R588 Parking Logic

What this simulator is based on. Taken from firmware 1.0.2.0.20261010 itself: the ACC sampler and its thresholds, the time-lapse entry and exit, the battery-protection windows, the three button bands (acted on release), the Wi-Fi switch behaviour, every settings list and factory default in the app (the firmware's own option tables), the recording folders and bitrates, and the voice files and where they are played — and checked against the camera on the bench (reports/53 §10, 54 §10, 56–59).

Indicator. One blue LED: 1 s on / 1 s off while recording, dark when recording stops — confirmed in the firmware and on the device. The red LED is lit by the bootloader during a firmware update. A stopped recording shows the same dark LED as a camera with no power. The camera has no screen and no GPS.

Hardware facts. 12 V vehicle power through the 3-wire kit (B+ / ACC / GND) gives every mode; on 5 V USB (or a 2-wire connection) the camera cannot see the ignition — it always stays in driving mode, and neither parking mode nor battery protection is available. R588 front 2560×1440 at 30 fps; R688 front 3840×2160 at 25 fps, upscaled from 2560×1440; rear 1920×1080 at 25 fps on both. Date and time are stamped into the picture as YYYY-MM-DD HH:MM:SS; file names are YYYY_MM_DD_HHMMSS_NN.TS (time-lapse files end in _t.TS). No pre-record before an event. The app sets the camera clock from the phone on every connection. "mirror display from left to right" acts on the rear camera, "vertical reflection" on the front camera — two different settings.

Device behaviour — developer reference. §1–10 describe the target logic we asked the vendor for (the hidden "Planned" profile). The page now runs firmware .930 as it really behaves — see §11. Timings come from the firmware (address in brackets).

1 · Inputs & power states. Two wires decide everything: B+ (constant 12 V) and ACC (ignition); the state is derived. No B+ or a tripped low-voltage latch → OFF. ACC on → DRIVING. ACC off with the parking timer still running → PARKING (time-lapse). ACC off otherwise → SLEEP (deep sleep, G-sensor armed).

2 · Boot & announcements. Any entry from OFF and every ACC edge runs the power-on path: chime start.mp3 (readiness only), then the mode word — accOn.mp3 מצב נסיעה on ACC on, accOff.mp3 מצב חניה on ACC off — then startRec. Recovery from a low-voltage cut is a full boot with the same notification, not a silent resume.

3 · Recording & files. Loop segments of Rec_Split_Time go to Normal/F·Normal/R; protected clips to Event/*, parking clips to Parking/* (F=front, R=rear). R588 front 2560×1440@30, R688 front 3840×2160@25 (upscaled from 2560×1440), rear 1920×1080@25. Files YYYY_MM_DD_HHMMSS_NN.TS, stamp in the picture YYYY-MM-DD HH:MM:SS. No pre-record. On any power-down the current buffer is flushed to a file first (LVP cut, B+ removed, ACC off, parking window ending) so the last clip is never lost, even below the normal 3 s minimum.

4 · G-sensor (two independent levels). GSR_SENSITIVITY (“G-Sensor Sensitivity”) is the driving impact level, LOW/MIDDLE/HIGH with no OFF — the floor is LOW (default), which does not false-trigger; an impact while DRIVING writes an Event clip. GSR_PARKING (app label “Parking Monitor”) is the parking level, OFF/LOW/MIDDLE/HIGH, default OFF — it decides whether the parked camera stays up at all. On the move the confirmation is a single short beep du.mp3.

5 · Parking (ACC off). Parking Monitor decides whether the camera stays up at all; Time-lapse decides, separately, whether it keeps recording. Monitor off → powerOff.mp3 and the camera powers down whatever Time-lapse says, only the ignition wakes it. Monitor on + Lapse off → sleeps listening; an impact wakes it, records one Rec_Split_Time, sleeps again. Monitor on + Lapse on → time-lapse runs the window; an impact switches to normal 25/30 fps for one Rec_Split_Time, then time-lapse resumes.

6 · Low-voltage protection (LVP) (reports/53; on the camera 89 s and 59 s, i.e. 1–1.5 min). Not available on 5 V USB power; the cut is ignored while an event clip is being written. Armed in one place only — when the time-lapse starts (LVP_Enable(1) @0x35168, not on 5 V) — and stays armed until the camera reboots; outside the time-lapse the camera is down anyway, so nothing measures the battery there. Threshold LOW_POWER_PROTECT = 11.8 / 12.0 / 12.2 V (value-set 34, factory 11.8; ADC 1005/1025/1038). The thread GAUGE_LEVEL_CHECK @0xe80ac takes one sample every 1.010 s, closes a window every 30 samples, and a window whose average is at or below the threshold counts one; a window above resets the series (@0xe8234). Two low windows in a row power the camera down: ≈61 s from arming. No hysteresis: raising the supply resets nothing, and after the cut only ACC on or a B+ reconnect brings the camera back. On the cut: Wi-Fi off, recording stopped and the file finalised, G-sensor interrupt disabled (SetSensitity(0) @0x34414 — an impact will not wake it), power-hold released (0x120b4020 ← 0). Planned announces powerOff.mp3 first; the real builds are silent. Real-build defect: the sample counter boots at −1 (.data 0x363f88) and arming does not reset it, so the first window holds 31 samples ÷ 30 — its average reads 3.3 % high and can miss the cut-off, costing a third window (≈91 s; measured on the bench with 11.45 V against 11.8 V: time-lapse 14:11:01 → last frame 14:12:26–30). Planned counts the first window correctly.

7 · Wi-Fi AP. SSID R588_XXXXXX / R688_XXXXXX (the last 3 bytes of the MAC in hex, prefix from network.wifi.ap.softap_ssid_def; seen on cameras: R588_D26C69, R688_D294AD), password 12345678, WPA2, 2.4 GHz, channel 6, camera at 192.168.0.1. Follows the ignition: off ≈2 s after ACC OFF, 1.0.2.0: not started at boot and not on ACC ON — only the button (reports/65 §3); switches itself off within ≈5 minutes with no phone connected (300 s timer, counting only while no station is associated); the button held 3–9 s switches it back on or off. The hidden "Planned" profile instead keeps the AP independent of the ignition with a 60 s idle timer.

8 · Button (single key, acted on release). Up to ≈3 s = the current video becomes a protected 30 s Event clip; 3–9 s = Wi-Fi on/off; over 9 s = factory reset. 1.0.2.0: the physical R588 button is key1 (ADC 335–395); its handler window is 3000–9000 ms for Wi-Fi and >9000 ms for factory reset (was 5000; reports/65 §0.1 #4 — the owner measured reset at ≥10 s). The page switches at 3 and 9 s. (The .930 profile keeps its calibrated 3.5 / 7 s.) No power-off branch. During the time-lapse a short press is only a beep.

9 · LED. One blue LED: blinks once a second while recording, dark when idle. Red is the bootloader during a firmware update, never the app.

10 · App / backend interface. HTTP CGI on port 80 (/cgi-bin/hisnet/*.cgi, -type=/-value=), live stream rtsp://<ip>/livestream/1 on 554, no auth beyond WPA2 (client identified by IP). Events surface as {"eventid":…,"arg1":…}. No cloud path to the camera — all control is local.

11 · Firmware 1.0.1.9.20260930 — what the page runs (reports/54 §8/§10, 55; everything not listed is as .929, reports/51–53). Earlier builds (Planned, .911, .918, .929) stay in the code as hidden profiles.

Topic	.930 on the camera
Factory settings	G-Sensor Sensitivity MIDDLE, Parking Monitor MIDDLE, time-lapse OFF, LOW_POWER_PROTECT 11.8 V (param, 4 bytes changed); the G-sensor menu has no OFF.
ACC OFF	ACC sampled once a second (Off=15 / On=23 / OffWf=2 — counts of 1 s samples, @0x319c0). If ACC was off at both boot samples (B+-only start, no U-Boot 0x88), the camera decides "two lines" (@0x31efc) and ACC OFF is not handled at all until ACC is first seen on. ≈2 s by the code (0x10437003): מצב חניה + Wi-Fi off — the operator hears it at ≈5 s (queue and player latency, not modelled); recording goes on in Normal/. ≈15 s (0x10437000), by time-lapse only: on → stop, 1 s, time-lapse + צילום בחניה הופעל; off → silent PowerOff, power-hold released ≈17 s, G-sensor armed if Parking Monitor is on.
ACC ON	Camera up (driving, within 15 s of ACC off, or after a B+-only start): מצב נסיעה on the edge — the first 1 Hz sample, 0–1 s after the wire (0x10437002 @0x16350 → accOn @0x354bc; gates only time-lapse flag and src≠0), as soon as the speaker is free; boot prompts that are not queued yet do not hold it back (reports/64). Camera down: a full boot (≈10 s), then chime, מצב נסיעה ≈3 s into the first file (start thread @0x332fc, unless the flag below is set) and ההקלטה החלה ≈5.8 s. From the time-lapse: מצב נסיעה once at ≈5–6 s (0x10437001), 2 s, record stop, reboot ≈10 s without recording (card: last time-lapse frame 14:54:05 → first Normal frame 14:54:15), then chime + ההקלטה החלה — no second «driving»: the reboot helper writes 1 to PMC 0x120f0058 (@0x345fc) and the start thread skips accOn when it reads 1 (@0x332e8).
Sticky flag 0x120f0058	Nothing in the firmware clears it (only writes of 1: reboot-from-time-lapse, FactoryReset, G-wake clip end with ACC on). On the camera it survived a power-off: after any exit from the time-lapse every later start with ACC on is chime + ההקלטה החלה without מצב נסיעה (15:08). The owner accepts this. Modelled as cleared only by removing B+ (NOT PROVEN for the register).
Impact, driving	du only; the running segment moves to Event/ and is extended by 30 s (front loses 0.4 s at the switch — card, .929); dropped while a prompt plays (D2).
Impact, time-lapse	New in .930: du → 0x83000201 → 30 s Event/F,R clip at 30 fps, then back to the time-lapse at 4 fps instead of 3 (@0x23ba4); the parking timer keeps running. Card: 14:50:00→14:50:30 at 30 fps, time-lapse from 14:50:30 without a gap; one clip started ≈2 s after the impact (those seconds stayed in the time-lapse). A second impact during the clip: du only, no new event, no extension. LVP is not handled while the clip runs (@0x35354).
Impact, camera down	Parking Monitor on: G-sensor INT boots the camera (≈10 s), chime (start.mp3, service_init @0x1702c), a pause of ≈3 s, then מצב חניה (start thread @0x332c8; accOff.mp3 itself opens with a 0.5 s two-tone ding) — no du on a wake by code, one 30 s Event/ clip (30–48 s on the card), then PowerOff or, if ACC is back, a reboot (which also sets the flag above). Monitor off, or after an LVP cut: the interrupt is off (SetSensitity(0)) — an impact does not wake it (confirmed 14:41).
Low-voltage cut	As reports/53: armed at the time-lapse entry only, 11.8/12.0/12.2 V, one sample per 1.01 s, 30-sample windows, two low windows in a row, no hysteresis, silent; first window after boot is 31÷30 (average +3.3 %) → 89 s at 11.45 V (card 14:39:18→14:40:47) or 59 s well below the cut-off (14:43:01→14:44:00). Wi-Fi off, file finalised, G-sensor interrupt off, power-hold released; back only on ACC on / B+.
App start/stop, Wi-Fi	workmodecmd.cgi start/stop are spoken (ההקלטה החלה / הופסקה). Wi-Fi R588_XXXXXX / R688_XXXXXX, password 12345678, WPA2, 2.4 GHz, channel 6; off ≈2 s after ACC OFF; in 1.0.2.0 on only by the button (held 3–9 s), never at boot or ACC ON; switches itself off within ≈5 minutes with no phone connected ("Wi-Fi off" is spoken); the button held 3–9 s turns it on or off.
Power	12 V through the 3-wire kit (B+ / ACC / GND): every mode. 5 V USB or a 2-wire connection: the camera cannot see the ignition — driving mode only, no parking mode, no battery protection. U-Boot .930 flags "ACC on at boot" so a 3-wire start is never mistaken for 2-wire wiring.
Settings	"mirror display from left to right" = the rear camera image; "vertical reflection" = the front camera image — two separate fields. The app sets the camera clock from the phone on every connection (setsystime.cgi → syncTime.mp3); at start-up the camera reminds to sync the time up to 3 times while the year is ≤ 2025. Speed unit is unused (no GPS). No screen.
Memory card	FAT32, 64 KB clusters. A card the camera cannot use (exFAT 64 GB+, other cluster size, damaged file system) may be formatted automatically on insertion, erasing its contents; the camera says תקלה בכרטיס הזיכרון ("memory card error", up to 3 times after start-up) while it cannot record. Format from the app: no voice (the startformatCard.mp3 call was removed @0x34ad8); getsdinfo reports status=1 while formatting; recording resumes ≈10 s later.
U-Boot check_acc	U-Boot .930 reads the ACC pin at boot and, if ACC is on, writes 0x88 to 0x120f0048; multi_cam then treats ACC as connected ("uboot Check acc on") — a start with ACC on can no longer be misread as two-wire wiring with ACC events disabled. Not modelled (the page always assumes three wires). U-Boot is otherwise unchanged; it is still written first and without verify on an update (reports/55).

12 · Firmware 1.0.2.0.20261010 — the default build (reports/65, 66). Everything else is .930 (ACC 15/23/2, LVP, G-wake, voice timing reports/64, sticky 0x120f0058).

Topic	1.0.2.0 vs .930
Wi-Fi at boot	Off. The start thread no longer calls app_network_start (A 0x334e0–0x334f0 removed, B 0x333c4); no other boot path starts the AP.
Wi-Fi at ACC ON	Stays off. PDT_UI_ProcAccEvents lost ProcWifiSwitchEvent(3,1) (reports/65 §3.2); the log line "acc turn on wifi" is still printed. ACC OFF still switches it off (≈2 s); the 300 s idle timer is unchanged.
Button (key1)	<3000 ms = protected clip; 3000–9000 ms = Wi-Fi toggle (wifiOn/wifiOff.mp3); >9000 ms = factory reset (was >5000).
Format voice	startformatCard.mp3 is called again — format from the app and auto-format.
Impact, time-lapse	As .930: 30 s clip → Event/F,R (renamed after 30.2 s), then back to the time-lapse at 4 fps; rear restart pause 100→200 ms (reports/66). Build 20261010: front waits 300 ms after the mode switch before recording starts (reports/67).
App version string	R588_261010 (container 1.0.2.0.20261010).