# RCP-TX7 PCB Notes These notes track direct physical observations from inside the Sony RCP-TX7. They are intentionally separate from the PT2 protocol notes, because the board layout and component choices may explain what the serial experiments alone do not. ## Current Physical Overview - The RCP appears to be split into **two circuit boards**. - One board looks like a **front-panel / operator interface board**: - button matrix - lamps / indicators - LCD support - mostly resistors and small logic - many TI `HC595A`-family or similar shift-register-style chips - That board connects through an intermediate link to a second board. - The second board appears to be the **main logic / controller board**: - single-sided - carries the main digital devices - appears to contain the actual control logic / firmware for the RCP ## Connector / Wiring Observations - The main logic board has an **8-pin connector** associated with the external 10-pin plug/cable assembly. - The **wire colors inside the RCP do not match** the cable color mapping noted earlier from the cable itself. - This means: - internal color cannot be trusted as a one-to-one continuation of external cable color - the board-side harness should be mapped by continuity, not by color ## Identified Components Observed on the main logic board: - `Sanyo LC3564BM-10` - `XICOR X20C05J-55 9926` - `27C512 RCPTX7 V1.05 SONY98` - socketed / clip-retained - appears user-replaceable - additional marking observed: `0047K` - `H8/536 HD` - full observed line-by-line marking on the main controller: - small logo resembling a target / concentric mark - `H8/536` - `1B1 A` - `HD` - `6435368F 16` - `W34 JAPAN` - several smaller TI logic ICs with varying markings ## Firmware Cluster Photo Notes From the close-up photo of the firmware area: - the firmware device is an **ST** `M27C512-10F1` family EPROM/OTP-style part carrying the Sony application label: - `27C512` - `RCPTX7` - `V1.05` - `©SONY98` - the package-side marking also shows: - `M27C512` - `10F1` - `58826` - `0047K` - `SINGAPORE` - the ROM is installed in a **socket**, which strongly supports the idea that the firmware can be removed and dumped without desoldering - the `XICOR X20C05J-55` sits immediately beside the firmware device - the `LC3564BM-10` sits directly above the firmware area This creates a very plausible classic memory cluster: - EPROM = program storage - SRAM = working memory - Xicor NVRAM/EEPROM = retained setup/configuration data ## Silkscreen Clarifications From Photo The close-up suggests a couple of earlier markings may need cautious reading: - the vertical marking beside the ROM socket still looks like `CNI12` / `CN112`-like text and should be rechecked carefully from the board itself - `RV1` appears near an **unpopulated footprint** below the ROM area rather than clearly identifying the ROM itself So, for now: - treat `RV1` as a likely local board reference near that empty footprint - do not treat `RV1` as the firmware module identifier ## Additional Photo-Backed Board Observations From the newer board photos: ### Internal Harness Connector - the internal board connector is silked as **`CN1`** - it is an **8-pin connector** - the visible wire colors at this connector appear to be: - red - brown - white - orange - yellow - gray - blue - black - this reinforces the earlier point that the internal harness color order does **not** match the earlier external cable-color assumptions Useful implication: - `CN1` is now the strongest candidate for the board-side harness/IO connector that should be traced against the external 10-pin cable assembly ### H8 / DIP Area - the H8 marking is now clearly readable in-package as: - `H8/536` - `HD` - `6435368F16` - `W34 JAPAN` - the DIP switches `S2` and `S3` are clearly visible above the H8 - the switches show an `ON` legend on one side, which will help keep bit numbering consistent during testing - the pin-number silkscreen around the H8 is clearly printed, which supports the earlier observation that the DIP banks land in the `43-50` region ### Likely `S1` Footprint - one photo shows an **unpopulated circular-pad footprint** labeled `S1` - this is important because it suggests: - `S1` was not "missing from our search" by accident - it may be an intentionally unpopulated switch or selector position on this board revision - Sony may have designed this PCB for multiple variants/options This makes the earlier "no visible `S1`" mystery much less mysterious. ### Board / Assembly Markings - one photo shows a boxed marking: - `A-8315` - `-095-A` - there is also a small sticker: - `2A1` Working interpretation: - `A-8315-095-A` is very likely a Sony board or assembly identifier - `2A1` may be an inspection, revision, or production tracking sticker ### Additional Logic / Glue Area - one of the smaller TI chips in the photo area is marked `HC74A` - this is consistent with ordinary glue logic / state / timing support around the CPU rather than with a second major processor - nearby resistor-network and option-footprint areas also fit the picture of a configurable CPU/control board with variant population options ## Additional Silkscreen / Board Markings Observed so far: - possible connector / reference markings: - `RV1` - `CNI12` - near the `H8/536`: - `CNI50` - DIP switches: - `S2` - `S3` - board label: - `EP-(GW+GN)` - large board text: - `CPU-345` - board appears visually split into quadrants - the main custom Sony chip appears to sit in: - `B-2` ## Initial Interpretation These are working interpretations, not yet final identifications. - `27C512 RCPTX7 V1.05 SONY98` - very likely the panel firmware EPROM - the `V1.05` label strongly suggests a firmware revision - the socketed mounting is very useful for restoration and dumping - `H8/536 HD` - likely the main microcontroller or one of the main controllers - especially likely given that the DIP switches reportedly connect to it - the full observed marking is consistent with a Hitachi `HD6435368F` H8-family MCU - `X20C05` - likely nonvolatile storage for configuration / calibration / retained setup - `LC3564BM-10` - likely RAM or working memory associated with the controller/firmware - TI `HC595A`-style parts on the front board - consistent with lamp, display, or scanned front-panel I/O expansion Additional interpretation from the newer markings: - `0047K` on the EPROM may be: - an internal Sony build/program label - a batch/date/option code - or a board/personality identifier tied to this firmware image - `CPU-345` strongly suggests this board is treated by Sony as a CPU/control board assembly rather than only an interface board - `B-2` may be a board-coordinate locator, which could help if a service manual or board overlay ever turns up - `CNI12` and `CNI50` both look more like connector/reference designators than component values - `RV1` is ambiguous: - often that would imply a variable resistor / trim pot - but if the silkscreen is hard to read, it is worth re-checking because it may instead be another connector or reference prefix - the `H8/536` line-by-line marking strongly suggests the main CPU is not a Sony custom controller but a member of the Hitachi H8 family, with Sony firmware and surrounding glue logic providing the product-specific behavior - the `16` suffix likely indicates a speed grade / variant marker rather than a board reference - the `JAPAN` marking fits an original Japanese-manufactured MCU package ## Cross-Equipment Clue - The RM-M7G reportedly contains a chip with the same target-like logo and `JAPAN` marking from the same apparent manufacturer family. Why this matters: - the RCP-TX7 and RM-M7G may share a similar controller platform philosophy - they may use related H8-family firmware architecture even if the surrounding hardware and protocol behavior differ - this strengthens the idea that DIP-config, ROM content, and NVRAM content may matter as much as the raw serial traffic itself ## DIP Switches - There are **two 4-position DIP switches** - All switches are currently **off** - One side of each DIP bank appears tied together - They appear to act as **ground sinks / pull-to-ground configuration inputs** - They reportedly connect to the `H8/536` - The DIP switch reference designators are: - `S2` - `S3` - Based on the silkscreen tracing, the DIP switches connect to **pins 43 through 50** This makes them likely candidates for: - panel address / ID selection - mode or personality selection - service / factory configuration - communication mode selection Notable oddity: - no obvious `S1` has been found yet That could mean: - `S1` exists on another board - `S1` is an unpopulated option on this revision - `S1` is present but hidden/obscured - Sony numbering simply did not start at `S1` on this assembly Why the `43-50` range matters: - eight switch positions feeding a contiguous pin range is exactly what you would expect for a boot-time configuration byte or bitfield - that makes `S2` + `S3` look less like analog trims and more like true digital mode/config inputs - if those really are `H8/536` pins, they may be read very early at reset or power-up Current best interpretation of the DIP banks: - together they likely form an **8-bit configuration field** - likely uses pull-ups or default highs on the MCU side - each switch probably pulls its line low when turned on - possible meanings still include: - panel address - model/personality select - PT mode / CCU compatibility mode - service / factory behavior bits - test/diagnostic mode ## Missing / Unpopulated Components - Several components look **intentionally unpopulated** For now, assume these may be: - factory options - alternate hardware revisions - model-variant population differences - unused test or expansion circuitry They should not be treated as damaged/missing until compared against: - both PCB sides - silk labels - any service-manual board drawing - other RCP-TX7 board photos, if found later The newer photos strengthen this: - `S1` now appears to be an intentionally unpopulated footprint - there are at least two additional unpopulated IC footprints in the same area - this board very likely supported multiple build options or derivatives ## Why This Matters This hardware picture is encouraging because it suggests the RCP is not just a "dumb front panel." It likely contains: - a real MCU (`H8/536`) - local firmware (`27C512`) - nonvolatile memory (`X20C05`) - a front-panel scan / display subsystem That means the panel may have: - multiple boot/configuration modes - stored setup or address data - more internal state than the serial experiments alone reveal It also makes a **firmware dump** or **DIP-switch mapping** potentially very high-value later. ## Next Hardware Inspection Targets Highest-value things to map next: 1. Exact full part markings on the `H8/536` package 2. Exact full part markings on the `LC3564BM-10` 3. Exact full part markings on each smaller TI logic IC near the I/O connector 4. Continuity from the external 10-pin pins to the main-board connector pins - especially through `CN1` 5. Continuity from the serial pins (`4`, `7`, `9`, `10`) to their destination chips/components 6. Whether any of the remaining wires land on: - MCU GPIO - analog conditioning - optocouplers - comparator/op-amp circuitry - transceiver/interface ICs 7. Silk labels near the two DIP switch blocks - including the exact orientation of the `ON` legend on `S2` and `S3` 8. Any test pads labeled for: - `TX` - `RX` - `CLK` - `DATA` - `RST` - `ROM` - `RAM` - `GND` - `+5V` - `+12V` ## Strong Next Leads Based on the current findings, the best hardware-side leads are: 1. **Map the DIP switches** - note silk labels - test whether any switch changes startup behavior or serial responses - specifically record the current `S2` / `S3` bit positions before touching - if possible, determine whether the switches are read only at boot or also during runtime 2. **Dump or at least photograph the EPROM label and socket area clearly** - the socketed `27C512` is one of the most promising restoration clues - include the `0047K` marking in the photo record 3. **Trace the 8-pin internal connector** - identify which of those lines are serial, power, and "something else" 4. **Identify whether the 10-pin path includes a dedicated interface chip** - if not, the extra lines may go directly into the MCU or surrounding logic 5. **Verify the likely connector references** - confirm whether `CNI12` is the 8-pin internal cable header - confirm whether `CNI50` refers to the H8 area, a nearby header, or another assembly reference - note that `CN1` is now the strongest observed silk for the internal 8-pin harness connector in the photos 6. **Compare the RM-M7G controller board if possible** - look for the exact MCU family/part - compare ROM / EEPROM / switch architecture - note whether Sony reused the same CPU platform with different front-end logic ## Open Questions - Is the `H8/536` definitely the primary CPU, or is there another Sony custom controller sharing that role? - Is the socketed `27C512` the only firmware store? - What exactly is stored in the `X20C05`? - Do the DIP switches select mode, address, or board variant? - Do `S2`/`S3` form a single boot configuration byte across MCU pins `43-50`? - Do any of the non-serial wires carry required wake/session information? - Is there a hardware reason the panel never fully leaves `CONNECT NOT ACT` under our emulated PT2 traffic? - What do `CPU-345`, `EP-(GW+GN)`, `CNI12`, and `CNI50` correspond to in Sony's internal board naming? - Is `A-8315-095-A` the specific board assembly number for this CPU board? - Does the RM-M7G use the same H8-family controller and a similar ROM/NVRAM arrangement? ## DIP Switch Experiment Ladder Current known baseline: - all 8 DIP positions are currently **off** - switches are grouped as: - `S2` = 4 positions - `S3` = 4 positions - together they likely feed MCU pins `43-50` ### Safety / Method Use this method for every DIP test: 1. Photograph the current DIP positions before changing anything. 2. Change **one switch only**. 3. Reassemble only as much as needed for safe power-on. 4. Power up the panel. 5. Observe behavior **before connecting serial**. 6. Then run the normal serial baseline checks. 7. Power down fully before changing the next switch. 8. Return to the all-off baseline between non-adjacent tests. Recommended observations for each run: - LCD startup text - whether the active light changes - whether `CONNECT NOT ACT` appears, and when - whether the idle heartbeat is still `00 00 00 00 80 DA` - whether known probes still behave the same: - `A0` - `90` - `AF` - `E8` - `EC` - any new button behavior in idle state - any change in baud-like behavior or complete silence ### Naming Convention Use a simple notation in notes/logs: - baseline = `S2=0000 S3=0000` - example single change: - `S2=1000 S3=0000` - meaning only the first `S2` switch is changed from baseline If the physical switch numbering is unclear, first label them visually as: - `S2-1` .. `S2-4` - `S3-1` .. `S3-4` based on one fixed left-to-right or top-to-bottom convention, and stick to it. ### Phase 1: Single-Bit Sweep Goal: - find out whether any single DIP bit has an obvious effect on startup, protocol, or front-panel behavior Run these eight tests, always starting from all-off baseline: 1. `S2-1` on, all others off 2. `S2-2` on, all others off 3. `S2-3` on, all others off 4. `S2-4` on, all others off 5. `S3-1` on, all others off 6. `S3-2` on, all others off 7. `S3-3` on, all others off 8. `S3-4` on, all others off For each test: - power-cycle - watch LCD/startup state - check for idle heartbeat - try one minimal probe set: - idle listen - `A0` - `A0 -> 90` - `A0 -> AF` What would count as a hit: - panel boots into a different visible mode - panel no longer shows `CONNECT NOT ACT` - heartbeat changes or disappears - known startup families change: - `64 40 30` - `0D 04 AB` - `0D 04 EB` - `E4 40 30` - buttons become active in idle ### Phase 2: Group Identity Test Only do this after Phase 1. Goal: - see whether one whole DIP bank behaves like an address nibble or mode nibble Run these four tests: 1. all `S2` on, `S3` all off 2. all `S2` off, all `S3` on 3. all `S2` on, all `S3` on 4. return to all off baseline and confirm behavior is restored What this can reveal: - one bank may control personality while the other controls address - one bank may do nothing while the other changes the panel sharply - all-on may expose service/test behavior that single-bit changes do not ### Phase 3: Follow-Up Only If A Bit Matters If Phase 1 reveals a promising bit, branch carefully: 1. repeat that same switch setting twice to confirm reproducibility 2. test neighboring bits in the same bank 3. test that bit plus one neighboring bit 4. compare: - startup text - heartbeat - `A0 -> 90` - `A0 -> AF` - `E8` / `EC` selector behavior ### Good First Serial Checks Per DIP Setting Keep the serial side small at first. Recommended order: 1. idle listen only 2. repeating heartbeat only 3. `A0` 4. `A0 -> 90` 5. `A0 -> AF` Only if something changes meaningfully, then test: - `E8` - `E9` - `EC` - CALL synthetic trigger ### Strong Cautions - Do not change multiple unknown DIP bits at once in the first pass. - Do not assume "on" means logic high; it may actually pull the line low. - Some switches may only be sampled at cold boot, not warm reset. - A strange setting may stop normal serial output entirely; that is still a useful result. - If one setting produces a dramatically different boot state, stop and record it before going wider.