aiden/h8-536-decoder
1
0
Fork 0
Code Activity

Shutter display

Browse Source
This commit is contained in:
Aiden
2026-05-26 16:38:32 +10:00
parent 3e1d30527f
commit 11b6a2dc3b
9 changed files with 428 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
docs/pt2-menu-state-machine.md
View File

@@ -82,7 +82,7 @@ Root OTHERS soft-key bits:
- Bit 11 sets `F711.6`.
- Bit 12 sets `F711.4`.
These look like CCU-provided OTHERS soft-key enable bits. If they are absent, some OTHERS controls can appear inactive even when the page table entry exists.
These bits are not only OTHERS soft-key enables. Bench tests show `E000[0x008F]` directly changes the shutter seven-segment display and iris AUTO lamp, so treat it as a packed camera/display status selector that also feeds the OTHERS root handler.
## Button / Lamp Masks
@@ -122,3 +122,72 @@ To make the local COPY path available from the panel, the fake CCU probably need
4. Still satisfy the `F791.7` local copy-start gate.
The current hardest unknown is step 4: the ROM uses `F791.7` in several places, but the source that sets it has not yet been identified.
## Bench Observation: OTHERS Gate Probe
Run:
```text
00 00 00 80 00 DA ; recover/seed CONNECT OK
00 01 0F 18 00 4C ; E000[0x008F] = 0x1800
06 00 15 00 01 48 ; E400[0x0015] = 0x0001, sent in active window
```
Observed on the real panel without touching the controls:
- LCD stayed at `CONNECT: OK`.
- SHUTTER seven-segment display changed to something like `EUS`; manuals make this likely `EVS` rendered on a seven-segment display.
- Iris AUTO lamp illuminated.
- OTHERS menu did not appear by itself.
Interpretation:
- The sequence reached real UI state, not only serial parser state.
- `E000[0x008F]=0x1800` is now a candidate shutter/mode-status value as well as an OTHERS soft-key source. Treat the earlier "soft-key bits" interpretation as incomplete.
- `E400[0x0015]=0x0001` may be the OTHERS/COPY visibility bit, but it may also affect an iris/auto feature path. Isolate before assigning a final meaning.
Recommended isolation probes:
```text
00 01 0F 08 00 5C ; E000[0x008F] bit 11 only
00 01 0F 10 00 44 ; E000[0x008F] bit 12 only
00 01 0F 18 00 4C ; E000[0x008F] bits 11+12
06 00 15 00 00 49 ; E400[0x0015] clear/zero
06 00 15 00 01 48 ; E400[0x0015] low nonzero
06 00 15 80 00 C9 ; E400[0x0015] high nonzero
```
Scenario files:
- `scenarios/others-isolate-008f-bit11.json`
- `scenarios/others-isolate-008f-bit12.json`
- `scenarios/others-isolate-008f-bits11-12.json`
- `scenarios/others-isolate-e400-0015-low.json`
- `scenarios/others-isolate-e400-0015-high.json`
- `scenarios/others-isolate-008f-then-e400-clear.json`
Isolation results:
| Scenario | Visible panel result | Serial result |
| --- | --- | --- |
| `others-isolate-008f-bit11` | Iris AUTO lamp on, SHUTTER seven-segment shows observed `EUS`, likely manual `EVS` | `04 01 0F 08 00 58`, then repeated `02 00 02 00 00 5A` |
| `others-isolate-008f-bit12` | Iris AUTO lamp on, SHUTTER seven-segment shows literal letters `OFF` | `04 01 0F 10 00 40`, then repeated `02 00 02 00 00 5A` |
| `others-isolate-008f-bits11-12` | Iris AUTO lamp on, SHUTTER seven-segment shows observed `EUS`, likely manual `EVS` | `04 01 0F 18 00 48`, then repeated `02 00 02 00 00 5A` |
| `others-isolate-e400-0015-low` | LCD stays `CONNECT: OK` only | repeated `01 00 02 00 00 59` after command 6 |
| `others-isolate-e400-0015-high` | LCD stays `CONNECT: OK` only | repeated `01 00 02 00 00 59` after command 6 |
| `others-isolate-008f-then-e400-clear` | Iris AUTO lamp on, SHUTTER seven-segment shows observed `EUS`, likely manual `EVS` | repeated `01 00 02 00 00 59` after command 6 |
Updated interpretation:
- `E000[0x008F]` directly affects visible shutter/iris UI state.
- Bit 11 selects the observed `EUS` shutter display, probably manual `EVS`; bit 12 selects literal shutter-display text `OFF`; when both are present, the likely `EVS` display appears to win.
- The iris AUTO lamp turns on for either bit 11 or bit 12, so it may be tied to the same status selector or to the resulting display mode.
- `E400[0x0015]` does not visibly change the panel by itself, even though command 6 does alter the report stream from `02 00 02 00 00 5A` to `01 00 02 00 00 59`.
- Keep `E400[0x0015]` as a probable OTHERS/COPY visibility/report-gate candidate, but do not assign the shutter/iris effect to it.
Manual correlation:
- The RCP-TX7 operating instructions list `OTHERS (1/6: SHUTTER)` with an `EVS` button, and say to use the shutter block `C.SCAN` or `SHUTTER ON/OFF` buttons when not using EVS.
- The same RCP-TX7 manual lists `EVS/ECS` under OTHERS for DXC-D30/D30P normal settings.
- A later CCU/RCP manual states that when EVS is on, `EVS` is displayed; when the shutter switch is off, `OFF` is displayed.
- Therefore `E000[0x008F].11` is best labeled `shutter_evs_display_or_mode`, and `E000[0x008F].12` is best labeled `shutter_off_display_or_mode` until ROM traces split display-only status from actual camera setting.

3
docs/pt2-protocol.md
View File

@@ -8,6 +8,7 @@ Focused companion notes:
- [PT2 Copy State Machine](pt2-copy-state-machine.md)
- [PT2 Menu State Machine](pt2-menu-state-machine.md)
- [PT2 Shutter Display Trace](pt2-shutter-display-trace.md)
## Current High-Confidence Facts
@@ -579,7 +580,7 @@ RCP-side OTHERS/COPY menu trace:
- The entry descriptor immediately before `H'6FF0` requires selector `0x0015` in the secondary table: `E400[0x0015] != 0`. Because command 6 writes `E400`, this is probably a CCU-provided feature/visibility bit, and command 6 must be sent in a live continuation/report window to have an effect.
- When the page sees `F770.2` set, it only follows the local copy-start branch if `F791.7` is already set. That branch sets `F76E.6`, `F795.7`, `F731.7`, `F798=H'C8`, `F711.7`, `F726=H'64`, calls `loc_5500`, then displays `COPY TO SLAVES`. This is the RCP-side equivalent of the serial `0x006D` copy-start effect.
- If `F770.2` is set while `F791.7` is clear, the ROM diverts through `H'704C` to a `SET RCP` / `MASTER` display path instead of starting copy. That makes `F791.7` a second, likely master/link/session gate for the physical COPY operation.
- The OTHERS root handler at `H'6EE4` also tests primary selector `E000[0x008F]` (`H'E11E`) bits 11 and 12, and uses them to set `F711.6` and `F711.4`. If those bits are absent, some OTHERS soft keys can appear inactive even when the page exists.
- The OTHERS root handler at `H'6EE4` also tests primary selector `E000[0x008F]` (`H'E11E`) bits 11 and 12, and uses them to set `F711.6` and `F711.4`. Bench isolation shows this selector is broader than an OTHERS gate: bit 11 makes the SHUTTER seven-segment display show observed `EUS`, probably the manual's `EVS` display, and bit 12 makes it show the literal letters `OFF`; either bit also illuminates the iris AUTO lamp.
- Candidate gate probes, not final protocol truth:
```text

122
docs/pt2-shutter-display-trace.md Normal file
View File

@@ -0,0 +1,122 @@
# PT2 Shutter Display Trace
This note collects the current ROM evidence for the shutter seven-segment display and related selector traffic.
## Confirmed Bench Mapping
The real panel responds to primary selector `0x008F`:
| Command 0 write | Meaning candidate | Observed panel result |
| --- | --- | --- |
| `00 01 0F 08 00 5C` | `E000[0x008F].11` | SHUTTER shows observed `EUS`, likely manual `EVS`; iris AUTO lamp on |
| `00 01 0F 10 00 44` | `E000[0x008F].12` | SHUTTER shows literal `OFF`; iris AUTO lamp on |
| `00 01 0F 18 00 4C` | bits 11 and 12 | likely `EVS` wins over `OFF`; iris AUTO lamp on |
| `00 01 0F 00 00 54` | clear candidate | not yet bench-confirmed |
Manual correlation:
- The RCP-TX7 manual has `OTHERS (1/6: SHUTTER)` with an `EVS` button.
- The RCP-TX7 menu table lists `EVS/ECS` under OTHERS for DXC-D30/D30P.
- A later CCU/RCP manual says the shutter display shows `EVS` when EVS is on and `OFF` when the shutter switch is off.
So `0x008F.11` is currently best labeled `shutter_evs_display_or_mode`, and `0x008F.12` is best labeled `shutter_off_display_or_mode`.
## Selector 0x008F ROM Path
Primary table address:
```text
selector 0x008F -> E000 + 2 * 0x008F = H'E11E
```
The OTHERS/SHUTTER menu handler is `H'6EE4`.
Important instructions:
```text
6F6E: BTST.W #11, @H'E11E
6F74: BSET.B #6, R0
6F76: BTST.W #12, @H'E11E
6F7C: BSET.B #4, R0
6F7E: MOV:G.B R0, @H'F711
```
This is the direct consumer seen so far. The current decompile does not show another static read of `H'E11E` outside this handler.
`H'6EE4` also programs local descriptor RAM before this:
```text
6EFD: F73E = H'088F
6F09: F74E = H'0800
6F0F: F742 = H'088F
6F1B: F752 = H'1000
```
Those descriptors match selector `0x008F` plus the two observed masks `0x0800` and `0x1000`, so the generic panel-output updater also appears to know about the same selector.
## Local Panel Trigger Path
`H'6EE4` can also generate a selector `0x008F` report/update from local OTHERS/SHUTTER controls:
```text
6F26: read F770 local action byte
6F2E: keep low two action bits
6F37: if action bit path and E400[0x008F].11 is enabled, set E800[0x008F] = 0x0800
6F45: if alternate action path and E400[0x008F].12 is enabled, set E800[0x008F] = 0x1000
6F53: R3 = 0x008F
6F64: call 3E54 report/target-frame builder
```
Practical meaning:
- The CCU can force the display state by writing `E000[0x008F]`.
- The RCP can also try to report local EVS/OFF changes through selector `0x008F`, but only when the secondary-table feature bits `E400[0x008F].11/.12` allow it.
## Adjacent Shutter Value Family
The periodic/control-change scanner at `H'15E0` processes changed input words collected by IRQ3 from the external panel chips. Around the shutter path it calls `H'19A2`, which compares a local delta against the current primary table value and, if changed, writes the `E800` current table and calls `H'3E54`.
Candidate selectors:
| Handler | Source RAM | Gate | Selector sent | Meaning candidate |
| --- | --- | --- | --- | --- |
| `H'17C9` | `F6AE/F6CE` | `E000[0x0093].12` | `0x00A3` | clear-scan/shutter value lane |
| `H'17FB` | `F6AC/F6CC` | `E000[0x0093].12` | `0x00A4` | clear-scan/shutter value lane |
| `H'182D` | `F6AA/F6CA` | `E000[0x0093].5`, `F717.2` clear | `0x00A5` | shutter value lane |
| `H'182D` | `F6AA/F6CA` | `F717.2` set | `0x00D8` | alternate/DXC-637 shutter lane |
| `H'1891` | `F6A8/F6C8` | `E000[0x0093].5`, `F717.2` clear | `0x0080` | shutter value lane |
| `H'1891` | `F6A8/F6C8` | `F717.2` set | `0x00D9` | alternate/DXC-637 shutter lane |
| `H'18E7` | `F6A6/F6C6` | `E000[0x0093].5`, `F717.2` clear | `0x00A6` | shutter value lane |
| `H'18E7` | `F6A6/F6C6` | `F717.2` set | `0x00DA` | alternate/DXC-637 shutter lane |
| `H'194A` | `F6A4/F6C4` | `F731 <= 3` | `0x0080` | shared value lane |
| `H'1979` | `F6A2/F6C2` plus `F68C` scale | `F731 <= 3` | `0x0081` | scaled analog value lane |
This cluster is a strong candidate for the numeric shutter speed / clear-scan frequency side of the display. It is not yet bench-confirmed.
## Candidate Probe Frames
Readback:
```text
01 01 0F 00 00 55 ; read 0x008F
01 01 13 00 00 49 ; read 0x0093 gate/status
01 01 23 00 00 79 ; read 0x00A3
01 01 24 00 00 7E ; read 0x00A4
01 01 25 00 00 7F ; read 0x00A5
01 01 58 00 00 02 ; read 0x00D8
01 01 00 00 00 5A ; read 0x0080
01 01 59 00 00 03 ; read 0x00D9
01 01 26 00 00 7C ; read 0x00A6
01 01 5A 00 00 00 ; read 0x00DA
01 01 01 00 00 5B ; read 0x0081
```
Potential display probes after `CONNECT: OK`:
```text
00 01 0F 00 00 54 ; clear selector 0x008F
00 01 13 80 00 C8 ; set 0x0093 high bit candidate
00 01 13 FF FF 48 ; enable all 0x0093 gates candidate
```
Use the value-lane selectors cautiously. They may represent shutter/clear-scan numeric values, but they are also part of the local control-report path, so bench probing should change one selector at a time and record LCD, shutter display, iris AUTO, and emitted report frames.

35
scenarios/others-isolate-008f-bit11.json Normal file
View File

@@ -0,0 +1,35 @@
{
"name": "others-isolate-008f-bit11",
"notes": [
"Recover to CONNECT OK, then write only E000[0x008F].11.",
"Use this to isolate whether bit 11 alone changes the shutter display, iris AUTO lamp, or OTHERS soft-key state."
],
"steps": [
{
"action": "power_cycle",
"off_seconds": 1.5
},
{
"action": "wait_ready",
"heartbeats": 2,
"timeout": 10.0,
"require": true
},
{
"action": "drain",
"seconds": 0.25
},
{
"action": "send",
"label": "selector_zero_connect_ok_seed",
"frame": "00 00 00 80 00 DA",
"listen": 0.20
},
{
"action": "send",
"label": "e000_008f_bit11_only",
"frame": "00 01 0F 08 00 5C",
"listen": 8.0
}
]
}

35
scenarios/others-isolate-008f-bit12.json Normal file
View File

@@ -0,0 +1,35 @@
{
"name": "others-isolate-008f-bit12",
"notes": [
"Recover to CONNECT OK, then write only E000[0x008F].12.",
"Use this to isolate whether bit 12 alone changes the shutter display, iris AUTO lamp, or OTHERS soft-key state."
],
"steps": [
{
"action": "power_cycle",
"off_seconds": 1.5
},
{
"action": "wait_ready",
"heartbeats": 2,
"timeout": 10.0,
"require": true
},
{
"action": "drain",
"seconds": 0.25
},
{
"action": "send",
"label": "selector_zero_connect_ok_seed",
"frame": "00 00 00 80 00 DA",
"listen": 0.20
},
{
"action": "send",
"label": "e000_008f_bit12_only",
"frame": "00 01 0F 10 00 44",
"listen": 8.0
}
]
}

35
scenarios/others-isolate-008f-bits11-12.json Normal file
View File

@@ -0,0 +1,35 @@
{
"name": "others-isolate-008f-bits11-12",
"notes": [
"Recover to CONNECT OK, then write E000[0x008F].11 and .12 together.",
"This repeats the first half of others-copy-gate-probe without the E400[0x0015] write."
],
"steps": [
{
"action": "power_cycle",
"off_seconds": 1.5
},
{
"action": "wait_ready",
"heartbeats": 2,
"timeout": 10.0,
"require": true
},
{
"action": "drain",
"seconds": 0.25
},
{
"action": "send",
"label": "selector_zero_connect_ok_seed",
"frame": "00 00 00 80 00 DA",
"listen": 0.20
},
{
"action": "send",
"label": "e000_008f_bits11_12",
"frame": "00 01 0F 18 00 4C",
"listen": 8.0
}
]
}

47
scenarios/others-isolate-008f-then-e400-clear.json Normal file
View File

@@ -0,0 +1,47 @@
{
"name": "others-isolate-008f-then-e400-clear",
"notes": [
"Recover to CONNECT OK, write E000[0x008F]=0x1800, then write E400[0x0015]=0x0000 in the live window.",
"This is the control case for others-copy-gate-probe: same root bits, but COPY visibility cleared instead of set."
],
"steps": [
{
"action": "power_cycle",
"off_seconds": 1.5
},
{
"action": "wait_ready",
"heartbeats": 2,
"timeout": 10.0,
"require": true
},
{
"action": "drain",
"seconds": 0.25
},
{
"action": "send",
"label": "selector_zero_connect_ok_seed",
"frame": "00 00 00 80 00 DA",
"listen": 0.15
},
{
"action": "send",
"label": "e000_008f_bits11_12",
"frame": "00 01 0F 18 00 4C",
"listen": 0.15
},
{
"action": "wait_for",
"frame": "02 00 02 00 00 5A",
"timeout": 1.5,
"require": false
},
{
"action": "send",
"label": "e400_0015_clear",
"frame": "06 00 15 00 00 49",
"listen": 8.0
}
]
}

41
scenarios/others-isolate-e400-0015-high.json Normal file
View File

@@ -0,0 +1,41 @@
{
"name": "others-isolate-e400-0015-high",
"notes": [
"Recover to CONNECT OK, wait for the live 02 report window, then write E400[0x0015]=0x8000.",
"This tests whether the high bit of the same secondary selector behaves differently from 0x0001."
],
"steps": [
{
"action": "power_cycle",
"off_seconds": 1.5
},
{
"action": "wait_ready",
"heartbeats": 2,
"timeout": 10.0,
"require": true
},
{
"action": "drain",
"seconds": 0.25
},
{
"action": "send",
"label": "selector_zero_connect_ok_seed",
"frame": "00 00 00 80 00 DA",
"listen": 0.15
},
{
"action": "wait_for",
"frame": "02 00 02 00 00 5A",
"timeout": 1.5,
"require": false
},
{
"action": "send",
"label": "e400_0015_high_nonzero",
"frame": "06 00 15 80 00 C9",
"listen": 8.0
}
]
}

41
scenarios/others-isolate-e400-0015-low.json Normal file
View File

@@ -0,0 +1,41 @@
{
"name": "others-isolate-e400-0015-low",
"notes": [
"Recover to CONNECT OK, wait for the live 02 report window, then write E400[0x0015]=0x0001.",
"This isolates the command-6 secondary-table write from the E000[0x008F] write."
],
"steps": [
{
"action": "power_cycle",
"off_seconds": 1.5
},
{
"action": "wait_ready",
"heartbeats": 2,
"timeout": 10.0,
"require": true
},
{
"action": "drain",
"seconds": 0.25
},
{
"action": "send",
"label": "selector_zero_connect_ok_seed",
"frame": "00 00 00 80 00 DA",
"listen": 0.15
},
{
"action": "wait_for",
"frame": "02 00 02 00 00 5A",
"timeout": 1.5,
"require": false
},
{
"action": "send",
"label": "e400_0015_low_nonzero",
"frame": "06 00 15 00 01 48",
"listen": 8.0
}
]
}