Hardware docs: board photos, schematic scan, GAL fuse dump

Organize the restoration source material under docs/hardware/:
- 9 board photos (renamed from Signal timestamps, index in README)
- Scans_018-014.pdf: 7-sheet VWE schematic set (RIO_1407 CPU/power/IO,
  PBE_1401 buttons, KEY_1402 keypad, DSP_1408 display, AMP_PLT 1413 amp)
- GAL20v8a_5764.JED: fuse map of the 1407's U7 memory decoder

README documents the board family, the 68HC11 memory map decode path,
the pod-bus signal set and jumper addressing, and cross-links PROTOCOL.md
and rio-firmware/.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,152 @@
+# RIO cockpit hardware — boards, schematics, GAL dump
+
+Physical documentation of the VWE Tesla-cockpit **RIO** (Remote Input/Output)
+board set, gathered during the 2026 restoration: board photos (Signal,
+2026-07-15), a scan of the original paper wire schematics, and the fuse map
+read out of the RIO board's GAL address decoder.
+
+All boards are **Copyright 1994 V.W.E. Inc.** — the schematic title blocks
+spell it out: **Virtual World Entertainment, 1100 W Cermak Suite B404,
+Chicago, Illinois**, every sheet and silkscreen credited **"Design by M.C."**
+Schematic plots are dated 1/11/1996 (peripheral boards) and 6/26/1996 (RIO
+board), so these drawings post-date the Rev. 0/1 boards they describe.
+
+## Board family
+
+| P/N | Title | Rev photographed | Key silicon |
+|-----|-------|------------------|-------------|
+| **1407** | RIO board ("CPU board") | Rev. 3 | Toshiba **TMP68HC11** @ 8 MHz, GAL20V8A decoder, 27C512 EPROM, LH52B256 32K SRAM, 5× HCTL-2016 |
+| **1401** | Buttons board | Rev. 0 | 2× UCN5821A lamp drivers, 2× 74HCT165, 74HCT164, 74LS00/05 |
+| **1402** | Keypad board | Rev. 1 | 2× 74HCT164, CD74HCT165, 74LS00/05 |
+| **1408** | Display board ("RIO external display") | Rev. 1 | Intersil **ICM7228B** 8-digit driver, 8× LTS313A 7-segment |
+| **1413** | Amplifier board | *(schematic only, not photographed)* | 4-channel speaker filter/check board, 12 VDC 5 A |
+
+Plus the cockpit position sensors: **HP HEDS-5700** two-channel quadrature
+optical encoders (option code **I** = 512 counts/rev; the photographed unit is
+date-coded 9515, Singapore), one per analog axis, read by the five HCTL-2016
+counters on the RIO board (`OPT1`–`OPT5` = stick X/Y, throttle, left/right
+pedals).
+
+## RIO board 1407 (schematic sheets 1–3, `RIO_1407`)
+
+**Sheet 1 — CPU : Memory Decoder.** The TMP68HC11 runs in expanded
+multiplexed mode: a 74HCT573 latches A[0:7] off the AD bus, and **U7 — drawn
+as a 20L8, fitted as a GAL20V8A-15LP** — decodes A[8:15] into `ROM_SEL*`
+(27C512 EPROM, U10), `RAM_SEL*` (LH52B256-70LL 32K SRAM, U11), `PH_SEL*`
+(HCTL-2016 bank via two 74LS138s), `DSP_SEL*` (external display port) and
+`BND_SEL` (I/O-interface latch, sheet 3). Each HCTL-2016 feeds a 5-pin
+header (`J4`–`J8`) carrying CHA/CHB from a HEDS-5700. The DB9 COM port goes
+through a MAX231/MAX232-class level shifter; the schematic's `IN_RESET*` from
+the serial side is the hardware behind the **DTR reset pulse** described in
+[PROTOCOL.md](../PROTOCOL.md) §1. The "display interface" block (ALS541
+buffers, HEADER14) exports latched data lines `HD[00:04]` + digit address
+`AS0-2` to the display board — this is a memory-mapped port, *not* the pod
+bus. A 22V10 site (U31) is drawn mostly N/C and is **unpopulated** on the
+photographed board.
+
+**Sheet 2 — Power & Reset Interface.** A MAX690 supervisor provides
+power-fail reset and a **watchdog (WDI)**; reset can also come from the
+front-panel `RESET` toggle (SW1) or remotely through an **H11L1 optocoupler**
+fed from an isolated 3-pin `+5 VDC` input (J8) — the game PC can hard-reset
+the board. The `ABORT` toggle (SW2) pulls the HC11 `IRQ*`. A 74LS241 drives
+the status LED bank: `POWER ON`, `FAULT`, `RESET`, `RUN`, `TX`, `RX`. Power
+enters on J9 through 5 A/10 A fuses, LC filters and 1N5341B clamp zeners,
+producing separate logic `VCC` and peripheral `VCC_EXT` rails.
+
+**Sheet 3 — I/O Interface ("pod bus").** Eight identical 16-pin IDC ports
+(`J11`–`J18`) fan out through ALS541 buffers and SIP resistor packs. All
+ports share the outbound signals; each port has its own return line
+(`DI[0..7]`, selected by a 74LS138 from `SEL0-2`) and its own buffered
+brightness line (`BRT_CTR0-7`, all copies of one PWM signal). A 74HC574
+latch written via `BND_SEL` holds the bus control bits (`SEL0-2`, `RD_SB`,
+`WR_SB`, `D_OUT`, `CCK`) — so the firmware bit-bangs the bus by rewriting
+this latch.
+
+### Pod bus signal set (per port)
+
+| Signal | Direction | Purpose |
+|--------|-----------|---------|
+| `CCK` | RIO → pod | shift clock |
+| `DD_IN` | RIO → pod | serial data into the pod's 74HCT164s (address select + payload) |
+| `WR_SB` | RIO → pod | write strobe (latch lamp/display data) |
+| `RD_SB` | RIO → pod | read strobe (parallel-load the pod's 74HCT165) |
+| `DD_OUT` | pod → RIO | serial readback, **open-collector 74LS05** so pods can share a cable |
+| `BRT_CTR` | RIO → pod | global lamp-brightness PWM, gates the UCN5821A output enable |
+| `VCC_EXT`, GND | — | peripheral power rail |
+
+Every pod board carries a 74HCT164 whose parallel outputs go to an
+**`ADR. SEL.` jumper block (`A-0`…`A-7`)**: the RIO shifts an address
+pattern down the cable, the jumper picks which bit this board answers to,
+and 74LS00 gates qualify `RD_SB`/`WR_SB` with that selection. This
+hardware addressing is what the 0x00–0x6F logical input map in
+[PROTOCOL.md](../PROTOCOL.md) ultimately resolves to.
+
+## Peripheral boards
+
+- **1401 Buttons board** (`PBE_1401`) — eight 4-pin connectors (`J3`–`J10`),
+  pinout `1 = buttons GND, 2 = button in, 3 = lamps +5V, 4 = lamps logic GND`.
+  Two UCN5821A serial-in latched sink drivers light the button lamps
+  (brightness = `BRT_CTR` PWM on their OE), two 74HCT165s read the buttons
+  back, one of them also echoing board status/address.
+- **1402 Keypad board** (`KEY_1402`) — hosts the COTS 16-key hex pad (0–F)
+  on an 8-line header (4×4 matrix). A second 74HCT164 drives the matrix
+  rows through open-collector 74LS05 inverters; the 74HCT165 reads the four
+  columns (`IN0-3`, 2.7K pull-ups) plus a board-detect line `BRD_DT*`.
+- **1408 Display board** (`DSP_1408`) — ICM7228B decoding `HD[00:04]` +
+  `AS0-2` + `WR` from the RIO's dedicated 14-pin *external display* port into
+  eight LTS313A digits (hex/code-B). The board also has a 26-pin **"IBM
+  printer port"** header with series resistors and per-line LEDs — a
+  diagnostic tap so a PC parallel port can exercise/observe the display bus.
+  Silkscreen reads "P/N 140B" but the schematic title block confirms **1408**.
+- **1413 Amplifier board** (`AMP_PLT`) — four channels (front/back ×
+  left/right): LC crossover filtering (820 µH/180 µH), 4 Ω 5 W loads, 6-pin
+  woofer/midrange/tweeter speaker connectors, a 12 VDC 5 A supply input, and
+  a green/red "speaker outputs checking circuit" per channel.
+
+## GAL dump — [`gal/GAL20v8a_5764.JED`](gal/GAL20v8a_5764.JED)
+
+Fuse map read 2023-03-09 from **U7 on the 1407 board** (GAL20V8A-15LP,
+hand-labeled **"5764"** — which matches the JEDEC fuse checksum `*C5764`, the
+source of the file name). Per sheet 1 it is the CPU **memory decoder**
+(drawn as a 20L8). Follow-up: run the JED through `jedutil`/`galette` to
+recover the boolean equations and cross-check the decoded memory map against
+the firmware disassembly in [`rio-firmware/`](../../rio-firmware/).
+
+## Schematic scan — [`schematics/Scans_018-014.pdf`](schematics/Scans_018-014.pdf)
+
+| PDF page | Sheet | Title block |
+|----------|-------|-------------|
+| 1 | RIO_1407 sheet 1/3 | CPU : Memory Decoder |
+| 2 | RIO_1407 sheet 2/3 | Power & Reset Interface |
+| 3 | RIO_1407 sheet 3/3 | I/O Interface |
+| 4 | PBE_1401 1/1 | Buttons Board |
+| 5 | AMP_PLT (P/N 1413) 1/1 | Amplifier Board |
+| 6 | KEY_1402 1/1 | Keypad Board |
+| 7 | DSP_1408 1/1 | Display Board |
+
+## Photo index ([`photos/`](photos/))
+
+Original Signal filenames preserved here for provenance (all taken
+2026-07-15).
+
+| File | Original | Shows |
+|------|----------|-------|
+| `encoder-heds5700-control-assembly.jpeg` | `signal-2026-07-15-093011.jpeg` | HP HEDS-5700 I02 encoder (9515 A, Singapore) on a control-mechanism shaft |
+| `display-board-1408-front-digits.jpeg` | `signal-2026-07-15-093017.jpeg` | Display board digit side, 8× LTS313A (U2–U9), PCB etch NT 1-0 5094 |
+| `display-board-1408-back-driver.jpeg` | `signal-2026-07-15-093023.jpeg` | Display board driver side: ICM7228BIPI (date 9438), 16-pin IDC, "RIO EXTERNAL DISPLAY / P/N 140B REV. 1" |
+| `keypad-1402-front-keys.jpeg` | `signal-2026-07-15-093032.jpeg` | 16-key hex keypad module (keys 0–F), front bezel |
+| `keypad-board-1402-back-logic.jpeg` | `signal-2026-07-15-093038.jpeg` | Keypad board logic: DM74LS00N, 2× MM74HCT164N, SN74LS05N, CD74HCT165E, ADR. SEL. jumpers, "P/N 1402 REV. 1" |
+| `buttons-board-1401-solder-side.jpeg` | `signal-2026-07-15-093045.jpeg` | Buttons board solder side, PCB etch NT 1-0 3695 |
+| `buttons-board-1401-component-side.jpeg` | `signal-2026-07-15-093051.jpeg` | Buttons board: 2× CD74HCT165E, 74HCT00AP, 2× UCN5821A-type drivers, 74HCT164N, 8× lamp/button connectors, "P/N 1401 REV. 0" |
+| `rio-board-1407-solder-side.jpeg` | `signal-2026-07-15-093058.jpeg` | RIO board solder side, PCB etch NT 3-0 4996 |
+| `rio-board-1407-component-side.jpeg` | `signal-2026-07-15-093105.jpeg` | RIO board: TMP68HC11 QFP, GAL20V8A ("5764" sticker), AM27C512 EPROM, LH52B256 SRAM, 5× HCTL-2016 + OPT1–5, J11–J18 pod ports, status LEDs, "P/N 1407 REV. 3" |
+
+## Cross-references
+
+- [`../PROTOCOL.md`](../PROTOCOL.md) — the 9600 8N1 wire protocol this
+  hardware speaks; its DTR reset pulse and 0x00–0x6F input map both have
+  their physical explanation above.
+- [`../../rio-firmware/`](../../rio-firmware/) — v4.2 EPROM dump (from the
+  AM27C512 at U10) and 68HC11 disassembly/patches.
+- [`../Win32RIO/`](../Win32RIO/) — FASA's original Windows driver for the
+  same hardware.

gal/GAL20v8a_5764.JED

@@ -0,0 +1,38 @@
+
+
+Device    :    GAL20V8A
+
+Created By:    http://www.autoelectric.cn
+
+Date      :    2023-03-09 19:02
+
+*QP24
+
+*QF2706
+
+*G0
+
+*F0
+
+*L00000 11111111111111111111111111111111
+
+*L00032 11111111111111011111111111111111
+
+*L00064 11111111110111110000000000000000
+
+*L00320 11111111111111111111111111111111
+
+*L00352 11111111111111111111111111111111
+
+*L00384 11111110111111110000000000000000
+
+*L00640 11111111111111111111111111111111
+
+*L00672 11111111100101111011101110111011
+
+*L00704 10111011101101110000000000000000
+
+*L00960 11111111111111111111111111111111
+
+*L00992 11111111111001111111111111111111
+