knee page discovery
This commit is contained in:
Aiden
175
docs/pt2-knee-rom-trace.md
Normal file
175
docs/pt2-knee-rom-trace.md
Normal file
@@ -0,0 +1,175 @@
|
||||
# PT2 KNEE ROM Trace
|
||||
|
||||
Date: 2026-05-26
|
||||
|
||||
## Short Version
|
||||
|
||||
KNEE is not a simple held selector bit. The ROM has a dedicated local panel-input handler at `loc_1795`, reached when the panel input word at `F104` changes. That handler uses CCU-side selector state as gates, then either shows a short timed KNEE page or reports a KNEE value change on selector `0x00BC`.
|
||||
|
||||
This explains the bench pattern where KNEE AUTO can light or flash and then clear even while serial traffic remains healthy: one ROM path is a timed display/page override, not a maintained lamp value.
|
||||
|
||||
## Input Path
|
||||
|
||||
The local panel path is:
|
||||
|
||||
```text
|
||||
F104 changes -> F692 updated -> F6F0.1 set -> main dispatcher calls loc_1795
|
||||
```
|
||||
|
||||
The important code anchors are:
|
||||
|
||||
```text
|
||||
3B33 MOV:G.W @H'F104, R0
|
||||
3B37 CMP:G.W @H'F692, R0
|
||||
3B3D BSET.B #1, @H'F6F0
|
||||
3B41 MOV:G.W R0, @H'F692
|
||||
|
||||
1630 BCLR.B #1, @H'F6F0
|
||||
1636 JSR @loc_1795
|
||||
```
|
||||
|
||||
So serial writes can prepare the state table, but the main KNEE control branch appears to require the panel-side input lane to change.
|
||||
|
||||
## Handler Decision Table
|
||||
|
||||
`loc_1795` reads two words from the primary selector table:
|
||||
|
||||
| ROM read | Selector meaning |
|
||||
| --- | --- |
|
||||
| `@H'E172` | `E000[0x00B9]` |
|
||||
| `@H'E220` | `E000[0x0110]` |
|
||||
|
||||
The branch is:
|
||||
|
||||
```text
|
||||
1795 if F731 > 2: skip
|
||||
179C if E000[0x00B9].13 == 0: loc_2127()
|
||||
17A7 else if E000[0x0110].15 == 1: loc_2127()
|
||||
17B2 else:
|
||||
delta = F692 - F6B2
|
||||
report/update selector 0x00BC via loc_19A2
|
||||
17C0 F6B2 = F692
|
||||
```
|
||||
|
||||
Practical interpretation:
|
||||
|
||||
| Condition | ROM effect | Current meaning |
|
||||
| --- | --- | --- |
|
||||
| `0x00B9.13 = 0` | timed KNEE page via `loc_2127` | KNEE value reporting not enabled |
|
||||
| `0x00B9.13 = 1`, `0x0110.15 = 1` | timed KNEE page via `loc_2127` | override/inhibit mode |
|
||||
| `0x00B9.13 = 1`, `0x0110.15 = 0` | value delta reported as selector `0x00BC` | likely live KNEE control/report lane |
|
||||
|
||||
This downgrades the earlier bench label that treated `0x00B9.15` as the main KNEE gate. The ROM gate for the panel-input handler is `0x00B9.13`.
|
||||
|
||||
## Timed KNEE Page
|
||||
|
||||
`loc_2127` is the timed page path:
|
||||
|
||||
```text
|
||||
2127 set FB03.7
|
||||
212D save old F732 into F734, if this is a fresh override
|
||||
2135 F732 = 0x1C03
|
||||
213B FB02 = 0x14
|
||||
2140 call loc_48FA
|
||||
```
|
||||
|
||||
The timer path later decrements `FB02`; when it expires, `loc_48EF` restores `F732` from `F734` and redraws. That is the likely cause of "lights, then falls away" observations.
|
||||
|
||||
The LCD dispatcher confirms `F732=0x1C03` is a KNEE page:
|
||||
|
||||
```text
|
||||
493E[0x1C] -> 0x92CC
|
||||
0x92DE[3] -> 0x95CE
|
||||
0x960B prints "KNEE"
|
||||
```
|
||||
|
||||
On that KNEE page, the second line is selected like this:
|
||||
|
||||
```text
|
||||
if E000[0x0110].15: "DL"
|
||||
else if E000[0x00B9].15: "PRESET"
|
||||
else: "AUTO"
|
||||
```
|
||||
|
||||
So `0x00B9.15` still matters, but it appears to choose the KNEE page label (`PRESET` versus `AUTO`) rather than enabling the report path. `0x0110.15` selects the `DL` label and also forces the timed page path from `loc_1795`.
|
||||
|
||||
## Bench Implications
|
||||
|
||||
Useful frames to test this model:
|
||||
|
||||
| Purpose | Frame |
|
||||
| --- | --- |
|
||||
| clear `0x00B9` | `00 01 39 00 00 62` |
|
||||
| set `0x00B9.13` gate | `00 01 39 20 00 42` |
|
||||
| set `0x00B9.15` label bit | `00 01 39 80 00 E2` |
|
||||
| set `0x00B9.15` and `.13` | `00 01 39 A0 00 C2` |
|
||||
| clear `0x0110` | `00 01 90 00 00 CB` |
|
||||
| set `0x0110.15` override | `00 01 90 80 00 4B` |
|
||||
| read `0x00BC` | `01 01 3C 00 00 66` |
|
||||
|
||||
The most direct live-control test is:
|
||||
|
||||
1. Reach `CONNECT: OK`.
|
||||
2. Send `00 01 39 20 00 42` to set `0x00B9.13`.
|
||||
3. Send `00 01 90 00 00 CB` to clear `0x0110.15`.
|
||||
4. Move or exercise the physical KNEE-related control, if available.
|
||||
5. Watch for TX/report traffic around selector `0x00BC`.
|
||||
|
||||
If no physical KNEE input is moved, the ROM may not enter `loc_1795`, because the trigger is the `F104` panel input change path rather than the serial write itself.
|
||||
|
||||
## Bench Observation: DTL / KNEE
|
||||
|
||||
The first `knee-rom-gate-and-value-probe` bench run produced a new LCD state with `DTL` on the left and `KNEE` on the right. That is an important confirmation: page `0x1C` contains both a KNEE entry and a DETAIL entry.
|
||||
|
||||
Relevant ROM text and page entries:
|
||||
|
||||
```text
|
||||
0x92DE[3] -> 0x95CE KNEE page entry
|
||||
0x92DE[7] -> 0x97C8 DETAIL page entry
|
||||
0x960B prints "KNEE"
|
||||
0x9805 prints "DETAIL"
|
||||
```
|
||||
|
||||
The bench display probably shows the page-0x1C menu neighborhood, with DETAIL abbreviated as `DTL` and KNEE as the selected/right-side item. The log does not encode LCD pixels, but the serial timing around the observation is consistent with the KNEE probe:
|
||||
|
||||
```text
|
||||
00 01 39 20 00 42 ; set 0x00B9.13 gate
|
||||
00 01 39 A0 00 C2 ; set 0x00B9.15 + 0x00B9.13
|
||||
00 01 90 80 00 4B ; set 0x0110.15 timed KNEE/DL override
|
||||
```
|
||||
|
||||
Next isolation target: determine whether `DTL/KNEE` appears from `0x00B9.13`, `0x00B9.A0`, `0x0110.15`, or only the combined sequence.
|
||||
|
||||
## Panel Correlation
|
||||
|
||||
The physical panel has both DETAIL and KNEE buttons near the LCD. That matches the ROM page-`0x1C` neighborhood and makes the observed `DTL/KNEE` state likely to be a local menu/button context rather than a generic lamp status.
|
||||
|
||||
Practical implication: once the CCU-side selector gates are prepared, pressing the physical DETAIL/KNEE buttons may be the missing `F104` panel-input transition that calls `loc_1795`. If so, the useful evidence should be:
|
||||
|
||||
- visible LCD movement between DETAIL and KNEE entries,
|
||||
- possible KNEE timed page redraws,
|
||||
- TX/report traffic for selector `0x00BC` when KNEE input movement is accepted,
|
||||
- or other page-`0x1C` selector reports from neighboring DETAIL/KNEE controls.
|
||||
|
||||
## Follow-Up: Lamp Without LCD Movement
|
||||
|
||||
The follow-up run after discovering the DETAIL/KNEE buttons did not reproduce an LCD page change. The observed result was:
|
||||
|
||||
- only the later KNEE cases/windows illuminated the KNEE AUTO lamp,
|
||||
- none of those cases changed the LCD.
|
||||
|
||||
Current interpretation:
|
||||
|
||||
- `0x0110.15` is still the strongest KNEE AUTO lamp/status source.
|
||||
- Serial table writes can light KNEE AUTO without necessarily entering the LCD DETAIL/KNEE page.
|
||||
- The LCD path probably needs an additional local-display/menu condition, not just the CCU-side selector bits.
|
||||
- The physical DETAIL/KNEE buttons may be scanned by the local panel path, but in this test they did not create a visible LCD transition or new serial report evidence.
|
||||
|
||||
This separates two related but distinct paths:
|
||||
|
||||
```text
|
||||
KNEE AUTO lamp/status: mostly selector/table driven, strongest source 0x0110.15
|
||||
DETAIL/KNEE LCD page: local page/menu context, likely page 0x1C plus panel/menu state
|
||||
```
|
||||
|
||||
Next ROM target: trace the DETAIL and KNEE button scan bits through the page-`0x1C` menu dispatcher, not just the `loc_1795` KNEE value handler.
|
||||
Reference in New Issue
Block a user