From 11b6a2dc3b7dd4371328cf3ba985ff9e60b4ac2c Mon Sep 17 00:00:00 2001 From: Aiden <68633820+awils27@users.noreply.github.com> Date: Tue, 26 May 2026 16:38:32 +1000 Subject: [PATCH] Shutter display --- docs/pt2-menu-state-machine.md | 71 +++++++++- docs/pt2-protocol.md | 3 +- docs/pt2-shutter-display-trace.md | 122 ++++++++++++++++++ scenarios/others-isolate-008f-bit11.json | 35 +++++ scenarios/others-isolate-008f-bit12.json | 35 +++++ scenarios/others-isolate-008f-bits11-12.json | 35 +++++ .../others-isolate-008f-then-e400-clear.json | 47 +++++++ scenarios/others-isolate-e400-0015-high.json | 41 ++++++ scenarios/others-isolate-e400-0015-low.json | 41 ++++++ 9 files changed, 428 insertions(+), 2 deletions(-) create mode 100644 docs/pt2-shutter-display-trace.md create mode 100644 scenarios/others-isolate-008f-bit11.json create mode 100644 scenarios/others-isolate-008f-bit12.json create mode 100644 scenarios/others-isolate-008f-bits11-12.json create mode 100644 scenarios/others-isolate-008f-then-e400-clear.json create mode 100644 scenarios/others-isolate-e400-0015-high.json create mode 100644 scenarios/others-isolate-e400-0015-low.json diff --git a/docs/pt2-menu-state-machine.md b/docs/pt2-menu-state-machine.md index df839fe..ceebbb4 100644 --- a/docs/pt2-menu-state-machine.md +++ b/docs/pt2-menu-state-machine.md @@ -82,7 +82,7 @@ Root OTHERS soft-key bits: - Bit 11 sets `F711.6`. - Bit 12 sets `F711.4`. -These look like CCU-provided OTHERS soft-key enable bits. If they are absent, some OTHERS controls can appear inactive even when the page table entry exists. +These bits are not only OTHERS soft-key enables. Bench tests show `E000[0x008F]` directly changes the shutter seven-segment display and iris AUTO lamp, so treat it as a packed camera/display status selector that also feeds the OTHERS root handler. ## Button / Lamp Masks @@ -122,3 +122,72 @@ To make the local COPY path available from the panel, the fake CCU probably need 4. Still satisfy the `F791.7` local copy-start gate. The current hardest unknown is step 4: the ROM uses `F791.7` in several places, but the source that sets it has not yet been identified. + +## Bench Observation: OTHERS Gate Probe + +Run: + +```text +00 00 00 80 00 DA ; recover/seed CONNECT OK +00 01 0F 18 00 4C ; E000[0x008F] = 0x1800 +06 00 15 00 01 48 ; E400[0x0015] = 0x0001, sent in active window +``` + +Observed on the real panel without touching the controls: + +- LCD stayed at `CONNECT: OK`. +- SHUTTER seven-segment display changed to something like `EUS`; manuals make this likely `EVS` rendered on a seven-segment display. +- Iris AUTO lamp illuminated. +- OTHERS menu did not appear by itself. + +Interpretation: + +- The sequence reached real UI state, not only serial parser state. +- `E000[0x008F]=0x1800` is now a candidate shutter/mode-status value as well as an OTHERS soft-key source. Treat the earlier "soft-key bits" interpretation as incomplete. +- `E400[0x0015]=0x0001` may be the OTHERS/COPY visibility bit, but it may also affect an iris/auto feature path. Isolate before assigning a final meaning. + +Recommended isolation probes: + +```text +00 01 0F 08 00 5C ; E000[0x008F] bit 11 only +00 01 0F 10 00 44 ; E000[0x008F] bit 12 only +00 01 0F 18 00 4C ; E000[0x008F] bits 11+12 +06 00 15 00 00 49 ; E400[0x0015] clear/zero +06 00 15 00 01 48 ; E400[0x0015] low nonzero +06 00 15 80 00 C9 ; E400[0x0015] high nonzero +``` + +Scenario files: + +- `scenarios/others-isolate-008f-bit11.json` +- `scenarios/others-isolate-008f-bit12.json` +- `scenarios/others-isolate-008f-bits11-12.json` +- `scenarios/others-isolate-e400-0015-low.json` +- `scenarios/others-isolate-e400-0015-high.json` +- `scenarios/others-isolate-008f-then-e400-clear.json` + +Isolation results: + +| Scenario | Visible panel result | Serial result | +| --- | --- | --- | +| `others-isolate-008f-bit11` | Iris AUTO lamp on, SHUTTER seven-segment shows observed `EUS`, likely manual `EVS` | `04 01 0F 08 00 58`, then repeated `02 00 02 00 00 5A` | +| `others-isolate-008f-bit12` | Iris AUTO lamp on, SHUTTER seven-segment shows literal letters `OFF` | `04 01 0F 10 00 40`, then repeated `02 00 02 00 00 5A` | +| `others-isolate-008f-bits11-12` | Iris AUTO lamp on, SHUTTER seven-segment shows observed `EUS`, likely manual `EVS` | `04 01 0F 18 00 48`, then repeated `02 00 02 00 00 5A` | +| `others-isolate-e400-0015-low` | LCD stays `CONNECT: OK` only | repeated `01 00 02 00 00 59` after command 6 | +| `others-isolate-e400-0015-high` | LCD stays `CONNECT: OK` only | repeated `01 00 02 00 00 59` after command 6 | +| `others-isolate-008f-then-e400-clear` | Iris AUTO lamp on, SHUTTER seven-segment shows observed `EUS`, likely manual `EVS` | repeated `01 00 02 00 00 59` after command 6 | + +Updated interpretation: + +- `E000[0x008F]` directly affects visible shutter/iris UI state. +- Bit 11 selects the observed `EUS` shutter display, probably manual `EVS`; bit 12 selects literal shutter-display text `OFF`; when both are present, the likely `EVS` display appears to win. +- The iris AUTO lamp turns on for either bit 11 or bit 12, so it may be tied to the same status selector or to the resulting display mode. +- `E400[0x0015]` does not visibly change the panel by itself, even though command 6 does alter the report stream from `02 00 02 00 00 5A` to `01 00 02 00 00 59`. +- Keep `E400[0x0015]` as a probable OTHERS/COPY visibility/report-gate candidate, but do not assign the shutter/iris effect to it. + +Manual correlation: + +- The RCP-TX7 operating instructions list `OTHERS (1/6: SHUTTER)` with an `EVS` button, and say to use the shutter block `C.SCAN` or `SHUTTER ON/OFF` buttons when not using EVS. +- The same RCP-TX7 manual lists `EVS/ECS` under OTHERS for DXC-D30/D30P normal settings. +- A later CCU/RCP manual states that when EVS is on, `EVS` is displayed; when the shutter switch is off, `OFF` is displayed. +- Therefore `E000[0x008F].11` is best labeled `shutter_evs_display_or_mode`, and `E000[0x008F].12` is best labeled `shutter_off_display_or_mode` until ROM traces split display-only status from actual camera setting. diff --git a/docs/pt2-protocol.md b/docs/pt2-protocol.md index 2d77c65..5b47aa4 100644 --- a/docs/pt2-protocol.md +++ b/docs/pt2-protocol.md @@ -8,6 +8,7 @@ Focused companion notes: - [PT2 Copy State Machine](pt2-copy-state-machine.md) - [PT2 Menu State Machine](pt2-menu-state-machine.md) +- [PT2 Shutter Display Trace](pt2-shutter-display-trace.md) ## Current High-Confidence Facts @@ -579,7 +580,7 @@ RCP-side OTHERS/COPY menu trace: - The entry descriptor immediately before `H'6FF0` requires selector `0x0015` in the secondary table: `E400[0x0015] != 0`. Because command 6 writes `E400`, this is probably a CCU-provided feature/visibility bit, and command 6 must be sent in a live continuation/report window to have an effect. - When the page sees `F770.2` set, it only follows the local copy-start branch if `F791.7` is already set. That branch sets `F76E.6`, `F795.7`, `F731.7`, `F798=H'C8`, `F711.7`, `F726=H'64`, calls `loc_5500`, then displays `COPY TO SLAVES`. This is the RCP-side equivalent of the serial `0x006D` copy-start effect. - If `F770.2` is set while `F791.7` is clear, the ROM diverts through `H'704C` to a `SET RCP` / `MASTER` display path instead of starting copy. That makes `F791.7` a second, likely master/link/session gate for the physical COPY operation. -- The OTHERS root handler at `H'6EE4` also tests primary selector `E000[0x008F]` (`H'E11E`) bits 11 and 12, and uses them to set `F711.6` and `F711.4`. If those bits are absent, some OTHERS soft keys can appear inactive even when the page exists. +- The OTHERS root handler at `H'6EE4` also tests primary selector `E000[0x008F]` (`H'E11E`) bits 11 and 12, and uses them to set `F711.6` and `F711.4`. Bench isolation shows this selector is broader than an OTHERS gate: bit 11 makes the SHUTTER seven-segment display show observed `EUS`, probably the manual's `EVS` display, and bit 12 makes it show the literal letters `OFF`; either bit also illuminates the iris AUTO lamp. - Candidate gate probes, not final protocol truth: ```text diff --git a/docs/pt2-shutter-display-trace.md b/docs/pt2-shutter-display-trace.md new file mode 100644 index 0000000..24bdfeb --- /dev/null +++ b/docs/pt2-shutter-display-trace.md @@ -0,0 +1,122 @@ +# PT2 Shutter Display Trace + +This note collects the current ROM evidence for the shutter seven-segment display and related selector traffic. + +## Confirmed Bench Mapping + +The real panel responds to primary selector `0x008F`: + +| Command 0 write | Meaning candidate | Observed panel result | +| --- | --- | --- | +| `00 01 0F 08 00 5C` | `E000[0x008F].11` | SHUTTER shows observed `EUS`, likely manual `EVS`; iris AUTO lamp on | +| `00 01 0F 10 00 44` | `E000[0x008F].12` | SHUTTER shows literal `OFF`; iris AUTO lamp on | +| `00 01 0F 18 00 4C` | bits 11 and 12 | likely `EVS` wins over `OFF`; iris AUTO lamp on | +| `00 01 0F 00 00 54` | clear candidate | not yet bench-confirmed | + +Manual correlation: + +- The RCP-TX7 manual has `OTHERS (1/6: SHUTTER)` with an `EVS` button. +- The RCP-TX7 menu table lists `EVS/ECS` under OTHERS for DXC-D30/D30P. +- A later CCU/RCP manual says the shutter display shows `EVS` when EVS is on and `OFF` when the shutter switch is off. + +So `0x008F.11` is currently best labeled `shutter_evs_display_or_mode`, and `0x008F.12` is best labeled `shutter_off_display_or_mode`. + +## Selector 0x008F ROM Path + +Primary table address: + +```text +selector 0x008F -> E000 + 2 * 0x008F = H'E11E +``` + +The OTHERS/SHUTTER menu handler is `H'6EE4`. + +Important instructions: + +```text +6F6E: BTST.W #11, @H'E11E +6F74: BSET.B #6, R0 +6F76: BTST.W #12, @H'E11E +6F7C: BSET.B #4, R0 +6F7E: MOV:G.B R0, @H'F711 +``` + +This is the direct consumer seen so far. The current decompile does not show another static read of `H'E11E` outside this handler. + +`H'6EE4` also programs local descriptor RAM before this: + +```text +6EFD: F73E = H'088F +6F09: F74E = H'0800 +6F0F: F742 = H'088F +6F1B: F752 = H'1000 +``` + +Those descriptors match selector `0x008F` plus the two observed masks `0x0800` and `0x1000`, so the generic panel-output updater also appears to know about the same selector. + +## Local Panel Trigger Path + +`H'6EE4` can also generate a selector `0x008F` report/update from local OTHERS/SHUTTER controls: + +```text +6F26: read F770 local action byte +6F2E: keep low two action bits +6F37: if action bit path and E400[0x008F].11 is enabled, set E800[0x008F] = 0x0800 +6F45: if alternate action path and E400[0x008F].12 is enabled, set E800[0x008F] = 0x1000 +6F53: R3 = 0x008F +6F64: call 3E54 report/target-frame builder +``` + +Practical meaning: + +- The CCU can force the display state by writing `E000[0x008F]`. +- The RCP can also try to report local EVS/OFF changes through selector `0x008F`, but only when the secondary-table feature bits `E400[0x008F].11/.12` allow it. + +## Adjacent Shutter Value Family + +The periodic/control-change scanner at `H'15E0` processes changed input words collected by IRQ3 from the external panel chips. Around the shutter path it calls `H'19A2`, which compares a local delta against the current primary table value and, if changed, writes the `E800` current table and calls `H'3E54`. + +Candidate selectors: + +| Handler | Source RAM | Gate | Selector sent | Meaning candidate | +| --- | --- | --- | --- | --- | +| `H'17C9` | `F6AE/F6CE` | `E000[0x0093].12` | `0x00A3` | clear-scan/shutter value lane | +| `H'17FB` | `F6AC/F6CC` | `E000[0x0093].12` | `0x00A4` | clear-scan/shutter value lane | +| `H'182D` | `F6AA/F6CA` | `E000[0x0093].5`, `F717.2` clear | `0x00A5` | shutter value lane | +| `H'182D` | `F6AA/F6CA` | `F717.2` set | `0x00D8` | alternate/DXC-637 shutter lane | +| `H'1891` | `F6A8/F6C8` | `E000[0x0093].5`, `F717.2` clear | `0x0080` | shutter value lane | +| `H'1891` | `F6A8/F6C8` | `F717.2` set | `0x00D9` | alternate/DXC-637 shutter lane | +| `H'18E7` | `F6A6/F6C6` | `E000[0x0093].5`, `F717.2` clear | `0x00A6` | shutter value lane | +| `H'18E7` | `F6A6/F6C6` | `F717.2` set | `0x00DA` | alternate/DXC-637 shutter lane | +| `H'194A` | `F6A4/F6C4` | `F731 <= 3` | `0x0080` | shared value lane | +| `H'1979` | `F6A2/F6C2` plus `F68C` scale | `F731 <= 3` | `0x0081` | scaled analog value lane | + +This cluster is a strong candidate for the numeric shutter speed / clear-scan frequency side of the display. It is not yet bench-confirmed. + +## Candidate Probe Frames + +Readback: + +```text +01 01 0F 00 00 55 ; read 0x008F +01 01 13 00 00 49 ; read 0x0093 gate/status +01 01 23 00 00 79 ; read 0x00A3 +01 01 24 00 00 7E ; read 0x00A4 +01 01 25 00 00 7F ; read 0x00A5 +01 01 58 00 00 02 ; read 0x00D8 +01 01 00 00 00 5A ; read 0x0080 +01 01 59 00 00 03 ; read 0x00D9 +01 01 26 00 00 7C ; read 0x00A6 +01 01 5A 00 00 00 ; read 0x00DA +01 01 01 00 00 5B ; read 0x0081 +``` + +Potential display probes after `CONNECT: OK`: + +```text +00 01 0F 00 00 54 ; clear selector 0x008F +00 01 13 80 00 C8 ; set 0x0093 high bit candidate +00 01 13 FF FF 48 ; enable all 0x0093 gates candidate +``` + +Use the value-lane selectors cautiously. They may represent shutter/clear-scan numeric values, but they are also part of the local control-report path, so bench probing should change one selector at a time and record LCD, shutter display, iris AUTO, and emitted report frames. diff --git a/scenarios/others-isolate-008f-bit11.json b/scenarios/others-isolate-008f-bit11.json new file mode 100644 index 0000000..8b53d2b --- /dev/null +++ b/scenarios/others-isolate-008f-bit11.json @@ -0,0 +1,35 @@ +{ + "name": "others-isolate-008f-bit11", + "notes": [ + "Recover to CONNECT OK, then write only E000[0x008F].11.", + "Use this to isolate whether bit 11 alone changes the shutter display, iris AUTO lamp, or OTHERS soft-key state." + ], + "steps": [ + { + "action": "power_cycle", + "off_seconds": 1.5 + }, + { + "action": "wait_ready", + "heartbeats": 2, + "timeout": 10.0, + "require": true + }, + { + "action": "drain", + "seconds": 0.25 + }, + { + "action": "send", + "label": "selector_zero_connect_ok_seed", + "frame": "00 00 00 80 00 DA", + "listen": 0.20 + }, + { + "action": "send", + "label": "e000_008f_bit11_only", + "frame": "00 01 0F 08 00 5C", + "listen": 8.0 + } + ] +} diff --git a/scenarios/others-isolate-008f-bit12.json b/scenarios/others-isolate-008f-bit12.json new file mode 100644 index 0000000..10f64f4 --- /dev/null +++ b/scenarios/others-isolate-008f-bit12.json @@ -0,0 +1,35 @@ +{ + "name": "others-isolate-008f-bit12", + "notes": [ + "Recover to CONNECT OK, then write only E000[0x008F].12.", + "Use this to isolate whether bit 12 alone changes the shutter display, iris AUTO lamp, or OTHERS soft-key state." + ], + "steps": [ + { + "action": "power_cycle", + "off_seconds": 1.5 + }, + { + "action": "wait_ready", + "heartbeats": 2, + "timeout": 10.0, + "require": true + }, + { + "action": "drain", + "seconds": 0.25 + }, + { + "action": "send", + "label": "selector_zero_connect_ok_seed", + "frame": "00 00 00 80 00 DA", + "listen": 0.20 + }, + { + "action": "send", + "label": "e000_008f_bit12_only", + "frame": "00 01 0F 10 00 44", + "listen": 8.0 + } + ] +} diff --git a/scenarios/others-isolate-008f-bits11-12.json b/scenarios/others-isolate-008f-bits11-12.json new file mode 100644 index 0000000..7304292 --- /dev/null +++ b/scenarios/others-isolate-008f-bits11-12.json @@ -0,0 +1,35 @@ +{ + "name": "others-isolate-008f-bits11-12", + "notes": [ + "Recover to CONNECT OK, then write E000[0x008F].11 and .12 together.", + "This repeats the first half of others-copy-gate-probe without the E400[0x0015] write." + ], + "steps": [ + { + "action": "power_cycle", + "off_seconds": 1.5 + }, + { + "action": "wait_ready", + "heartbeats": 2, + "timeout": 10.0, + "require": true + }, + { + "action": "drain", + "seconds": 0.25 + }, + { + "action": "send", + "label": "selector_zero_connect_ok_seed", + "frame": "00 00 00 80 00 DA", + "listen": 0.20 + }, + { + "action": "send", + "label": "e000_008f_bits11_12", + "frame": "00 01 0F 18 00 4C", + "listen": 8.0 + } + ] +} diff --git a/scenarios/others-isolate-008f-then-e400-clear.json b/scenarios/others-isolate-008f-then-e400-clear.json new file mode 100644 index 0000000..ed1a18e --- /dev/null +++ b/scenarios/others-isolate-008f-then-e400-clear.json @@ -0,0 +1,47 @@ +{ + "name": "others-isolate-008f-then-e400-clear", + "notes": [ + "Recover to CONNECT OK, write E000[0x008F]=0x1800, then write E400[0x0015]=0x0000 in the live window.", + "This is the control case for others-copy-gate-probe: same root bits, but COPY visibility cleared instead of set." + ], + "steps": [ + { + "action": "power_cycle", + "off_seconds": 1.5 + }, + { + "action": "wait_ready", + "heartbeats": 2, + "timeout": 10.0, + "require": true + }, + { + "action": "drain", + "seconds": 0.25 + }, + { + "action": "send", + "label": "selector_zero_connect_ok_seed", + "frame": "00 00 00 80 00 DA", + "listen": 0.15 + }, + { + "action": "send", + "label": "e000_008f_bits11_12", + "frame": "00 01 0F 18 00 4C", + "listen": 0.15 + }, + { + "action": "wait_for", + "frame": "02 00 02 00 00 5A", + "timeout": 1.5, + "require": false + }, + { + "action": "send", + "label": "e400_0015_clear", + "frame": "06 00 15 00 00 49", + "listen": 8.0 + } + ] +} diff --git a/scenarios/others-isolate-e400-0015-high.json b/scenarios/others-isolate-e400-0015-high.json new file mode 100644 index 0000000..b16ad84 --- /dev/null +++ b/scenarios/others-isolate-e400-0015-high.json @@ -0,0 +1,41 @@ +{ + "name": "others-isolate-e400-0015-high", + "notes": [ + "Recover to CONNECT OK, wait for the live 02 report window, then write E400[0x0015]=0x8000.", + "This tests whether the high bit of the same secondary selector behaves differently from 0x0001." + ], + "steps": [ + { + "action": "power_cycle", + "off_seconds": 1.5 + }, + { + "action": "wait_ready", + "heartbeats": 2, + "timeout": 10.0, + "require": true + }, + { + "action": "drain", + "seconds": 0.25 + }, + { + "action": "send", + "label": "selector_zero_connect_ok_seed", + "frame": "00 00 00 80 00 DA", + "listen": 0.15 + }, + { + "action": "wait_for", + "frame": "02 00 02 00 00 5A", + "timeout": 1.5, + "require": false + }, + { + "action": "send", + "label": "e400_0015_high_nonzero", + "frame": "06 00 15 80 00 C9", + "listen": 8.0 + } + ] +} diff --git a/scenarios/others-isolate-e400-0015-low.json b/scenarios/others-isolate-e400-0015-low.json new file mode 100644 index 0000000..7491992 --- /dev/null +++ b/scenarios/others-isolate-e400-0015-low.json @@ -0,0 +1,41 @@ +{ + "name": "others-isolate-e400-0015-low", + "notes": [ + "Recover to CONNECT OK, wait for the live 02 report window, then write E400[0x0015]=0x0001.", + "This isolates the command-6 secondary-table write from the E000[0x008F] write." + ], + "steps": [ + { + "action": "power_cycle", + "off_seconds": 1.5 + }, + { + "action": "wait_ready", + "heartbeats": 2, + "timeout": 10.0, + "require": true + }, + { + "action": "drain", + "seconds": 0.25 + }, + { + "action": "send", + "label": "selector_zero_connect_ok_seed", + "frame": "00 00 00 80 00 DA", + "listen": 0.15 + }, + { + "action": "wait_for", + "frame": "02 00 02 00 00 5A", + "timeout": 1.5, + "require": false + }, + { + "action": "send", + "label": "e400_0015_low_nonzero", + "frame": "06 00 15 00 01 48", + "listen": 8.0 + } + ] +}