pcb

docs/pcb-notes.md

@@ -0,0 +1,573 @@
+# RCP-TX7 PCB Notes
+
+These notes track direct physical observations from inside the Sony RCP-TX7.
+They are intentionally separate from the PT2 protocol notes, because the board
+layout and component choices may explain what the serial experiments alone do
+not.
+
+## Current Physical Overview
+
+- The RCP appears to be split into **two circuit boards**.
+- One board looks like a **front-panel / operator interface board**:
+  - button matrix
+  - lamps / indicators
+  - LCD support
+  - mostly resistors and small logic
+  - many TI `HC595A`-family or similar shift-register-style chips
+- That board connects through an intermediate link to a second board.
+- The second board appears to be the **main logic / controller board**:
+  - single-sided
+  - carries the main digital devices
+  - appears to contain the actual control logic / firmware for the RCP
+
+## Connector / Wiring Observations
+
+- The main logic board has an **8-pin connector** associated with the external
+  10-pin plug/cable assembly.
+- The **wire colors inside the RCP do not match** the cable color mapping noted
+  earlier from the cable itself.
+- This means:
+  - internal color cannot be trusted as a one-to-one continuation of external
+    cable color
+  - the board-side harness should be mapped by continuity, not by color
+
+## Identified Components
+
+Observed on the main logic board:
+
+- `Sanyo LC3564BM-10`
+- `XICOR X20C05J-55 9926`
+- `27C512 RCPTX7 V1.05 SONY98`
+  - socketed / clip-retained
+  - appears user-replaceable
+  - additional marking observed: `0047K`
+- `H8/536 HD`
+- full observed line-by-line marking on the main controller:
+  - small logo resembling a target / concentric mark
+  - `H8/536`
+  - `1B1     A`
+  - `HD`
+  - `6435368F  16`
+  - `W34 JAPAN`
+- several smaller TI logic ICs with varying markings
+
+## Firmware Cluster Photo Notes
+
+From the close-up photo of the firmware area:
+
+- the firmware device is an **ST** `M27C512-10F1` family EPROM/OTP-style part
+  carrying the Sony application label:
+  - `27C512`
+  - `RCPTX7`
+  - `V1.05`
+  - `©SONY98`
+- the package-side marking also shows:
+  - `M27C512`
+  - `10F1`
+  - `58826`
+  - `0047K`
+  - `SINGAPORE`
+- the ROM is installed in a **socket**, which strongly supports the idea that
+  the firmware can be removed and dumped without desoldering
+- the `XICOR X20C05J-55` sits immediately beside the firmware device
+- the `LC3564BM-10` sits directly above the firmware area
+
+This creates a very plausible classic memory cluster:
+
+- EPROM = program storage
+- SRAM = working memory
+- Xicor NVRAM/EEPROM = retained setup/configuration data
+
+## Silkscreen Clarifications From Photo
+
+The close-up suggests a couple of earlier markings may need cautious reading:
+
+- the vertical marking beside the ROM socket still looks like
+  `CNI12` / `CN112`-like text and should be rechecked carefully from the board
+  itself
+- `RV1` appears near an **unpopulated footprint** below the ROM area
+  rather than clearly identifying the ROM itself
+
+So, for now:
+
+- treat `RV1` as a likely local board reference near that empty footprint
+- do not treat `RV1` as the firmware module identifier
+
+## Additional Photo-Backed Board Observations
+
+From the newer board photos:
+
+### Internal Harness Connector
+
+- the internal board connector is silked as **`CN1`**
+- it is an **8-pin connector**
+- the visible wire colors at this connector appear to be:
+  - red
+  - brown
+  - white
+  - orange
+  - yellow
+  - gray
+  - blue
+  - black
+- this reinforces the earlier point that the internal harness color order does
+  **not** match the earlier external cable-color assumptions
+
+Useful implication:
+
+- `CN1` is now the strongest candidate for the board-side harness/IO connector
+  that should be traced against the external 10-pin cable assembly
+
+### H8 / DIP Area
+
+- the H8 marking is now clearly readable in-package as:
+  - `H8/536`
+  - `HD`
+  - `6435368F16`
+  - `W34 JAPAN`
+- the DIP switches `S2` and `S3` are clearly visible above the H8
+- the switches show an `ON` legend on one side, which will help keep bit
+  numbering consistent during testing
+- the pin-number silkscreen around the H8 is clearly printed, which supports
+  the earlier observation that the DIP banks land in the `43-50` region
+
+### Likely `S1` Footprint
+
+- one photo shows an **unpopulated circular-pad footprint** labeled `S1`
+- this is important because it suggests:
+  - `S1` was not "missing from our search" by accident
+  - it may be an intentionally unpopulated switch or selector position on this
+    board revision
+  - Sony may have designed this PCB for multiple variants/options
+
+This makes the earlier "no visible `S1`" mystery much less mysterious.
+
+### Board / Assembly Markings
+
+- one photo shows a boxed marking:
+  - `A-8315`
+  - `-095-A`
+- there is also a small sticker:
+  - `2A1`
+
+Working interpretation:
+
+- `A-8315-095-A` is very likely a Sony board or assembly identifier
+- `2A1` may be an inspection, revision, or production tracking sticker
+
+### Additional Logic / Glue Area
+
+- one of the smaller TI chips in the photo area is marked `HC74A`
+- this is consistent with ordinary glue logic / state / timing support around
+  the CPU rather than with a second major processor
+- nearby resistor-network and option-footprint areas also fit the picture of a
+  configurable CPU/control board with variant population options
+
+## Additional Silkscreen / Board Markings
+
+Observed so far:
+
+- possible connector / reference markings:
+  - `RV1`
+  - `CNI12`
+- near the `H8/536`:
+  - `CNI50`
+- DIP switches:
+  - `S2`
+  - `S3`
+- board label:
+  - `EP-(GW+GN)`
+- large board text:
+  - `CPU-345`
+- board appears visually split into quadrants
+- the main custom Sony chip appears to sit in:
+  - `B-2`
+
+## Initial Interpretation
+
+These are working interpretations, not yet final identifications.
+
+- `27C512 RCPTX7 V1.05 SONY98`
+  - very likely the panel firmware EPROM
+  - the `V1.05` label strongly suggests a firmware revision
+  - the socketed mounting is very useful for restoration and dumping
+- `H8/536 HD`
+  - likely the main microcontroller or one of the main controllers
+  - especially likely given that the DIP switches reportedly connect to it
+  - the full observed marking is consistent with a Hitachi `HD6435368F`
+    H8-family MCU
+- `X20C05`
+  - likely nonvolatile storage for configuration / calibration / retained setup
+- `LC3564BM-10`
+  - likely RAM or working memory associated with the controller/firmware
+- TI `HC595A`-style parts on the front board
+  - consistent with lamp, display, or scanned front-panel I/O expansion
+
+Additional interpretation from the newer markings:
+
+- `0047K` on the EPROM may be:
+  - an internal Sony build/program label
+  - a batch/date/option code
+  - or a board/personality identifier tied to this firmware image
+- `CPU-345` strongly suggests this board is treated by Sony as a CPU/control
+  board assembly rather than only an interface board
+- `B-2` may be a board-coordinate locator, which could help if a service manual
+  or board overlay ever turns up
+- `CNI12` and `CNI50` both look more like connector/reference designators than
+  component values
+- `RV1` is ambiguous:
+  - often that would imply a variable resistor / trim pot
+  - but if the silkscreen is hard to read, it is worth re-checking because it
+    may instead be another connector or reference prefix
+- the `H8/536` line-by-line marking strongly suggests the main CPU is not a
+  Sony custom controller but a member of the Hitachi H8 family, with Sony
+  firmware and surrounding glue logic providing the product-specific behavior
+- the `16` suffix likely indicates a speed grade / variant marker rather than a
+  board reference
+- the `JAPAN` marking fits an original Japanese-manufactured MCU package
+
+## Cross-Equipment Clue
+
+- The RM-M7G reportedly contains a chip with the same target-like logo and
+  `JAPAN` marking from the same apparent manufacturer family.
+
+Why this matters:
+
+- the RCP-TX7 and RM-M7G may share a similar controller platform philosophy
+- they may use related H8-family firmware architecture even if the surrounding
+  hardware and protocol behavior differ
+- this strengthens the idea that DIP-config, ROM content, and NVRAM content may
+  matter as much as the raw serial traffic itself
+
+## DIP Switches
+
+- There are **two 4-position DIP switches**
+- All switches are currently **off**
+- One side of each DIP bank appears tied together
+- They appear to act as **ground sinks / pull-to-ground configuration inputs**
+- They reportedly connect to the `H8/536`
+- The DIP switch reference designators are:
+  - `S2`
+  - `S3`
+- Based on the silkscreen tracing, the DIP switches connect to
+  **pins 43 through 50**
+
+This makes them likely candidates for:
+
+- panel address / ID selection
+- mode or personality selection
+- service / factory configuration
+- communication mode selection
+
+Notable oddity:
+
+- no obvious `S1` has been found yet
+
+That could mean:
+
+- `S1` exists on another board
+- `S1` is an unpopulated option on this revision
+- `S1` is present but hidden/obscured
+- Sony numbering simply did not start at `S1` on this assembly
+
+Why the `43-50` range matters:
+
+- eight switch positions feeding a contiguous pin range is exactly what you
+  would expect for a boot-time configuration byte or bitfield
+- that makes `S2` + `S3` look less like analog trims and more like true digital
+  mode/config inputs
+- if those really are `H8/536` pins, they may be read very early at reset or
+  power-up
+
+Current best interpretation of the DIP banks:
+
+- together they likely form an **8-bit configuration field**
+- likely uses pull-ups or default highs on the MCU side
+- each switch probably pulls its line low when turned on
+- possible meanings still include:
+  - panel address
+  - model/personality select
+  - PT mode / CCU compatibility mode
+  - service / factory behavior bits
+  - test/diagnostic mode
+
+## Missing / Unpopulated Components
+
+- Several components look **intentionally unpopulated**
+
+For now, assume these may be:
+
+- factory options
+- alternate hardware revisions
+- model-variant population differences
+- unused test or expansion circuitry
+
+They should not be treated as damaged/missing until compared against:
+
+- both PCB sides
+- silk labels
+- any service-manual board drawing
+- other RCP-TX7 board photos, if found later
+
+The newer photos strengthen this:
+
+- `S1` now appears to be an intentionally unpopulated footprint
+- there are at least two additional unpopulated IC footprints in the same area
+- this board very likely supported multiple build options or derivatives
+
+## Why This Matters
+
+This hardware picture is encouraging because it suggests the RCP is not just a
+"dumb front panel."
+
+It likely contains:
+
+- a real MCU (`H8/536`)
+- local firmware (`27C512`)
+- nonvolatile memory (`X20C05`)
+- a front-panel scan / display subsystem
+
+That means the panel may have:
+
+- multiple boot/configuration modes
+- stored setup or address data
+- more internal state than the serial experiments alone reveal
+
+It also makes a **firmware dump** or **DIP-switch mapping** potentially very
+high-value later.
+
+## Next Hardware Inspection Targets
+
+Highest-value things to map next:
+
+1. Exact full part markings on the `H8/536` package
+2. Exact full part markings on the `LC3564BM-10`
+3. Exact full part markings on each smaller TI logic IC near the I/O connector
+4. Continuity from the external 10-pin pins to the main-board connector pins
+   - especially through `CN1`
+5. Continuity from the serial pins (`4`, `7`, `9`, `10`) to their destination
+   chips/components
+6. Whether any of the remaining wires land on:
+   - MCU GPIO
+   - analog conditioning
+   - optocouplers
+   - comparator/op-amp circuitry
+   - transceiver/interface ICs
+7. Silk labels near the two DIP switch blocks
+   - including the exact orientation of the `ON` legend on `S2` and `S3`
+8. Any test pads labeled for:
+   - `TX`
+   - `RX`
+   - `CLK`
+   - `DATA`
+   - `RST`
+   - `ROM`
+   - `RAM`
+   - `GND`
+   - `+5V`
+   - `+12V`
+
+## Strong Next Leads
+
+Based on the current findings, the best hardware-side leads are:
+
+1. **Map the DIP switches**
+   - note silk labels
+   - test whether any switch changes startup behavior or serial responses
+   - specifically record the current `S2` / `S3` bit positions before touching
+   - if possible, determine whether the switches are read only at boot or also
+     during runtime
+2. **Dump or at least photograph the EPROM label and socket area clearly**
+   - the socketed `27C512` is one of the most promising restoration clues
+   - include the `0047K` marking in the photo record
+3. **Trace the 8-pin internal connector**
+   - identify which of those lines are serial, power, and "something else"
+4. **Identify whether the 10-pin path includes a dedicated interface chip**
+    - if not, the extra lines may go directly into the MCU or surrounding logic
+5. **Verify the likely connector references**
+   - confirm whether `CNI12` is the 8-pin internal cable header
+   - confirm whether `CNI50` refers to the H8 area, a nearby header, or another
+     assembly reference
+   - note that `CN1` is now the strongest observed silk for the internal
+     8-pin harness connector in the photos
+6. **Compare the RM-M7G controller board if possible**
+   - look for the exact MCU family/part
+   - compare ROM / EEPROM / switch architecture
+   - note whether Sony reused the same CPU platform with different front-end
+     logic
+
+## Open Questions
+
+- Is the `H8/536` definitely the primary CPU, or is there another Sony custom
+  controller sharing that role?
+- Is the socketed `27C512` the only firmware store?
+- What exactly is stored in the `X20C05`?
+- Do the DIP switches select mode, address, or board variant?
+- Do `S2`/`S3` form a single boot configuration byte across MCU pins `43-50`?
+- Do any of the non-serial wires carry required wake/session information?
+- Is there a hardware reason the panel never fully leaves `CONNECT NOT ACT`
+  under our emulated PT2 traffic?
+- What do `CPU-345`, `EP-(GW+GN)`, `CNI12`, and `CNI50` correspond to in Sony's
+  internal board naming?
+- Is `A-8315-095-A` the specific board assembly number for this CPU board?
+- Does the RM-M7G use the same H8-family controller and a similar ROM/NVRAM
+  arrangement?
+
+## DIP Switch Experiment Ladder
+
+Current known baseline:
+
+- all 8 DIP positions are currently **off**
+- switches are grouped as:
+  - `S2` = 4 positions
+  - `S3` = 4 positions
+- together they likely feed MCU pins `43-50`
+
+### Safety / Method
+
+Use this method for every DIP test:
+
+1. Photograph the current DIP positions before changing anything.
+2. Change **one switch only**.
+3. Reassemble only as much as needed for safe power-on.
+4. Power up the panel.
+5. Observe behavior **before connecting serial**.
+6. Then run the normal serial baseline checks.
+7. Power down fully before changing the next switch.
+8. Return to the all-off baseline between non-adjacent tests.
+
+Recommended observations for each run:
+
+- LCD startup text
+- whether the active light changes
+- whether `CONNECT NOT ACT` appears, and when
+- whether the idle heartbeat is still `00 00 00 00 80 DA`
+- whether known probes still behave the same:
+  - `A0`
+  - `90`
+  - `AF`
+  - `E8`
+  - `EC`
+- any new button behavior in idle state
+- any change in baud-like behavior or complete silence
+
+### Naming Convention
+
+Use a simple notation in notes/logs:
+
+- baseline = `S2=0000 S3=0000`
+- example single change:
+  - `S2=1000 S3=0000`
+  - meaning only the first `S2` switch is changed from baseline
+
+If the physical switch numbering is unclear, first label them visually as:
+
+- `S2-1` .. `S2-4`
+- `S3-1` .. `S3-4`
+
+based on one fixed left-to-right or top-to-bottom convention, and stick to it.
+
+### Phase 1: Single-Bit Sweep
+
+Goal:
+
+- find out whether any single DIP bit has an obvious effect on startup,
+  protocol, or front-panel behavior
+
+Run these eight tests, always starting from all-off baseline:
+
+1. `S2-1` on, all others off
+2. `S2-2` on, all others off
+3. `S2-3` on, all others off
+4. `S2-4` on, all others off
+5. `S3-1` on, all others off
+6. `S3-2` on, all others off
+7. `S3-3` on, all others off
+8. `S3-4` on, all others off
+
+For each test:
+
+- power-cycle
+- watch LCD/startup state
+- check for idle heartbeat
+- try one minimal probe set:
+  - idle listen
+  - `A0`
+  - `A0 -> 90`
+  - `A0 -> AF`
+
+What would count as a hit:
+
+- panel boots into a different visible mode
+- panel no longer shows `CONNECT NOT ACT`
+- heartbeat changes or disappears
+- known startup families change:
+  - `64 40 30`
+  - `0D 04 AB`
+  - `0D 04 EB`
+  - `E4 40 30`
+- buttons become active in idle
+
+### Phase 2: Group Identity Test
+
+Only do this after Phase 1.
+
+Goal:
+
+- see whether one whole DIP bank behaves like an address nibble or mode nibble
+
+Run these four tests:
+
+1. all `S2` on, `S3` all off
+2. all `S2` off, all `S3` on
+3. all `S2` on, all `S3` on
+4. return to all off baseline and confirm behavior is restored
+
+What this can reveal:
+
+- one bank may control personality while the other controls address
+- one bank may do nothing while the other changes the panel sharply
+- all-on may expose service/test behavior that single-bit changes do not
+
+### Phase 3: Follow-Up Only If A Bit Matters
+
+If Phase 1 reveals a promising bit, branch carefully:
+
+1. repeat that same switch setting twice to confirm reproducibility
+2. test neighboring bits in the same bank
+3. test that bit plus one neighboring bit
+4. compare:
+   - startup text
+   - heartbeat
+   - `A0 -> 90`
+   - `A0 -> AF`
+   - `E8` / `EC` selector behavior
+
+### Good First Serial Checks Per DIP Setting
+
+Keep the serial side small at first.
+
+Recommended order:
+
+1. idle listen only
+2. repeating heartbeat only
+3. `A0`
+4. `A0 -> 90`
+5. `A0 -> AF`
+
+Only if something changes meaningfully, then test:
+
+- `E8`
+- `E9`
+- `EC`
+- CALL synthetic trigger
+
+### Strong Cautions
+
+- Do not change multiple unknown DIP bits at once in the first pass.
+- Do not assume "on" means logic high; it may actually pull the line low.
+- Some switches may only be sampled at cold boot, not warm reset.
+- A strange setting may stop normal serial output entirely; that is still a
+  useful result.
+- If one setting produces a dramatically different boot state, stop and record
+  it before going wider.