# RCP-TX7 PCB Notes

These notes track direct physical observations from inside the Sony RCP-TX7.
They are intentionally separate from the PT2 protocol notes, because the board
layout and component choices may explain what the serial experiments alone do
not.

## Current Physical Overview

- The RCP appears to be split into **two circuit boards**.
- One board looks like a **front-panel / operator interface board**:
  - button matrix
  - lamps / indicators
  - LCD support
  - mostly resistors and small logic
  - many TI `HC595A`-family or similar shift-register-style chips
- That board connects through an intermediate link to a second board.
- The second board appears to be the **main logic / controller board**:
  - single-sided
  - carries the main digital devices
  - appears to contain the actual control logic / firmware for the RCP

## Connector / Wiring Observations

- The main logic board has an **8-pin connector** associated with the external
  10-pin plug/cable assembly.
- The **wire colors inside the RCP do not match** the cable color mapping noted
  earlier from the cable itself.
- This means:
  - internal color cannot be trusted as a one-to-one continuation of external
    cable color
  - the board-side harness should be mapped by continuity, not by color

## Identified Components

Observed on the main logic board:

- `Sanyo LC3564BM-10`
- `XICOR X20C05J-55 9926`
- `27C512 RCPTX7 V1.05 SONY98`
  - socketed / clip-retained
  - appears user-replaceable
  - additional marking observed: `0047K`
- `H8/536 HD`
- full observed line-by-line marking on the main controller:
  - small logo resembling a target / concentric mark
  - `H8/536`
  - `1B1     A`
  - `HD`
  - `6435368F  16`
  - `W34 JAPAN`
- several smaller TI logic ICs with varying markings

## Firmware Cluster Photo Notes

From the close-up photo of the firmware area:

- the firmware device is an **ST** `M27C512-10F1` family EPROM/OTP-style part
  carrying the Sony application label:
  - `27C512`
  - `RCPTX7`
  - `V1.05`
  - `©SONY98`
- the package-side marking also shows:
  - `M27C512`
  - `10F1`
  - `58826`
  - `0047K`
  - `SINGAPORE`
- the ROM is installed in a **socket**, which strongly supports the idea that
  the firmware can be removed and dumped without desoldering
- the `XICOR X20C05J-55` sits immediately beside the firmware device
- the `LC3564BM-10` sits directly above the firmware area

This creates a very plausible classic memory cluster:

- EPROM = program storage
- SRAM = working memory
- Xicor NVRAM/EEPROM = retained setup/configuration data

## Silkscreen Clarifications From Photo

The close-up suggests a couple of earlier markings may need cautious reading:

- the vertical marking beside the ROM socket still looks like
  `CNI12` / `CN112`-like text and should be rechecked carefully from the board
  itself
- `RV1` appears near an **unpopulated footprint** below the ROM area
  rather than clearly identifying the ROM itself

So, for now:

- treat `RV1` as a likely local board reference near that empty footprint
- do not treat `RV1` as the firmware module identifier

## Additional Photo-Backed Board Observations

From the newer board photos:

### Internal Harness Connector

- the internal board connector is silked as **`CN1`**
- it is an **8-pin connector**
- the visible wire colors at this connector appear to be:
  - red
  - brown
  - white
  - orange
  - yellow
  - gray
  - blue
  - black
- this reinforces the earlier point that the internal harness color order does
  **not** match the earlier external cable-color assumptions

Useful implication:

- `CN1` is now the strongest candidate for the board-side harness/IO connector
  that should be traced against the external 10-pin cable assembly

### `CN1` Continuity Mapping

Based on your continuity tracing and the board silkscreen numbering:

| `CN1` pin | Observed function | Internal wire color | External 10-pin |
| --- | --- | --- | --- |
| `1` | `VBS (X) IN` | white | pin `2` |
| `2` | `VBS (G) IN` | blue | pin `3` |
| `3` | data ground | grey | pin `5` |
| `4` | data `RCP -> CCU` | yellow | pin `4` |
| `5` | data `CCU -> RCP` | orange | pin `7` |
| `6` | data ground | brown | pin `6` |
| `7` | ground | black | pin `9` |
| `8` | `DC+` | red | pin `10` |

Important observations:

- `CN1` pin `7` is the main ground path and maps to external pin `9`
- `CN1` pin `8` is DC power and maps to external pin `10`
- the serial pair is now clearly confirmed at the board level:
  - `CN1` pin `4` / external pin `4` = `RCP -> CCU`
  - `CN1` pin `5` / external pin `7` = `CCU -> RCP`
- there are **two additional non-serial signal inputs** on external pins `2`
  and `3`
- there are **two separate data-ground/return lines** on external pins `5` and
  `6`

Very important electrical note from tracing:

- the two data-ground lines (`CN1` pins `3` and `6`) were observed as **not
  connected to common ground**

That strongly suggests the connector is not just:

- power
- one TX line
- one RX line

Instead, it likely carries a mixed signal set with at least:

- analog/video-related inputs
- serial/control
- separate signal returns
- power/common ground

Refined grounding observation:

- the separate data grounds appear to connect to common ground **through small
  ceramic capacitors** near the connector
- the relevant parts are labeled:
  - `C55`
  - `C56`

This changes the interpretation from "totally isolated grounds" to something
more like:

- DC-isolated or not directly hard-tied
- but AC-coupled / noise-referenced to common ground

That is a very plausible arrangement for:

- signal-return noise control
- EMI filtering
- keeping the data pair referenced without fully hard-bonding the return paths

### Manual Cross-Check: External Connector Signals

The manual fragment for the external connector aligns very strongly with the
continuity map we traced:

| External pin | Manual signal | Notes |
| --- | --- | --- |
| `1` | `(SPARE)` | matches the fact that it has not appeared on `CN1` |
| `2` | `VBS (X) IN` | manual notes `1.0 Vp-p, sync negative` |
| `3` | `VBS (G) IN` | confirms a second VBS input line |
| `4` | `S. DATA (RCP -> CCU)` | matches traced serial-out line |
| `5` | `S. DATA GND` | matches traced separate data ground |
| `6` | `S. DATA GND` | matches traced separate data ground |
| `7` | `S. DATA (CCU -> RCP)` | matches traced serial-in line |

This is a strong confirmation that the harness tracing is fundamentally right.

Big implication:

- `VBS (X) IN` and `VBS (G) IN` are not mystery wires anymore
- they are documented inputs and are likely meaningful to normal panel
  operation
- the wake/session problem may therefore depend on more than serial traffic,
  although board-level routing now suggests that may vary by revision/options

The manual wording also strengthens the idea that these are likely
video/reference-style inputs rather than general-purpose logic lines.

### H8 / DIP Area

- the H8 marking is now clearly readable in-package as:
  - `H8/536`
  - `HD`
  - `6435368F16`
  - `W34 JAPAN`
- the DIP switches `S2` and `S3` are clearly visible above the H8
- the switches show an `ON` legend on one side, which will help keep bit
  numbering consistent during testing
- the pin-number silkscreen around the H8 is clearly printed, which supports
  the earlier observation that the DIP banks land in the `43-50` region

### Likely `S1` Footprint

- one photo shows an **unpopulated circular-pad footprint** labeled `S1`
- this is important because it suggests:
  - `S1` was not "missing from our search" by accident
  - it may be an intentionally unpopulated switch or selector position on this
    board revision
  - Sony may have designed this PCB for multiple variants/options

This makes the earlier "no visible `S1`" mystery much less mysterious.

### Board / Assembly Markings

- one photo shows a boxed marking:
  - `A-8315`
  - `-095-A`
- there is also a small sticker:
  - `2A1`

Working interpretation:

- `A-8315-095-A` is very likely a Sony board or assembly identifier
- `2A1` may be an inspection, revision, or production tracking sticker

### Additional Logic / Glue Area

- one of the smaller TI chips in the photo area is marked `HC74A`
- this is consistent with ordinary glue logic / state / timing support around
  the CPU rather than with a second major processor
- nearby resistor-network and option-footprint areas also fit the picture of a
  configurable CPU/control board with variant population options

### Serial Interface Confirmation

Tracing from the connector into the board:

- external pin `4` / `CN1` pin `4` goes to a `MAX202` device at package pad
  `14`
- external pin `7` / `CN1` pin `5` goes to the same `MAX202` device at package
  pad `13`
- no other `CN1` pins were observed going to that `MAX202`

Observed marking on the interface chip:

- `MAX202`
- `CSE 0107`

Interpretation:

- this is a very strong confirmation that the PT2 serial path is carried as a
  real RS-232-style interface through a dedicated line transceiver
- it also strongly implies the other connector lines (`1`, `2`, `3`, `6`) are
  **not** just extra serial handshake pins to the same interface chip
- the wake/session problem may therefore involve:
  - analog/video sense inputs
  - separate return/reference behavior
  - or higher-level protocol/state expectations beyond the RS-232 channel alone

Refined serial-ground read:

- because the two `S. DATA GND` lines are capacitor-coupled to common ground,
  the serial interface likely expects a somewhat cleaner/dedicated return
  structure than a naive "everything tied straight together" hookup
- this does **not** by itself explain the missing wake/session behavior
- but it does support the idea that Sony treated the remote link as a proper
  interface with controlled grounding rather than as a casual single-ground
  wiring bundle

### Important Open Electrical Discrepancy

The manual fragment for external pin `7` appears to describe:

- `Zi >= 10 kohm`
- high/open state around `4.5 +/- 0.5 V`
- low state around `0 +/- 0.5 V`

That does **not** read like a classic bipolar RS-232-level description.

But the board tracing currently shows external pin `7` going into the `MAX202`
at pad `13` (`R1IN` on a standard MAX202 pinout), while external pin `4` goes
to pad `14` (`T1OUT`).

So there is now a real discrepancy to resolve:

1. the manual signal description for pin `7` looks logic/open style
2. the board tracing looks like an RS-232 transceiver path

Possible explanations to keep open for now:

- the manual fragment may describe behavior at a different system boundary or
  for a slightly different revision/context
- the Sony interface may be electrically unusual despite using a `MAX202`
- there may be surrounding circuitry affecting how the line behaves at the
  connector

For now, the safest conclusion is:

- the signal names are strongly confirmed
- the exact electrical behavior still needs reconciliation

### Board Construction / Routing Note

- The board appears to be a **2-layer PCB**
- Components are populated on only **one side**
- With transmitted light, traces appear visible on the opposite side, with no
  obvious evidence of hidden inner layers

This matters because it makes visual trace-following more trustworthy and makes
the connector routing conclusions stronger.

### VBS Routing Observation

New tracing observation:

- `VBS (X) IN` and `VBS (G) IN` do **not** appear to run into the CPU/serial
  section directly
- instead, they route to the side of the board toward an **empty connector
  position labeled `CN5`**
- the only other obvious trace associated with that area appears to be ground

Working interpretation:

- the VBS lines may be routed primarily to an **unpopulated optional connector
  or daughterboard position**
- this could mean:
  - the TX7 PCB was designed for a variant that used the VBS signals more
    directly
  - this particular board revision does not currently use them in the populated
    build
  - or the signals are simply passed through / made available without deep
    local processing

Why this matters:

- this weakens the earlier "VBS is definitely the missing wake input" theory
- it does **not** eliminate it completely
- but it does suggest the most immediate wake/session logic is still more likely
  to live in:
  - the serial path
  - the DIP/boot configuration
  - optional/unpopulated variant circuitry
  - or retained configuration in NVRAM/firmware

## Additional Silkscreen / Board Markings

Observed so far:

- possible connector / reference markings:
  - `RV1`
  - `CNI12`
- near the `H8/536`:
  - `CNI50`
- DIP switches:
  - `S2`
  - `S3`
- board label:
  - `EP-(GW+GN)`
- large board text:
  - `CPU-345`
- board appears visually split into quadrants
- the main custom Sony chip appears to sit in:
  - `B-2`

## Initial Interpretation

These are working interpretations, not yet final identifications.

- `27C512 RCPTX7 V1.05 SONY98`
  - very likely the panel firmware EPROM
  - the `V1.05` label strongly suggests a firmware revision
  - the socketed mounting is very useful for restoration and dumping
- `H8/536 HD`
  - likely the main microcontroller or one of the main controllers
  - especially likely given that the DIP switches reportedly connect to it
  - the full observed marking is consistent with a Hitachi `HD6435368F`
    H8-family MCU
- `X20C05`
  - likely nonvolatile storage for configuration / calibration / retained setup
- `LC3564BM-10`
  - likely RAM or working memory associated with the controller/firmware
- TI `HC595A`-style parts on the front board
  - consistent with lamp, display, or scanned front-panel I/O expansion

Additional interpretation from the newer markings:

- `0047K` on the EPROM may be:
  - an internal Sony build/program label
  - a batch/date/option code
  - or a board/personality identifier tied to this firmware image
- `CPU-345` strongly suggests this board is treated by Sony as a CPU/control
  board assembly rather than only an interface board
- `B-2` may be a board-coordinate locator, which could help if a service manual
  or board overlay ever turns up
- `CNI12` and `CNI50` both look more like connector/reference designators than
  component values
- `RV1` is ambiguous:
  - often that would imply a variable resistor / trim pot
  - but if the silkscreen is hard to read, it is worth re-checking because it
    may instead be another connector or reference prefix
- the `H8/536` line-by-line marking strongly suggests the main CPU is not a
  Sony custom controller but a member of the Hitachi H8 family, with Sony
  firmware and surrounding glue logic providing the product-specific behavior
- the `16` suffix likely indicates a speed grade / variant marker rather than a
  board reference
- the `JAPAN` marking fits an original Japanese-manufactured MCU package

## Cross-Equipment Clue

- The RM-M7G reportedly contains a chip with the same target-like logo and
  `JAPAN` marking from the same apparent manufacturer family.

Why this matters:

- the RCP-TX7 and RM-M7G may share a similar controller platform philosophy
- they may use related H8-family firmware architecture even if the surrounding
  hardware and protocol behavior differ
- this strengthens the idea that DIP-config, ROM content, and NVRAM content may
  matter as much as the raw serial traffic itself

## DIP Switches

- There are **two 4-position DIP switches**
- All switches are currently **off**
- One side of each DIP bank appears tied together
- They appear to act as **ground sinks / pull-to-ground configuration inputs**
- They reportedly connect to the `H8/536`
- The DIP switch reference designators are:
  - `S2`
  - `S3`
- Based on the silkscreen tracing, the DIP switches connect to
  **pins 43 through 50**

This makes them likely candidates for:

- panel address / ID selection
- mode or personality selection
- service / factory configuration
- communication mode selection

Notable oddity:

- no obvious `S1` has been found yet

That could mean:

- `S1` exists on another board
- `S1` is an unpopulated option on this revision
- `S1` is present but hidden/obscured
- Sony numbering simply did not start at `S1` on this assembly

Why the `43-50` range matters:

- eight switch positions feeding a contiguous pin range is exactly what you
  would expect for a boot-time configuration byte or bitfield
- that makes `S2` + `S3` look less like analog trims and more like true digital
  mode/config inputs
- if those really are `H8/536` pins, they may be read very early at reset or
  power-up

Current best interpretation of the DIP banks:

- together they likely form an **8-bit configuration field**
- likely uses pull-ups or default highs on the MCU side
- each switch probably pulls its line low when turned on
- possible meanings still include:
  - panel address
  - model/personality select
  - PT mode / CCU compatibility mode
  - service / factory behavior bits
  - test/diagnostic mode

## Missing / Unpopulated Components

- Several components look **intentionally unpopulated**

For now, assume these may be:

- factory options
- alternate hardware revisions
- model-variant population differences
- unused test or expansion circuitry

They should not be treated as damaged/missing until compared against:

- both PCB sides
- silk labels
- any service-manual board drawing
- other RCP-TX7 board photos, if found later

The newer photos strengthen this:

- `S1` now appears to be an intentionally unpopulated footprint
- there are at least two additional unpopulated IC footprints in the same area
- this board very likely supported multiple build options or derivatives

## Why This Matters

This hardware picture is encouraging because it suggests the RCP is not just a
"dumb front panel."

It likely contains:

- a real MCU (`H8/536`)
- local firmware (`27C512`)
- nonvolatile memory (`X20C05`)
- a front-panel scan / display subsystem

That means the panel may have:

- multiple boot/configuration modes
- stored setup or address data
- more internal state than the serial experiments alone reveal

It also makes a **firmware dump** or **DIP-switch mapping** potentially very
high-value later.

## Next Hardware Inspection Targets

Highest-value things to map next:

1. Exact full part markings on the `H8/536` package
2. Exact full part markings on the `LC3564BM-10`
3. Exact full part markings on each smaller TI logic IC near the I/O connector
4. Continuity from the external 10-pin pins to the main-board connector pins
   - especially through `CN1`
5. Continuity from the serial pins (`4`, `7`, `9`, `10`) to their destination
   chips/components
6. Whether any of the remaining wires land on:
   - MCU GPIO
   - analog conditioning
   - optocouplers
   - comparator/op-amp circuitry
   - transceiver/interface ICs
7. Silk labels near the two DIP switch blocks
   - including the exact orientation of the `ON` legend on `S2` and `S3`
8. Any test pads labeled for:
   - `TX`
   - `RX`
   - `CLK`
   - `DATA`
   - `RST`
   - `ROM`
   - `RAM`
   - `GND`
   - `+5V`
   - `+12V`

## Strong Next Leads

Based on the current findings, the best hardware-side leads are:

1. **Map the DIP switches**
   - note silk labels
   - test whether any switch changes startup behavior or serial responses
   - specifically record the current `S2` / `S3` bit positions before touching
   - if possible, determine whether the switches are read only at boot or also
     during runtime
2. **Dump or at least photograph the EPROM label and socket area clearly**
   - the socketed `27C512` is one of the most promising restoration clues
   - include the `0047K` marking in the photo record
3. **Trace the 8-pin internal connector**
   - identify which of those lines are serial, power, and "something else"
4. **Identify whether the 10-pin path includes a dedicated interface chip**
    - if not, the extra lines may go directly into the MCU or surrounding logic
5. **Verify the likely connector references**
   - confirm whether `CNI12` is the 8-pin internal cable header
   - confirm whether `CNI50` refers to the H8 area, a nearby header, or another
     assembly reference
   - note that `CN1` is now the strongest observed silk for the internal
     8-pin harness connector in the photos
6. **Compare the RM-M7G controller board if possible**
   - look for the exact MCU family/part
   - compare ROM / EEPROM / switch architecture
   - note whether Sony reused the same CPU platform with different front-end
     logic

## Open Questions

- Is the `H8/536` definitely the primary CPU, or is there another Sony custom
  controller sharing that role?
- Is the socketed `27C512` the only firmware store?
- What exactly is stored in the `X20C05`?
- Do the DIP switches select mode, address, or board variant?
- Do `S2`/`S3` form a single boot configuration byte across MCU pins `43-50`?
- Do any of the non-serial wires carry required wake/session information?
- Is there a hardware reason the panel never fully leaves `CONNECT NOT ACT`
  under our emulated PT2 traffic?
- What do `CPU-345`, `EP-(GW+GN)`, `CNI12`, and `CNI50` correspond to in Sony's
  internal board naming?
- Is `A-8315-095-A` the specific board assembly number for this CPU board?
- Does the RM-M7G use the same H8-family controller and a similar ROM/NVRAM
  arrangement?

## DIP Switch Experiment Ladder

Current known baseline:

- all 8 DIP positions are currently **off**
- switches are grouped as:
  - `S2` = 4 positions
  - `S3` = 4 positions
- together they likely feed MCU pins `43-50`

### Safety / Method

Use this method for every DIP test:

1. Photograph the current DIP positions before changing anything.
2. Change **one switch only**.
3. Reassemble only as much as needed for safe power-on.
4. Power up the panel.
5. Observe behavior **before connecting serial**.
6. Then run the normal serial baseline checks.
7. Power down fully before changing the next switch.
8. Return to the all-off baseline between non-adjacent tests.

Recommended observations for each run:

- LCD startup text
- whether the active light changes
- whether `CONNECT NOT ACT` appears, and when
- whether the idle heartbeat is still `00 00 00 00 80 DA`
- whether known probes still behave the same:
  - `A0`
  - `90`
  - `AF`
  - `E8`
  - `EC`
- any new button behavior in idle state
- any change in baud-like behavior or complete silence

### Naming Convention

Use a simple notation in notes/logs:

- baseline = `S2=0000 S3=0000`
- example single change:
  - `S2=1000 S3=0000`
  - meaning only the first `S2` switch is changed from baseline

If the physical switch numbering is unclear, first label them visually as:

- `S2-1` .. `S2-4`
- `S3-1` .. `S3-4`

based on one fixed left-to-right or top-to-bottom convention, and stick to it.

### Phase 1: Single-Bit Sweep

Goal:

- find out whether any single DIP bit has an obvious effect on startup,
  protocol, or front-panel behavior

Run these eight tests, always starting from all-off baseline:

1. `S2-1` on, all others off
2. `S2-2` on, all others off
3. `S2-3` on, all others off
4. `S2-4` on, all others off
5. `S3-1` on, all others off
6. `S3-2` on, all others off
7. `S3-3` on, all others off
8. `S3-4` on, all others off

For each test:

- power-cycle
- watch LCD/startup state
- check for idle heartbeat
- try one minimal probe set:
  - idle listen
  - `A0`
  - `A0 -> 90`
  - `A0 -> AF`

What would count as a hit:

- panel boots into a different visible mode
- panel no longer shows `CONNECT NOT ACT`
- heartbeat changes or disappears
- known startup families change:
  - `64 40 30`
  - `0D 04 AB`
  - `0D 04 EB`
  - `E4 40 30`
- buttons become active in idle

### Phase 2: Group Identity Test

Only do this after Phase 1.

Goal:

- see whether one whole DIP bank behaves like an address nibble or mode nibble

Run these four tests:

1. all `S2` on, `S3` all off
2. all `S2` off, all `S3` on
3. all `S2` on, all `S3` on
4. return to all off baseline and confirm behavior is restored

What this can reveal:

- one bank may control personality while the other controls address
- one bank may do nothing while the other changes the panel sharply
- all-on may expose service/test behavior that single-bit changes do not

### Phase 3: Follow-Up Only If A Bit Matters

If Phase 1 reveals a promising bit, branch carefully:

1. repeat that same switch setting twice to confirm reproducibility
2. test neighboring bits in the same bank
3. test that bit plus one neighboring bit
4. compare:
   - startup text
   - heartbeat
   - `A0 -> 90`
   - `A0 -> AF`
   - `E8` / `EC` selector behavior

### Good First Serial Checks Per DIP Setting

Keep the serial side small at first.

Recommended order:

1. idle listen only
2. repeating heartbeat only
3. `A0`
4. `A0 -> 90`
5. `A0 -> AF`

Only if something changes meaningfully, then test:

- `E8`
- `E9`
- `EC`
- CALL synthetic trigger

### Strong Cautions

- Do not change multiple unknown DIP bits at once in the first pass.
- Do not assume "on" means logic high; it may actually pull the line low.
- Some switches may only be sampled at cold boot, not warm reset.
- A strange setting may stop normal serial output entirely; that is still a
  useful result.
- If one setting produces a dramatically different boot state, stop and record
  it before going wider.

## DIP Switch First-Pass Results

The first single-bit sweep produced a useful answer:

- the DIP switches are **not** inert
- but they do **not** seem to act like a blunt "service mode on/off" in the
  simplest sense

What changed visibly:

- user reported that the first tested DIP setting briefly showed a **small
  cursor on the LCD**
- the other single-bit settings looked the same visually

What changed serially:

- `S3-1` shifted the `A0 -> 90` startup family from:
  - `07 80 64 40 30 C9`
  to:
  - `07 80 E4 40 30 49`
- `S2-3` suppressed the `A0 -> 90` branch entirely in the first pass
- `S2-1` left `A0 -> 90` alive but appears to have flattened `A0 -> AF`

Best current hardware interpretation:

- the DIP banks very likely participate in **startup personality / mode
  selection**
- they may not directly control "active vs inactive panel"
- but they clearly can steer which startup-family surface the firmware exposes

This is consistent with the earlier suspicion that `S2` + `S3` form a boot-time
configuration byte rather than casual front-panel options.
