aiden/h8-536-decoder
1
0
Fork 0
Code Activity

Intresting

Browse Source
This commit is contained in:
Aiden
2026-05-26 16:17:24 +10:00
parent d9a9dade41
commit 3e1d30527f
13 changed files with 917909 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

125
docs/pt2-copy-state-machine.md Normal file
View File

@@ -0,0 +1,125 @@
# PT2 Copy State Machine
This is a focused reference for the COPY behavior seen on the RCP LCD and traced in the ROM.
## Known Entry Points
### Serial Start / Progress
Frame:
```text
05 00 6D 00 00 32
```
ROM path:
- Command 5 accepts selector `0x006D` at `BD80-BDBF`.
- The selector is queued through `BE70`.
- Selector `0x006D` dispatches to `H'3015`.
Observed effects from forced decode:
- Sets `F731.7`.
- Sets `F795.6/F795.7`.
- Loads `F798=H'C8`.
- Sets display selector `F732=H'1903`.
- Sets `FB02=H'64`.
- Calls the display/report bridge at `48FA`.
- Sets `F76E.6`.
LCD dispatch:
- `F732` high byte `0x19` selects `493E[0x19] -> H'930A`.
- The local table at `H'931C` maps substate `0x03` to `H'9F6A`.
- `H'9F6A` builds `COPY` / `IN PROGRESS`.
### Serial Complete / Exit
Frame:
```text
05 00 6C 00 00 33
```
ROM path:
- Command 5 accepts selector `0x006C` at `BD80-BDBF`.
- The selector is queued through `BE70`.
- Selector `0x006C` dispatches to `H'2FAF`.
Observed effects from forced decode:
- Manipulates `F76E`, `F795`, `F797`, and `F799`.
- Can set display selector `F732=H'1904`.
- Sets `FB02=H'14`.
- Calls the display/report bridge at `48FA`.
LCD dispatch:
- `F732` high byte `0x19` selects `493E[0x19] -> H'930A`.
- The local table at `H'931C` maps substate `0x04` to `H'9FDA`.
- `H'9FDA` builds `COPY` / `COMPLETED`.
### RCP-Side Menu Start
ROM path:
- OTHERS menu page: `493E[0x01] -> H'631C`.
- Local page table: `H'632E`.
- `COPY TO SLAVES` entry handler: `H'6FF0`.
Required gates:
- The entry descriptor before `H'6FF0` requires `E400[0x0015] != 0`.
- The local COPY action branch requires `F770.2` and `F791.7`.
Local branch effects:
- Sets `F76E.6`.
- Sets `F795.7`.
- Sets `F731.7`.
- Loads `F798=H'C8`.
- Sets `F711.7`.
- Loads `F726=H'64`.
- Calls `loc_5500`.
- Displays `COPY TO SLAVES`.
If `F770.2` is set while `F791.7` is clear, the ROM diverts through `H'704C` to a `SET RCP` / `MASTER` display path instead of starting copy.
## Working State Model
| State | Likely indicators | Entry | Exit |
| --- | --- | --- | --- |
| Idle / no copy | `F731.7` clear | Boot, timeout, or completion cleanup | `0x006D` or local COPY branch |
| Copy in progress | `F731.7`, `F795.6/F795.7`, `F798` live, `F732=H'1903` | `05 00 6D 00 00 32` or local COPY branch | `0x006C` in the live window, or timer expiry |
| Copy completed | `F732=H'1904` | `05 00 6C 00 00 33` while copy flags are live | Display/session timeout or next state update |
| Timeout / not active | `F731.7` cleared by timer path | `F797` or `F798` reaches zero | Normal CONNECT recovery traffic |
## Bench Results
Observed on the real panel:
```text
006C alone -> CONNECT OK -> blank
006D alone -> CONNECT OK -> COPY IN PROGRESS -> CONNECT NOT ACT
006D -> 006C after 250 ms -> COPY IN PROGRESS -> COPY COMPLETED
006D -> 006C after 1.0-1.5 s -> COPY IN PROGRESS -> COPY COMPLETED
006D -> 006C after 2.0-2.5 s -> COPY IN PROGRESS -> CONNECT NOT ACT
006D repeated, then 006C -> COPY IN PROGRESS held longer -> COPY COMPLETED
006D repeated without 006C -> COPY IN PROGRESS -> CONNECT NOT ACT
```
Current interpretation:
- `0x006D` is a copy-start/progress-window refresh selector.
- `0x006C` is a completion/exit selector that only behaves cleanly while the copy window is live.
- The copy window is transient and timer-controlled.
- The panel does not treat `0x006C` as a stateless "show completed" command.
## Open Questions
- What sets `F791.7` during normal CCU/RCP operation?
- What exact official PT2 name belongs to selectors `0x006C`, `0x006D`, and `0x006E`?
- Whether `0x006E` is a copy cancel/error sibling or an unrelated special selector.
- Whether the CCU sends repeated progress refreshes during a real COPY TO SLAVES operation.

124
docs/pt2-menu-state-machine.md Normal file
View File

@@ -0,0 +1,124 @@
# PT2 Menu State Machine
This is a focused reference for the ROM menu/display selection machinery that drives LCD pages and panel soft-key activity.
## Page Dispatch
Primary display selector:
- `F732` holds the current display/page selector.
- The high byte of `F732` selects a page wrapper through `493E`.
- The low byte is used as a page-local substate/selection, commonly through `F733`.
Important dispatcher:
- `48FA` bridges table/report state into LCD page dispatch.
- `493E[page]` points at a wrapper.
- Wrappers pass a local table pointer to `5FD2`.
For COPY status:
- `F732=H'1903` selects page `0x19`, substate `0x03`, `COPY IN PROGRESS`.
- `F732=H'1904` selects page `0x19`, substate `0x04`, `COPY COMPLETED`.
For OTHERS:
- `493E[0x01] -> H'631C`.
- Local table `H'632E` includes the OTHERS pages.
## Local Entry Selection
`loc_5FD2` is the local menu chooser.
Important RAM:
| RAM | Role |
| --- | --- |
| `F72C` | visible/selectable entry bitmask |
| `F72E` | count of visible/selectable entries |
| `F72F` | cached page high byte |
| `F733` | selected local entry index |
| `FB03.7` | no-entry/error/display suppression flag |
| `FB02` | display/session timer or message timer |
Observed algorithm shape:
1. If the page changed, clear `F72C/F72E` and cache the new page in `F72F`.
2. Walk the page-local handler table from the last entry down.
3. For each handler, read descriptor words immediately before the handler.
4. Compare the entry state descriptor against `F731`.
5. If the entry has required selector descriptors, test `E400 + selector*2`.
6. If requirements pass, set the entry bit in `F72C` and increment `F72E`.
7. Clamp or reset `F733` so it points at a visible entry.
8. If no entries are visible, set `FB03.7`, set `FB02=H'14`, clear `F72F`, and return `R4=H'FFFE`.
Practical meaning:
- A page can exist in ROM but be invisible/inactive until the CCU seeds the right `E400` feature/status selector.
- Command 6 writes the `E400-E7FF` secondary table, but only on the continuation side of the protocol.
## OTHERS / COPY TO SLAVES Gates
OTHERS page map:
| Local entry | Handler | Visible text | Required secondary selector |
| --- | --- | --- | --- |
| 1 | `H'6FF0` | `OTHERS` / `COPY TO SLAVES` | `E400[0x0015] != 0` |
| 2 | `H'70F6` | `OTHERS` / `CAM ID SET` | `E400[0x0043] != 0` |
| 3 | `H'7188` | `OTHERS` / `CAM ID IND` | `E400[0x0037] != 0` |
| 4 | `H'7258` | `OTHERS` / `CAM BARS` | `E400[0x0038] != 0` |
| 5-6 | `H'7328/H'73D8` | marker/percentage pages | `E400[0x0027] != 0` |
COPY TO SLAVES local action gate:
- Handler `H'6FF0` watches `F770.2`.
- If `F770.2` is clear, it only displays the OTHERS/COPY page.
- If `F770.2` is set and `F791.7` is set, it enters the local copy-start branch.
- If `F770.2` is set and `F791.7` is clear, it diverts to `SET RCP` / `MASTER`.
Root OTHERS soft-key bits:
- Root handler `H'6EE4` tests `E000[0x008F]` at `H'E11E`.
- Bit 11 sets `F711.6`.
- Bit 12 sets `F711.4`.
These look like CCU-provided OTHERS soft-key enable bits. If they are absent, some OTHERS controls can appear inactive even when the page table entry exists.
## Button / Lamp Masks
Important RAM:
| RAM | Role |
| --- | --- |
| `F711-F718` | panel output masks used by external panel chips |
| `F711.4-F711.7` | soft-key/menu-related bits seen around OTHERS/COPY |
| `F726` | countdown that temporarily preserves some soft-key bits |
| `F770` | local panel action/change code |
Relevant ROM behavior:
- Init clears `F711-F717` and sets `F718=H'FF`.
- `5A7A` clears `F711.4-F711.7` if `F726 == 0`.
- The FRT timer path decrements `F726`; when it expires, it clears `F713.6` and `F711.4-F711.7`.
- The OTHERS/COPY branch sets `F711.7` and `F726=H'64` to keep the local key/display state alive briefly.
## Bench Implications
To make the local COPY path available from the panel, the fake CCU probably needs to:
1. Recover to a live `CONNECT: OK` style session.
2. Seed root OTHERS soft-key bits:
```text
00 01 0F 18 00 4C ; E000[0x008F] bits 11+12
```
3. During a live continuation/report window, seed the COPY page visibility bit:
```text
06 00 15 00 01 48 ; E400[0x0015] nonzero
```
4. Still satisfy the `F791.7` local copy-start gate.
The current hardest unknown is step 4: the ROM uses `F791.7` in several places, but the source that sets it has not yet been identified.

23
docs/pt2-protocol.md
View File

@@ -4,6 +4,11 @@ This document is the current working model for the serial protocol spoken by the
A later RCP manual mentions a "PT2 compatibility mode" for controlling the same CCU family this panel was made for. We are using "PT2" here as a practical label for this six-byte SCI1 protocol model. It is not yet a claim that every field name matches Sony's official PT2 terminology.
Focused companion notes:
- [PT2 Copy State Machine](pt2-copy-state-machine.md)
- [PT2 Menu State Machine](pt2-menu-state-machine.md)
## Current High-Confidence Facts
- The real bench link is `38400 8E1`, not `38400 8N1`.
@@ -562,11 +567,27 @@ The `0x006D` copy path is now confirmed outside the earlier all-suite ordering c
- Selector `0x006D` dispatches to `H'3015`. Forced decoding shows it sets `F731.7`, loads `F798=H'C8`, sets `F795.6/F795.7`, sets display selector `F732=H'1903`, sets `FB02=H'64`, calls `48FA`, then sets `F76E.6`.
- The LCD dispatch for these states is now traced: `loc_48FA` reads the high byte at `F732`, so `F732=H'1903/H'1904` selects display page `0x19`, not direct page `0x03/0x04`. `493E[0x19] -> H'930A`; that page's local table at `H'931C` includes `H'9F6A` for `COPY` / `IN PROGRESS` and `H'9FDA` for `COPY` / `COMPLETED`. The low byte at `F733` is the substate selector: `0x03` is in-progress and `0x04` is completed.
- This makes the likely copy handshake: `0x006D` starts copy and sets the `F795.6/F795.7` in-progress flags; `0x006C` is the completion/exit sibling only when those flags are live. Sending `0x006C` alone can therefore blank or clear state instead of displaying `COPY COMPLETED`.
- Bench step-through confirmed the sequence model: `006C` alone produced `CONNECT OK -> blank`; `006D` alone produced `CONNECT OK -> COPY IN PROGRESS`; `006D` followed by `006C` after 250 ms produced a brief `COPY IN PROGRESS` then `COPY COMPLETED`; the same after 1.0 s and 1.5 s produced a longer `COPY IN PROGRESS` then `COPY COMPLETED`; after 2.0 s or 2.5 s it fell to `CONNECT:NOT ACT` instead of completing. Repeating `006D` before `006C` also completed successfully in the 2x and 3x repeat tests. This points to an active completion window that can likely be refreshed/restarted by additional in-progress/progress traffic, rather than a stateless command.
- Bench step-through confirmed the sequence model: `006C` alone produced `CONNECT OK -> blank`; `006D` alone produced `CONNECT OK -> COPY IN PROGRESS`; `006D` followed by `006C` after 250 ms produced a brief `COPY IN PROGRESS` then `COPY COMPLETED`; the same after 1.0 s and 1.5 s produced a longer `COPY IN PROGRESS` then `COPY COMPLETED`; after 2.0 s or 2.5 s it fell to `CONNECT:NOT ACT` instead of completing. Repeating `006D` before `006C` also completed successfully in the 2x and 3x repeat tests. A longer `006D` hold test kept `COPY IN PROGRESS` active for several seconds and then completed when `006C` arrived, while the same hold without `006C` timed out from `COPY IN PROGRESS` to `CONNECT:NOT ACT`. This points to `006D` as an in-progress/progress-window refresh selector and `006C` as the explicit completion/exit selector, not a stateless command pair.
- The FRT1 timer path decrements `F797` and `F798`; when either reaches zero, it clears `F731.7`. This matches the observed transient display modes falling back to `CONNECT:NOT ACT`.
- The string `COPY IN PROGRESS` is present in the ROM LCD resources, so the `006D` result is not a generic serial artifact.
- Manual interpretation: the RCP-TX7 operating manual describes `COPY IN PROGRESS` as the LCD state shown during the multi-camera `COPY TO SLAVES` data-transfer operation over the RS232C command-link system. During that state, all linked RCP units display the message and their buttons/knobs are locked until `COPY COMPLETED`. Therefore selector `0x006D` is best treated as entering a command-link copy/data-transfer state, not as a normal CCU connection ACK.
RCP-side OTHERS/COPY menu trace:
- The OTHERS menu is page `0x01`: `493E[0x01] -> H'631C`, local table `H'632E`.
- Local table entry 1 points to `H'6FF0`, the page that renders `OTHERS` / `COPY TO SLAVES`.
- The entry descriptor immediately before `H'6FF0` requires selector `0x0015` in the secondary table: `E400[0x0015] != 0`. Because command 6 writes `E400`, this is probably a CCU-provided feature/visibility bit, and command 6 must be sent in a live continuation/report window to have an effect.
- When the page sees `F770.2` set, it only follows the local copy-start branch if `F791.7` is already set. That branch sets `F76E.6`, `F795.7`, `F731.7`, `F798=H'C8`, `F711.7`, `F726=H'64`, calls `loc_5500`, then displays `COPY TO SLAVES`. This is the RCP-side equivalent of the serial `0x006D` copy-start effect.
- If `F770.2` is set while `F791.7` is clear, the ROM diverts through `H'704C` to a `SET RCP` / `MASTER` display path instead of starting copy. That makes `F791.7` a second, likely master/link/session gate for the physical COPY operation.
- The OTHERS root handler at `H'6EE4` also tests primary selector `E000[0x008F]` (`H'E11E`) bits 11 and 12, and uses them to set `F711.6` and `F711.4`. If those bits are absent, some OTHERS soft keys can appear inactive even when the page exists.
- Candidate gate probes, not final protocol truth:
```text
00 01 0F 18 00 4C ; command 0, set E000[0x008F] bits 11+12
06 00 15 00 01 48 ; command 6, set E400[0x0015] nonzero; requires live continuation
06 00 15 80 00 C9 ; command 6, alternate nonzero visibility value; requires live continuation
```
Read table state:
```powershell