Sony-rcp/docs/pcb-notes.md

# RCP-TX7 PCB Notes

These notes track direct physical observations from inside the Sony RCP-TX7.
They are intentionally separate from the PT2 protocol notes, because the board
layout and component choices may explain what the serial experiments alone do
not.

## Current Physical Overview

- The RCP appears to be split into **two circuit boards**.
- One board looks like a **front-panel / operator interface board**:
  - button matrix
  - lamps / indicators
  - LCD support
  - mostly resistors and small logic
  - many TI `HC595A`-family or similar shift-register-style chips
- That board connects through an intermediate link to a second board.
- The second board appears to be the **main logic / controller board**:
  - single-sided
  - carries the main digital devices
  - appears to contain the actual control logic / firmware for the RCP

## Connector / Wiring Observations

- The main logic board has an **8-pin connector** associated with the external
  10-pin plug/cable assembly.
- The **wire colors inside the RCP do not match** the cable color mapping noted
  earlier from the cable itself.
- This means:
  - internal color cannot be trusted as a one-to-one continuation of external
    cable color
  - the board-side harness should be mapped by continuity, not by color

## Identified Components

Observed on the main logic board:

- `Sanyo LC3564BM-10`
- `XICOR X20C05J-55 9926`
- `27C512 RCPTX7 V1.05 SONY98`
  - socketed / clip-retained
  - appears user-replaceable
  - additional marking observed: `0047K`
- `H8/536 HD`
- full observed line-by-line marking on the main controller:
  - small logo resembling a target / concentric mark
  - `H8/536`
  - `1B1     A`
  - `HD`
  - `6435368F  16`
  - `W34 JAPAN`
- several smaller TI logic ICs with varying markings

## Firmware Cluster Photo Notes

From the close-up photo of the firmware area:

- the firmware device is an **ST** `M27C512-10F1` family EPROM/OTP-style part
  carrying the Sony application label:
  - `27C512`
  - `RCPTX7`
  - `V1.05`
  - `©SONY98`
- the package-side marking also shows:
  - `M27C512`
  - `10F1`
  - `58826`
  - `0047K`
  - `SINGAPORE`
- the ROM is installed in a **socket**, which strongly supports the idea that
  the firmware can be removed and dumped without desoldering
- the `XICOR X20C05J-55` sits immediately beside the firmware device
- the `LC3564BM-10` sits directly above the firmware area

This creates a very plausible classic memory cluster:

- EPROM = program storage
- SRAM = working memory
- Xicor NVRAM/EEPROM = retained setup/configuration data

## Silkscreen Clarifications From Photo

The close-up suggests a couple of earlier markings may need cautious reading:

- the vertical marking beside the ROM socket still looks like
  `CNI12` / `CN112`-like text and should be rechecked carefully from the board
  itself
- `RV1` appears near an **unpopulated footprint** below the ROM area
  rather than clearly identifying the ROM itself

So, for now:

- treat `RV1` as a likely local board reference near that empty footprint
- do not treat `RV1` as the firmware module identifier

## Additional Photo-Backed Board Observations

From the newer board photos:

### Internal Harness Connector

- the internal board connector is silked as **`CN1`**
- it is an **8-pin connector**
- the visible wire colors at this connector appear to be:
  - red
  - brown
  - white
  - orange
  - yellow
  - gray
  - blue
  - black
- this reinforces the earlier point that the internal harness color order does
  **not** match the earlier external cable-color assumptions

Useful implication:

- `CN1` is now the strongest candidate for the board-side harness/IO connector
  that should be traced against the external 10-pin cable assembly

### H8 / DIP Area

- the H8 marking is now clearly readable in-package as:
  - `H8/536`
  - `HD`
  - `6435368F16`
  - `W34 JAPAN`
- the DIP switches `S2` and `S3` are clearly visible above the H8
- the switches show an `ON` legend on one side, which will help keep bit
  numbering consistent during testing
- the pin-number silkscreen around the H8 is clearly printed, which supports
  the earlier observation that the DIP banks land in the `43-50` region

### Likely `S1` Footprint

- one photo shows an **unpopulated circular-pad footprint** labeled `S1`
- this is important because it suggests:
  - `S1` was not "missing from our search" by accident
  - it may be an intentionally unpopulated switch or selector position on this
    board revision
  - Sony may have designed this PCB for multiple variants/options

This makes the earlier "no visible `S1`" mystery much less mysterious.

### Board / Assembly Markings

- one photo shows a boxed marking:
  - `A-8315`
  - `-095-A`
- there is also a small sticker:
  - `2A1`

Working interpretation:

- `A-8315-095-A` is very likely a Sony board or assembly identifier
- `2A1` may be an inspection, revision, or production tracking sticker

### Additional Logic / Glue Area

- one of the smaller TI chips in the photo area is marked `HC74A`
- this is consistent with ordinary glue logic / state / timing support around
  the CPU rather than with a second major processor
- nearby resistor-network and option-footprint areas also fit the picture of a
  configurable CPU/control board with variant population options

## Additional Silkscreen / Board Markings

Observed so far:

- possible connector / reference markings:
  - `RV1`
  - `CNI12`
- near the `H8/536`:
  - `CNI50`
- DIP switches:
  - `S2`
  - `S3`
- board label:
  - `EP-(GW+GN)`
- large board text:
  - `CPU-345`
- board appears visually split into quadrants
- the main custom Sony chip appears to sit in:
  - `B-2`

## Initial Interpretation

These are working interpretations, not yet final identifications.

- `27C512 RCPTX7 V1.05 SONY98`
  - very likely the panel firmware EPROM
  - the `V1.05` label strongly suggests a firmware revision
  - the socketed mounting is very useful for restoration and dumping
- `H8/536 HD`
  - likely the main microcontroller or one of the main controllers
  - especially likely given that the DIP switches reportedly connect to it
  - the full observed marking is consistent with a Hitachi `HD6435368F`
    H8-family MCU
- `X20C05`
  - likely nonvolatile storage for configuration / calibration / retained setup
- `LC3564BM-10`
  - likely RAM or working memory associated with the controller/firmware
- TI `HC595A`-style parts on the front board
  - consistent with lamp, display, or scanned front-panel I/O expansion

Additional interpretation from the newer markings:

- `0047K` on the EPROM may be:
  - an internal Sony build/program label
  - a batch/date/option code
  - or a board/personality identifier tied to this firmware image
- `CPU-345` strongly suggests this board is treated by Sony as a CPU/control
  board assembly rather than only an interface board
- `B-2` may be a board-coordinate locator, which could help if a service manual
  or board overlay ever turns up
- `CNI12` and `CNI50` both look more like connector/reference designators than
  component values
- `RV1` is ambiguous:
  - often that would imply a variable resistor / trim pot
  - but if the silkscreen is hard to read, it is worth re-checking because it
    may instead be another connector or reference prefix
- the `H8/536` line-by-line marking strongly suggests the main CPU is not a
  Sony custom controller but a member of the Hitachi H8 family, with Sony
  firmware and surrounding glue logic providing the product-specific behavior
- the `16` suffix likely indicates a speed grade / variant marker rather than a
  board reference
- the `JAPAN` marking fits an original Japanese-manufactured MCU package

## Cross-Equipment Clue

- The RM-M7G reportedly contains a chip with the same target-like logo and
  `JAPAN` marking from the same apparent manufacturer family.

Why this matters:

- the RCP-TX7 and RM-M7G may share a similar controller platform philosophy
- they may use related H8-family firmware architecture even if the surrounding
  hardware and protocol behavior differ
- this strengthens the idea that DIP-config, ROM content, and NVRAM content may
  matter as much as the raw serial traffic itself

## DIP Switches

- There are **two 4-position DIP switches**
- All switches are currently **off**
- One side of each DIP bank appears tied together
- They appear to act as **ground sinks / pull-to-ground configuration inputs**
- They reportedly connect to the `H8/536`
- The DIP switch reference designators are:
  - `S2`
  - `S3`
- Based on the silkscreen tracing, the DIP switches connect to
  **pins 43 through 50**

This makes them likely candidates for:

- panel address / ID selection
- mode or personality selection
- service / factory configuration
- communication mode selection

Notable oddity:

- no obvious `S1` has been found yet

That could mean:

- `S1` exists on another board
- `S1` is an unpopulated option on this revision
- `S1` is present but hidden/obscured
- Sony numbering simply did not start at `S1` on this assembly

Why the `43-50` range matters:

- eight switch positions feeding a contiguous pin range is exactly what you
  would expect for a boot-time configuration byte or bitfield
- that makes `S2` + `S3` look less like analog trims and more like true digital
  mode/config inputs
- if those really are `H8/536` pins, they may be read very early at reset or
  power-up

Current best interpretation of the DIP banks:

- together they likely form an **8-bit configuration field**
- likely uses pull-ups or default highs on the MCU side
- each switch probably pulls its line low when turned on
- possible meanings still include:
  - panel address
  - model/personality select
  - PT mode / CCU compatibility mode
  - service / factory behavior bits
  - test/diagnostic mode

## Missing / Unpopulated Components

- Several components look **intentionally unpopulated**

For now, assume these may be:

- factory options
- alternate hardware revisions
- model-variant population differences
- unused test or expansion circuitry

They should not be treated as damaged/missing until compared against:

- both PCB sides
- silk labels
- any service-manual board drawing
- other RCP-TX7 board photos, if found later

The newer photos strengthen this:

- `S1` now appears to be an intentionally unpopulated footprint
- there are at least two additional unpopulated IC footprints in the same area
- this board very likely supported multiple build options or derivatives

## Why This Matters

This hardware picture is encouraging because it suggests the RCP is not just a
"dumb front panel."

It likely contains:

- a real MCU (`H8/536`)
- local firmware (`27C512`)
- nonvolatile memory (`X20C05`)
- a front-panel scan / display subsystem

That means the panel may have:

- multiple boot/configuration modes
- stored setup or address data
- more internal state than the serial experiments alone reveal

It also makes a **firmware dump** or **DIP-switch mapping** potentially very
high-value later.

## Next Hardware Inspection Targets

Highest-value things to map next:

1. Exact full part markings on the `H8/536` package
2. Exact full part markings on the `LC3564BM-10`
3. Exact full part markings on each smaller TI logic IC near the I/O connector
4. Continuity from the external 10-pin pins to the main-board connector pins
   - especially through `CN1`
5. Continuity from the serial pins (`4`, `7`, `9`, `10`) to their destination
   chips/components
6. Whether any of the remaining wires land on:
   - MCU GPIO
   - analog conditioning
   - optocouplers
   - comparator/op-amp circuitry
   - transceiver/interface ICs
7. Silk labels near the two DIP switch blocks
   - including the exact orientation of the `ON` legend on `S2` and `S3`
8. Any test pads labeled for:
   - `TX`
   - `RX`
   - `CLK`
   - `DATA`
   - `RST`
   - `ROM`
   - `RAM`
   - `GND`
   - `+5V`
   - `+12V`

## Strong Next Leads

Based on the current findings, the best hardware-side leads are:

1. **Map the DIP switches**
   - note silk labels
   - test whether any switch changes startup behavior or serial responses
   - specifically record the current `S2` / `S3` bit positions before touching
   - if possible, determine whether the switches are read only at boot or also
     during runtime
2. **Dump or at least photograph the EPROM label and socket area clearly**
   - the socketed `27C512` is one of the most promising restoration clues
   - include the `0047K` marking in the photo record
3. **Trace the 8-pin internal connector**
   - identify which of those lines are serial, power, and "something else"
4. **Identify whether the 10-pin path includes a dedicated interface chip**
    - if not, the extra lines may go directly into the MCU or surrounding logic
5. **Verify the likely connector references**
   - confirm whether `CNI12` is the 8-pin internal cable header
   - confirm whether `CNI50` refers to the H8 area, a nearby header, or another
     assembly reference
   - note that `CN1` is now the strongest observed silk for the internal
     8-pin harness connector in the photos
6. **Compare the RM-M7G controller board if possible**
   - look for the exact MCU family/part
   - compare ROM / EEPROM / switch architecture
   - note whether Sony reused the same CPU platform with different front-end
     logic

## Open Questions

- Is the `H8/536` definitely the primary CPU, or is there another Sony custom
  controller sharing that role?
- Is the socketed `27C512` the only firmware store?
- What exactly is stored in the `X20C05`?
- Do the DIP switches select mode, address, or board variant?
- Do `S2`/`S3` form a single boot configuration byte across MCU pins `43-50`?
- Do any of the non-serial wires carry required wake/session information?
- Is there a hardware reason the panel never fully leaves `CONNECT NOT ACT`
  under our emulated PT2 traffic?
- What do `CPU-345`, `EP-(GW+GN)`, `CNI12`, and `CNI50` correspond to in Sony's
  internal board naming?
- Is `A-8315-095-A` the specific board assembly number for this CPU board?
- Does the RM-M7G use the same H8-family controller and a similar ROM/NVRAM
  arrangement?

## DIP Switch Experiment Ladder

Current known baseline:

- all 8 DIP positions are currently **off**
- switches are grouped as:
  - `S2` = 4 positions
  - `S3` = 4 positions
- together they likely feed MCU pins `43-50`

### Safety / Method

Use this method for every DIP test:

1. Photograph the current DIP positions before changing anything.
2. Change **one switch only**.
3. Reassemble only as much as needed for safe power-on.
4. Power up the panel.
5. Observe behavior **before connecting serial**.
6. Then run the normal serial baseline checks.
7. Power down fully before changing the next switch.
8. Return to the all-off baseline between non-adjacent tests.

Recommended observations for each run:

- LCD startup text
- whether the active light changes
- whether `CONNECT NOT ACT` appears, and when
- whether the idle heartbeat is still `00 00 00 00 80 DA`
- whether known probes still behave the same:
  - `A0`
  - `90`
  - `AF`
  - `E8`
  - `EC`
- any new button behavior in idle state
- any change in baud-like behavior or complete silence

### Naming Convention

Use a simple notation in notes/logs:

- baseline = `S2=0000 S3=0000`
- example single change:
  - `S2=1000 S3=0000`
  - meaning only the first `S2` switch is changed from baseline

If the physical switch numbering is unclear, first label them visually as:

- `S2-1` .. `S2-4`
- `S3-1` .. `S3-4`

based on one fixed left-to-right or top-to-bottom convention, and stick to it.

### Phase 1: Single-Bit Sweep

Goal:

- find out whether any single DIP bit has an obvious effect on startup,
  protocol, or front-panel behavior

Run these eight tests, always starting from all-off baseline:

1. `S2-1` on, all others off
2. `S2-2` on, all others off
3. `S2-3` on, all others off
4. `S2-4` on, all others off
5. `S3-1` on, all others off
6. `S3-2` on, all others off
7. `S3-3` on, all others off
8. `S3-4` on, all others off

For each test:

- power-cycle
- watch LCD/startup state
- check for idle heartbeat
- try one minimal probe set:
  - idle listen
  - `A0`
  - `A0 -> 90`
  - `A0 -> AF`

What would count as a hit:

- panel boots into a different visible mode
- panel no longer shows `CONNECT NOT ACT`
- heartbeat changes or disappears
- known startup families change:
  - `64 40 30`
  - `0D 04 AB`
  - `0D 04 EB`
  - `E4 40 30`
- buttons become active in idle

### Phase 2: Group Identity Test

Only do this after Phase 1.

Goal:

- see whether one whole DIP bank behaves like an address nibble or mode nibble

Run these four tests:

1. all `S2` on, `S3` all off
2. all `S2` off, all `S3` on
3. all `S2` on, all `S3` on
4. return to all off baseline and confirm behavior is restored

What this can reveal:

- one bank may control personality while the other controls address
- one bank may do nothing while the other changes the panel sharply
- all-on may expose service/test behavior that single-bit changes do not

### Phase 3: Follow-Up Only If A Bit Matters

If Phase 1 reveals a promising bit, branch carefully:

1. repeat that same switch setting twice to confirm reproducibility
2. test neighboring bits in the same bank
3. test that bit plus one neighboring bit
4. compare:
   - startup text
   - heartbeat
   - `A0 -> 90`
   - `A0 -> AF`
   - `E8` / `EC` selector behavior

### Good First Serial Checks Per DIP Setting

Keep the serial side small at first.

Recommended order:

1. idle listen only
2. repeating heartbeat only
3. `A0`
4. `A0 -> 90`
5. `A0 -> AF`

Only if something changes meaningfully, then test:

- `E8`
- `E9`
- `EC`
- CALL synthetic trigger

### Strong Cautions

- Do not change multiple unknown DIP bits at once in the first pass.
- Do not assume "on" means logic high; it may actually pull the line low.
- Some switches may only be sampled at cold boot, not warm reset.
- A strange setting may stop normal serial output entirely; that is still a
  useful result.
- If one setting produces a dramatically different boot state, stop and record
  it before going wider.