176 lines
6.4 KiB
Markdown
176 lines
6.4 KiB
Markdown
# PT2 KNEE ROM Trace
|
|
|
|
Date: 2026-05-26
|
|
|
|
## Short Version
|
|
|
|
KNEE is not a simple held selector bit. The ROM has a dedicated local panel-input handler at `loc_1795`, reached when the panel input word at `F104` changes. That handler uses CCU-side selector state as gates, then either shows a short timed KNEE page or reports a KNEE value change on selector `0x00BC`.
|
|
|
|
This explains the bench pattern where KNEE AUTO can light or flash and then clear even while serial traffic remains healthy: one ROM path is a timed display/page override, not a maintained lamp value.
|
|
|
|
## Input Path
|
|
|
|
The local panel path is:
|
|
|
|
```text
|
|
F104 changes -> F692 updated -> F6F0.1 set -> main dispatcher calls loc_1795
|
|
```
|
|
|
|
The important code anchors are:
|
|
|
|
```text
|
|
3B33 MOV:G.W @H'F104, R0
|
|
3B37 CMP:G.W @H'F692, R0
|
|
3B3D BSET.B #1, @H'F6F0
|
|
3B41 MOV:G.W R0, @H'F692
|
|
|
|
1630 BCLR.B #1, @H'F6F0
|
|
1636 JSR @loc_1795
|
|
```
|
|
|
|
So serial writes can prepare the state table, but the main KNEE control branch appears to require the panel-side input lane to change.
|
|
|
|
## Handler Decision Table
|
|
|
|
`loc_1795` reads two words from the primary selector table:
|
|
|
|
| ROM read | Selector meaning |
|
|
| --- | --- |
|
|
| `@H'E172` | `E000[0x00B9]` |
|
|
| `@H'E220` | `E000[0x0110]` |
|
|
|
|
The branch is:
|
|
|
|
```text
|
|
1795 if F731 > 2: skip
|
|
179C if E000[0x00B9].13 == 0: loc_2127()
|
|
17A7 else if E000[0x0110].15 == 1: loc_2127()
|
|
17B2 else:
|
|
delta = F692 - F6B2
|
|
report/update selector 0x00BC via loc_19A2
|
|
17C0 F6B2 = F692
|
|
```
|
|
|
|
Practical interpretation:
|
|
|
|
| Condition | ROM effect | Current meaning |
|
|
| --- | --- | --- |
|
|
| `0x00B9.13 = 0` | timed KNEE page via `loc_2127` | KNEE value reporting not enabled |
|
|
| `0x00B9.13 = 1`, `0x0110.15 = 1` | timed KNEE page via `loc_2127` | override/inhibit mode |
|
|
| `0x00B9.13 = 1`, `0x0110.15 = 0` | value delta reported as selector `0x00BC` | likely live KNEE control/report lane |
|
|
|
|
This downgrades the earlier bench label that treated `0x00B9.15` as the main KNEE gate. The ROM gate for the panel-input handler is `0x00B9.13`.
|
|
|
|
## Timed KNEE Page
|
|
|
|
`loc_2127` is the timed page path:
|
|
|
|
```text
|
|
2127 set FB03.7
|
|
212D save old F732 into F734, if this is a fresh override
|
|
2135 F732 = 0x1C03
|
|
213B FB02 = 0x14
|
|
2140 call loc_48FA
|
|
```
|
|
|
|
The timer path later decrements `FB02`; when it expires, `loc_48EF` restores `F732` from `F734` and redraws. That is the likely cause of "lights, then falls away" observations.
|
|
|
|
The LCD dispatcher confirms `F732=0x1C03` is a KNEE page:
|
|
|
|
```text
|
|
493E[0x1C] -> 0x92CC
|
|
0x92DE[3] -> 0x95CE
|
|
0x960B prints "KNEE"
|
|
```
|
|
|
|
On that KNEE page, the second line is selected like this:
|
|
|
|
```text
|
|
if E000[0x0110].15: "DL"
|
|
else if E000[0x00B9].15: "PRESET"
|
|
else: "AUTO"
|
|
```
|
|
|
|
So `0x00B9.15` still matters, but it appears to choose the KNEE page label (`PRESET` versus `AUTO`) rather than enabling the report path. `0x0110.15` selects the `DL` label and also forces the timed page path from `loc_1795`.
|
|
|
|
## Bench Implications
|
|
|
|
Useful frames to test this model:
|
|
|
|
| Purpose | Frame |
|
|
| --- | --- |
|
|
| clear `0x00B9` | `00 01 39 00 00 62` |
|
|
| set `0x00B9.13` gate | `00 01 39 20 00 42` |
|
|
| set `0x00B9.15` label bit | `00 01 39 80 00 E2` |
|
|
| set `0x00B9.15` and `.13` | `00 01 39 A0 00 C2` |
|
|
| clear `0x0110` | `00 01 90 00 00 CB` |
|
|
| set `0x0110.15` override | `00 01 90 80 00 4B` |
|
|
| read `0x00BC` | `01 01 3C 00 00 66` |
|
|
|
|
The most direct live-control test is:
|
|
|
|
1. Reach `CONNECT: OK`.
|
|
2. Send `00 01 39 20 00 42` to set `0x00B9.13`.
|
|
3. Send `00 01 90 00 00 CB` to clear `0x0110.15`.
|
|
4. Move or exercise the physical KNEE-related control, if available.
|
|
5. Watch for TX/report traffic around selector `0x00BC`.
|
|
|
|
If no physical KNEE input is moved, the ROM may not enter `loc_1795`, because the trigger is the `F104` panel input change path rather than the serial write itself.
|
|
|
|
## Bench Observation: DTL / KNEE
|
|
|
|
The first `knee-rom-gate-and-value-probe` bench run produced a new LCD state with `DTL` on the left and `KNEE` on the right. That is an important confirmation: page `0x1C` contains both a KNEE entry and a DETAIL entry.
|
|
|
|
Relevant ROM text and page entries:
|
|
|
|
```text
|
|
0x92DE[3] -> 0x95CE KNEE page entry
|
|
0x92DE[7] -> 0x97C8 DETAIL page entry
|
|
0x960B prints "KNEE"
|
|
0x9805 prints "DETAIL"
|
|
```
|
|
|
|
The bench display probably shows the page-0x1C menu neighborhood, with DETAIL abbreviated as `DTL` and KNEE as the selected/right-side item. The log does not encode LCD pixels, but the serial timing around the observation is consistent with the KNEE probe:
|
|
|
|
```text
|
|
00 01 39 20 00 42 ; set 0x00B9.13 gate
|
|
00 01 39 A0 00 C2 ; set 0x00B9.15 + 0x00B9.13
|
|
00 01 90 80 00 4B ; set 0x0110.15 timed KNEE/DL override
|
|
```
|
|
|
|
Next isolation target: determine whether `DTL/KNEE` appears from `0x00B9.13`, `0x00B9.A0`, `0x0110.15`, or only the combined sequence.
|
|
|
|
## Panel Correlation
|
|
|
|
The physical panel has both DETAIL and KNEE buttons near the LCD. That matches the ROM page-`0x1C` neighborhood and makes the observed `DTL/KNEE` state likely to be a local menu/button context rather than a generic lamp status.
|
|
|
|
Practical implication: once the CCU-side selector gates are prepared, pressing the physical DETAIL/KNEE buttons may be the missing `F104` panel-input transition that calls `loc_1795`. If so, the useful evidence should be:
|
|
|
|
- visible LCD movement between DETAIL and KNEE entries,
|
|
- possible KNEE timed page redraws,
|
|
- TX/report traffic for selector `0x00BC` when KNEE input movement is accepted,
|
|
- or other page-`0x1C` selector reports from neighboring DETAIL/KNEE controls.
|
|
|
|
## Follow-Up: Lamp Without LCD Movement
|
|
|
|
The follow-up run after discovering the DETAIL/KNEE buttons did not reproduce an LCD page change. The observed result was:
|
|
|
|
- only the later KNEE cases/windows illuminated the KNEE AUTO lamp,
|
|
- none of those cases changed the LCD.
|
|
|
|
Current interpretation:
|
|
|
|
- `0x0110.15` is still the strongest KNEE AUTO lamp/status source.
|
|
- Serial table writes can light KNEE AUTO without necessarily entering the LCD DETAIL/KNEE page.
|
|
- The LCD path probably needs an additional local-display/menu condition, not just the CCU-side selector bits.
|
|
- The physical DETAIL/KNEE buttons may be scanned by the local panel path, but in this test they did not create a visible LCD transition or new serial report evidence.
|
|
|
|
This separates two related but distinct paths:
|
|
|
|
```text
|
|
KNEE AUTO lamp/status: mostly selector/table driven, strongest source 0x0110.15
|
|
DETAIL/KNEE LCD page: local page/menu context, likely page 0x1C plus panel/menu state
|
|
```
|
|
|
|
Next ROM target: trace the DETAIL and KNEE button scan bits through the page-`0x1C` menu dispatcher, not just the `loc_1795` KNEE value handler.
|