aiden/Sony-rcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

run 13

Browse Source
This commit is contained in:
Aiden
2026-05-13 17:13:30 +10:00
parent 4c97f0aae9
commit 693735dc0a
17 changed files with 848 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

216
docs/discovery-notes.md
View File

@@ -3276,3 +3276,219 @@ For each test, power-cycle first and do not press any panel buttons. If C1/C2
produce `0x45`, the host can synthesize the CALL event path. If they do not,
the RCP's own physical CALL transition is required before the echo pair has
meaning.
### 2026-05-13 Cold No-Button CALL Injection Result
Captures:
- `captures/rcp-buttons-cold-call-pair-gap-50ms.txt`
- `captures/rcp-buttons-cold-call-pair-gap-80ms.txt`
- `captures/rcp-buttons-cold-call-high-only.txt`
- `captures/rcp-buttons-cold-call-low-only.txt`
Observed result:
| Test | Host startup frame(s) | Result |
| --- | --- | --- |
| C1 | `00 00 15 80 00 CF`, 50 ms gap, `00 00 15 00 00 4F` | `07 80 45 20 D0 68` |
| C2 | `00 00 15 80 00 CF`, 80 ms gap, `00 00 15 00 00 4F` | `07 80 45 20 D0 68` |
| C3 | `00 00 15 80 00 CF` only | heartbeat only |
| C4 | `00 00 15 00 00 4F` only | heartbeat only |
Interpretation:
- The host can synthesize the CALL `0x45` response path without pressing the
physical `CALL` button.
- The RCP does not require its own front-panel CALL transition before this path
has meaning.
- The required trigger is the ordered CALL-high then CALL-low pair with a small
inter-frame gap. Either frame alone is insufficient.
- This makes `00 00 15 80 00 CF -> 00 00 15 00 00 4F` a confirmed host-side
event stimulus, not merely an echo of physical button traffic.
- The response still returns to heartbeat afterward; this remains useful for
protocol probing but is not yet an activation/session handshake.
### Next CALL Tests
Two useful follow-ups now that the host can synthesize the CALL path:
1. Determine whether the synthetic CALL trigger is repeatable within one power
cycle, or whether the first `0x45` response latches/suppresses later ones.
2. Probe adjacent `0x45` family responses that might drive the illuminated CALL
button or another visible state.
### CALL Retrigger / Latch Tests
Tooling note:
- `scripts/serial_button_response_test.py` now supports repeating the startup
frame group with `--startup-repeat` and `--startup-repeat-interval`.
Test R1: two synthetic CALL trigger cycles, 2 second gap.
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 16 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --startup-repeat 2 --startup-repeat-interval 2.0 --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-repeat-2x-gap-2s.txt
```
Test R2: two synthetic CALL trigger cycles, 5 second gap.
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 22 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --startup-repeat 2 --startup-repeat-interval 5.0 --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-repeat-2x-gap-5s.txt
```
Test R3: three synthetic CALL trigger cycles, 2 second gap.
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 24 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --startup-repeat 3 --startup-repeat-interval 2.0 --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-repeat-3x-gap-2s.txt
```
Interpretation:
- If `Watch totals` shows one `0x45` hit per trigger cycle, this path is
repeatable and not a one-shot latch.
- If only the first cycle produces `0x45`, treat the CALL path as latched until
power cycle or some unknown reset.
- If later cycles produce `07 80 45 30 D0 78` instead of `...20...`, the RCP
may be stepping through a small state machine rather than simply suppressing
repeats.
### Adjacent `0x45` Family Follow-Up Tests
Goal: once the synthetic CALL pair has produced `07 80 45 20 D0 68`, send nearby
frames that might act like CALL lamp/tally control. Watch the CALL button lamp,
LCD, and serial stream after each follow-up.
Useful adjacent candidates:
| Candidate type | Follow-up frame | Why it is interesting |
| --- | --- | --- |
| host-shaped command below | `00 00 44 20 D0 EE` | adjacent command byte |
| host-shaped command known | `00 00 45 20 D0 EF` | same command, host-shaped |
| host-shaped command above | `00 00 46 20 D0 EC` | adjacent command byte |
| exact-family sibling seen once | `07 80 45 30 D0 78` | observed adjacent state |
| exact-family state below | `07 80 45 10 D0 58` | nearby state nibble |
| exact-family command above | `07 80 46 20 D0 6B` | nearby command nibble |
Run each candidate in a separate power cycle. The startup CALL pair is used only
to make the RCP produce the known `0x45` response first.
Test A1:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --followup-on-watch-frame --followup-frame "00 00 44 20 D0 EE" --log captures/rcp-buttons-call-adjacent-44-host.txt
```
Test A2:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --followup-on-watch-frame --followup-frame "00 00 45 20 D0 EF" --log captures/rcp-buttons-call-adjacent-45-host.txt
```
Test A3:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --followup-on-watch-frame --followup-frame "00 00 46 20 D0 EC" --log captures/rcp-buttons-call-adjacent-46-host.txt
```
Test A4:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --followup-on-watch-frame --followup-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-call-adjacent-45-state30.txt
```
Test A5:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --followup-on-watch-frame --followup-frame "07 80 45 10 D0 58" --log captures/rcp-buttons-call-adjacent-45-state10.txt
```
Test A6:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 15 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --watch-frame "07 80 45 20 D0 68" --followup-on-watch-frame --followup-frame "07 80 46 20 D0 6B" --log captures/rcp-buttons-call-adjacent-46-exact.txt
```
Record for each run:
- whether the CALL button lamp changes
- whether the LCD changes
- whether any non-heartbeat serial data appears after the follow-up
### 2026-05-13 Initial CALL Retrigger Result
Captures:
- `captures/rcp-buttons-cold-call-repeat-2x-gap-2s.txt`
- `captures/rcp-buttons-cold-call-repeat-2x-gap-5s.txt`
- `captures/rcp-buttons-cold-call-repeat-3x-gap-2s.txt`
Observed result:
- All configured synthetic CALL trigger cycles were transmitted.
- Each run recorded only one visible `07 80 45 20 D0 68`.
- No LCD change was observed beyond the already known `CONNECT NOT ACT`.
Important tooling limitation:
- In this first version of the repeat test, the helper sent all startup trigger
groups before entering its main RX loop.
- That means the captured `0x45` frame count is not a clean per-cycle measure.
A single buffered `0x45` at the end does not prove whether only one cycle
triggered or multiple triggers collapsed into one unread serial burst.
Interpretation:
- These runs suggest the CALL path may be latched or at least not obviously
retriggering, but they are not strong enough to prove it.
- A corrected repeat test must read after each trigger group before sending the
next one.
Tooling update:
- `scripts/serial_button_response_test.py` now supports
`--startup-read-after-group`, which reads and logs RX after each startup-frame
group before the next repeat.
Corrected repeat tests:
```powershell
python scripts/serial_button_response_test.py --port COM5 --duration 16 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --startup-repeat 2 --startup-repeat-interval 2.0 --startup-read-after-group 0.8 --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-repeat-2x-gap-2s-v2.txt
python scripts/serial_button_response_test.py --port COM5 --duration 22 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --startup-repeat 2 --startup-repeat-interval 5.0 --startup-read-after-group 0.8 --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-repeat-2x-gap-5s-v2.txt
python scripts/serial_button_response_test.py --port COM5 --duration 24 --prompt --startup-delay 1.0 --startup-frame-interval 0.05 --startup-frame "00 00 15 80 00 CF" --startup-frame "00 00 15 00 00 4F" --startup-repeat 3 --startup-repeat-interval 2.0 --startup-read-after-group 0.8 --watch-frame "07 80 45 20 D0 68" --watch-frame "07 80 45 30 D0 78" --log captures/rcp-buttons-cold-call-repeat-3x-gap-2s-v2.txt
```
### 2026-05-13 Adjacent `0x45` Follow-Up Result
Captures:
- `captures/rcp-buttons-call-adjacent-44-host.txt`
- `captures/rcp-buttons-call-adjacent-45-host.txt`
- `captures/rcp-buttons-call-adjacent-46-host.txt`
- `captures/rcp-buttons-call-adjacent-45-state30.txt`
- `captures/rcp-buttons-call-adjacent-45-state10.txt`
- `captures/rcp-buttons-call-adjacent-46-exact.txt`
User observation:
- No LCD changes were observed beyond the already known `CONNECT NOT ACT`.
- No CALL button lamp change was observed in these runs.
Serial result:
| Test | Follow-up frame after `07 80 45 20 D0 68` | Result |
| --- | --- | --- |
| A1 | `00 00 44 20 D0 EE` | heartbeat only after follow-up |
| A2 | `00 00 45 20 D0 EF` | heartbeat only after follow-up |
| A3 | `00 00 46 20 D0 EC` | heartbeat only after follow-up |
| A4 | `07 80 45 30 D0 78` | heartbeat only after follow-up |
| A5 | `07 80 45 10 D0 58` | heartbeat only after follow-up |
| A6 | `07 80 46 20 D0 6B` | heartbeat only after follow-up |
Interpretation:
- None of the first adjacent `0x45` family probes appear to drive the CALL lamp
or advance the serial state.
- The obvious nearby command/state variants are not enough on their own to act
like a CALL lamp/tally command.
- The CALL `0x45` family remains useful as a probe point, but the lamp control
is probably elsewhere in the protocol or needs more session context.