, value |
| 0x34 | Subtract from Variable | index, source, value |
| 0x44 | Divide Variable | index, source, value |
| 0x54 | Multiply Variable | index, source, value |
| 0x63 | Or Variable | index, source, value |
| 0x73 | And Variable | index, source, value |
| 0x64 | Sign Variable | index, source, value |
| 0x74 | Absolute Value | index, source, value |
| 0x32 | Set Sensor Type | sensor 0–2, type 0–4 |
| 0x42 | Set Sensor Mode | sensor, mode / slope |
| 0x26 | Clear Sensor Value | sensor |
| 0x56 | Clear Timer | timer |
| 0x66 | Set Program Number | program 0–4 |
| 0x71 | Start Task | task |
| 0x76 | Stop Task | task |
| 0x50 | Stop All Tasks | — |
| 0x61 | Delete Task | task |
| 0x40 | Delete All Tasks | — |
| 0x36 | Delete Subroutine | subroutine |
| 0x70 | Delete All Subroutines | — |
| 0x25 | Start Task Download | task, length |
| 0x35 | Start Subroutine Download | subroutine, length |
| 0x45 | Transfer Data | index, length, data[], checksum |
| 0x75 | Start Firmware Download | address, checksum |
| 0x65 | Delete Firmware | key[5] |
| 0x52 | Set Datalog Size / Unlock Firmware | size · or · key[5] |
| 0x53 | Upload Datalog | first, count |
| 0x62 | Datalog Next | source, argument |
| 0x15 | Get Versions | key[5] → ROM + firmware |
| 0x20 | Get Memory Map | — |
| 0x30 | Get Battery Power | → millivolts |
| 0x31 | Set Transmitter Range | range (short / long) |
| 0x22 | Set Time | hours, minutes |
| 0x33 | Set Display | source, argument |
| 0x46 | Set Power Down Delay | minutes |
| 0x60 | Power Off | — |
Bytecode (inside a downloaded program; no reply)
| Opcode | Command | Args |
|---|---|---|
| 0x43 | Wait | source, argument |
| 0x17 | Call Subroutine | subroutine |
| 0xf6 | Return from Subroutine | — |
| 0x27 | Branch Always (near) | offset |
| 0x72 | Branch Always (far) | offset (2-byte) |
| 0x85 | Test and Branch (near) | sources, args, offset |
| 0x95 | Test and Branch (far) | sources, args, offset |
| 0x82 | Set Loop Counter | source, argument |
| 0x37 | Decrement Loop Counter (near) | offset |
| 0x92 | Decrement Loop Counter (far) | offset |
| 0x90 | Clear Message | — |
| 0xf7 | Set Message | message byte (only request with no reply) |
| 0xb2 | Send Message | source, argument (broadcasts over IR) |
See RCX IR protocol for messaging detail (Set Message vs Send Message).
Value sources (the source byte)
0 Variable · 1 Timer · 2 Immediate (constant) · 3 Motor state · 4 Random · 5–7 reserved · 8 Current program · 9 Sensor value · 10 Sensor type · 11 Sensor mode · 12 Raw sensor · 13 Boolean sensor · 14 Clock · 15 Message.
→ e.g. Send Message with source = 2 sends a constant; source = 0 sends a variable's value.