# PT2 KNEE ROM Trace

Date: 2026-05-26

## Short Version

KNEE is not a simple held selector bit. The ROM has a dedicated local panel-input handler at `loc_1795`, reached when the panel input word at `F104` changes. That handler uses CCU-side selector state as gates, then either shows a short timed KNEE page or reports a KNEE value change on selector `0x00BC`.

This explains the bench pattern where KNEE AUTO can light or flash and then clear even while serial traffic remains healthy: one ROM path is a timed display/page override, not a maintained lamp value.

## Input Path

The local panel path is:

```text
F104 changes -> F692 updated -> F6F0.1 set -> main dispatcher calls loc_1795
```

The important code anchors are:

```text
3B33  MOV:G.W @H'F104, R0
3B37  CMP:G.W @H'F692, R0
3B3D  BSET.B #1, @H'F6F0
3B41  MOV:G.W R0, @H'F692

1630  BCLR.B #1, @H'F6F0
1636  JSR @loc_1795
```

So serial writes can prepare the state table, but the main KNEE control branch appears to require the panel-side input lane to change.

## Handler Decision Table

`loc_1795` reads two words from the primary selector table:

| ROM read | Selector meaning |
| --- | --- |
| `@H'E172` | `E000[0x00B9]` |
| `@H'E220` | `E000[0x0110]` |

The branch is:

```text
1795  if F731 > 2: skip
179C  if E000[0x00B9].13 == 0: loc_2127()
17A7  else if E000[0x0110].15 == 1: loc_2127()
17B2  else:
        delta = F692 - F6B2
        report/update selector 0x00BC via loc_19A2
17C0  F6B2 = F692
```

Practical interpretation:

| Condition | ROM effect | Current meaning |
| --- | --- | --- |
| `0x00B9.13 = 0` | timed KNEE page via `loc_2127` | KNEE value reporting not enabled |
| `0x00B9.13 = 1`, `0x0110.15 = 1` | timed KNEE page via `loc_2127` | override/inhibit mode |
| `0x00B9.13 = 1`, `0x0110.15 = 0` | value delta reported as selector `0x00BC` | likely live KNEE control/report lane |

This downgrades the earlier bench label that treated `0x00B9.15` as the main KNEE gate. The ROM gate for the panel-input handler is `0x00B9.13`.

## Timed KNEE Page

`loc_2127` is the timed page path:

```text
2127  set FB03.7
212D  save old F732 into F734, if this is a fresh override
2135  F732 = 0x1C03
213B  FB02 = 0x14
2140  call loc_48FA
```

The timer path later decrements `FB02`; when it expires, `loc_48EF` restores `F732` from `F734` and redraws. That is the likely cause of "lights, then falls away" observations.

The LCD dispatcher confirms `F732=0x1C03` is a KNEE page:

```text
493E[0x1C] -> 0x92CC
0x92DE[3] -> 0x95CE
0x960B prints "KNEE"
```

On that KNEE page, the second line is selected like this:

```text
if E000[0x0110].15: "DL"
else if E000[0x00B9].15: "PRESET"
else: "AUTO"
```

So `0x00B9.15` still matters, but it appears to choose the KNEE page label (`PRESET` versus `AUTO`) rather than enabling the report path. `0x0110.15` selects the `DL` label and also forces the timed page path from `loc_1795`.

## Bench Implications

Useful frames to test this model:

| Purpose | Frame |
| --- | --- |
| clear `0x00B9` | `00 01 39 00 00 62` |
| set `0x00B9.13` gate | `00 01 39 20 00 42` |
| set `0x00B9.15` label bit | `00 01 39 80 00 E2` |
| set `0x00B9.15` and `.13` | `00 01 39 A0 00 C2` |
| clear `0x0110` | `00 01 90 00 00 CB` |
| set `0x0110.15` override | `00 01 90 80 00 4B` |
| read `0x00BC` | `01 01 3C 00 00 66` |

The most direct live-control test is:

1. Reach `CONNECT: OK`.
2. Send `00 01 39 20 00 42` to set `0x00B9.13`.
3. Send `00 01 90 00 00 CB` to clear `0x0110.15`.
4. Move or exercise the physical KNEE-related control, if available.
5. Watch for TX/report traffic around selector `0x00BC`.

If no physical KNEE input is moved, the ROM may not enter `loc_1795`, because the trigger is the `F104` panel input change path rather than the serial write itself.

## Bench Observation: DTL / KNEE

The first `knee-rom-gate-and-value-probe` bench run produced a new LCD state with `DTL` on the left and `KNEE` on the right. That is an important confirmation: page `0x1C` contains both a KNEE entry and a DETAIL entry.

Relevant ROM text and page entries:

```text
0x92DE[3] -> 0x95CE  KNEE page entry
0x92DE[7] -> 0x97C8  DETAIL page entry
0x960B prints "KNEE"
0x9805 prints "DETAIL"
```

The bench display probably shows the page-0x1C menu neighborhood, with DETAIL abbreviated as `DTL` and KNEE as the selected/right-side item. The log does not encode LCD pixels, but the serial timing around the observation is consistent with the KNEE probe:

```text
00 01 39 20 00 42  ; set 0x00B9.13 gate
00 01 39 A0 00 C2  ; set 0x00B9.15 + 0x00B9.13
00 01 90 80 00 4B  ; set 0x0110.15 timed KNEE/DL override
```

Next isolation target: determine whether `DTL/KNEE` appears from `0x00B9.13`, `0x00B9.A0`, `0x0110.15`, or only the combined sequence.

## Panel Correlation

The physical panel has both DETAIL and KNEE buttons near the LCD. That matches the ROM page-`0x1C` neighborhood and makes the observed `DTL/KNEE` state likely to be a local menu/button context rather than a generic lamp status.

Practical implication: once the CCU-side selector gates are prepared, pressing the physical DETAIL/KNEE buttons may be the missing `F104` panel-input transition that calls `loc_1795`. If so, the useful evidence should be:

- visible LCD movement between DETAIL and KNEE entries,
- possible KNEE timed page redraws,
- TX/report traffic for selector `0x00BC` when KNEE input movement is accepted,
- or other page-`0x1C` selector reports from neighboring DETAIL/KNEE controls.

## Follow-Up: Lamp Without LCD Movement

The follow-up run after discovering the DETAIL/KNEE buttons did not reproduce an LCD page change. The observed result was:

- only the later KNEE cases/windows illuminated the KNEE AUTO lamp,
- none of those cases changed the LCD.

Current interpretation:

- `0x0110.15` is still the strongest KNEE AUTO lamp/status source.
- Serial table writes can light KNEE AUTO without necessarily entering the LCD DETAIL/KNEE page.
- The LCD path probably needs an additional local-display/menu condition, not just the CCU-side selector bits.
- The physical DETAIL/KNEE buttons may be scanned by the local panel path, but in this test they did not create a visible LCD transition or new serial report evidence.

This separates two related but distinct paths:

```text
KNEE AUTO lamp/status:  mostly selector/table driven, strongest source 0x0110.15
DETAIL/KNEE LCD page:  local page/menu context, likely page 0x1C plus panel/menu state
```

Next ROM target: trace the DETAIL and KNEE button scan bits through the page-`0x1C` menu dispatcher, not just the `loc_1795` KNEE value handler.
