Files

Aiden 2ab54be5ec new run

2026-05-14 00:58:14 +10:00

26 KiB

Raw Blame History

RCP-TX7 PCB Notes

These notes track direct physical observations from inside the Sony RCP-TX7. They are intentionally separate from the PT2 protocol notes, because the board layout and component choices may explain what the serial experiments alone do not.

Current Physical Overview

The RCP appears to be split into two circuit boards.
One board looks like a front-panel / operator interface board:
- button matrix
- lamps / indicators
- LCD support
- mostly resistors and small logic
- many TI HC595A-family or similar shift-register-style chips
That board connects through an intermediate link to a second board.
The second board appears to be the main logic / controller board:
- single-sided
- carries the main digital devices
- appears to contain the actual control logic / firmware for the RCP

Connector / Wiring Observations

The main logic board has an 8-pin connector associated with the external 10-pin plug/cable assembly.
The wire colors inside the RCP do not match the cable color mapping noted earlier from the cable itself.
This means:
- internal color cannot be trusted as a one-to-one continuation of external cable color
- the board-side harness should be mapped by continuity, not by color

Identified Components

Observed on the main logic board:

Sanyo LC3564BM-10
XICOR X20C05J-55 9926
27C512 RCPTX7 V1.05 SONY98
- socketed / clip-retained
- appears user-replaceable
- additional marking observed: 0047K
H8/536 HD
full observed line-by-line marking on the main controller:
- small logo resembling a target / concentric mark
- H8/536
- 1B1 A
- HD
- 6435368F 16
- W34 JAPAN
several smaller TI logic ICs with varying markings

Firmware Cluster Photo Notes

From the close-up photo of the firmware area:

the firmware device is an ST M27C512-10F1 family EPROM/OTP-style part carrying the Sony application label:
- 27C512
- RCPTX7
- V1.05
- ©SONY98
the package-side marking also shows:
- M27C512
- 10F1
- 58826
- 0047K
- SINGAPORE
the ROM is installed in a socket, which strongly supports the idea that the firmware can be removed and dumped without desoldering
the XICOR X20C05J-55 sits immediately beside the firmware device
the LC3564BM-10 sits directly above the firmware area

This creates a very plausible classic memory cluster:

EPROM = program storage
SRAM = working memory
Xicor NVRAM/EEPROM = retained setup/configuration data

Silkscreen Clarifications From Photo

The close-up suggests a couple of earlier markings may need cautious reading:

the vertical marking beside the ROM socket still looks like CNI12 / CN112-like text and should be rechecked carefully from the board itself
RV1 appears near an unpopulated footprint below the ROM area rather than clearly identifying the ROM itself

So, for now:

treat RV1 as a likely local board reference near that empty footprint
do not treat RV1 as the firmware module identifier

Additional Photo-Backed Board Observations

From the newer board photos:

Internal Harness Connector

the internal board connector is silked as CN1
it is an 8-pin connector
the visible wire colors at this connector appear to be:
- red
- brown
- white
- orange
- yellow
- gray
- blue
- black
this reinforces the earlier point that the internal harness color order does not match the earlier external cable-color assumptions

Useful implication:

CN1 is now the strongest candidate for the board-side harness/IO connector that should be traced against the external 10-pin cable assembly

`CN1` Continuity Mapping

Based on your continuity tracing and the board silkscreen numbering:

`CN1` pin	Observed function	Internal wire color	External 10-pin
`1`	`VBS (X) IN`	white	pin `2`
`2`	`VBS (G) IN`	blue	pin `3`
`3`	data ground	grey	pin `5`
`4`	data `RCP -> CCU`	yellow	pin `4`
`5`	data `CCU -> RCP`	orange	pin `7`
`6`	data ground	brown	pin `6`
`7`	ground	black	pin `9`
`8`	`DC+`	red	pin `10`

Important observations:

CN1 pin 7 is the main ground path and maps to external pin 9
CN1 pin 8 is DC power and maps to external pin 10
the serial pair is now clearly confirmed at the board level:
- CN1 pin 4 / external pin 4 = RCP -> CCU
- CN1 pin 5 / external pin 7 = CCU -> RCP
there are two additional non-serial signal inputs on external pins 2 and 3
there are two separate data-ground/return lines on external pins 5 and 6

Very important electrical note from tracing:

the two data-ground lines (CN1 pins 3 and 6) were observed as not connected to common ground

That strongly suggests the connector is not just:

power
one TX line
one RX line

Instead, it likely carries a mixed signal set with at least:

analog/video-related inputs
serial/control
separate signal returns
power/common ground

Refined grounding observation:

the separate data grounds appear to connect to common ground through small ceramic capacitors near the connector
the relevant parts are labeled:
- C55
- C56

This changes the interpretation from "totally isolated grounds" to something more like:

DC-isolated or not directly hard-tied
but AC-coupled / noise-referenced to common ground

That is a very plausible arrangement for:

signal-return noise control
EMI filtering
keeping the data pair referenced without fully hard-bonding the return paths

Manual Cross-Check: External Connector Signals

The manual fragment for the external connector aligns very strongly with the continuity map we traced:

External pin	Manual signal	Notes
`1`	`(SPARE)`	matches the fact that it has not appeared on `CN1`
`2`	`VBS (X) IN`	manual notes `1.0 Vp-p, sync negative`
`3`	`VBS (G) IN`	confirms a second VBS input line
`4`	`S. DATA (RCP -> CCU)`	matches traced serial-out line
`5`	`S. DATA GND`	matches traced separate data ground
`6`	`S. DATA GND`	matches traced separate data ground
`7`	`S. DATA (CCU -> RCP)`	matches traced serial-in line

This is a strong confirmation that the harness tracing is fundamentally right.

Big implication:

VBS (X) IN and VBS (G) IN are not mystery wires anymore
they are documented inputs and are likely meaningful to normal panel operation
the wake/session problem may therefore depend on more than serial traffic, although board-level routing now suggests that may vary by revision/options

The manual wording also strengthens the idea that these are likely video/reference-style inputs rather than general-purpose logic lines.

H8 / DIP Area

the H8 marking is now clearly readable in-package as:
- H8/536
- HD
- 6435368F16
- W34 JAPAN
the DIP switches S2 and S3 are clearly visible above the H8
the switches show an ON legend on one side, which will help keep bit numbering consistent during testing
the pin-number silkscreen around the H8 is clearly printed, which supports the earlier observation that the DIP banks land in the 43-50 region

Likely `S1` Footprint

one photo shows an unpopulated circular-pad footprint labeled S1
this is important because it suggests:
- S1 was not "missing from our search" by accident
- it may be an intentionally unpopulated switch or selector position on this board revision
- Sony may have designed this PCB for multiple variants/options

This makes the earlier "no visible S1" mystery much less mysterious.

Board / Assembly Markings

one photo shows a boxed marking:
- A-8315
- -095-A
there is also a small sticker:
- 2A1

Working interpretation:

A-8315-095-A is very likely a Sony board or assembly identifier
2A1 may be an inspection, revision, or production tracking sticker

Additional Logic / Glue Area

one of the smaller TI chips in the photo area is marked HC74A
this is consistent with ordinary glue logic / state / timing support around the CPU rather than with a second major processor
nearby resistor-network and option-footprint areas also fit the picture of a configurable CPU/control board with variant population options

Serial Interface Confirmation

Tracing from the connector into the board:

external pin 4 / CN1 pin 4 goes to a MAX202 device at package pad 14
external pin 7 / CN1 pin 5 goes to the same MAX202 device at package pad 13
no other CN1 pins were observed going to that MAX202

Observed marking on the interface chip:

MAX202
CSE 0107

Interpretation:

this is a very strong confirmation that the PT2 serial path is carried as a real RS-232-style interface through a dedicated line transceiver
it also strongly implies the other connector lines (1, 2, 3, 6) are not just extra serial handshake pins to the same interface chip
the wake/session problem may therefore involve:
- analog/video sense inputs
- separate return/reference behavior
- or higher-level protocol/state expectations beyond the RS-232 channel alone

Refined serial-ground read:

because the two S. DATA GND lines are capacitor-coupled to common ground, the serial interface likely expects a somewhat cleaner/dedicated return structure than a naive "everything tied straight together" hookup
this does not by itself explain the missing wake/session behavior
but it does support the idea that Sony treated the remote link as a proper interface with controlled grounding rather than as a casual single-ground wiring bundle

Important Open Electrical Discrepancy

The manual fragment for external pin 7 appears to describe:

Zi >= 10 kohm
high/open state around 4.5 +/- 0.5 V
low state around 0 +/- 0.5 V

That does not read like a classic bipolar RS-232-level description.

But the board tracing currently shows external pin 7 going into the MAX202 at pad 13 (R1IN on a standard MAX202 pinout), while external pin 4 goes to pad 14 (T1OUT).

So there is now a real discrepancy to resolve:

the manual signal description for pin 7 looks logic/open style
the board tracing looks like an RS-232 transceiver path

Possible explanations to keep open for now:

the manual fragment may describe behavior at a different system boundary or for a slightly different revision/context
the Sony interface may be electrically unusual despite using a MAX202
there may be surrounding circuitry affecting how the line behaves at the connector

For now, the safest conclusion is:

the signal names are strongly confirmed
the exact electrical behavior still needs reconciliation

Board Construction / Routing Note

The board appears to be a 2-layer PCB
Components are populated on only one side
With transmitted light, traces appear visible on the opposite side, with no obvious evidence of hidden inner layers

This matters because it makes visual trace-following more trustworthy and makes the connector routing conclusions stronger.

VBS Routing Observation

New tracing observation:

VBS (X) IN and VBS (G) IN do not appear to run into the CPU/serial section directly
instead, they route to the side of the board toward an empty connector position labeled CN5
the only other obvious trace associated with that area appears to be ground

Working interpretation:

the VBS lines may be routed primarily to an unpopulated optional connector or daughterboard position
this could mean:
- the TX7 PCB was designed for a variant that used the VBS signals more directly
- this particular board revision does not currently use them in the populated build
- or the signals are simply passed through / made available without deep local processing

Why this matters:

this weakens the earlier "VBS is definitely the missing wake input" theory
it does not eliminate it completely
but it does suggest the most immediate wake/session logic is still more likely to live in:
- the serial path
- the DIP/boot configuration
- optional/unpopulated variant circuitry
- or retained configuration in NVRAM/firmware

Additional Silkscreen / Board Markings

Observed so far:

possible connector / reference markings:
- RV1
- CNI12
near the H8/536:
- CNI50
DIP switches:
- S2
- S3
board label:
- EP-(GW+GN)
large board text:
- CPU-345
board appears visually split into quadrants
the main custom Sony chip appears to sit in:
- B-2

Initial Interpretation

These are working interpretations, not yet final identifications.

27C512 RCPTX7 V1.05 SONY98
- very likely the panel firmware EPROM
- the V1.05 label strongly suggests a firmware revision
- the socketed mounting is very useful for restoration and dumping
H8/536 HD
- likely the main microcontroller or one of the main controllers
- especially likely given that the DIP switches reportedly connect to it
- the full observed marking is consistent with a Hitachi HD6435368F H8-family MCU
X20C05
- likely nonvolatile storage for configuration / calibration / retained setup
LC3564BM-10
- likely RAM or working memory associated with the controller/firmware
TI HC595A-style parts on the front board
- consistent with lamp, display, or scanned front-panel I/O expansion

Additional interpretation from the newer markings:

0047K on the EPROM may be:
- an internal Sony build/program label
- a batch/date/option code
- or a board/personality identifier tied to this firmware image
CPU-345 strongly suggests this board is treated by Sony as a CPU/control board assembly rather than only an interface board
B-2 may be a board-coordinate locator, which could help if a service manual or board overlay ever turns up
CNI12 and CNI50 both look more like connector/reference designators than component values
RV1 is ambiguous:
- often that would imply a variable resistor / trim pot
- but if the silkscreen is hard to read, it is worth re-checking because it may instead be another connector or reference prefix
the H8/536 line-by-line marking strongly suggests the main CPU is not a Sony custom controller but a member of the Hitachi H8 family, with Sony firmware and surrounding glue logic providing the product-specific behavior
the 16 suffix likely indicates a speed grade / variant marker rather than a board reference
the JAPAN marking fits an original Japanese-manufactured MCU package

Cross-Equipment Clue

The RM-M7G reportedly contains a chip with the same target-like logo and JAPAN marking from the same apparent manufacturer family.

Why this matters:

the RCP-TX7 and RM-M7G may share a similar controller platform philosophy
they may use related H8-family firmware architecture even if the surrounding hardware and protocol behavior differ
this strengthens the idea that DIP-config, ROM content, and NVRAM content may matter as much as the raw serial traffic itself

DIP Switches

There are two 4-position DIP switches
All switches are currently off
One side of each DIP bank appears tied together
They appear to act as ground sinks / pull-to-ground configuration inputs
They reportedly connect to the H8/536
The DIP switch reference designators are:
- S2
- S3
Based on the silkscreen tracing, the DIP switches connect to pins 43 through 50

This makes them likely candidates for:

panel address / ID selection
mode or personality selection
service / factory configuration
communication mode selection

Notable oddity:

no obvious S1 has been found yet

That could mean:

S1 exists on another board
S1 is an unpopulated option on this revision
S1 is present but hidden/obscured
Sony numbering simply did not start at S1 on this assembly

Why the 43-50 range matters:

eight switch positions feeding a contiguous pin range is exactly what you would expect for a boot-time configuration byte or bitfield
that makes S2 + S3 look less like analog trims and more like true digital mode/config inputs
if those really are H8/536 pins, they may be read very early at reset or power-up

Current best interpretation of the DIP banks:

together they likely form an 8-bit configuration field
likely uses pull-ups or default highs on the MCU side
each switch probably pulls its line low when turned on
possible meanings still include:
- panel address
- model/personality select
- PT mode / CCU compatibility mode
- service / factory behavior bits
- test/diagnostic mode

Missing / Unpopulated Components

Several components look intentionally unpopulated

For now, assume these may be:

factory options
alternate hardware revisions
model-variant population differences
unused test or expansion circuitry

They should not be treated as damaged/missing until compared against:

both PCB sides
silk labels
any service-manual board drawing
other RCP-TX7 board photos, if found later

The newer photos strengthen this:

S1 now appears to be an intentionally unpopulated footprint
there are at least two additional unpopulated IC footprints in the same area
this board very likely supported multiple build options or derivatives

Why This Matters

This hardware picture is encouraging because it suggests the RCP is not just a "dumb front panel."

It likely contains:

a real MCU (H8/536)
local firmware (27C512)
nonvolatile memory (X20C05)
a front-panel scan / display subsystem

That means the panel may have:

multiple boot/configuration modes
stored setup or address data
more internal state than the serial experiments alone reveal

It also makes a firmware dump or DIP-switch mapping potentially very high-value later.

Next Hardware Inspection Targets

Highest-value things to map next:

Exact full part markings on the H8/536 package
Exact full part markings on the LC3564BM-10
Exact full part markings on each smaller TI logic IC near the I/O connector
Continuity from the external 10-pin pins to the main-board connector pins
- especially through CN1
Continuity from the serial pins (4, 7, 9, 10) to their destination chips/components
Whether any of the remaining wires land on:
- MCU GPIO
- analog conditioning
- optocouplers
- comparator/op-amp circuitry
- transceiver/interface ICs
Silk labels near the two DIP switch blocks
- including the exact orientation of the ON legend on S2 and S3
Any test pads labeled for:
- TX
- RX
- CLK
- DATA
- RST
- ROM
- RAM
- GND
- +5V
- +12V

Strong Next Leads

Based on the current findings, the best hardware-side leads are:

Map the DIP switches
- note silk labels
- test whether any switch changes startup behavior or serial responses
- specifically record the current S2 / S3 bit positions before touching
- if possible, determine whether the switches are read only at boot or also during runtime
Dump or at least photograph the EPROM label and socket area clearly
- the socketed 27C512 is one of the most promising restoration clues
- include the 0047K marking in the photo record
Trace the 8-pin internal connector
- identify which of those lines are serial, power, and "something else"
Identify whether the 10-pin path includes a dedicated interface chip
- if not, the extra lines may go directly into the MCU or surrounding logic
Verify the likely connector references
- confirm whether CNI12 is the 8-pin internal cable header
- confirm whether CNI50 refers to the H8 area, a nearby header, or another assembly reference
- note that CN1 is now the strongest observed silk for the internal 8-pin harness connector in the photos
Compare the RM-M7G controller board if possible
- look for the exact MCU family/part
- compare ROM / EEPROM / switch architecture
- note whether Sony reused the same CPU platform with different front-end logic

Open Questions

Is the H8/536 definitely the primary CPU, or is there another Sony custom controller sharing that role?
Is the socketed 27C512 the only firmware store?
What exactly is stored in the X20C05?
Do the DIP switches select mode, address, or board variant?
Do S2/S3 form a single boot configuration byte across MCU pins 43-50?
Do any of the non-serial wires carry required wake/session information?
Is there a hardware reason the panel never fully leaves CONNECT NOT ACT under our emulated PT2 traffic?
What do CPU-345, EP-(GW+GN), CNI12, and CNI50 correspond to in Sony's internal board naming?
Is A-8315-095-A the specific board assembly number for this CPU board?
Does the RM-M7G use the same H8-family controller and a similar ROM/NVRAM arrangement?

DIP Switch Experiment Ladder

Current known baseline:

all 8 DIP positions are currently off
switches are grouped as:
- S2 = 4 positions
- S3 = 4 positions
together they likely feed MCU pins 43-50

Safety / Method

Use this method for every DIP test:

Photograph the current DIP positions before changing anything.
Change one switch only.
Reassemble only as much as needed for safe power-on.
Power up the panel.
Observe behavior before connecting serial.
Then run the normal serial baseline checks.
Power down fully before changing the next switch.
Return to the all-off baseline between non-adjacent tests.

Recommended observations for each run:

LCD startup text
whether the active light changes
whether CONNECT NOT ACT appears, and when
whether the idle heartbeat is still 00 00 00 00 80 DA
whether known probes still behave the same:
- A0
- 90
- AF
- E8
- EC
any new button behavior in idle state
any change in baud-like behavior or complete silence

Naming Convention

Use a simple notation in notes/logs:

baseline = S2=0000 S3=0000
example single change:
- S2=1000 S3=0000
- meaning only the first S2 switch is changed from baseline

If the physical switch numbering is unclear, first label them visually as:

S2-1 .. S2-4
S3-1 .. S3-4

based on one fixed left-to-right or top-to-bottom convention, and stick to it.

Phase 1: Single-Bit Sweep

Goal:

find out whether any single DIP bit has an obvious effect on startup, protocol, or front-panel behavior

Run these eight tests, always starting from all-off baseline:

S2-1 on, all others off
S2-2 on, all others off
S2-3 on, all others off
S2-4 on, all others off
S3-1 on, all others off
S3-2 on, all others off
S3-3 on, all others off
S3-4 on, all others off

For each test:

power-cycle
watch LCD/startup state
check for idle heartbeat
try one minimal probe set:
- idle listen
- A0
- A0 -> 90
- A0 -> AF

What would count as a hit:

panel boots into a different visible mode
panel no longer shows CONNECT NOT ACT
heartbeat changes or disappears
known startup families change:
- 64 40 30
- 0D 04 AB
- 0D 04 EB
- E4 40 30
buttons become active in idle

Phase 2: Group Identity Test

Only do this after Phase 1.

Goal:

see whether one whole DIP bank behaves like an address nibble or mode nibble

Run these four tests:

all S2 on, S3 all off
all S2 off, all S3 on
all S2 on, all S3 on
return to all off baseline and confirm behavior is restored

What this can reveal:

one bank may control personality while the other controls address
one bank may do nothing while the other changes the panel sharply
all-on may expose service/test behavior that single-bit changes do not

Phase 3: Follow-Up Only If A Bit Matters

If Phase 1 reveals a promising bit, branch carefully:

repeat that same switch setting twice to confirm reproducibility
test neighboring bits in the same bank
test that bit plus one neighboring bit
compare:
- startup text
- heartbeat
- A0 -> 90
- A0 -> AF
- E8 / EC selector behavior

Good First Serial Checks Per DIP Setting

Keep the serial side small at first.

Recommended order:

idle listen only
repeating heartbeat only
A0
A0 -> 90
A0 -> AF

Only if something changes meaningfully, then test:

E8
E9
EC
CALL synthetic trigger

Strong Cautions

Do not change multiple unknown DIP bits at once in the first pass.
Do not assume "on" means logic high; it may actually pull the line low.
Some switches may only be sampled at cold boot, not warm reset.
A strange setting may stop normal serial output entirely; that is still a useful result.
If one setting produces a dramatically different boot state, stop and record it before going wider.

DIP Switch First-Pass Results

The first single-bit sweep produced a useful answer:

the DIP switches are not inert
but they do not seem to act like a blunt "service mode on/off" in the simplest sense

What changed visibly:

user reported that the first tested DIP setting briefly showed a small cursor on the LCD
the other single-bit settings looked the same visually

What changed serially:

S3-1 shifted the A0 -> 90 startup family from:
- 07 80 64 40 30 C9 to:
- 07 80 E4 40 30 49
S2-3 suppressed the A0 -> 90 branch entirely in the first pass
S2-1 left A0 -> 90 alive but appears to have flattened A0 -> AF

Best current hardware interpretation:

the DIP banks very likely participate in startup personality / mode selection
they may not directly control "active vs inactive panel"
but they clearly can steer which startup-family surface the firmware exposes

This is consistent with the earlier suspicion that S2 + S3 form a boot-time configuration byte rather than casual front-panel options.

26 KiB Raw Blame History