I confirmed what opl3 said about the attack starting point not necessarily being 511. I allowed a waveform to rise completely, then during the decay / release phase I turned off the note and then turned it back on again. The result is that the attack starts from the point that the envelope had fallen to during the decay / release phase. The first attack started from a putative envelope level of 511, through 383, 287, 215, 161,120,89,66,49,36,26,19,14,10,7,5,3,2,1,0.
Then having fallen to 60 a new attack phase took it up through 44, 32,23,17,12,8,5,3,2,1,0.
A further fall to 96 was then followed by a third attack through 71,53,39,29,21,15,11,8,5,3,2,1,0.
The attack rate in the experiment was 14, so this is using the f(x) = x - (x/4) - 1 algorithm.