Files

Aiden 861b16118c pcb

2026-05-13 23:11:50 +10:00

18 KiB

Raw Blame History

RCP-TX7 PCB Notes

These notes track direct physical observations from inside the Sony RCP-TX7. They are intentionally separate from the PT2 protocol notes, because the board layout and component choices may explain what the serial experiments alone do not.

Current Physical Overview

The RCP appears to be split into two circuit boards.
One board looks like a front-panel / operator interface board:
- button matrix
- lamps / indicators
- LCD support
- mostly resistors and small logic
- many TI HC595A-family or similar shift-register-style chips
That board connects through an intermediate link to a second board.
The second board appears to be the main logic / controller board:
- single-sided
- carries the main digital devices
- appears to contain the actual control logic / firmware for the RCP

Connector / Wiring Observations

The main logic board has an 8-pin connector associated with the external 10-pin plug/cable assembly.
The wire colors inside the RCP do not match the cable color mapping noted earlier from the cable itself.
This means:
- internal color cannot be trusted as a one-to-one continuation of external cable color
- the board-side harness should be mapped by continuity, not by color

Identified Components

Observed on the main logic board:

Sanyo LC3564BM-10
XICOR X20C05J-55 9926
27C512 RCPTX7 V1.05 SONY98
- socketed / clip-retained
- appears user-replaceable
- additional marking observed: 0047K
H8/536 HD
full observed line-by-line marking on the main controller:
- small logo resembling a target / concentric mark
- H8/536
- 1B1 A
- HD
- 6435368F 16
- W34 JAPAN
several smaller TI logic ICs with varying markings

Firmware Cluster Photo Notes

From the close-up photo of the firmware area:

the firmware device is an ST M27C512-10F1 family EPROM/OTP-style part carrying the Sony application label:
- 27C512
- RCPTX7
- V1.05
- ©SONY98
the package-side marking also shows:
- M27C512
- 10F1
- 58826
- 0047K
- SINGAPORE
the ROM is installed in a socket, which strongly supports the idea that the firmware can be removed and dumped without desoldering
the XICOR X20C05J-55 sits immediately beside the firmware device
the LC3564BM-10 sits directly above the firmware area

This creates a very plausible classic memory cluster:

EPROM = program storage
SRAM = working memory
Xicor NVRAM/EEPROM = retained setup/configuration data

Silkscreen Clarifications From Photo

The close-up suggests a couple of earlier markings may need cautious reading:

the vertical marking beside the ROM socket still looks like CNI12 / CN112-like text and should be rechecked carefully from the board itself
RV1 appears near an unpopulated footprint below the ROM area rather than clearly identifying the ROM itself

So, for now:

treat RV1 as a likely local board reference near that empty footprint
do not treat RV1 as the firmware module identifier

Additional Photo-Backed Board Observations

From the newer board photos:

Internal Harness Connector

the internal board connector is silked as CN1
it is an 8-pin connector
the visible wire colors at this connector appear to be:
- red
- brown
- white
- orange
- yellow
- gray
- blue
- black
this reinforces the earlier point that the internal harness color order does not match the earlier external cable-color assumptions

Useful implication:

CN1 is now the strongest candidate for the board-side harness/IO connector that should be traced against the external 10-pin cable assembly

H8 / DIP Area

the H8 marking is now clearly readable in-package as:
- H8/536
- HD
- 6435368F16
- W34 JAPAN
the DIP switches S2 and S3 are clearly visible above the H8
the switches show an ON legend on one side, which will help keep bit numbering consistent during testing
the pin-number silkscreen around the H8 is clearly printed, which supports the earlier observation that the DIP banks land in the 43-50 region

Likely `S1` Footprint

one photo shows an unpopulated circular-pad footprint labeled S1
this is important because it suggests:
- S1 was not "missing from our search" by accident
- it may be an intentionally unpopulated switch or selector position on this board revision
- Sony may have designed this PCB for multiple variants/options

This makes the earlier "no visible S1" mystery much less mysterious.

Board / Assembly Markings

one photo shows a boxed marking:
- A-8315
- -095-A
there is also a small sticker:
- 2A1

Working interpretation:

A-8315-095-A is very likely a Sony board or assembly identifier
2A1 may be an inspection, revision, or production tracking sticker

Additional Logic / Glue Area

one of the smaller TI chips in the photo area is marked HC74A
this is consistent with ordinary glue logic / state / timing support around the CPU rather than with a second major processor
nearby resistor-network and option-footprint areas also fit the picture of a configurable CPU/control board with variant population options

Additional Silkscreen / Board Markings

Observed so far:

possible connector / reference markings:
- RV1
- CNI12
near the H8/536:
- CNI50
DIP switches:
- S2
- S3
board label:
- EP-(GW+GN)
large board text:
- CPU-345
board appears visually split into quadrants
the main custom Sony chip appears to sit in:
- B-2

Initial Interpretation

These are working interpretations, not yet final identifications.

27C512 RCPTX7 V1.05 SONY98
- very likely the panel firmware EPROM
- the V1.05 label strongly suggests a firmware revision
- the socketed mounting is very useful for restoration and dumping
H8/536 HD
- likely the main microcontroller or one of the main controllers
- especially likely given that the DIP switches reportedly connect to it
- the full observed marking is consistent with a Hitachi HD6435368F H8-family MCU
X20C05
- likely nonvolatile storage for configuration / calibration / retained setup
LC3564BM-10
- likely RAM or working memory associated with the controller/firmware
TI HC595A-style parts on the front board
- consistent with lamp, display, or scanned front-panel I/O expansion

Additional interpretation from the newer markings:

0047K on the EPROM may be:
- an internal Sony build/program label
- a batch/date/option code
- or a board/personality identifier tied to this firmware image
CPU-345 strongly suggests this board is treated by Sony as a CPU/control board assembly rather than only an interface board
B-2 may be a board-coordinate locator, which could help if a service manual or board overlay ever turns up
CNI12 and CNI50 both look more like connector/reference designators than component values
RV1 is ambiguous:
- often that would imply a variable resistor / trim pot
- but if the silkscreen is hard to read, it is worth re-checking because it may instead be another connector or reference prefix
the H8/536 line-by-line marking strongly suggests the main CPU is not a Sony custom controller but a member of the Hitachi H8 family, with Sony firmware and surrounding glue logic providing the product-specific behavior
the 16 suffix likely indicates a speed grade / variant marker rather than a board reference
the JAPAN marking fits an original Japanese-manufactured MCU package

Cross-Equipment Clue

The RM-M7G reportedly contains a chip with the same target-like logo and JAPAN marking from the same apparent manufacturer family.

Why this matters:

the RCP-TX7 and RM-M7G may share a similar controller platform philosophy
they may use related H8-family firmware architecture even if the surrounding hardware and protocol behavior differ
this strengthens the idea that DIP-config, ROM content, and NVRAM content may matter as much as the raw serial traffic itself

DIP Switches

There are two 4-position DIP switches
All switches are currently off
One side of each DIP bank appears tied together
They appear to act as ground sinks / pull-to-ground configuration inputs
They reportedly connect to the H8/536
The DIP switch reference designators are:
- S2
- S3
Based on the silkscreen tracing, the DIP switches connect to pins 43 through 50

This makes them likely candidates for:

panel address / ID selection
mode or personality selection
service / factory configuration
communication mode selection

Notable oddity:

no obvious S1 has been found yet

That could mean:

S1 exists on another board
S1 is an unpopulated option on this revision
S1 is present but hidden/obscured
Sony numbering simply did not start at S1 on this assembly

Why the 43-50 range matters:

eight switch positions feeding a contiguous pin range is exactly what you would expect for a boot-time configuration byte or bitfield
that makes S2 + S3 look less like analog trims and more like true digital mode/config inputs
if those really are H8/536 pins, they may be read very early at reset or power-up

Current best interpretation of the DIP banks:

together they likely form an 8-bit configuration field
likely uses pull-ups or default highs on the MCU side
each switch probably pulls its line low when turned on
possible meanings still include:
- panel address
- model/personality select
- PT mode / CCU compatibility mode
- service / factory behavior bits
- test/diagnostic mode

Missing / Unpopulated Components

Several components look intentionally unpopulated

For now, assume these may be:

factory options
alternate hardware revisions
model-variant population differences
unused test or expansion circuitry

They should not be treated as damaged/missing until compared against:

both PCB sides
silk labels
any service-manual board drawing
other RCP-TX7 board photos, if found later

The newer photos strengthen this:

S1 now appears to be an intentionally unpopulated footprint
there are at least two additional unpopulated IC footprints in the same area
this board very likely supported multiple build options or derivatives

Why This Matters

This hardware picture is encouraging because it suggests the RCP is not just a "dumb front panel."

It likely contains:

a real MCU (H8/536)
local firmware (27C512)
nonvolatile memory (X20C05)
a front-panel scan / display subsystem

That means the panel may have:

multiple boot/configuration modes
stored setup or address data
more internal state than the serial experiments alone reveal

It also makes a firmware dump or DIP-switch mapping potentially very high-value later.

Next Hardware Inspection Targets

Highest-value things to map next:

Exact full part markings on the H8/536 package
Exact full part markings on the LC3564BM-10
Exact full part markings on each smaller TI logic IC near the I/O connector
Continuity from the external 10-pin pins to the main-board connector pins
- especially through CN1
Continuity from the serial pins (4, 7, 9, 10) to their destination chips/components
Whether any of the remaining wires land on:
- MCU GPIO
- analog conditioning
- optocouplers
- comparator/op-amp circuitry
- transceiver/interface ICs
Silk labels near the two DIP switch blocks
- including the exact orientation of the ON legend on S2 and S3
Any test pads labeled for:
- TX
- RX
- CLK
- DATA
- RST
- ROM
- RAM
- GND
- +5V
- +12V

Strong Next Leads

Based on the current findings, the best hardware-side leads are:

Map the DIP switches
- note silk labels
- test whether any switch changes startup behavior or serial responses
- specifically record the current S2 / S3 bit positions before touching
- if possible, determine whether the switches are read only at boot or also during runtime
Dump or at least photograph the EPROM label and socket area clearly
- the socketed 27C512 is one of the most promising restoration clues
- include the 0047K marking in the photo record
Trace the 8-pin internal connector
- identify which of those lines are serial, power, and "something else"
Identify whether the 10-pin path includes a dedicated interface chip
- if not, the extra lines may go directly into the MCU or surrounding logic
Verify the likely connector references
- confirm whether CNI12 is the 8-pin internal cable header
- confirm whether CNI50 refers to the H8 area, a nearby header, or another assembly reference
- note that CN1 is now the strongest observed silk for the internal 8-pin harness connector in the photos
Compare the RM-M7G controller board if possible
- look for the exact MCU family/part
- compare ROM / EEPROM / switch architecture
- note whether Sony reused the same CPU platform with different front-end logic

Open Questions

Is the H8/536 definitely the primary CPU, or is there another Sony custom controller sharing that role?
Is the socketed 27C512 the only firmware store?
What exactly is stored in the X20C05?
Do the DIP switches select mode, address, or board variant?
Do S2/S3 form a single boot configuration byte across MCU pins 43-50?
Do any of the non-serial wires carry required wake/session information?
Is there a hardware reason the panel never fully leaves CONNECT NOT ACT under our emulated PT2 traffic?
What do CPU-345, EP-(GW+GN), CNI12, and CNI50 correspond to in Sony's internal board naming?
Is A-8315-095-A the specific board assembly number for this CPU board?
Does the RM-M7G use the same H8-family controller and a similar ROM/NVRAM arrangement?

DIP Switch Experiment Ladder

Current known baseline:

all 8 DIP positions are currently off
switches are grouped as:
- S2 = 4 positions
- S3 = 4 positions
together they likely feed MCU pins 43-50

Safety / Method

Use this method for every DIP test:

Photograph the current DIP positions before changing anything.
Change one switch only.
Reassemble only as much as needed for safe power-on.
Power up the panel.
Observe behavior before connecting serial.
Then run the normal serial baseline checks.
Power down fully before changing the next switch.
Return to the all-off baseline between non-adjacent tests.

Recommended observations for each run:

LCD startup text
whether the active light changes
whether CONNECT NOT ACT appears, and when
whether the idle heartbeat is still 00 00 00 00 80 DA
whether known probes still behave the same:
- A0
- 90
- AF
- E8
- EC
any new button behavior in idle state
any change in baud-like behavior or complete silence

Naming Convention

Use a simple notation in notes/logs:

baseline = S2=0000 S3=0000
example single change:
- S2=1000 S3=0000
- meaning only the first S2 switch is changed from baseline

If the physical switch numbering is unclear, first label them visually as:

S2-1 .. S2-4
S3-1 .. S3-4

based on one fixed left-to-right or top-to-bottom convention, and stick to it.

Phase 1: Single-Bit Sweep

Goal:

find out whether any single DIP bit has an obvious effect on startup, protocol, or front-panel behavior

Run these eight tests, always starting from all-off baseline:

S2-1 on, all others off
S2-2 on, all others off
S2-3 on, all others off
S2-4 on, all others off
S3-1 on, all others off
S3-2 on, all others off
S3-3 on, all others off
S3-4 on, all others off

For each test:

power-cycle
watch LCD/startup state
check for idle heartbeat
try one minimal probe set:
- idle listen
- A0
- A0 -> 90
- A0 -> AF

What would count as a hit:

panel boots into a different visible mode
panel no longer shows CONNECT NOT ACT
heartbeat changes or disappears
known startup families change:
- 64 40 30
- 0D 04 AB
- 0D 04 EB
- E4 40 30
buttons become active in idle

Phase 2: Group Identity Test

Only do this after Phase 1.