Pin additons

2026-05-25 15:18:47 +10:00
parent cdfb811c28
commit a82f3f6628
10 changed files with 3498 additions and 50 deletions
--- a/README.md
+++ b/README.md
@@ -33,6 +33,8 @@ To turn the structured decompile output into conservative C-like pseudocode:
 - Emits memory-region metadata for vector, DTC, RAM, register-field, and mode-dependent program/external space.
 - Parses the DTC vector table described by the manual and decodes DTC register-information blocks.
 - Tracks SCI setup writes and can infer baud rates from SMR/BRR when `--clock-hz` is supplied.
+- Annotates SCI protocol actions such as TDRE waits, TDR writes, RDR reads, RX/TX interrupt enables, and receive-error clears.
+- Adds a Sony RCP-TX7 board profile that ties H8/536 pin 66 `P95/TXD` and pin 67 `P96/RXD` to the MAX202 RS232 transceiver.
 - Flags/manual-annotates TEMP-register access ordering for FRT and A/D 16-bit peripheral registers.
 - Scans unreached ROM ranges for ASCII strings and pointer-table candidates.
 - Scans likely LCD/menu text records, groups display-text regions, and reports literal/near matches for terms such as `CONNECT`.
@@ -70,6 +72,7 @@ python h8536_decompiler.py --help
 - `--start H'1000 --end H'D100`: constrain the decode range.
 - `--br H'FE`: resolve short absolute `@aa:8` operands through a known base-register value.
 - `--clock-hz 16000000`: infer SCI baud rates from manual BRR formulas.
+- `--board-profile sony_rcp_tx7|none`: include or suppress known board-trace annotations.
 - `--cycles`: append Appendix A cycle estimates to assembly comments.
 - `--timing`: include straight-line block and backward-branch loop timing summaries.
 - `--callgraph-dot build\callgraph.dot`: write a Graphviz DOT call graph.
@@ -105,6 +108,8 @@ python h8536_pseudocode.py --help
 - `h8536/lcd_driver.py`: LCD E-clock access and busy-poll recognizer.
 - `h8536/timing.py`: block and loop cycle summaries.
 - `h8536/sci.py`: SCI setup tracking and baud inference.
+- `h8536/sci_protocol.py`: SCI transmit/receive/status semantic annotations.
+- `h8536/board_profile.py`: Sony RCP-TX7 board-trace annotations, including the MAX202 RS232 path.
 - `h8536/peripheral_access.py`: FRT/A-D TEMP-register access analysis.
 - `h8536/pseudocode.py`: JSON-to-C-like pseudocode generation.
 - `h8536/render.py`: assembly and JSON output.
--- a/build/rom_decompiled.asm
+++ b/build/rom_decompiled.asm
@@ -224,6 +224,12 @@
 ; mem_F10E         H'F10E program_or_external memory   r=0 w=1 width=byte
 ; ... 206 more symbols omitted from listing header

+; Board Profile
+; Board trace ties the H8/536 SCI1 pins to a MAX202 RS232 transceiver.
+; H8 pin 66 P95/TXD (TXD) -> MAX202 pin 11
+; H8 pin 67 P96/RXD (RXD) -> MAX202 pin 12
+; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.
+
 ; LCD/Text Scan
 ; search 'CONNECT': not literal, hits=0
 ;   near: H'A025 'COMPLETED', H'8E79 'ON  CONT1  OFF~X', H'8F55 'ON  CONT2  OFF~X', H'94A9 'ON'
@@ -399,7 +405,7 @@ vec_reset_1000:
 1025: 15 FE FE 06 93 MOV:G.B #H'93, @P9DDR ; P9DDR = H'93; cycles=9
 102A: 15 FE FF 06 00 MOV:G.B #H'00, @P9DR ; P9DR = H'00; cycles=9
 102F: 15 FE FC 06 87 MOV:G.B #H'87, @SYSCR1 ; SYSCR1 = H'87 (IRQ1E=0 IRQ0E=0 NMIEG=0 BRLE=0; P12/P13 are I/O, IRQ0 disabled, IRQ1 disabled); cycles=9
-1034: 15 FE FD 06 84 MOV:G.B #H'84, @SYSCR2 ; SYSCR2 = H'84 (IRQ5E=0 IRQ4E=0 IRQ3E=0 IRQ2E=0 P6PWME=1 P9PWME=0 P9SCI2E=0; enabled P6 PWM); cycles=9
+1034: 15 FE FD 06 84 MOV:G.B #H'84, @SYSCR2 ; SYSCR2 = H'84 (IRQ5E=0 IRQ4E=0 IRQ3E=0 IRQ2E=0 P6PWME=1 P9PWME=0 P9SCI2E=0; enabled P6 PWM); SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; cycles=9
 1039: 15 FE 90 06 02 MOV:G.B #H'02, @FRT1_TCR ; FRT1_TCR = H'02 (ICIE=0 OCIEB=0 OCIEA=0 OVIE=0 OEB=0 OEA=0 CKS1=1 CKS0=0); cycles=9
 103E: 15 FE 91 06 01 MOV:G.B #H'01, @FRT1_TCSR ; FRT1_TCSR = H'01 (ICF=0 OCFB=0 OCFA=0 OVF=0 OLVLB=0 OLVLA=0 IEDG=0 CCLRA=1); cycles=9
 1043: 1D FE 92 06 00 MOV:G.W #H'00, @FRT1_FRC_H ; FRT1_FRC_H = H'00; FRT1_FRC word write; TEMP byte-order hazard avoided; cycles=9
@@ -418,12 +424,12 @@ vec_reset_1000:
 1086: 15 FE C5 06 FF MOV:G.B #H'FF, @PWM2_DTR ; PWM2_DTR = H'FF; cycles=9
 108B: 15 FE C8 06 3B MOV:G.B #H'3B, @PWM3_TCR ; PWM3_TCR = H'3B (OE=0 OS=0 CKS2=0 CKS1=1 CKS0=1); cycles=9
 1090: 15 FE C9 06 7D MOV:G.B #H'7D, @PWM3_DTR ; PWM3_DTR = H'7D; cycles=9
-1095: 15 FE D8 06 24 MOV:G.B #H'24, @SCI1_SMR ; SCI1_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); cycles=9
-109A: 15 FE DA 06 3C MOV:G.B #H'3C, @SCI1_SCR ; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); cycles=9
-109F: 15 FE D9 06 07 MOV:G.B #H'07, @SCI1_BRR ; SCI1_BRR = H'07; SCI1 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; cycles=9
-10A4: 15 FE F0 06 24 MOV:G.B #H'24, @SCI2_SMR ; SCI2_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); cycles=9
-10A9: 15 FE F2 06 0C MOV:G.B #H'0C, @SCI2_SCR ; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); cycles=9
-10AE: 15 FE F1 06 07 MOV:G.B #H'07, @SCI2_BRR ; SCI2_BRR = H'07; SCI2 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; cycles=9
+1095: 15 FE D8 06 24 MOV:G.B #H'24, @SCI1_SMR ; SCI1_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI1 SMR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); cycles=9
+109A: 15 FE DA 06 3C MOV:G.B #H'3C, @SCI1_SCR ; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); disable SCI1 TX interrupt (TIE); disable SCI1 receive and receive-error interrupts (RIE); enable SCI1 transmitter (TE); enable SCI1 receiver (RE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
+109F: 15 FE D9 06 07 MOV:G.B #H'07, @SCI1_BRR ; SCI1_BRR = H'07; SCI1 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI1 BRR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); cycles=9
+10A4: 15 FE F0 06 24 MOV:G.B #H'24, @SCI2_SMR ; SCI2_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI2 SMR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
+10A9: 15 FE F2 06 0C MOV:G.B #H'0C, @SCI2_SCR ; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); disable SCI2 TX interrupt (TIE); disable SCI2 receive and receive-error interrupts (RIE); disable SCI2 transmitter (TE); disable SCI2 receiver (RE); SCI2 SCR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
+10AE: 15 FE F1 06 07 MOV:G.B #H'07, @SCI2_BRR ; SCI2_BRR = H'07; SCI2 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI2 BRR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; cycles=9
 10B3: 15 FE E8 06 19 MOV:G.B #H'19, @ADCSR ; ADCSR = H'19 (ADF=0 ADIE=0 ADST=0 SCAN=1 CKS=1 CH2=0 CH1=0 CH0=1; A/D halt, scan AN0-AN1, 138-state max, ADI disabled); cycles=9
 10B8: 15 FE E9 06 7F MOV:G.B #H'7F, @H'FEE9 ; refs H'FEE9 in register_field; cycles=9
 10BD: 15 FF 10 06 F0 MOV:G.B #H'F0, @WCR ; WCR = H'F0 (WMS1=0 WMS0=0 WC1=0 WC0=0; programmable wait, 0 waits); cycles=9
@@ -2576,12 +2582,12 @@ loc_434C:
 435B: 15 FF 03 06 00 MOV:G.B #H'00, @IPRD ; IPRD = H'00 (FRT3 priority=0; 8-bit timer priority=0); cycles=9
 4360: 15 FF 04 06 50 MOV:G.B #H'50, @IPRE ; IPRE = H'50 (SCI1 priority=5; SCI2 priority=0); cycles=9
 4365: 15 FF 05 06 40 MOV:G.B #H'40, @IPRF ; IPRF = H'40 (A/D priority=4); cycles=9
-436A: 15 FE DA C6    BSET.B #6, @SCI1_SCR ; set RIE (bit 6) of SCI1_SCR; cycles=9
+436A: 15 FE DA C6    BSET.B #6, @SCI1_SCR ; set RIE (bit 6) of SCI1_SCR; enable SCI1 receive and receive-error interrupts (RIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
 436E: 15 FE 90 C5    BSET.B #5, @FRT1_TCR ; set OCIEA (bit 5) of FRT1_TCR; cycles=9
 4372: 15 FE A0 C5    BSET.B #5, @FRT2_TCR ; set OCIEA (bit 5) of FRT2_TCR; cycles=9
 4376: 15 FE E8 C6    BSET.B #6, @ADCSR ; set ADIE (bit 6) of ADCSR; cycles=9
-437A: 15 FE FD C4    BSET.B #4, @SYSCR2 ; set IRQ3E (bit 4) of SYSCR2; cycles=9
-437E: 15 FE FD C5    BSET.B #5, @SYSCR2 ; set IRQ4E (bit 5) of SYSCR2; cycles=9
+437A: 15 FE FD C4    BSET.B #4, @SYSCR2 ; set IRQ3E (bit 4) of SYSCR2; SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; cycles=9
+437E: 15 FE FD C5    BSET.B #5, @SYSCR2 ; set IRQ4E (bit 5) of SYSCR2; SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; cycles=9
 4382: 15 FE 8E F6    BTST.B #6, @P7DR ; refs P7DR in register_field; cycles=7
 4386: 27 06          BEQ loc_438E ; cycles=3/7 nt/t
 4388: 1D FE EC 07 A5 3F MOV:G.W #H'A53F, @WDT_TCSR_R ; WDT_TCSR_R = H'A53F (OVF=0 WT/IT=0 TME=1 CKS2=1 CKS1=1 CKS0=1; TCSR password H'A5, WDT enabled, interval IRQ0, clock phi/4096); cycles=11
@@ -3025,13 +3031,13 @@ BA60: 15 F8 5C 60    XOR.B @H'F85C, R0 ; refs ram_F85C in on_chip_ram; cycles=7
 BA64: 15 F8 5D 90    MOV:G.B R0, @H'F85D ; refs ram_F85D in on_chip_ram; cycles=7

 loc_BA68:
-BA68: 15 FE DC F7    BTST.B #7, @SCI1_SSR ; refs SCI1_SSR in register_field; cycles=7
-BA6C: 27 FA          BEQ loc_BA68 ; cycles=3/7 nt/t
+BA68: 15 FE DC F7    BTST.B #7, @SCI1_SSR ; wait for SCI1 transmit data register empty (TDRE=1); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR in register_field; cycles=7
+BA6C: 27 FA          BEQ loc_BA68 ; repeat SCI1 transmit-empty wait while TDRE=0; cycles=3/7 nt/t
 BA6E: 15 F8 58 80    MOV:G.B @H'F858, R0 ; refs ram_F858 in on_chip_ram; cycles=7
-BA72: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; cycles=7
+BA72: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; cycles=7
 BA76: 15 F9 C2 06 01 MOV:G.B #H'01, @H'F9C2 ; refs ram_F9C2 in on_chip_ram; cycles=9
-BA7B: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; cycles=8
-BA7F: 15 FE DA C7    BSET.B #7, @SCI1_SCR ; set TIE (bit 7) of SCI1_SCR; cycles=8
+BA7B: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BA7F: 15 FE DA C7    BSET.B #7, @SCI1_SCR ; set TIE (bit 7) of SCI1_SCR; enable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=8
 BA83: 19             RTS ; cycles=13

 vec_sci1_txi_BA84:
@@ -3043,7 +3049,7 @@ BA90: 15 F9 C3 16    TST.B @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=7
 BA94: 27 13          BEQ loc_BAA9 ; cycles=3/7 nt/t
 BA96: 15 FA A2 D3    BCLR.B #3, @H'FAA2 ; refs ram_FAA2 in on_chip_ram; cycles=9
 BA9A: 15 FA A3 13    CLR.B @H'FAA3 ; refs ram_FAA3 in on_chip_ram; cycles=9
-BA9E: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; cycles=9
+BA9E: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
 BAA2: 15 F9 C0 06 1F MOV:G.B #H'1F, @H'F9C0 ; refs ram_F9C0 in on_chip_ram; cycles=9
 BAA7: 20 48          BRA loc_BAF1 ; cycles=8

@@ -3052,13 +3058,13 @@ BAA9: BF 90          MOV:G.W R0, @-R7 ; cycles=5
 BAAB: 15 F9 C2 80    MOV:G.B @H'F9C2, R0 ; refs ram_F9C2 in on_chip_ram; cycles=6
 BAAF: A0 12          EXTU.B R0 ; cycles=3
 BAB1: F0 F8 58 80    MOV:G.B @(-H'07A8,R0), R0 ; cycles=6
-BAB5: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; cycles=6
+BAB5: 15 FE DB 90    MOV:G.B R0, @SCI1_TDR ; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; cycles=6
 BAB9: CF 80          MOV:G.W @R7+, R0 ; cycles=6
-BABB: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; cycles=8
+BABB: 15 FE DC D7    BCLR.B #7, @SCI1_SSR ; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
 BABF: 15 F9 C2 08    ADD:Q.B #1, @H'F9C2 ; refs ram_F9C2 in on_chip_ram; cycles=8
 BAC3: 15 F9 C2 04 06 CMP:G.B #H'06, @H'F9C2 ; refs ram_F9C2 in on_chip_ram; cycles=6
 BAC8: 26 27          BNE loc_BAF1 ; cycles=3/7 nt/t
-BACA: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; cycles=9
+BACA: 15 FE DA D7    BCLR.B #7, @SCI1_SCR ; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); cycles=9
 BACE: 15 F7 95 F6    BTST.B #6, @H'F795 ; refs ram_F795 in on_chip_ram; cycles=7
 BAD2: 26 14          BNE loc_BAE8 ; cycles=3/7 nt/t
 BAD4: 15 F7 91 F7    BTST.B #7, @H'F791 ; refs ram_F791 in on_chip_ram; cycles=7
@@ -3120,14 +3126,14 @@ BB56: 19             RTS ; cycles=12

 vec_sci1_eri_BB57:
 BB57: 15 FA A4 C7    BSET.B #7, @H'FAA4 ; refs ram_FAA4 in on_chip_ram; cycles=8
-BB5B: 15 FE DC D5    BCLR.B #5, @SCI1_SSR ; clear ORER (bit 5) of SCI1_SSR; cycles=8
-BB5F: 15 FE DC D4    BCLR.B #4, @SCI1_SSR ; clear FER (bit 4) of SCI1_SSR; cycles=8
-BB63: 15 FE DC D3    BCLR.B #3, @SCI1_SSR ; clear PER (bit 3) of SCI1_SSR; cycles=8
+BB5B: 15 FE DC D5    BCLR.B #5, @SCI1_SSR ; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB5F: 15 FE DC D4    BCLR.B #4, @SCI1_SSR ; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB63: 15 FE DC D3    BCLR.B #3, @SCI1_SSR ; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8

 vec_sci1_rxi_BB67:
 BB67: 12 03          STM.W {R0,R1}, @-SP ; cycles=12
-BB69: 15 FE DC D6    BCLR.B #6, @SCI1_SSR ; clear RDRF (bit 6) of SCI1_SSR; cycles=8
-BB6D: 15 FE DD 80    MOV:G.B @SCI1_RDR, R0 ; refs SCI1_RDR in register_field; cycles=6
+BB69: 15 FE DC D6    BCLR.B #6, @SCI1_SSR ; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; cycles=8
+BB6D: 15 FE DD 80    MOV:G.B @SCI1_RDR, R0 ; read SCI1 received byte from RDR; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR in register_field; cycles=6
 BB71: 15 F9 C1 16    TST.B @H'F9C1 ; refs ram_F9C1 in on_chip_ram; cycles=6
 BB75: 26 06          BNE loc_BB7D ; cycles=3/8 nt/t
 BB77: 15 F9 C3 13    CLR.B @H'F9C3 ; refs ram_F9C3 in on_chip_ram; cycles=8
--- a/build/rom_decompiled.json
+++ b/build/rom_decompiled.json
--- a/build/rom_pseudocode.c
+++ b/build/rom_pseudocode.c
@@ -465,7 +465,7 @@ void vec_reset_1000(void)
    P9DDR = (uint8_t)(0x93); /* 1025; MOV:G.B #H'93, @P9DDR; P9DDR = H'93; refs P9DDR; cycles=9 */
    P9DR = (uint8_t)(0x00); /* 102A; MOV:G.B #H'00, @P9DR; P9DR = H'00; refs P9DR; cycles=9 */
    SYSCR1 = (uint8_t)(0x87); /* 102F; MOV:G.B #H'87, @SYSCR1; SYSCR1 = H'87 (IRQ1E=0 IRQ0E=0 NMIEG=0 BRLE=0; P12/P13 are I/O, IRQ0 disabled, IRQ1 disabled); refs SYSCR1; cycles=9 */
-    SYSCR2 = (uint8_t)(0x84); /* 1034; MOV:G.B #H'84, @SYSCR2; SYSCR2 = H'84 (IRQ5E=0 IRQ4E=0 IRQ3E=0 IRQ2E=0 P6PWME=1 P9PWME=0 P9SCI2E=0; enabled P6 PWM); refs SYSCR2; cycles=9 */
+    SYSCR2 = (uint8_t)(0x84); /* 1034; MOV:G.B #H'84, @SYSCR2; SYSCR2 = H'84 (IRQ5E=0 IRQ4E=0 IRQ3E=0 IRQ2E=0 P6PWME=1 P9PWME=0 P9SCI2E=0; enabled P6 PWM); SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; refs SYSCR2; cycles=9 */
    FRT1_TCR = (uint8_t)(0x02); /* 1039; MOV:G.B #H'02, @FRT1_TCR; FRT1_TCR = H'02 (ICIE=0 OCIEB=0 OCIEA=0 OVIE=0 OEB=0 OEA=0 CKS1=1 CKS0=0); refs FRT1_TCR; cycles=9 */
    FRT1_TCSR = (uint8_t)(0x01); /* 103E; MOV:G.B #H'01, @FRT1_TCSR; FRT1_TCSR = H'01 (ICF=0 OCFB=0 OCFA=0 OVF=0 OLVLB=0 OLVLA=0 IEDG=0 CCLRA=1); refs FRT1_TCSR; cycles=9 */
    FRT1_FRC_H = (uint16_t)(0x00); /* 1043; MOV:G.W #H'00, @FRT1_FRC_H; FRT1_FRC_H = H'00; refs FRT1_FRC_H; FRT1_FRC W write high TEMP access; cycles=9 */
@@ -484,12 +484,12 @@ void vec_reset_1000(void)
    PWM2_DTR = (uint8_t)(0xFF); /* 1086; MOV:G.B #H'FF, @PWM2_DTR; PWM2_DTR = H'FF; refs PWM2_DTR; cycles=9 */
    PWM3_TCR = (uint8_t)(0x3B); /* 108B; MOV:G.B #H'3B, @PWM3_TCR; PWM3_TCR = H'3B (OE=0 OS=0 CKS2=0 CKS1=1 CKS0=1); refs PWM3_TCR; cycles=9 */
    PWM3_DTR = (uint8_t)(0x7D); /* 1090; MOV:G.B #H'7D, @PWM3_DTR; PWM3_DTR = H'7D; refs PWM3_DTR; cycles=9 */
-    SCI1_SMR = (uint8_t)(0x24); /* 1095; MOV:G.B #H'24, @SCI1_SMR; SCI1_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); refs SCI1_SMR; cycles=9 */
-    SCI1_SCR = (uint8_t)(0x3C); /* 109A; MOV:G.B #H'3C, @SCI1_SCR; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); refs SCI1_SCR; cycles=9 */
-    SCI1_BRR = (uint8_t)(0x07); /* 109F; MOV:G.B #H'07, @SCI1_BRR; SCI1_BRR = H'07; SCI1 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; refs SCI1_BRR; cycles=9 */
-    SCI2_SMR = (uint8_t)(0x24); /* 10A4; MOV:G.B #H'24, @SCI2_SMR; SCI2_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); refs SCI2_SMR; cycles=9 */
-    SCI2_SCR = (uint8_t)(0x0C); /* 10A9; MOV:G.B #H'0C, @SCI2_SCR; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); refs SCI2_SCR; cycles=9 */
-    SCI2_BRR = (uint8_t)(0x07); /* 10AE; MOV:G.B #H'07, @SCI2_BRR; SCI2_BRR = H'07; SCI2 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; refs SCI2_BRR; cycles=9 */
+    SCI1_SMR = (uint8_t)(0x24); /* 1095; MOV:G.B #H'24, @SCI1_SMR; SCI1_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI1 SMR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); refs SCI1_SMR; cycles=9 */
+    SCI1_SCR = (uint8_t)(0x3C); /* 109A; MOV:G.B #H'3C, @SCI1_SCR; SCI1_SCR = H'3C (TIE=0 RIE=0 TE=1 RE=1 CKE1=0 CKE0=0; SCI enables TX,RX, internal clock); disable SCI1 TX interrupt (TIE); disable SCI1 receive and receive-error interrupts (RIE); enable SCI1 transmitter (TE); enable SCI1 receiver (RE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
+    SCI1_BRR = (uint8_t)(0x07); /* 109F; MOV:G.B #H'07, @SCI1_BRR; SCI1_BRR = H'07; SCI1 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI1 BRR serial init for traced RS232/MAX202 path (H8 pin 66 P95/TXD to MAX202 pin 11; MAX202 pin 12 to H8 pin 67 P96/RXD); refs SCI1_BRR; cycles=9 */
+    SCI2_SMR = (uint8_t)(0x24); /* 10A4; MOV:G.B #H'24, @SCI2_SMR; SCI2_SMR = H'24 (C/A=0 CHR=0 PE=1 O/E=0 STOP=0 CKS1=0 CKS0=0; SCI async, 8-bit, even parity, 1 stop, clock phi); SCI2 SMR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_SMR; cycles=9 */
+    SCI2_SCR = (uint8_t)(0x0C); /* 10A9; MOV:G.B #H'0C, @SCI2_SCR; SCI2_SCR = H'0C (TIE=0 RIE=0 TE=0 RE=0 CKE1=0 CKE0=0; SCI enables none, internal clock); disable SCI2 TX interrupt (TIE); disable SCI2 receive and receive-error interrupts (RIE); disable SCI2 transmitter (TE); disable SCI2 receiver (RE); SCI2 SCR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_SCR; cycles=9 */
+    SCI2_BRR = (uint8_t)(0x07); /* 10AE; MOV:G.B #H'07, @SCI2_BRR; SCI2_BRR = H'07; SCI2 async 8-bit even parity 1 stop BRR N=7 CKS n=0; baud needs --clock-hz; SCI2 BRR write; not the traced MAX202 path; P9SCI2E=0 disables SCI2 pins P92/P93/P94, while the board trace is SCI1 P95/P96; refs SCI2_BRR; cycles=9 */
    ADCSR = (uint8_t)(0x19); /* 10B3; MOV:G.B #H'19, @ADCSR; ADCSR = H'19 (ADF=0 ADIE=0 ADST=0 SCAN=1 CKS=1 CH2=0 CH1=0 CH0=1; A/D halt, scan AN0-AN1, 138-state max, ADI disabled); refs ADCSR; cycles=9 */
    MEM8[0xFEE9] = (uint8_t)(0x7F); /* 10B8; MOV:G.B #H'7F, @H'FEE9; cycles=9 */
    WCR = (uint8_t)(0xF0); /* 10BD; MOV:G.B #H'F0, @WCR; WCR = H'F0 (WMS1=0 WMS0=0 WC1=0 WC0=0; programmable wait, 0 waits); refs WCR; cycles=9 */
@@ -2432,12 +2432,12 @@ void loc_434C(void)
    IPRD = (uint8_t)(0x00); /* 435B; MOV:G.B #H'00, @IPRD; IPRD = H'00 (FRT3 priority=0; 8-bit timer priority=0); refs IPRD; cycles=9 */
    IPRE = (uint8_t)(0x50); /* 4360; MOV:G.B #H'50, @IPRE; IPRE = H'50 (SCI1 priority=5; SCI2 priority=0); refs IPRE; cycles=9 */
    IPRF = (uint8_t)(0x40); /* 4365; MOV:G.B #H'40, @IPRF; IPRF = H'40 (A/D priority=4); refs IPRF; cycles=9 */
-    SCI1_SCR |= BIT(6); /* 436A; BSET.B #6, @SCI1_SCR; set RIE (bit 6) of SCI1_SCR; refs SCI1_SCR; cycles=9 */
+    SCI1_SCR |= BIT(6); /* 436A; BSET.B #6, @SCI1_SCR; set RIE (bit 6) of SCI1_SCR; enable SCI1 receive and receive-error interrupts (RIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
    FRT1_TCR |= BIT(5); /* 436E; BSET.B #5, @FRT1_TCR; set OCIEA (bit 5) of FRT1_TCR; refs FRT1_TCR; cycles=9 */
    FRT2_TCR |= BIT(5); /* 4372; BSET.B #5, @FRT2_TCR; set OCIEA (bit 5) of FRT2_TCR; refs FRT2_TCR; cycles=9 */
    ADCSR |= BIT(6); /* 4376; BSET.B #6, @ADCSR; set ADIE (bit 6) of ADCSR; refs ADCSR; cycles=9 */
-    SYSCR2 |= BIT(4); /* 437A; BSET.B #4, @SYSCR2; set IRQ3E (bit 4) of SYSCR2; refs SYSCR2; cycles=9 */
-    SYSCR2 |= BIT(5); /* 437E; BSET.B #5, @SYSCR2; set IRQ4E (bit 5) of SYSCR2; refs SYSCR2; cycles=9 */
+    SYSCR2 |= BIT(4); /* 437A; BSET.B #4, @SYSCR2; set IRQ3E (bit 4) of SYSCR2; SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; refs SYSCR2; cycles=9 */
+    SYSCR2 |= BIT(5); /* 437E; BSET.B #5, @SYSCR2; set IRQ4E (bit 5) of SYSCR2; SYSCR2 write leaves P9SCI2E=0; SCI2 pins are disabled, so SCI2 is not the traced MAX202 path; traced RS232/MAX202 remains SCI1 P95/P96; refs SYSCR2; cycles=9 */
    set_flags_btst(P7DR, 6); /* 4382; BTST.B #6, @P7DR; refs P7DR; cycles=7 */
    if (!Z) { /* 4386; BEQ loc_438E; cycles=3/7 nt/t */
        WDT_TCSR_R = (uint16_t)(0xA53F); /* 4388; MOV:G.W #H'A53F, @WDT_TCSR_R; WDT_TCSR_R = H'A53F (OVF=0 WT/IT=0 TME=1 CKS2=1 CKS1=1 CKS0=1; TCSR password H'A5, WDT enabled, interval IRQ0, clock phi/4096); refs WDT_TCSR_R; cycles=11 */
@@ -2849,13 +2849,13 @@ void loc_BA26(void)
    R0 ^= (uint8_t)(MEM8[0xF85C]); /* BA60; XOR.B @H'F85C, R0; refs ram_F85C; cycles=7 */
    MEM8[0xF85D] = (uint8_t)(R0); /* BA64; MOV:G.B R0, @H'F85D; refs ram_F85D; cycles=7 */
    do {
-        set_flags_btst(SCI1_SSR, 7); /* BA68; BTST.B #7, @SCI1_SSR; refs SCI1_SSR; cycles=7 */
-    } while (Z); /* BA6C; BEQ loc_BA68; cycles=3/7 nt/t */
+        set_flags_btst(SCI1_SSR, 7); /* BA68; BTST.B #7, @SCI1_SSR; wait for SCI1 transmit data register empty (TDRE=1); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=7 */
+    } while (Z); /* BA6C; BEQ loc_BA68; repeat SCI1 transmit-empty wait while TDRE=0; cycles=3/7 nt/t */
    R0 = (uint8_t)(MEM8[0xF858]); /* BA6E; MOV:G.B @H'F858, R0; refs ram_F858; cycles=7 */
-    SCI1_TDR = (uint8_t)(R0); /* BA72; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; refs SCI1_TDR; cycles=7 */
+    SCI1_TDR = (uint8_t)(R0); /* BA72; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; refs SCI1_TDR; cycles=7 */
    MEM8[0xF9C2] = (uint8_t)(0x01); /* BA76; MOV:G.B #H'01, @H'F9C2; refs ram_F9C2; cycles=9 */
-    SCI1_SSR &= ~BIT(7); /* BA7B; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; refs SCI1_SSR; cycles=8 */
-    SCI1_SCR |= BIT(7); /* BA7F; BSET.B #7, @SCI1_SCR; set TIE (bit 7) of SCI1_SCR; refs SCI1_SCR; cycles=8 */
+    SCI1_SSR &= ~BIT(7); /* BA7B; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    SCI1_SCR |= BIT(7); /* BA7F; BSET.B #7, @SCI1_SCR; set TIE (bit 7) of SCI1_SCR; enable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=8 */
    return; /* BA83; RTS; cycles=13 */
 }

@@ -2870,7 +2870,7 @@ void vec_sci1_txi_BA84(void)
    if (Z) goto loc_BAA9; /* BA94; BEQ loc_BAA9; cycles=3/7 nt/t */
    MEM8[0xFAA2] &= ~BIT(3); /* BA96; BCLR.B #3, @H'FAA2; refs ram_FAA2; cycles=9 */
    MEM8[0xFAA3] = 0; /* BA9A; CLR.B @H'FAA3; refs ram_FAA3; cycles=9 */
-    SCI1_SCR &= ~BIT(7); /* BA9E; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; refs SCI1_SCR; cycles=9 */
+    SCI1_SCR &= ~BIT(7); /* BA9E; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
    MEM8[0xF9C0] = (uint8_t)(0x1F); /* BAA2; MOV:G.B #H'1F, @H'F9C0; refs ram_F9C0; cycles=9 */
    goto loc_BAF1; /* BAA7; BRA loc_BAF1; cycles=8 */
 loc_BAA9:
@@ -2878,13 +2878,13 @@ loc_BAA9:
    R0 = (uint8_t)(MEM8[0xF9C2]); /* BAAB; MOV:G.B @H'F9C2, R0; refs ram_F9C2; cycles=6 */
    R0 = zero_extend8(R0); /* BAAF; EXTU.B R0; cycles=3 */
    R0 = (uint8_t)(MEM8[R0 - 0x07A8]); /* BAB1; MOV:G.B @(-H'07A8,R0), R0; cycles=6 */
-    SCI1_TDR = (uint8_t)(R0); /* BAB5; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; refs SCI1_TDR; cycles=6 */
+    SCI1_TDR = (uint8_t)(R0); /* BAB5; MOV:G.B R0, @SCI1_TDR; SCI1_TDR; write RS232/SCI byte to SCI1 TDR for transmission; SCI1 TDR write transmits on traced RS232/MAX202 path: H8 pin 66 P95/TXD -> MAX202 pin 11; refs SCI1_TDR; cycles=6 */
    R0 = (uint16_t)(MEM16[R7++]); /* BAB9; MOV:G.W @R7+, R0; cycles=6 */
-    SCI1_SSR &= ~BIT(7); /* BABB; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; refs SCI1_SSR; cycles=8 */
+    SCI1_SSR &= ~BIT(7); /* BABB; BCLR.B #7, @SCI1_SSR; clear TDRE (bit 7) of SCI1_SSR; clear SCI1 transmit data register empty flag (TDRE); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
    MEM8[0xF9C2] += (uint8_t)(1); /* BABF; ADD:Q.B #1, @H'F9C2; refs ram_F9C2; cycles=8 */
    set_flags_cmp8(MEM8[0xF9C2], 0x06); /* BAC3; CMP:G.B #H'06, @H'F9C2; refs ram_F9C2; cycles=6 */
    if (!Z) goto loc_BAF1; /* BAC8; BNE loc_BAF1; cycles=3/7 nt/t */
-    SCI1_SCR &= ~BIT(7); /* BACA; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; refs SCI1_SCR; cycles=9 */
+    SCI1_SCR &= ~BIT(7); /* BACA; BCLR.B #7, @SCI1_SCR; clear TIE (bit 7) of SCI1_SCR; disable SCI1 TX interrupt (TIE); SCI1 SCR write TE=1 RE=1; TE/RE select the traced RS232/MAX202 pins (P95/TXD pin 66 to MAX202 pin 11, P96/RXD pin 67 to MAX202 pin 12); refs SCI1_SCR; cycles=9 */
    set_flags_btst(MEM8[0xF795], 6); /* BACE; BTST.B #6, @H'F795; refs ram_F795; cycles=7 */
    if (!Z) goto loc_BAE8; /* BAD2; BNE loc_BAE8; cycles=3/7 nt/t */
    set_flags_btst(MEM8[0xF791], 7); /* BAD4; BTST.B #7, @H'F791; refs ram_F791; cycles=7 */
@@ -2945,17 +2945,17 @@ void vec_sci1_eri_BB57(void)
 {
    /* vector sources: sci1_eri */
    MEM8[0xFAA4] |= BIT(7); /* BB57; BSET.B #7, @H'FAA4; refs ram_FAA4; cycles=8 */
-    SCI1_SSR &= ~BIT(5); /* BB5B; BCLR.B #5, @SCI1_SSR; clear ORER (bit 5) of SCI1_SSR; refs SCI1_SSR; cycles=8 */
-    SCI1_SSR &= ~BIT(4); /* BB5F; BCLR.B #4, @SCI1_SSR; clear FER (bit 4) of SCI1_SSR; refs SCI1_SSR; cycles=8 */
-    SCI1_SSR &= ~BIT(3); /* BB63; BCLR.B #3, @SCI1_SSR; clear PER (bit 3) of SCI1_SSR; refs SCI1_SSR; cycles=8 */
+    SCI1_SSR &= ~BIT(5); /* BB5B; BCLR.B #5, @SCI1_SSR; clear ORER (bit 5) of SCI1_SSR; clear SCI1 overrun error flag (ORER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    SCI1_SSR &= ~BIT(4); /* BB5F; BCLR.B #4, @SCI1_SSR; clear FER (bit 4) of SCI1_SSR; clear SCI1 framing error flag (FER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    SCI1_SSR &= ~BIT(3); /* BB63; BCLR.B #3, @SCI1_SSR; clear PER (bit 3) of SCI1_SSR; clear SCI1 parity error flag (PER); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
 }

 void vec_sci1_rxi_BB67(void)
 {
    /* vector sources: sci1_rxi */
    push_registers(R0, R1); /* BB67; STM.W {R0,R1}, @-SP; cycles=12 */
-    SCI1_SSR &= ~BIT(6); /* BB69; BCLR.B #6, @SCI1_SSR; clear RDRF (bit 6) of SCI1_SSR; refs SCI1_SSR; cycles=8 */
-    R0 = (uint8_t)(SCI1_RDR); /* BB6D; MOV:G.B @SCI1_RDR, R0; refs SCI1_RDR; cycles=6 */
+    SCI1_SSR &= ~BIT(6); /* BB69; BCLR.B #6, @SCI1_SSR; clear RDRF (bit 6) of SCI1_SSR; clear SCI1 receive-data-full flag (RDRF); SCI1 SSR status for traced RS232/MAX202 path; TDRE/RDRF/error flags gate TDR/RDR use; refs SCI1_SSR; cycles=8 */
+    R0 = (uint8_t)(SCI1_RDR); /* BB6D; MOV:G.B @SCI1_RDR, R0; read SCI1 received byte from RDR; SCI1 RDR read receives from traced RS232/MAX202 path: MAX202 pin 12 -> H8 pin 67 P96/RXD; refs SCI1_RDR; cycles=6 */
    set_flags_tst8(MEM8[0xF9C1]); /* BB71; TST.B @H'F9C1; refs ram_F9C1; cycles=6 */
    if (!Z) goto loc_BB7D; /* BB75; BNE loc_BB7D; cycles=3/8 nt/t */
    MEM8[0xF9C3] = 0; /* BB77; CLR.B @H'F9C3; refs ram_F9C3; cycles=8 */
--- a/h8536/board_profile.py
+++ b/h8536/board_profile.py
@@ -207,6 +207,29 @@ def board_metadata_for_instruction(
    return metadata if isinstance(metadata, dict) else None


+def board_json_payload(analysis: Mapping[str, object] | None) -> dict[str, object]:
+    if not analysis:
+        return {
+            "board": None,
+            "name": None,
+            "summary": None,
+            "manual_references": [],
+            "traces": [],
+            "channels": {},
+            "instructions": {},
+        }
+    return {
+        "board": analysis.get("board"),
+        "name": analysis.get("name"),
+        "summary": analysis.get("summary"),
+        "manual_references": analysis.get("manual_references", []),
+        "traces": analysis.get("traces", []),
+        "channels": analysis.get("channels", {}),
+        "instructions": analysis.get("instructions", {}),
+        "state": analysis.get("state", {}),
+    }
+
+
 def _initial_channel_payload(profile: Mapping[str, object]) -> dict[str, dict[str, object]]:
    traces = [dict(trace) for trace in profile["traces"] if isinstance(trace, Mapping)]
    return {
--- a/h8536/cli.py
+++ b/h8536/cli.py
@@ -4,6 +4,7 @@ import argparse
 from pathlib import Path

 from .analysis import build_call_graph, collect_labels, linear_sweep, trace
+from .board_profile import analyze_board_profile
 from .cycles import annotate_cycles
 from .data_analysis import analyze_unreached_data
 from .dataflow import analyze_dataflow
@@ -16,6 +17,7 @@ from .peripheral_access import analyze_peripheral_access
 from .render import format_callgraph_dot, format_listing, write_json
 from .rom import Rom
 from .sci import analyze_sci
+from .sci_protocol import analyze_sci_protocol
 from .symbols import discover_symbols
 from .timing import summarize_timing
 from .vectors import read_dtc_vectors_max, read_dtc_vectors_min, read_vectors_max, read_vectors_min
@@ -40,6 +42,12 @@ def main() -> int:
    parser.add_argument("--entry", type=parse_int, action="append", default=[], help="extra entry point to trace")
    parser.add_argument("--br", type=parse_int, default=None, help="optional BR value for @aa:8 short absolute operands")
    parser.add_argument("--clock-hz", type=parse_int, default=None, help="oscillator clock in Hz for SCI baud inference")
+    parser.add_argument(
+        "--board-profile",
+        choices=("sony_rcp_tx7", "none"),
+        default="sony_rcp_tx7",
+        help="emit board-specific annotations for known physical traces",
+    )
    parser.add_argument("--linear", action="store_true", help="linear-sweep the selected range instead of tracing from vectors")
    parser.add_argument("--cycles", action="store_true", help="append Appendix A cycle estimates to assembly comments")
    parser.add_argument("--timing", action="store_true", help="include straight-line block and loop cycle summaries")
@@ -81,6 +89,12 @@ def main() -> int:
    symbols = discover_symbols(instructions, data_candidates=data_candidates)
    timing_summary = summarize_timing(instructions, labels, call_graph) if args.timing else None
    sci_analysis = analyze_sci(instructions, clock_hz=args.clock_hz)
+    sci_protocol = analyze_sci_protocol(instructions)
+    board_profile = (
+        None
+        if args.board_profile == "none"
+        else analyze_board_profile(instructions, board=args.board_profile)
+    )
    peripheral_access = analyze_peripheral_access(instructions)
    indirect_flow = analyze_indirect_flow(rom, instructions, labels)
    lcd_text = analyze_lcd_text(rom, instructions, start=args.start, end=end)
@@ -101,6 +115,8 @@ def main() -> int:
            timing_summary=timing_summary,
            show_cycles=args.cycles,
            sci_analysis=sci_analysis,
+            sci_protocol=sci_protocol,
+            board_profile=board_profile,
            peripheral_access=peripheral_access,
            indirect_flow=indirect_flow,
            dataflow=dataflow,
@@ -122,6 +138,8 @@ def main() -> int:
            call_graph=call_graph,
            timing_summary=timing_summary,
            sci_analysis=sci_analysis,
+            sci_protocol=sci_protocol,
+            board_profile=board_profile,
            peripheral_access=peripheral_access,
            indirect_flow=indirect_flow,
            dataflow=dataflow,
--- a/h8536/pseudocode.py
+++ b/h8536/pseudocode.py
@@ -900,6 +900,14 @@ def _metadata_comments(ins: JsonObject) -> list[str]:
            if isinstance(inference, dict) and inference.get("comment"):
                comments.append(str(inference["comment"]))

+    for event in ins.get("sci_protocol", []):
+        if isinstance(event, dict) and event.get("comment"):
+            comments.append(str(event["comment"]))
+
+    board_profile = ins.get("board_profile")
+    if isinstance(board_profile, dict) and board_profile.get("comment"):
+        comments.append(str(board_profile["comment"]))
+
    indirect = ins.get("indirect_flow")
    if isinstance(indirect, dict) and indirect.get("summary"):
        comments.append(str(indirect["summary"]))
--- a/h8536/render.py
+++ b/h8536/render.py
@@ -3,6 +3,7 @@ from __future__ import annotations
 import json
 from pathlib import Path

+from .board_profile import board_comment_for_instruction, board_json_payload, board_metadata_for_instruction
 from .cycles import cycle_comment
 from .dataflow import state_for_instruction
 from .dtc import DtcEndpointInfo, DtcRegisterInfo
@@ -19,6 +20,11 @@ from .peripheral_access import (
 )
 from .rom import Rom
 from .sci import sci_comment_for_instruction, sci_json_payload, sci_metadata_for_instruction
+from .sci_protocol import (
+    sci_protocol_comment_for_instruction,
+    sci_protocol_json_payload,
+    sci_protocol_metadata_for_instruction,
+)
 from .symbols import symbol_for_address
 from .tables import IO_REGISTERS
 from .timing import format_timing_summary
@@ -217,6 +223,31 @@ def _lcd_driver_lines(lcd_driver: dict[str, object] | None) -> list[str]:
    return lines


+def _board_profile_lines(board_profile: dict[str, object] | None) -> list[str]:
+    if not board_profile:
+        return []
+    traces = board_profile.get("traces", [])
+    if not isinstance(traces, list) or not traces:
+        return []
+
+    lines = ["; Board Profile"]
+    summary = board_profile.get("summary")
+    if summary:
+        lines.append(f"; {summary}")
+    for trace in traces:
+        if not isinstance(trace, dict):
+            continue
+        lines.append(
+            f"; H8 pin {trace['h8_pin']} {trace['h8_pin_name']} "
+            f"({trace['signal']}) -> MAX202 pin {trace['max202_pin']}",
+        )
+    state = board_profile.get("state")
+    if isinstance(state, dict) and state.get("P9SCI2E") is False:
+        lines.append("; SCI2 pin routing is disabled by SYSCR2.P9SCI2E=0 in the observed setup.")
+    lines.append("")
+    return lines
+
+
 def format_listing(
    rom_path: Path,
    rom: Rom,
@@ -230,6 +261,8 @@ def format_listing(
    timing_summary: dict[str, list[dict[str, object]]] | None = None,
    show_cycles: bool = False,
    sci_analysis: dict[str, object] | None = None,
+    sci_protocol: dict[str, object] | None = None,
+    board_profile: dict[str, object] | None = None,
    peripheral_access: dict[str, object] | None = None,
    indirect_flow: dict[str, object] | None = None,
    dataflow: dict[str, object] | None = None,
@@ -294,6 +327,7 @@ def format_listing(
            lines.append("")

    lines.extend(_symbol_lines(symbols))
+    lines.extend(_board_profile_lines(board_profile))
    lines.extend(_lcd_text_lines(lcd_text))
    lines.extend(_lcd_driver_lines(lcd_driver))

@@ -312,6 +346,8 @@ def format_listing(
            for part in (
                ins.comment,
                sci_comment_for_instruction(sci_analysis, address),
+                sci_protocol_comment_for_instruction(sci_protocol, address),
+                board_comment_for_instruction(board_profile, address),
                peripheral_comment_for_instruction(peripheral_access, address),
                indirect_comment_for_instruction(indirect_flow, address),
                lcd_text_comment_for_instruction(lcd_text, address),
@@ -338,6 +374,8 @@ def write_json(
    call_graph: dict[str, object] | None = None,
    timing_summary: dict[str, list[dict[str, object]]] | None = None,
    sci_analysis: dict[str, object] | None = None,
+    sci_protocol: dict[str, object] | None = None,
+    board_profile: dict[str, object] | None = None,
    peripheral_access: dict[str, object] | None = None,
    indirect_flow: dict[str, object] | None = None,
    dataflow: dict[str, object] | None = None,
@@ -365,6 +403,8 @@ def write_json(
        "call_graph": call_graph or {"nodes": [], "edges": []},
        "timing_summary": timing_summary or {"blocks": [], "loops": []},
        "sci": sci_json_payload(sci_analysis),
+        "sci_protocol": sci_protocol_json_payload(sci_protocol),
+        "board_profile": board_json_payload(board_profile),
        "peripheral_access": peripheral_json_payload(peripheral_access),
        "indirect_flow": indirect_flow or {"sites": []},
        "dataflow": _dataflow_json_payload(dataflow),
@@ -372,7 +412,18 @@ def write_json(
        "lcd_text": lcd_text or {"strings": [], "regions": [], "searches": []},
        "lcd_driver": lcd_driver or {"accesses": [], "polling_loops": [], "routines": []},
        "instructions": [
-            _instruction_payload(ins, sci_analysis, peripheral_access, indirect_flow, dataflow, symbols, lcd_text, lcd_driver)
+            _instruction_payload(
+                ins,
+                sci_analysis,
+                sci_protocol,
+                board_profile,
+                peripheral_access,
+                indirect_flow,
+                dataflow,
+                symbols,
+                lcd_text,
+                lcd_driver,
+            )
            for ins in (instructions[addr] for addr in sorted(instructions))
        ],
    }
@@ -425,6 +476,8 @@ def _dataflow_instruction_payload(dataflow: dict[str, object] | None, address: i
 def _instruction_payload(
    ins: Instruction,
    sci_analysis: dict[str, object] | None = None,
+    sci_protocol: dict[str, object] | None = None,
+    board_profile: dict[str, object] | None = None,
    peripheral_access: dict[str, object] | None = None,
    indirect_flow: dict[str, object] | None = None,
    dataflow: dict[str, object] | None = None,
@@ -458,6 +511,12 @@ def _instruction_payload(
    sci_metadata = sci_metadata_for_instruction(sci_analysis, ins.address)
    if sci_metadata:
        payload["sci"] = sci_metadata
+    sci_protocol_metadata = sci_protocol_metadata_for_instruction(sci_protocol, ins.address)
+    if sci_protocol_metadata:
+        payload["sci_protocol"] = sci_protocol_metadata
+    board_metadata = board_metadata_for_instruction(board_profile, ins.address)
+    if board_metadata:
+        payload["board_profile"] = board_metadata
    peripheral_metadata = peripheral_metadata_for_instruction(peripheral_access, ins.address)
    if peripheral_metadata:
        payload["peripheral_access"] = peripheral_metadata
--- a/tests/test_board_profile.py
+++ b/tests/test_board_profile.py
@@ -1,7 +1,7 @@
 import json
 import unittest

-from h8536.board_profile import analyze_board_profile, board_comment_for_instruction
+from h8536.board_profile import analyze_board_profile, board_comment_for_instruction, board_json_payload
 from h8536.model import Instruction


@@ -21,6 +21,7 @@ class BoardProfileTest(unittest.TestCase):
        self.assertEqual(traces[0]["max202_pin"], 11)
        self.assertEqual(traces[1]["h8_pin"], 67)
        self.assertEqual(traces[1]["max202_pin"], 12)
+        self.assertEqual(board_json_payload(analysis)["board"], "sony_rcp_tx7")
        json.dumps(analysis)

    def test_sci1_init_and_scr_comments_identify_rs232_max202_path(self):
--- a/tests/test_board_sci_integration.py
+++ b/tests/test_board_sci_integration.py
@@ -0,0 +1,80 @@
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from h8536.board_profile import analyze_board_profile
+from h8536.model import Instruction
+from h8536.pseudocode import PseudocodeOptions, generate_pseudocode
+from h8536.render import format_listing, write_json
+from h8536.rom import Rom
+from h8536.sci_protocol import analyze_sci_protocol
+
+
+class BoardSciIntegrationTest(unittest.TestCase):
+    def test_listing_json_and_pseudocode_include_rs232_path_comments(self):
+        instructions = {
+            0x1000: Instruction(
+                0x1000,
+                b"\x15\xFE\xDA\x06\x3C",
+                "MOV:G.B",
+                "#H'3C, @SCI1_SCR",
+                references=[0xFEDA],
+                comment="SCI1_SCR = H'3C",
+            ),
+            0x1005: Instruction(
+                0x1005,
+                b"\x15\xFE\xDB\x90",
+                "MOV:G.B",
+                "R0, @SCI1_TDR",
+                references=[0xFEDB],
+            ),
+            0x1009: Instruction(
+                0x1009,
+                b"\x15\xFE\xDD\x80",
+                "MOV:G.B",
+                "@SCI1_RDR, R0",
+                references=[0xFEDD],
+            ),
+        }
+        sci_protocol = analyze_sci_protocol(instructions)
+        board_profile = analyze_board_profile(instructions)
+
+        listing = format_listing(
+            Path("rom.bin"),
+            Rom(b"\xFF" * 0x20),
+            instructions,
+            {},
+            {},
+            "min",
+            traced=False,
+            sci_protocol=sci_protocol,
+            board_profile=board_profile,
+        )
+
+        self.assertIn("; Board Profile", listing)
+        self.assertIn("H8 pin 66 P95/TXD", listing)
+        self.assertIn("write RS232/SCI byte to SCI1 TDR", listing)
+        self.assertIn("MAX202 pin 12 -> H8 pin 67 P96/RXD", listing)
+
+        with tempfile.TemporaryDirectory() as tmp:
+            path = Path(tmp) / "out.json"
+            write_json(path, instructions, {}, {}, sci_protocol=sci_protocol, board_profile=board_profile)
+            payload = json.loads(path.read_text(encoding="utf-8"))
+
+        self.assertEqual(payload["board_profile"]["board"], "sony_rcp_tx7")
+        self.assertEqual(payload["board_profile"]["traces"][0]["max202_pin"], 11)
+        tdr_instruction = next(item for item in payload["instructions"] if item["address"] == 0x1005)
+        self.assertEqual(tdr_instruction["sci_protocol"][0]["action"], "write_tdr")
+        self.assertIn("board_profile", tdr_instruction)
+
+        pseudocode = generate_pseudocode(
+            payload,
+            options=PseudocodeOptions(include_addresses=False, include_asm=False, structured=False),
+        )
+        self.assertIn("write RS232/SCI byte to SCI1 TDR", pseudocode)
+        self.assertIn("H8 pin 66 P95/TXD -> MAX202 pin 11", pseudocode)
+
+
+if __name__ == "__main__":
+    unittest.main()