Import RIO board firmware from RIOjoy repo (history preserved)

Board firmware dumps, disassembly, make_patch.py, patched images
(RIO 4.3 + FastRIO), analysis, and bench testlogs — moved from the
RIOjoy repo into the Tesla cockpit restoration archive.

git-subtree-dir: restoration/rio-firmware
git-subtree-mainline: 6c0dfcf792
git-subtree-split: 4fb91775fc
This commit is contained in:
Cyd
2026-07-19 20:45:16 -05:00
38 changed files with 133109 additions and 0 deletions
+100
View File
@@ -0,0 +1,100 @@
# RIO board firmware
> **Pod owner, not an engineer?** Read
> [wedge-explained.md](wedge-explained.md) — a plain-language account of
> the "stick died mid-battle" bug that RIO 4.3 fixes.
- **`RIOv4_2.bin`** — RIO cockpit I/O board firmware **v4.2**, dumped
2026-07-04 from one of our own boards' EPROM: an **AMD AM27C512-150**
(64K x 8 UV EPROM, 150ns — the image fills it exactly).
sha256 `60a88718835c654b6135dbec7721c40ef99dca07df2ad4b57eedeb24037a5f73`.
For the eventual patched burn: a pin-compatible Winbond W27C512
(electrically erasable, TL866-friendly) drops straight into the socket;
the original AMD chip gets labeled and preserved unmodified.
## First-look analysis (from the image alone, confirmed on hardware)
- MCU: **Toshiba TMP68HC11** (read off the chip; the code fingerprint
agrees — 6800-family opcodes with writes into the 68HC11 internal
register block at `$10xx`).
- Memory map: image is FF up to **0xC000**; 16KB of code occupies
`$C000-$FFFF` (EPROM mapped at the top of the HC11 address space).
- Startup at `$C000`: `SEI; LDS #$8000; STAA $1024 (TMSK2);
STAA $1022 (TMSK1); ...` then a long `JSR` init chain — textbook HC11
bring-up.
- Vector table (`$FFD6-$FFFF`, big-endian):
- `$FFFE` RESET → `$C000`
- **`$FFD6` SCI (serial) → `$D630`** — the entry point of the board's
receive/protocol interrupt handler. The suspected board-side
DISABLE_AND_DIE-style wedge (see RIO-NOTES.md: the board mirrors the
game's PCSPAK state machine, and mash-stress leaves the reply path
dead while the button/event path stays alive) is reachable from here.
- `$FFE4` → `$C1B2`, `$FFE6` → `$C18E` (timer output-compares); most
other vectors → `$DB07..$DB3D` stubs.
## Why this exists
The remaining RIO reliability issue is board-side: under button-mash
stress the board's reply/analog state machine wedges (RX dead, TX alive;
a button press or power cycle revives it), reproduced identically on two
different USB serial adapters. The game-side half of the protocol was
binary-patched for tolerance (BTL4OPT patches v2-v4); the board firmware
is the other half. Plan (RIO-NOTES.md "Board firmware patch plan"):
disassemble as 68HC11 from `$C000` with the vector entries as roots, find
the SCI state machine (protocol constants FC=ACK FD=NAK FE=RESTART
FF=IDLE, idle-reload-4 patterns), patch the early-ACK/error wedge path or
widen its window, burn a new EPROM, keep this original safe.
## RIO 4.3 — `RIOv4_3.bin` (current production firmware)
**Christened 2026-07-19** after full on-hardware certification. Built
by `make_patch.py --e0thresh=5 --checkrepaint --reportversion=4.3
RIOv4_2.bin RIOv4_3.bin`; sha256
`6d67a2fc77130b601fdb0ac02042dd4d0a98ac7e29a8077d588987a81073939c`
(69 bytes changed vs stock). 9600 baud, native-game compatible. On the
stock v4.2 base it carries:
1. **Reply-latch wedge fix** (edits 1-2) — bench-certified.
2. **E0-display threshold, N=5** (edit 5) — certified: display holds
`F0000000` through sub-threshold error events, flips to the live
`E0` readout at the 5th teardown (`E0000105` on the bench).
3. **Check self-test display repaint** (edit 6) — certified both ways:
version+check leaves `F0000000` when healthy, and re-renders the E0
readout when counters are over threshold (`E0000305` on the bench)
instead of stock's stale `04000000`.
4. **Version bump** (edit 7, `--reportversion=4.3`) — the VersionReply
now announces **4.3** (one operand byte at `$C6FF`). Nothing
host-side validates the value (native games verified not to check
it). The certification runs below were made on the pre-edit-7 bytes;
the only delta is the version literal. Chips burned before this edit
report 4.2 — re-burn to announce 4.3.
Certification runs (all in `testlogs/` + RIOv4_2-ANALYSIS.md): two
`--e0test` acceptance passes (display verified by eye at each step) and
a 120 s mash at **549 presses/min sustained** — zero wedges, board
counters flat, zero NAK, 247 resends all healed
(`riomash-rio43rc1-9600-20260719-164901.log`).
## FastRIO 4.3 — `RIOv4_3_fastrio.bin`
Same generation for the RIOJoy-only cockpits: `make_patch.py
--baud31250 --widen-ackwait --e0thresh=5 --checkrepaint
--reportversion=4.3 RIOv4_2.bin RIOv4_3_fastrio.bin`; sha256
`ee807831fe0df9dc147eb5cdc3302672ae21f6ff349da30babea27fc863234b9`
(71 bytes vs stock — differs from `RIOv4_3.bin` in exactly two bytes:
`$D62B` baud `30→02` and `$D9E7` ACK-wait `04→28`). 31250 baud,
FTDI-class adapter required, **not** native-game compatible.
Disassembly-verified; run the acceptance ladder on the FastRIO cockpit
before deploying (`--e0test COM1` auto-probes 31250, then a mash
spot-check at `--baud 31250`).
## Archive
All prior generations live in [`archive/`](archive/) with their
disassemblies: `RIOv4_2_patched` (wedge fix only), `_31250`/`_31250v2`
(FastRIO speed builds), `_62500`/`_125000` (speed-ladder science runs),
and the `_e0t5` pair (threshold without check-repaint). Bench verdicts
and per-edit history: RIOv4_2-ANALYSIS.md. The pristine dump
`RIOv4_2.bin` stays at top level — it is the source every patch builds
from. RIO 4.3 is in the cockpit socket as of 2026-07-19; the original
AMD chip and the retired e0t5 burn are labeled and preserved.
@@ -0,0 +1,559 @@
# RIO v4.2 firmware — protocol wedge analysis
Reverse-engineering of `RIOv4_2.bin` (Toshiba TMP68HC11, AM27C512) to find
the board-side cause of the "reply path wedges under stress, button-press
revives it" fault. Disassembly by `disasm_6811.py`
`RIOv4_2.disasm.asm`. **Research only** — the fix below is proposed, not
yet burned or tested (no spare EPROM on hand). Validate on hardware with
the `RIO_TAP` mash test before trusting.
Addresses are CPU = file offset (EPROM at `$C000-$FFFF`; reset `$FFFE`
`$C000`). RAM lives at `$20xx-$31xx`.
## How the serial protocol is structured
- **SCI interrupt** (`$FFD6``$D630`): `JSR $D634; RTI`. `$D634` runs BOTH
workers every interrupt: `JSR $D6EA` (RX) then `JSR $D887` (TX). So the
transmitter is poked after every received byte, not only on TX-empty
interrupts.
- **RX ISR** `$D6EA`: reads SCSR/SCDR, stores the byte at `$3172`, then
`LDX $292F; JMP $00,X` — dispatches through a **state-handler pointer**
at `$292F`. Handlers classify bytes (`$D717`: `FE`=RESTART, `FF`=IDLE,
`FC`/`FD`=game ACK/NAK, `$82`=analog request, table lookup at `$3144`),
accumulate the body + checksum (`AND $7F`), and on a complete packet run
the ACK/NAK decision at `$D81F`.
- **TX ISR** `$D887`: if TDRE, send a pending ACK (`$316F``$FC`) or NAK
(`$3170``$FD`), else dispatch through the TX state pointer `$2D3B`
(`$D8C2` ring-drain → `$D90E` reply/retry machine). When idle it disarms
the TX interrupt (SCCR2 `#$2C`, TIE off) at `$D918`; the enqueue routine
`$D63B` re-arms it (SCCR2 `#$AC`, TIE on) at `$D664`.
## The wedge: an orphaned "reply-in-progress" latch (`$2521`)
`$2521` = "an analog reply is in progress." The analog-request handler
gates on it:
```
D74F CMPB #$82 ; analog request from the game
D753 LDAA #$01
D755 STAA $2520 ; arm reply generation
D758 TST $2521 ; already replying?
D75B BNE $D77A ; YES -> D77A: CLR $2520, drop this request
```
So while `$2521` is set, **every analog request is silently dropped**.
The latch is set when a reply is generated:
```
D847 JSR $C5EC ; build the analog reply
D84C STAA $2521 ; reply-in-progress = 1
```
and is cleared in only three places: power-on init (`$C0A3`), a host
reset/init command handler (`$C686`), and the reply **success** teardown
(`$DA00`). The success teardown is reached at `$D9C1` when the game ACKs
the reply, and clears the latch — but only conditionally:
```
DA21 LDAA $2522 ; did the $87 reply byte actually start sending?
DA24 CMPA #$01
DA26 BNE $DA2E ; if not, skip the clears <-- fragile
DA28 CLR $2521
DA2B CLR $2522
```
`$2521` is set the instant the reply is *generated* (`$D84C`), but `$2522`
is set only once the `$87` command byte *starts transmitting* (`$D8FD`).
**The leak** is the retry-exhausted give-up path, which is *separate* from
the success teardown. When the game fails to ACK a reply, `$D90E`/`$D9BE`
retries up to 4 times, then gives up:
```
D9D5 LDAB #$FE ; give up: send RESTART
D9D7 STAB $102F ; SCDR
D9DA INC $317A
D9DD JMP $DA2F ; teardown -- but DA2F never touches $2521
```
`$DA2F` resets the TX pointers and calls `$D5F2` (a debug-counter
formatter that does *not* clear the latch), then returns. **`$2521` is
left set forever.** From then on every `$82` analog request is dropped at
`$D758` → the board is mute to analog while its RX/event path stays fully
alive.
### Why a button press / new game revives it
The only mid-run code that clears `$2521` is the host command handler at
`$C669-$C689` (it clears `$2520`/`$2521`/`$2522` plus a raft of state).
That runs for a host-level reset/init command — exactly what the game
sends at game-start / on the player's opening button actions. Mid-mission
button-mashing sends no such command, so the leaked latch stays stuck
until the next game-start reset. This matches the field observation
precisely: the board goes mute under stress and only a new-game/button
resync brings analog back.
### Why mash stress triggers it
Button-event traffic floods the link while the board is mid-analog-reply;
the reply's ACKs collide/drop, the 4-retry budget exhausts, and the
give-up path (`$DA2F`) fires — leaking the latch. Light traffic rarely
exhausts the retries, so it's a stress-only fault. Two different USB
adapters showed the identical stall because the defect is in the board,
not the transport — consistent with this being firmware, not timing.
## Proposed fix (minimal, in-place; UNTESTED)
Clear `$2521` on *every* reply teardown, not just the `$2522`-gated
success path. Two edits, no code-size change, 8 KB of free ROM exists at
`$DFF0-$FFBF` for the stub:
1. **Give-up path** — redirect its teardown through a stub that clears the
latch first. At `$D9DD` change `JMP $DA2F` (`7E DA 2F`) →
`JMP $DFF0` (`7E DF F0`), and place at `$DFF0`:
```
DFF0 7F 25 21 CLR $2521
DFF3 7F 25 22 CLR $2522
DFF6 7E DA 2F JMP $DA2F
```
2. **Success path** — make the clear unconditional (belt-and-suspenders,
covers an abort before `$87` is sent). Replace `$DA21-$DA2D` (13 bytes)
in place:
```
DA21 7F 25 21 CLR $2521
DA24 7F 25 22 CLR $2522
DA27 01 01 01 01 01 01 01 (NOP x7)
DA2E 39 RTS (unchanged)
```
Rationale: `$2521` means "a reply is in progress"; any path that tears
down reply state must release it. There is no case where you reset the
reply machine yet want the latch to stay set, so unconditional clearing is
safe. This is the board-side analogue of the game-side "make collisions
harmless" patches (BTL4OPT v2-v4) — instead of widening a timing window it
removes the latch leak entirely.
### Patched binary — built & statically verified (2026-07-04)
`make_patch.py` applies both edits to `RIOv4_2.bin` (asserting the exact
original bytes at each site first) → **`RIOv4_2_patched.bin`**
(sha256 `3fc8170caf60e2580641724ff995176c93c4f2e706f31487beded8233142493f`,
23 bytes changed). Re-disassembling it (`RIOv4_2_patched.disasm.asm`) and
diffing against the original confirms the change is confined to exactly
three regions with no downstream desync:
- `$D9DD` `JMP $DA2F` → `JMP $DFF0`
- `$DFF0` new stub: `CLR $2521 ; CLR $2522 ; JMP $DA2F`
- `$DA21` `CLR $2521 ; CLR $2522 ; NOP×7` (RTS at `$DA2E` intact)
Flash `RIOv4_2_patched.bin` directly to the W27C512 (DIP-28). This is
static verification only; dynamic proof still needs the burned chip.
### 31250-baud variant (2026-07-17) — `RIOv4_2_patched_31250.bin`
`make_patch.py --baud31250` adds **one byte** to the wedge patch: the SCI
init at `$D62A` (`LDAA #$30 ; STAA $102B BAUD`) becomes `LDAA #$02`.
BAUD `$30` = prescale ÷13, divider ÷1 → 2 MHz E-clock / (16·13) = 9615
("9600"); `$02` = prescale ÷1, divider ÷4 → 2 MHz / (16·4) = **31250
exactly** (3.3× faster; analog exchange ~15 ms → ~4.6 ms; 96-lamp burst
~0.4 s → ~0.12 s; every collision window shrinks 3×). The BAUD write
confirms the 8 MHz crystal / 2 MHz E-clock — 19200/38400 are unreachable.
sha256 `9f866cf353d04906e1d3e3847b6375eaae251c987b656f68f093e61ba1bd545b`,
24 bytes changed (the 23 wedge bytes + `$D62B: 30→02`). Re-disassembly
diff vs the classic patched image shows exactly the one operand line.
**Caveats:** 31250 is non-standard — FTDI-class USB adapters make it
exactly, classic 16550 UARTs cannot; the **native games still speak
9600**, so a 31250 chip is bench/RIOJoy-only until Firestorm/Red Planet
get BTL4OPT-style baud patches; and the 2 MHz HC11's RX ISR has ~640
cycles/byte at this rate (fine) — do NOT be tempted to `$01`/62500 or
`$00`/125 k without cycle-counting the `$D630` ISR worst path first.
PC side: `SerialPortTransport` takes a baud parameter and the
monitor/mash tools accept `--baud 31250`. Validate the wedge patch at
9600 FIRST (one variable at a time), then A/B this chip with
`--mash COM1 300 --label patched-31250 --baud 31250`.
### Validation plan (when a chip is available)
Burn the two edits to a W27C512, socket it (preserve the original AMD
chip), then run the `RIO_TAP` two-handed 8-button mash test. Expect: no
permanent analog mute; any collision self-recovers without a game-start
reset. Compare dropout counts to the 2026-07-03/04 baseline taps.
**Instrumented harness** (2026-07-17): the mash protocol is mechanized in
`tools/RioSerialMonitor` —
dotnet run --project tools/RioSerialMonitor -- --mash COM1 300 --label patched
It disables the app's own >5 s reset-recovery (a wedge must stay observable),
echoes lamps on every press (lamp/reply collisions are the trigger), and logs
to `riomash-<label>-<stamp>.log`: analog-gap histogram + longest gaps, WEDGE
events with beep/banner and a self-recovered vs button-revived classification
(button within 300 ms of resume = the unpatched revival signature), and the
board's own RestartCount/AbandonCount/FullBufferCount before/after with the
delta (7-bit wrap-aware). Exit 0 = no wedge, 1 = wedge seen. Run once with
`--label baseline` on the original chip (control: prove the test still bites),
then `--label patched`; the fixed-layout summary blocks diff directly.
`--mash --selftest` runs a scripted in-memory board that fakes a
button-revived wedge — use it to sanity-check the alarm before a session.
## Firmware memory map (as decoded so far)
| addr | meaning |
|---|---|
| `$292F` | RX state-handler pointer (`JMP $00,X` dispatch) |
| `$2D3B` | TX state-handler pointer |
| `$2D34/$36/$38` | TX ring read/write/aux pointers (ring `$2932-$2D31`) |
| `$2520` | reply gate (analog request pending) |
| `$2521` | **reply-in-progress latch — the wedge** |
| `$2522` | `$87` analog-reply-byte-sent flag |
| `$316C/$6D` | game ACK / NAK received |
| `$316E` | unknown-command seen |
| `$316F/$70` | ACK / NAK pending to send (→ TX ISR) |
| `$3172` | last received byte |
| `$3173/$74/$75` | ACK/NAK/wait retry counters (limit 4) |
| `$317A/$7B` | RESTART / IDLE keep-alive counters |
| `$3184/$85` | give-up / error diagnostic counters |
| `$3186` | RX overrun flag (set at `$D701`, **never read** — not the cause) |
| `$102D/$2E/$2F` | SCCR2 / SCSR / SCDR (HC11 SCI) |
## Bench validation results (2026-07-18) — PATCH CONFIRMED
Rig: real RIO board, FTDI FT232R on COM1, `RioSerialMonitor --mash`
(app auto-recovery disabled, lamp echo on). Logs in `testlogs/`.
| | baseline (original AMD chip) | patched (W27C512) |
|---|---|---|
| startup version/check exchange | **wedged at 0.62s** (reply/reply collision) | survived |
| analog replies | 6 total, then dead for 300s | 2419 @ 152s, steady ~16/s |
| mash | 951 presses (peak 460/min) | 1315 presses (peak 635/min) |
| worst analog gap | infinite — no recovery in 300s despite 951 presses | 0.58s, self-recovered |
| wedge events | 1, unresolved (power cycle required) | 0 |
Notes: the baseline wedge didn't even need the mash — the tool's own
version+check request colliding with the analog poll killed the reply
path instantly, and (contrary to the earlier RIO-NOTES observation)
button presses did NOT revive it. The patched chip's single 0.58s gap
is the intended failure mode: collision → teardown → latch cleared by
the $DFF0 stub → self-recovery. Patched run cut at ~155s by operator
(finger fatigue); given the baseline's 0.62s time-to-wedge, 2.5 min of
heavier mash is decisive. Remaining (cabinet): overnight idle soak +
a native-game session. Both check snapshots also reported a board/lamp
fault item — persistent across chips, likely a real tired lamp; inspect
separately.
## 31250-baud bench run (2026-07-18) — patch holds; retry window is byte-scaled
`testlogs/riomash-patched-31250-20260718-003114.log` (127s mash, FTDI
COM1 @ 31250, latency timer already 1ms): **zero wedges**, but
framing=5655, analog replies at 215% of poll slots (duplicates), and
AbandonCount=65 — a reply-retry storm. Reading: the board's reply
ACK-wait window scales with BYTE TIME, not wall clock. At 9600 the
window (~5+ms) hides USB turnaround entirely (zero framing in both
9600 runs); at 31250 it shrinks to ~1.6ms, which USB cannot reliably
beat, so most replies retransmit and 65 exhausted all 4 retries.
Two conclusions:
1. **Brutal confirmation of the wedge patch**: 65 trips through the
give-up path in 127s, every one self-recovered ($DFF0 stub). The
unpatched firmware would have latched dead on the first.
2. **31250 needs one more firmware tweak to be clean**: widen the
reply-retry wait (the pacing/limit around the $D90E/$D9BE retry
machine) so the window stays >=10ms of wall clock at 31250. Until
then: cabinets run the 9600 patched chip (validated clean); 31250
stays a bench branch. Note the duplicate replies also mean the raw
reply rate overstates throughput — unique samples are still capped
by the host's 55ms poll; harvesting the speed needs a faster poll
AFTER the retry window is fixed.
### 31250 v2 (2026-07-18) — `RIOv4_2_patched_31250v2.bin` — widened ACK-wait
Root cause of the v1 retry storm CONFIRMED in the disassembly: the reply
ACK-wait loop at `$D9E0` self-clocks in **byte times** — each tick sends an
IDLE (`$FF`) keep-alive and re-enters on that byte's TX-complete interrupt,
so the `CMPA #$04` limit means ~5 byte times of grace: ~5.2ms at 9600
(USB ACK wins; zero framing in both 9600 runs) vs ~1.6ms at 31250 (USB
loses; framing 5655 / Abandon 65 on the v1 bench run). Those keep-alive/
RESTART bytes landing mid-packet are exactly the host-side framing resyncs.
`make_patch.py --baud31250 --widen-ackwait` → one more byte,
`$D9E7: $04 → $28` (40 ticks ≈ 12.8ms at 31250, clears FTDI worst case
with margin). The NAK-retry limit ($3175) is event-counted, untouched.
sha256 `420d4cfc6b513651687982a70db2daeecda7bd00a5324321e272f35b95dca753`,
25 bytes vs original; re-disassembly diff vs the v1 31250 image is exactly
the one CMPA operand line. Expected on the bench: framing 5655 → ~0,
Abandon 65 → ~0, wedges 0 → 0.
### 31250 v2 bench results (2026-07-18) — CLEAN. Byte-clock theory confirmed.
`testlogs/riomash-patched-31250v2-20260718-110853.log` (192s mash):
| metric | v1 @31250 | v2 @31250 (ACK-wait $28) |
|-------------------|----------------|--------------------------|
| framing resyncs | 5655 (~45/s) | **54 (~0.3/s, -99.4%)** |
| Abandon delta | 65 | **+0** |
| Restart delta | 2 | **+0** |
| analog vs polls | 215% (dupes) | **88.6% (no dupes)** |
| wedge events | 0 | **0** |
| worst mid-run gap | 0.09s (steady) | 0.14s (tail <100ms) |
The 88.6% delivery ratio equals the healthy 9600 patched profile (87.5%)
— the deficit is the $D758 in-flight drop gate, identical at both rates,
i.e. structural, not a v2 artifact. Counters perfectly flat: the board
never entered retry escalation in 192s. FastRIO is now *clean*, not
just survivable. To actually harvest the bandwidth, the next dial is
host-side: drop the 55ms analog poll interval (the board now answers in
~4.6ms of wire time). Cabinet adoption still gated on game-side baud
patches; 9600 patched chip remains the production standard meanwhile.
### 125000 bench results (2026-07-18) — CPU wall found; RX overrun confirmed
`testlogs/riomash-patched-125000-20260718-125310.log` (103s): zero wedges
(all gaps self-recovered <=0.52s even here), but the board's RX drowns:
NAK=1082 (~2/3 of the ~1650 lamp commands arrived checksum-corrupt —
overrun-dropped bytes; lamps visibly dead), analog delivery 60.6% (2-byte
requests survive better than 4-byte packets), both status exchanges
failed. Direction asymmetry nails the cause: board->PC was near-perfect
(framing 5), so the MAX232 leg is fine at 125k — the 2MHz HC11 RX ISR
(~160 E-cycles/byte, 1-byte buffer) is the wall, exactly as the cycle
estimate predicted. Verdict: 125000 NOT viable. Sweet-spot candidate:
`RIOv4_2_patched_62500.bin` (320 cycles/byte, MAX232 in-spec, ACK-wait
80 ticks = 12.8ms), sha256 below, awaiting bench.
### 62500 bench results (2026-07-18) — the ladder is complete
`testlogs/riomash-patched-62500-20260718-130333.log` (132s): analog
pristine (88.1% delivery = the structural drop-gate ratio; worst mid-run
gap 0.14s; counters flat; zero wedges; status exchanges fine) but
**NAK=69 of ~1060 lamp commands (~6.5%)** — 4-byte bursts still outrun
the RX ISR occasionally, and fire-and-forget lamp writes turn each loss
into a visible stuck-bright / missed-bright lamp. The ISR's worst-case
path therefore sits right at ~320 E-cycles.
**The RIO speed ladder (2 MHz E-clock, all with wedge fix):**
| rate | bytes OK inbound | verdict |
|---|---|---|
| 9600 | all | production (native-game compatible) |
| 31250 v2 | all (NAK 0.3%) | CLEAN — FastRIO recommended |
| 62500 | 2-byte yes, 4-byte ~6.5% loss | usable ONLY with host NAK-retransmit |
| 125000 | ~40-65% loss | not viable — CPU wall |
Host-side NAK-driven retransmit (the protocol's intended use of ACK/NAK;
RioSerialLink currently fire-and-forgets outbound) would make 62500
lamp-solid (1 retry -> ~0.4% residual, 2 -> ~0.03%) and is good
robustness at any rate. Until then, 31250 v2 is the honest FastRIO.
### 62500 final verdict (2026-07-19) — SHELVED. Chord-driven RX overrun.
Three rounds of host-side hardening at 62500 (evidence in `testlogs/`,
implementations in RioJoy.Core RioSerialLink):
1. **NAK-race resend** — resends tracked NAKs 1:1 (321/321) yet lamps
still glitched: under bursts the NAK arrives after a newer command is
already "latest", so the wrong packet was resent; total shreds never
NAK at all.
2. **Stop-and-wait** (one command in flight; ACK/NAK/50ms-timeout;
retransmit the SAME packet, limit 2) — still glitched: reply
resolution was type-blind, so an analog reply in USB transit from the
previous poll falsely confirmed the next lamp command.
3. **Typed resolution** (a reply only resolves its matching request;
ACK/NAK safe type-blind because the board's TX ISR prioritizes them
ahead of reply data; 10ms settle after budget-exhausted drops) —
improved, but **chorded presses still glitch even at slow press
rates**.
The chord observation closes the case: a chord makes the board scan,
queue and transmit N button events at once — worst-case ISR latency —
exactly when our 4-byte lamp replies arrive at 160us/byte into a 2-byte
RX buffer. Corruption at 62500 is chord-shaped, not rate-shaped; no
host-side protocol can prevent the board losing bytes it never latched,
and retries can land in the same busy window. Fixing it for real means
firmware ISR restructuring (or sequence numbers) — out of scope.
**Final ladder verdict: 31250 v2 is the FastRIO standard** (3.3x stock,
clean without any host-side compensation — NAK 5 in 192s of mash).
The stop-and-wait + typed-resolution machinery stays enabled at every
rate as delivery insurance (it hardens 9600 production cabinets against
ordinary electrical noise, and its retries are near-zero on clean links).
62500 images remain in the repo for future firmware work.
## FINAL CERTIFICATION (2026-07-19) — 31250 v2 ships
Operator-verified at 31250 v2 with stop-and-wait active: **zero lamp
misses/hangs** through the slow-chord test (the exact scenario that
condemned 62500) and a 392-presses/min mash.
`testlogs/riomash-31250v2-final`: analog 89.0% (structural), **NAK = 0**,
25 resends — all timeout-triggered, i.e. the retry machinery silently
healing occasional INBOUND response loss (29 host-side framing events),
which is exactly the insurance it exists to provide. Counters flat,
zero wedges, gaps <100ms except run-start/stop artifacts.
`testlogs/riomash-31250v2-poll20` (--poll 20): delivered ~31 Hz analog
(2036 replies/65s) vs the legacy 18 Hz — 1.7×. The 62.6%-of-slots figure
is a host artifact, not board saturation: the poll loop delays AFTER each
awaited exchange (~6-9 ms), so the real cadence is interval+exchange.
Absolute-schedule pacing would approach 40+ Hz; ~94% of actually-issued
polls were answered. Future host tweak, not firmware.
### Production configuration (updated 2026-07-19: RIO 4.3 christened)
| deployment | chip | config.json |
|---|---|---|
| native-game cabinets | **`RIOv4_3.bin`** (9600; supersedes `archive/RIOv4_2_patched.bin`) | defaults (RioBaudRate 9600, AnalogPollMs 55) |
| RIOJoy-only cockpits (FastRIO) | **`RIOv4_3_fastrio.bin`** (built 2026-07-19, disassembly-verified; run the acceptance ladder on-cockpit before deploying — supersedes `archive/RIOv4_2_patched_31250v2.bin`) | RioBaudRate 31250, AnalogPollMs 20-25, FTDI-class adapter |
AppConfig.RioBaudRate + AnalogPollMs are plumbed through RioCoordinator;
stop-and-wait delivery is always on (near-zero cost on clean links).
Firmware images, hashes, disassemblies, the mechanized mash harness, and
all eleven bench logs live in this directory. The original AMD chip is
retired, preserved unmodified.
## Error-handling inventory (v4.2, unpatched baseline)
Complete map of what the board does — and pointedly does not do — when
things go wrong. Complements the wedge analysis above; display-side
detail in [`docs/hardware/display-board-1408.md`](../docs/hardware/display-board-1408.md).
### Host-facing (protocol)
- **Inbound packet checksum** (7-bit sum, verified at the `$D81F`
decision): good packet → queue **ACK `$FC`** (`$316F`); bad → **NAK
`$FD`** (`$3170`). The TX ISR sends pending ACK/NAK ahead of reply
data (`$D8A6`). Control bytes `$FE` RESTART / `$FF` IDLE.
- **Outbound reply delivery**: replies must be ACKed by the game; the
retry machine (`$D90E`/`$D9BE`) retransmits — **5 times** (bench
2026-07-19; the earlier code reading of "4" was wrong) — then gives
up: sends `$FE` RESTART, `INC $317A`, `INC $3184` (give-up counter),
teardown at `$DA2F` (`INC $3185` — teardowns: ANY reply cycle that
needed at least one retransmission ends here, including NAK-recovered
ones, so `$3185` is the counter behind a lone cockpit `E0000001`).
The give-up teardown is where the `$2521` wedge leak lives (see
above; fixed in the patched images). Bench-observed await behavior:
the ACK wait arms only after the COMPLETE reply frame is sent
(mid-frame ACK/NAK/RESTART is ignored); a game NAK of the completed
frame triggers exactly one immediate counted retransmit; once the
first retry timeout lapses the cycle runs blind to give-up — a late
ACK cannot rescue it.
- **RX overrun: unhandled.** The RX ISR reads SCSR/SCDR but never acts
on the overrun flag — dropped bytes just corrupt the frame and
surface as checksum NAKs. This is why the 125000-baud bench run
produced NAK=1082 rather than any explicit overrun signal.
### Internal
- **TX-ring overflow** (`$D63B` enqueue): if the ring would overtake
the drain pointer, the byte is silently dropped, `INC $3187`, and the
E0 diagnostic display refreshes. The host is not told.
- **TX dispatcher sanity trap** (`$D8C2`): each outgoing command byte
is looked up in an 8-entry table at `$3158`; no match ⇒ internal
corruption ⇒ `JMP $DAB2` — the **`dEAd` crash screen**, an infinite
loop rendering `dEAd` + RAM `$0000/$0001` on the 8-digit display.
Permanent until reset.
- **Unused interrupt vectors** → `NOP; BRA self` stubs at
`$DB07-$DB3D`: silent hang, no display, no recovery.
- **Error counters** `$3173-$317B` (ACK/NAK/retry/give-up bookkeeping)
and the three displayed ones `$3187/$3184/$3185` — rendered as
`E0 <ring-ovf> <give-ups> <teardowns>` by `$D5F2` at every increment.
### Hardware (RIO_1407 sheet 2)
- **MAX690 supervisor**: power-on/brownout reset via the PFI
comparator. The front-panel RESET toggle (SW1) and the optocoupled
remote-reset input both work by pulling PFI low — a "commanded
power-fail". **FAULT LED = PFO**, so it lights during any such event.
- **No working watchdog.** WDI has no off-sheet tag (never reaches the
CPU) and the firmware contains no strobe code — so software hangs
(`dEAd`, vector stubs, the reply wedge) persist until a human or the
game PC resets the board. This is corroborating evidence for the
bench-observed behavior: a wedged board stays wedged indefinitely.
- **RUN LED = buffered `AS*`** (address strobe): it indicates "clock
alive", not "software alive" — it stays lit even inside the `dEAd`
loop. TX/RX LEDs are buffered `SER_OUT`/`SER_IN`.
### E0-display threshold patch (edit 5, `--e0thresh[=N]`)
Stock firmware has **no threshold**: the first increment of any of the
three displayed counters repaints the cockpit display from `F0000000` to
the `E0` readout and it never reverts — so a single benign reply
give-up (e.g. one lost ACK healed by host-side stop-and-wait) leaves a
permanent `E0000001`. `make_patch.py --e0thresh=N` (default 5) gates the
renderer: `$D5F4`'s `LDX #$2038` becomes `JMP $E000`, and a 30-byte cave
at `$E000` (erased region, clear of the `$DFF0` wedge stub) compares
`$3187`/`$3184`/`$3185` against N — all below ⇒ exit through the
routine's own epilogue (`$D61D`, registers restored, display untouched);
any at/above ⇒ resume the render at `$D5F7`. Counters still accumulate
regardless, so the diagnostic history is intact — the display just stays
quiet until real trouble (N events since power-on).
Built variants (wedge fix + threshold 5):
| image | config | sha256 (first 12) |
|---|---|---|
| `RIOv4_2_patched_e0t5.bin` | 9600, native-game compatible | `9c21ac7199fb` |
| `RIOv4_2_patched_31250v2_e0t5.bin` | 31250 + widened ACK-wait (FastRIO) | `b43032b016d7` |
**Bench-verified 2026-07-19 (9600 image, burned): PASS.** Driven by
`RioSerialMonitor --e0test` (DTR reset → clean handshake → four
NAK-then-ACK sub-threshold teardown cycles → one unACKed give-up
cycle): the display held `F0000000` through the handshake and all four
sub-threshold teardowns — stock paints `E0…` at the first — and flipped
exactly at the 5th teardown to **`E0000105`** (`$3187`=00 overflows,
`$3184`=01 give-up, `$3185`=05 teardowns), confirmed by eye on the
cockpit display. Mash regression (120s, lamps on,
`testlogs/riomash-patched-e0t5-9600-20260719-154259.log`): **PASS**
0 wedges, 236/236 presses, 88.0% analog fill, NAK 0, board counters
flat. The 31250v2_e0t5 image is the same patch on the certified
FastRIO base and is expected to behave identically.
**Post-run display `04000000` — the CheckRequest self-test (corrected
finding).** The first read of this (keypad A-9-E chord entering test
mode) was wrong — disproved on the bench: the display is static (axis
movement does not change it) and version-only exchanges leave it alone.
The real mechanism is the **CheckRequest (`0x80`) handler at `$C5A6`**:
a full built-in self-test that sets the test-display flag `$2421`
(`$C5B1`), sends `TestModeChange 0x8C` to the host (`$C70E`), runs a
lamp pattern (`$D34A`), scans the pods, sweeps all five encoder
channels (`$CC53`, ending on channel 4 — whose `cc00hhll` frame is the
last thing rendered), enqueues the fault reports, clears the flag
(`$C5E1`), notifies `0x8C` again — and **returns without repainting the
display**. Every status check therefore leaves a stale
`04 00 <ch4 count>` snapshot (idle: `04000000`) on the digits. The
board is fully healthy afterwards; no reset is needed. Proper fix:
**edit 6** (`make_patch.py --checkrepaint`) — a 10-byte cave at `$E020`
hooked from the handler's final notify (`$C5E4`): `JSR $C70E` (original
notify), `JSR $CB7C` (repaint `F0000000`), `JSR $D5F2` (re-render the
E0 readout, which the edit-5 gate suppresses below threshold), `RTS`.
Built into **`RIOv4_3rc1.bin`** (with edits 1-2 and 5; sha256
`dc59bd51cae3…`); prior generations moved to `archive/`.
Why `04000000` was never seen in period (user-verified by re-slotting
the ORIGINAL stock chip, 2026-07-19): stock leaves the same stale frame
after every check, but the ungated E0 readout papers over it at the
first counter event — `04000000` flashes momentarily, then `E000000x`
as errors accrue and the reply-latch wedge trips under load. The wedge
fix plus the E0 threshold gate are what exposed the stale frame.
**RC1 acceptance (burned 2026-07-19): PASS on both edit-6 paths.**
Below threshold: a version+check exchange leaves the display at
`F0000000`. Over threshold: the full `--e0test` sequence reproduced the
certified behavior (held `F0000000` through four sub-threshold events,
flipped at the 5th teardown), and the closing CheckRequest — 65 status
frames — left the display at **`E0000305`**: repaint + live E0
re-render, not the stale `04000000`. The `$3184`=03 (vs predicted 01)
pins down the counter semantics one notch further: two of the 65 check
frames hit a timeout-retry that our late ACK then rescued — so
**`$3184` counts started timeout-retry sequences** (give-ups are the
subset that exhaust all 5 retransmits), and a timeout-recovered cycle
exits via the success teardown (no `$3185`), while NAK-recovered cycles
tear down through `$DA2F` (`$3185`). Every observation from both bench
sessions fits this model.
**CHRISTENED RIO 4.3 (2026-07-19).** Final gate: 120 s mash at 549
presses/min sustained (1129 presses — the heaviest stress run of the
campaign), zero wedges, counters flat, NAK 0, 247 resends all healed
(`testlogs/riomash-rio43rc1-9600-20260719-164901.log`). `RIOv4_3rc1`
renamed to **`RIOv4_3.bin`** — the production firmware for native-game
cabinets. Post-christening, **edit 7** (`--reportversion=4.3`, one
operand byte at `$C6FF` in the VersionReply builder `$C6EA`) makes the
board announce 4.3; final sha256 `6d67a2fc7713…` (69 bytes vs stock).
No host software validates the version value (native games verified
not to check it — Cyd, 2026-07-19); tools will print `firmware: 4.3`
after the next burn.
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
File diff suppressed because one or more lines are too long
File diff suppressed because it is too large Load Diff
+236
View File
@@ -0,0 +1,236 @@
#!/usr/bin/env python3
"""Recursive-descent 68HC11 disassembler for the RIO board firmware.
The RIO board (Toshiba TMP68HC11 + AM27C512) speaks the PCSPAK serial
protocol to the game. This tool disassembles RIOv4_2.bin to help locate the
receive/reply state machine and the wedge where the reply path dies under
stress. Address == file offset for this image (EPROM occupies $C000-$FFFF,
reset vector $FFFE -> $C000 confirms).
Usage: python disasm_6811.py [RIOv4_2.bin] > RIOv4_2.disasm.asm
"""
import sys
# ---- HC11 internal register block ($1000-$103F) annotations --------------
REG = {
0x00:"PORTA",0x02:"PIOC",0x03:"PORTC",0x04:"PORTB",0x05:"PORTCL",
0x07:"DDRC",0x08:"PORTD",0x09:"DDRD",0x0A:"PORTE",0x0B:"CFORC",
0x0C:"OC1M",0x0D:"OC1D",0x0E:"TCNT",0x10:"TIC1",0x12:"TIC2",
0x14:"TIC3",0x16:"TOC1",0x18:"TOC2",0x1A:"TOC3",0x1C:"TOC4",
0x1E:"TI4O5",0x20:"TCTL1",0x21:"TCTL2",0x22:"TMSK1",0x23:"TFLG1",
0x24:"TMSK2",0x25:"TFLG2",0x26:"PACTL",0x27:"PACNT",0x28:"SPCR",
0x29:"SPSR",0x2A:"SPDR",0x2B:"BAUD",0x2C:"SCCR1",0x2D:"SCCR2",
0x2E:"SCSR",0x2F:"SCDR",0x30:"ADCTL",0x31:"ADR1",0x32:"ADR2",
0x33:"ADR3",0x34:"ADR4",0x39:"OPTION",0x3A:"COPRST",0x3B:"PPROG",
0x3C:"HPRIO",0x3D:"INIT",0x3E:"TEST1",0x3F:"CONFIG",
}
def reg_ann(addr):
if 0x1000 <= addr <= 0x103F and (addr-0x1000) in REG:
return " ; "+REG[addr-0x1000]
return ""
# addressing modes and their extra operand byte counts
INH,IMM8,IMM16,DIR,EXT,IDX,IDY,REL = range(8)
BSET_DIR,BCLR_DIR,BRSET_DIR,BRCLR_DIR = range(8,12)
BSET_IDX,BCLR_IDX,BRSET_IDX,BRCLR_IDX = range(12,16)
MODELEN = {INH:0,IMM8:1,IMM16:2,DIR:1,EXT:2,IDX:1,IDY:1,REL:1,
BSET_DIR:2,BCLR_DIR:2,BRSET_DIR:3,BRCLR_DIR:3,
BSET_IDX:2,BCLR_IDX:2,BRSET_IDX:3,BRCLR_IDX:3}
# base page opcode table: opcode -> (mnemonic, mode)
OP = {
0x00:("TEST",INH),0x01:("NOP",INH),0x02:("IDIV",INH),0x03:("FDIV",INH),
0x04:("LSRD",INH),0x05:("LSLD",INH),0x06:("TAP",INH),0x07:("TPA",INH),
0x08:("INX",INH),0x09:("DEX",INH),0x0A:("CLV",INH),0x0B:("SEV",INH),
0x0C:("CLC",INH),0x0D:("SEC",INH),0x0E:("CLI",INH),0x0F:("SEI",INH),
0x10:("SBA",INH),0x11:("CBA",INH),0x12:("BRSET",BRSET_DIR),0x13:("BRCLR",BRCLR_DIR),
0x14:("BSET",BSET_DIR),0x15:("BCLR",BCLR_DIR),0x16:("TAB",INH),0x17:("TBA",INH),
0x19:("DAA",INH),0x1B:("ABA",INH),
0x1C:("BSET",BSET_IDX),0x1D:("BCLR",BCLR_IDX),0x1E:("BRSET",BRSET_IDX),0x1F:("BRCLR",BRCLR_IDX),
0x20:("BRA",REL),0x21:("BRN",REL),0x22:("BHI",REL),0x23:("BLS",REL),
0x24:("BCC",REL),0x25:("BCS",REL),0x26:("BNE",REL),0x27:("BEQ",REL),
0x28:("BVC",REL),0x29:("BVS",REL),0x2A:("BPL",REL),0x2B:("BMI",REL),
0x2C:("BGE",REL),0x2D:("BLT",REL),0x2E:("BGT",REL),0x2F:("BLE",REL),
0x30:("TSX",INH),0x31:("INS",INH),0x32:("PULA",INH),0x33:("PULB",INH),
0x34:("DES",INH),0x35:("TXS",INH),0x36:("PSHA",INH),0x37:("PSHB",INH),
0x38:("PULX",INH),0x39:("RTS",INH),0x3A:("ABX",INH),0x3B:("RTI",INH),
0x3C:("PSHX",INH),0x3D:("MUL",INH),0x3E:("WAI",INH),0x3F:("SWI",INH),
0x40:("NEGA",INH),0x43:("COMA",INH),0x44:("LSRA",INH),0x46:("RORA",INH),
0x47:("ASRA",INH),0x48:("LSLA",INH),0x49:("ROLA",INH),0x4A:("DECA",INH),
0x4C:("INCA",INH),0x4D:("TSTA",INH),0x4F:("CLRA",INH),
0x50:("NEGB",INH),0x53:("COMB",INH),0x54:("LSRB",INH),0x56:("RORB",INH),
0x57:("ASRB",INH),0x58:("LSLB",INH),0x59:("ROLB",INH),0x5A:("DECB",INH),
0x5C:("INCB",INH),0x5D:("TSTB",INH),0x5F:("CLRB",INH),
0x60:("NEG",IDX),0x63:("COM",IDX),0x64:("LSR",IDX),0x66:("ROR",IDX),
0x67:("ASR",IDX),0x68:("LSL",IDX),0x69:("ROL",IDX),0x6A:("DEC",IDX),
0x6C:("INC",IDX),0x6D:("TST",IDX),0x6E:("JMP",IDX),0x6F:("CLR",IDX),
0x70:("NEG",EXT),0x73:("COM",EXT),0x74:("LSR",EXT),0x76:("ROR",EXT),
0x77:("ASR",EXT),0x78:("LSL",EXT),0x79:("ROL",EXT),0x7A:("DEC",EXT),
0x7C:("INC",EXT),0x7D:("TST",EXT),0x7E:("JMP",EXT),0x7F:("CLR",EXT),
0x80:("SUBA",IMM8),0x81:("CMPA",IMM8),0x82:("SBCA",IMM8),0x83:("SUBD",IMM16),
0x84:("ANDA",IMM8),0x85:("BITA",IMM8),0x86:("LDAA",IMM8),0x88:("EORA",IMM8),
0x89:("ADCA",IMM8),0x8A:("ORAA",IMM8),0x8B:("ADDA",IMM8),0x8C:("CPX",IMM16),
0x8D:("BSR",REL),0x8E:("LDS",IMM16),0x8F:("XGDX",INH),
0x90:("SUBA",DIR),0x91:("CMPA",DIR),0x92:("SBCA",DIR),0x93:("SUBD",DIR),
0x94:("ANDA",DIR),0x95:("BITA",DIR),0x96:("LDAA",DIR),0x97:("STAA",DIR),
0x98:("EORA",DIR),0x99:("ADCA",DIR),0x9A:("ORAA",DIR),0x9B:("ADDA",DIR),
0x9C:("CPX",DIR),0x9D:("JSR",DIR),0x9E:("LDS",DIR),0x9F:("STS",DIR),
0xA0:("SUBA",IDX),0xA1:("CMPA",IDX),0xA2:("SBCA",IDX),0xA3:("SUBD",IDX),
0xA4:("ANDA",IDX),0xA5:("BITA",IDX),0xA6:("LDAA",IDX),0xA7:("STAA",IDX),
0xA8:("EORA",IDX),0xA9:("ADCA",IDX),0xAA:("ORAA",IDX),0xAB:("ADDA",IDX),
0xAC:("CPX",IDX),0xAD:("JSR",IDX),0xAE:("LDS",IDX),0xAF:("STS",IDX),
0xB0:("SUBA",EXT),0xB1:("CMPA",EXT),0xB2:("SBCA",EXT),0xB3:("SUBD",EXT),
0xB4:("ANDA",EXT),0xB5:("BITA",EXT),0xB6:("LDAA",EXT),0xB7:("STAA",EXT),
0xB8:("EORA",EXT),0xB9:("ADCA",EXT),0xBA:("ORAA",EXT),0xBB:("ADDA",EXT),
0xBC:("CPX",EXT),0xBD:("JSR",EXT),0xBE:("LDS",EXT),0xBF:("STS",EXT),
0xC0:("SUBB",IMM8),0xC1:("CMPB",IMM8),0xC2:("SBCB",IMM8),0xC3:("ADDD",IMM16),
0xC4:("ANDB",IMM8),0xC5:("BITB",IMM8),0xC6:("LDAB",IMM8),0xC8:("EORB",IMM8),
0xC9:("ADCB",IMM8),0xCA:("ORAB",IMM8),0xCB:("ADDB",IMM8),0xCC:("LDD",IMM16),
0xCE:("LDX",IMM16),0xCF:("STOP",INH),
0xD0:("SUBB",DIR),0xD1:("CMPB",DIR),0xD2:("SBCB",DIR),0xD3:("ADDD",DIR),
0xD4:("ANDB",DIR),0xD5:("BITB",DIR),0xD6:("LDAB",DIR),0xD7:("STAB",DIR),
0xD8:("EORB",DIR),0xD9:("ADCB",DIR),0xDA:("ORAB",DIR),0xDB:("ADDB",DIR),
0xDC:("LDD",DIR),0xDD:("STD",DIR),0xDE:("LDX",DIR),0xDF:("STX",DIR),
0xE0:("SUBB",IDX),0xE1:("CMPB",IDX),0xE2:("SBCB",IDX),0xE3:("ADDD",IDX),
0xE4:("ANDB",IDX),0xE5:("BITB",IDX),0xE6:("LDAB",IDX),0xE7:("STAB",IDX),
0xE8:("EORB",IDX),0xE9:("ADCB",IDX),0xEA:("ORAB",IDX),0xEB:("ADDB",IDX),
0xEC:("LDD",IDX),0xED:("STD",IDX),0xEE:("LDX",IDX),0xEF:("STX",IDX),
0xF0:("SUBB",EXT),0xF1:("CMPB",EXT),0xF2:("SBCB",EXT),0xF3:("ADDD",EXT),
0xF4:("ANDB",EXT),0xF5:("BITB",EXT),0xF6:("LDAB",EXT),0xF7:("STAB",EXT),
0xF8:("EORB",EXT),0xF9:("ADCB",EXT),0xFA:("ORAB",EXT),0xFB:("ADDB",EXT),
0xFC:("LDD",EXT),0xFD:("STD",EXT),0xFE:("LDX",EXT),0xFF:("STX",EXT),
}
# page 2 ($18): Y-register/Y-indexed forms
OP18 = {
0x08:("INY",INH),0x09:("DEY",INH),0x1C:("BSET",BSET_IDX),0x1D:("BCLR",BCLR_IDX),
0x1E:("BRSET",BRSET_IDX),0x1F:("BRCLR",BRCLR_IDX),0x30:("TSY",INH),0x35:("TYS",INH),
0x38:("PULY",INH),0x3A:("ABY",INH),0x3C:("PSHY",INH),0x60:("NEG",IDY),
0x63:("COM",IDY),0x64:("LSR",IDY),0x66:("ROR",IDY),0x67:("ASR",IDY),
0x68:("LSL",IDY),0x69:("ROL",IDY),0x6A:("DEC",IDY),0x6C:("INC",IDY),
0x6D:("TST",IDY),0x6E:("JMP",IDY),0x6F:("CLR",IDY),0x8C:("CPY",IMM16),
0x8F:("XGDY",INH),0x9C:("CPY",DIR),0xA0:("SUBA",IDY),0xA1:("CMPA",IDY),
0xA2:("SBCA",IDY),0xA3:("SUBD",IDY),0xA4:("ANDA",IDY),0xA5:("BITA",IDY),
0xA6:("LDAA",IDY),0xA7:("STAA",IDY),0xA8:("EORA",IDY),0xA9:("ADCA",IDY),
0xAA:("ORAA",IDY),0xAB:("ADDA",IDY),0xAC:("CPY",IDY),0xAD:("JSR",IDY),
0xAE:("LDS",IDY),0xAF:("STS",IDY),0xBC:("CPY",EXT),0xCE:("LDY",IMM16),
0xDE:("LDY",DIR),0xDF:("STY",DIR),0xE0:("SUBB",IDY),0xE1:("CMPB",IDY),
0xE2:("SBCB",IDY),0xE3:("ADDD",IDY),0xE4:("ANDB",IDY),0xE5:("BITB",IDY),
0xE6:("LDAB",IDY),0xE7:("STAB",IDY),0xE8:("EORB",IDY),0xE9:("ADCB",IDY),
0xEA:("ORAB",IDY),0xEB:("ADDB",IDY),0xEC:("LDD",IDY),0xED:("STD",IDY),
0xEE:("LDY",IDY),0xEF:("STY",IDY),0xBE:("LDY",EXT),0xBF:("STY",EXT),
}
OP1A = {0x83:("CPD",IMM16),0x93:("CPD",DIR),0xA3:("CPD",IDX),0xB3:("CPD",EXT),
0xAC:("CPY",IDX),0xEE:("LDY",IDX),0xEF:("STY",IDX)}
OPCD = {0xA3:("CPD",IDY),0xAC:("CPX",IDY),0xEE:("LDX",IDY),0xEF:("STX",IDY)}
def u16(d,a): return (d[a]<<8)|d[a+1]
class Insn:
__slots__=("addr","end","mnem","mode","opbytes","txt","target","flow")
def __init__(s,**k):
for n,v in k.items(): setattr(s,n,v)
def decode(d,a):
"""Decode one instruction at address a. Returns Insn or None (illegal)."""
start=a; op=d[a]; a+=1; pfx=None; table=OP
if op==0x18: pfx=0x18; table=OP18; op=d[a]; a+=1
elif op==0x1A: pfx=0x1A; table=OP1A; op=d[a]; a+=1
elif op==0xCD: pfx=0xCD; table=OPCD; op=d[a]; a+=1
ent=table.get(op)
if ent is None: return None
mnem,mode=ent; n=MODELEN[mode]; ops=d[a:a+n]; a+=n
idxreg="Y" if (mode in (IDY,) or pfx in (0x18,) and mode in (IDX,)) else "X"
if pfx==0xCD: idxreg="Y"
if pfx==0x1A and mode==IDY: idxreg="Y"
tgt=None; flow="seq"; ann=""
if mode==INH: txt=mnem
elif mode==IMM8: txt=f"{mnem} #${ops[0]:02X}"
elif mode==IMM16:
v=(ops[0]<<8)|ops[1]; txt=f"{mnem} #${v:04X}"
elif mode==DIR:
txt=f"{mnem} ${ops[0]:02X}"; ann=reg_ann(ops[0])
elif mode==EXT:
v=(ops[0]<<8)|ops[1]; txt=f"{mnem} ${v:04X}"; ann=reg_ann(v)
if mnem=="JSR": tgt=v; flow="call"
elif mnem=="JMP": tgt=v; flow="jump"
elif mode==IDX or mode==IDY:
txt=f"{mnem} ${ops[0]:02X},{idxreg}"
elif mode==REL:
rel=ops[0]-256 if ops[0]>127 else ops[0]; tgt=a+rel
txt=f"{mnem} ${tgt:04X}"
if mnem=="BRA": flow="jump"
elif mnem=="BSR": flow="call"
else: flow="branch"
elif mode in (BSET_DIR,BCLR_DIR):
txt=f"{mnem} ${ops[0]:02X},#${ops[1]:02X}"; ann=reg_ann(ops[0])
elif mode in (BSET_IDX,BCLR_IDX):
txt=f"{mnem} ${ops[0]:02X},{idxreg},#${ops[1]:02X}"
elif mode in (BRSET_DIR,BRCLR_DIR):
rel=ops[2]-256 if ops[2]>127 else ops[2]; tgt=a+rel
txt=f"{mnem} ${ops[0]:02X},#${ops[1]:02X},${tgt:04X}"; ann=reg_ann(ops[0]); flow="branch"
elif mode in (BRSET_IDX,BRCLR_IDX):
rel=ops[2]-256 if ops[2]>127 else ops[2]; tgt=a+rel
txt=f"{mnem} ${ops[0]:02X},{idxreg},#${ops[1]:02X},${tgt:04X}"; flow="branch"
else: txt=mnem
if mnem in ("RTS","RTI","JMP","BRA","STOP","WAI") and flow not in ("call","branch"):
if mnem in ("RTS","RTI","STOP"): flow="end"
ob=bytes([d[i] for i in range(start,a)])
return Insn(addr=start,end=a,mnem=mnem,mode=mode,opbytes=ob,
txt=txt+ann,target=tgt,flow=flow)
def main():
path=sys.argv[1] if len(sys.argv)>1 else "RIOv4_2.bin"
d=open(path,"rb").read()
LO,HI=0xC000,0x10000
# entry points: reset + all IRQ vectors
entries=set()
for va in range(0xFFD6,0x10000,2):
entries.add(u16(d,va))
# The RX/TX protocol runs as a pointer state machine: handlers are stored
# into dispatch-pointer RAM vars and reached via `JMP $00,X`, which a
# recursive tracer can't follow. Seed every handler by scanning for
# `LDX #imm16 ; STX <dispatchvar>` (CE iw FF pp) and taking imm16.
DISPATCH={0x292F,0x2927,0x2929,0x292B,0x2D3B,0x2D34,0x2D36,0x2D38}
for a in range(LO,HI-5):
if d[a]==0xCE and d[a+3]==0xFF:
iw=(d[a+1]<<8)|d[a+2]; pp=(d[a+4]<<8)|d[a+5]
if pp in DISPATCH and LO<=iw<HI:
entries.add(iw)
insns={}; labels=set(); calls=set()
work=[e for e in entries if LO<=e<HI]
for e in work: labels.add(e)
seen=set()
while work:
a=work.pop()
while LO<=a<HI and a not in insns:
ins=decode(d,a)
if ins is None: break
insns[a]=ins
if ins.target is not None and LO<=ins.target<HI:
labels.add(ins.target)
if ins.flow in ("call",): calls.add(ins.target)
if ins.flow in ("call","branch","jump"):
if ins.target not in insns: work.append(ins.target)
if ins.flow in ("end","jump"): break
a=ins.end
# emit listing
out=[]
a=LO
while a<HI:
if a in insns:
ins=insns[a]
lbl=f"L{a:04X}:" if a in labels else ""
mark=" <<<CALLED" if a in calls else ""
hexb=" ".join(f"{b:02X}" for b in ins.opbytes)
out.append(f"{a:04X} {hexb:<20} {lbl:<8}{ins.txt}{mark}")
a=ins.end
else:
# data byte
out.append(f"{a:04X} {d[a]:02X} .byte ${d[a]:02X}")
a+=1
sys.stdout.write("\n".join(out)+"\n")
sys.stderr.write(f"decoded {len(insns)} insns, {len(labels)} labels, "
f"{len(calls)} call targets\n")
if __name__=="__main__":
main()
+195
View File
@@ -0,0 +1,195 @@
#!/usr/bin/env python3
"""Apply the RIO v4.2 reply-wedge fix to RIOv4_2.bin -> RIOv4_2_patched.bin.
Fix (see RIOv4_2-ANALYSIS.md): clear the reply-in-progress latch $2521 on
EVERY reply teardown, not just the $2522-gated success path.
1. Give-up path: redirect $D9DD `JMP $DA2F` to a stub at free ROM $DFF0
that clears $2521/$2522 then continues to $DA2F.
2. Success path: make $DA00's clear of $2521/$2522 unconditional.
With --baud31250, additionally retune the SCI from 9600 to 31250 baud
(-> RIOv4_2_patched_31250.bin): the init at $D62A loads BAUD ($102B) with
$30 (prescale /13, divider /1 -> 2MHz E / (16*13) = 9615). $02 selects
prescale /1, divider /4 -> 2MHz / (16*4) = 31250 exactly. One operand
byte at $D62B. NOTE: 31250 is a non-standard rate — FTDI-class USB
adapters produce it exactly; classic 16550 UARTs cannot. The native
games still expect 9600, so a 31250 chip is bench/RIOJoy-only until the
games are patched.
Each edit asserts the exact original bytes first, so a wrong assumption
aborts instead of corrupting the image. Address == file offset.
"""
import sys, hashlib
# Baud retunes: flag -> (BAUD register value, ACK-wait ticks for ~12.8ms, name).
# The ACK-wait loop self-clocks in byte times (see edit 4), so each rate needs
# its own tick count to hold the same ~12.8ms wall-clock ACK grace window.
BAUD_OPTS = {
"--baud31250": (0x02, 0x28, "31250"), # /1 /4 -> 31250 (40 ticks)
"--baud62500": (0x01, 0x50, "62500"), # /1 /2 -> 62500 (80 ticks)
"--baud125000": (0x00, 0xA0, "125000"), # /1 /1 -> 125000 (160 ticks)
}
selected = [f for f in BAUD_OPTS if f in sys.argv]
assert len(selected) <= 1, f"pick one baud flag, got {selected}"
BAUD_VAL, ACKWAIT_VAL, BAUD_NAME = BAUD_OPTS[selected[0]] if selected else (None, None, None)
# --widen-ackwait: required semantics for 62500/125000 (implied there); optional
# for 31250 to keep the historical v1 image reproducible.
WIDEN_ACKWAIT = "--widen-ackwait" in sys.argv or BAUD_NAME in ("62500", "125000")
assert not ("--widen-ackwait" in sys.argv) or selected, \
"--widen-ackwait only makes sense with a baud retune (the wait is byte-scaled)"
# --e0thresh[=N]: gate the E0 error display (see edit 5). Default N=5.
E0T = None
for a in sys.argv:
if a.startswith("--e0thresh"):
E0T = int(a.split("=", 1)[1]) if "=" in a else 5
assert E0T is None or 1 <= E0T <= 255, f"--e0thresh out of range: {E0T}"
# --checkrepaint: repaint the display after the CheckRequest self-test (edit 6).
CHECKREPAINT = "--checkrepaint" in sys.argv
assert not CHECKREPAINT or E0T is not None, \
"--checkrepaint requires --e0thresh (it re-renders E0 via the gated $D5F2)"
# --reportversion=M.N (edit 7): the major.minor bytes the VersionReply returns.
REPORTVER = None
for a in sys.argv:
if a.startswith("--reportversion="):
REPORTVER = tuple(int(x) for x in a.split("=", 1)[1].split("."))
assert len(REPORTVER) == 2 and all(0 <= v <= 127 for v in REPORTVER), \
f"--reportversion must be M.N with 7-bit values: {REPORTVER}"
args = [a for a in sys.argv[1:] if not a.startswith("--")]
SRC = args[0] if len(args) > 0 else "RIOv4_2.bin"
if len(args) > 1:
DST = args[1]
elif BAUD_NAME == "31250":
DST = "RIOv4_2_patched_31250v2.bin" if WIDEN_ACKWAIT else "RIOv4_2_patched_31250.bin"
elif BAUD_NAME:
DST = f"RIOv4_2_patched_{BAUD_NAME}.bin"
else:
DST = "RIOv4_2_patched.bin"
if E0T is not None and len(args) <= 1:
DST = DST[:-4] + f"_e0t{E0T}.bin"
if CHECKREPAINT and len(args) <= 1:
DST = DST[:-4] + "_ckr.bin"
d = bytearray(open(SRC, "rb").read())
assert len(d) == 0x10000, f"expected 64KB image, got {len(d)}"
orig_sha = hashlib.sha256(d).hexdigest()
assert orig_sha == "60a88718835c654b6135dbec7721c40ef99dca07df2ad4b57eedeb24037a5f73", \
f"unexpected source image {orig_sha}"
def patch(addr, expect, new):
got = bytes(d[addr:addr+len(expect)])
assert got == bytes(expect), (
f"@${addr:04X}: expected {got.hex()} to be {bytes(expect).hex()}")
assert len(new) == len(expect), "length mismatch"
d[addr:addr+len(new)] = bytes(new)
# --- edit 1: give-up path redirect ---------------------------------------
# $D9DD 7E DA 2F JMP $DA2F -> 7E DF F0 JMP $DFF0
patch(0xD9DD, [0x7E, 0xDA, 0x2F], [0x7E, 0xDF, 0xF0])
# stub at $DFF0 (was erased $FF): CLR $2521; CLR $2522; JMP $DA2F
patch(0xDFF0, [0xFF]*8,
[0x7F, 0x25, 0x21, # CLR $2521
0x7F, 0x25, 0x22, # CLR $2522
0x7E, 0xDA]) # JMP $DA2F (hi + first target byte)
patch(0xDFF8, [0xFF], [0x2F]) # JMP low byte
# --- edit 2: success teardown, unconditional clear -----------------------
# $DA21 B6 25 22 LDAA $2522
# $DA24 81 01 CMPA #$01
# $DA26 26 06 BNE $DA2E
# $DA28 7F 25 21 CLR $2521
# $DA2B 7F 25 22 CLR $2522 (13 bytes $DA21-$DA2D; $DA2E RTS untouched)
# -> CLR $2521 ; CLR $2522 ; NOP x7
patch(0xDA21,
[0xB6,0x25,0x22, 0x81,0x01, 0x26,0x06, 0x7F,0x25,0x21, 0x7F,0x25,0x22],
[0x7F,0x25,0x21, 0x7F,0x25,0x22, 0x01,0x01,0x01,0x01,0x01,0x01,0x01])
assert d[0xDA2E] == 0x39, "RTS at $DA2E must be intact"
# --- edit 3 (--baud31250 only): SCI 9600 -> 31250 --------------------------
# $D62A 86 30 LDAA #$30 (SCP=/13, SCR=/1) -> 86 02 (SCP=/1, SCR=/4)
# then STAA $102B (BAUD). 2MHz E-clock: 2e6/(16*13)=9615 -> 2e6/(16*4)=31250.
if BAUD_VAL is not None:
assert d[0xD62A] == 0x86 and bytes(d[0xD62C:0xD62F]) == bytes([0xB7,0x10,0x2B]), \
"expected LDAA #imm ; STAA $102B at $D62A"
patch(0xD62B, [0x30], [BAUD_VAL])
# --- edit 4 (--widen-ackwait; implied for 62500/125000): scale the ACK-wait --
# The no-ACK wait loop at $D9E0 self-clocks in BYTE TIMES: each tick transmits
# an IDLE ($FF) keep-alive and re-enters on that byte's TX-complete interrupt.
# The stock limit (4 ticks) = ~5.2ms at 9600 (USB ACK wins) but shrinks with
# baud (retry storm at 31250; bench 2026-07-18: framing 5655, Abandon 65).
# Each retune holds the window at ~12.8ms wall clock: 40/80/160 ticks.
# $D9E6 81 04 CMPA #$04 -> 81 <ticks>
if WIDEN_ACKWAIT:
assert d[0xD9E6] == 0x81 and bytes(d[0xD9E3:0xD9E6]) == bytes([0xB6,0x31,0x7B]), \
"expected LDAA $317B ; CMPA #imm at $D9E3"
patch(0xD9E7, [0x04], [ACKWAIT_VAL])
# --- edit 5 (--e0thresh=N): threshold-gate the E0 error display -----------
# Stock behavior: every increment of $3187 (TX-ring overflow), $3184 (reply
# retransmit) or $3185 (reply teardown/give-up) immediately calls $D5F2,
# which paints 'E0'+counters over the F0 banner — so ONE benign give-up
# shows E0000001 forever. Gate the render: skip unless any counter >= N.
# $D5F2 prologue (PSHX/PSHA) has already run when we take over its
# LDX #$2038; the cave may clobber A/X because both exits restore them —
# below-threshold leaves via the routine's own epilogue at $D61D
# (PULA/PULX/RTS), at-or-above resumes the render at $D5F7.
if E0T is not None:
patch(0xD5F4, [0xCE, 0x20, 0x38], [0x7E, 0xE0, 0x00]) # LDX #$2038 -> JMP $E000
cave = [0xB6, 0x31, 0x87, # $E000 LDAA $3187 (ring overflows)
0x81, E0T, # $E003 CMPA #N
0x24, 0x11, # $E005 BCC $E018 (>=N -> render)
0xB6, 0x31, 0x84, # $E007 LDAA $3184 (reply retransmits)
0x81, E0T, # $E00A CMPA #N
0x24, 0x0A, # $E00C BCC $E018
0xB6, 0x31, 0x85, # $E00E LDAA $3185 (teardowns/give-ups)
0x81, E0T, # $E011 CMPA #N
0x24, 0x03, # $E013 BCC $E018
0x7E, 0xD6, 0x1D, # $E015 JMP $D61D (below threshold: epilogue)
0xCE, 0x20, 0x38, # $E018 LDX #$2038 (displaced instruction)
0x7E, 0xD5, 0xF7] # $E01B JMP $D5F7 (resume render)
patch(0xE000, [0xFF] * len(cave), cave)
# --- edit 6 (--checkrepaint): repaint the display after the check self-test --
# The CheckRequest handler ($C5A6) renders its five-channel encoder sweep to
# the cockpit display (it sets the test-display flag $2421 for the duration)
# and returns without repainting, leaving a stale '04 00 <ch4 count>' frame
# (idle: 04000000) after every status check. Hook its final TestModeChange
# notify ($C5E4 JSR $C70E) through a cave that also repaints F0000000
# ($CB7C) and then re-renders the E0 error readout via $D5F2 — which, with
# the edit-5 gate, paints only when a counter is at/over threshold. Display
# after any check: F0000000 when healthy, E0... when not.
if CHECKREPAINT:
patch(0xC5E4, [0xBD, 0xC7, 0x0E], [0xBD, 0xE0, 0x20]) # JSR $C70E -> JSR $E020
cave6 = [0xBD, 0xC7, 0x0E, # $E020 JSR $C70E (original notify, kept)
0xBD, 0xCB, 0x7C, # $E023 JSR $CB7C (repaint F0000000)
0xBD, 0xD5, 0xF2, # $E026 JSR $D5F2 (E0 readout iff >= threshold)
0x39] # $E029 RTS
patch(0xE020, [0xFF] * len(cave6), cave6)
# --- edit 7 (--reportversion=M.N): version bytes in the VersionReply --------
# The reply builder at $C6EA loads the payload with LDAA #$04 ($C6F7) and
# LDAA #$02 ($C6FE) — hardcoded "4.2". Nothing host-side validates the value
# (legacy app prints it, RIOJoy parses it, native games ignore it — verified
# by Cyd 2026-07-19), so the christened firmware can announce itself.
if REPORTVER is not None:
assert d[0xC6F7] == 0x86 and d[0xC6FE] == 0x86, "expected LDAA #imm pair at $C6F7/$C6FE"
patch(0xC6F8, [0x04], [REPORTVER[0]])
patch(0xC6FF, [0x02], [REPORTVER[1]])
open(DST, "wb").write(d)
new_sha = hashlib.sha256(d).hexdigest()
# byte-diff report
diffs = [(a, orig, d[a]) for a, orig in
enumerate(open(SRC,"rb").read()) if d[a] != orig]
print(f"source : {SRC} sha256 {orig_sha}")
print(f"patched: {DST} sha256 {new_sha}")
print(f"{len(diffs)} bytes changed:")
for a, o, n in diffs:
print(f" ${a:04X}: {o:02X} -> {n:02X}")
@@ -0,0 +1,28 @@
== RIO mash test :: COM1 @ 31250 8N1, 300s, chip label '31250v2-final' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, poll 55ms, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-31250v2-final-20260719-141437.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.83s] progress: presses=157 (157/min) analog=500 maxGap=0.28s wedges=0
[ 61.84s] progress: presses=432 (419/min) analog=976 maxGap=0.28s wedges=0
[ 65.45s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [31250v2-final] ==
run : 65s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 436 / 436 (392 presses/min)
analog replies : 1051 (~1181 poll slots; 89.0%), sentinels 0
framing / NAK : 29 / 0 (command resends NAK/timeout: 25)
gap histogram : <100ms:1048 100-250ms:0 250-500ms:2 0.5-1s:0 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.33s@65.4s, 0.28s@0.6s, 0.09s@45.0s, 0.08s@19.8s, 0.08s@22.4s, 0.08s@41.7s, 0.08s@24.5s, 0.08s@8.5s, 0.08s@37.5s, 0.08s@14.6s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-31250v2-final-20260719-141437.log
@@ -0,0 +1,28 @@
== RIO mash test :: COM1 @ 31250 8N1, 120s, chip label '31250v2-poll20' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, poll 20ms, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-31250v2-poll20-20260719-141620.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 120s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.97s] progress: presses=63 (63/min) analog=986 maxGap=0.51s wedges=0
[ 62.02s] progress: presses=314 (304/min) analog=1890 maxGap=0.51s wedges=0
[ 65.66s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [31250v2-poll20] ==
run : 65s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 318 / 318 (285 presses/min)
analog replies : 2036 (~3250 poll slots; 62.6%), sentinels 0
framing / NAK : 73 / 0 (command resends NAK/timeout: 57)
gap histogram : <100ms:2032 100-250ms:1 250-500ms:1 0.5-1s:1 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.51s@0.7s, 0.29s@65.7s, 0.13s@50.6s, 0.08s@55.1s, 0.07s@50.9s, 0.07s@50.7s, 0.07s@50.8s, 0.07s@54.3s, 0.06s@48.5s, 0.06s@57.9s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-31250v2-poll20-20260719-141620.log
@@ -0,0 +1,20 @@
== RIO mash test :: COM1 @ 9600 8N1, 300s, chip label 'baseline' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-baseline-20260718-000311.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
[ 2.70s] *** WEDGE: no analog reply for >2.0s (last at 0.62s). Keep pressing buttons — do NOT power cycle. ***
[ 31.89s] progress: presses=196 (196/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 62.00s] progress: presses=475 (460/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 92.03s] progress: presses=663 (432/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 122.14s] progress: presses=781 (384/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 152.22s] progress: presses=894 (352/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 182.28s] progress: presses=894 (294/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 212.28s] progress: presses=951 (269/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 242.36s] progress: presses=951 (235/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 272.40s] progress: presses=951 (209/min) analog=6 maxGap=0.08s wedges=0 [WEDGED NOW]
[ 301.88s] *** RUN ENDED WHILE WEDGED (301.3s and counting) ***
@@ -0,0 +1,29 @@
== RIO mash test :: COM1 @ 125000 8N1, 300s, chip label 'patched-125000' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-125000-20260718-125310.log
firmware: 4.2
counters before: (no status reply — reply path dead?)
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 33.05s] progress: presses=147 (147/min) analog=344 maxGap=0.31s wedges=0
[ 63.12s] progress: presses=472 (449/min) analog=668 maxGap=0.37s wedges=0
[ 93.14s] progress: presses=741 (477/min) analog=999 maxGap=0.44s wedges=0
[ 103.09s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-125000] ==
run : 103s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 827 / 824 (470 presses/min)
analog replies : 1134 (~1872 poll slots; 60.6%), sentinels 0
framing / NAK : 5 / 1082
gap histogram : <100ms:804 100-250ms:298 250-500ms:30 0.5-1s:1 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.52s@95.7s, 0.44s@63.3s, 0.44s@86.0s, 0.38s@79.8s, 0.37s@56.4s, 0.37s@73.4s, 0.37s@81.5s, 0.34s@95.3s, 0.31s@40.8s, 0.31s@58.4s
wedge events : 0
counters before : (no status reply — reply path dead?)
counters after : (no status reply — reply path dead?)
counter delta : (incomplete — a snapshot got no reply)
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-125000-20260718-125310.log
@@ -0,0 +1,16 @@
== RIO mash test :: COM1 @ 9600 8N1, 300s, chip label 'patched' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-20260718-001800.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
[ 31.82s] progress: presses=227 (227/min) analog=501 maxGap=0.58s wedges=0
[ 61.91s] progress: presses=556 (539/min) analog=984 maxGap=0.58s wedges=0
[ 91.99s] progress: presses=862 (562/min) analog=1462 maxGap=0.58s wedges=0
[ 122.05s] progress: presses=1292 (635/min) analog=1941 maxGap=0.58s wedges=0
[ 152.13s] progress: presses=1315 (519/min) analog=2419 maxGap=0.58s wedges=0
[ 182.17s] progress: presses=1315 (433/min) analog=2899 maxGap=0.58s wedges=0
[ 212.18s] progress: presses=1315 (372/min) analog=3378 maxGap=0.58s wedges=0
@@ -0,0 +1,30 @@
== RIO mash test :: COM1 @ 31250 8N1, 300s, chip label 'patched-31250' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-31250-20260718-003114.log
firmware: (no version reply!)
counters before: (no status reply — reply path dead?)
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.90s] progress: presses=188 (188/min) analog=1185 maxGap=0.09s wedges=0
[ 61.90s] progress: presses=395 (383/min) analog=2370 maxGap=0.09s wedges=0
[ 91.93s] progress: presses=798 (521/min) analog=3559 maxGap=0.09s wedges=0
[ 121.96s] progress: presses=932 (459/min) analog=4713 maxGap=0.09s wedges=0
[ 126.86s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-31250] ==
run : 126s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 946 / 977 (443 presses/min)
analog replies : 4927 (~2290 poll slots; 215.2%), sentinels 0
framing / NAK : 5655 / 5
gap histogram : <100ms:4925 100-250ms:0 250-500ms:0 0.5-1s:1 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.54s@126.9s, 0.09s@28.6s, 0.08s@29.5s, 0.08s@121.9s, 0.08s@24.3s, 0.08s@108.9s, 0.08s@21.8s, 0.08s@85.9s, 0.08s@88.9s, 0.08s@83.5s
wedge events : 0
counters before : (no status reply — reply path dead?)
counters after : RestartCount=2 AbandonCount=65 FullBufferCount=0 [board/lamp faults reported!]
counter delta : (incomplete — a snapshot got no reply)
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-31250-20260718-003114.log
@@ -0,0 +1,32 @@
== RIO mash test :: COM1 @ 31250 8N1, 300s, chip label 'patched-31250v2' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-31250v2-20260718-110853.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 33.03s] progress: presses=63 (63/min) analog=523 maxGap=0.28s wedges=0
[ 63.05s] progress: presses=165 (157/min) analog=1002 maxGap=0.28s wedges=0
[ 93.08s] progress: presses=185 (119/min) analog=1481 maxGap=0.28s wedges=0
[ 123.11s] progress: presses=347 (169/min) analog=1958 maxGap=0.28s wedges=0
[ 153.22s] progress: presses=504 (197/min) analog=2440 maxGap=0.28s wedges=0
[ 183.26s] progress: presses=763 (250/min) analog=2919 maxGap=0.28s wedges=0
[ 191.98s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-31250v2] ==
run : 191s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 775 / 775 (241 presses/min)
analog replies : 3076 (~3472 poll slots; 88.6%), sentinels 0
framing / NAK : 54 / 5
gap histogram : <100ms:3068 100-250ms:5 250-500ms:2 0.5-1s:0 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.30s@192.0s, 0.28s@1.8s, 0.14s@57.2s, 0.13s@107.8s, 0.12s@98.5s, 0.11s@130.9s, 0.10s@165.4s, 0.10s@24.5s, 0.10s@151.9s, 0.10s@167.4s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-31250v2-20260718-110853.log
@@ -0,0 +1,30 @@
== RIO mash test :: COM1 @ 62500 8N1, 300s, chip label 'patched-62500' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-62500-20260718-130333.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 33.04s] progress: presses=156 (156/min) analog=521 maxGap=0.22s wedges=0
[ 63.12s] progress: presses=299 (284/min) analog=998 maxGap=0.22s wedges=0
[ 93.15s] progress: presses=396 (255/min) analog=1478 maxGap=0.22s wedges=0
[ 123.17s] progress: presses=505 (246/min) analog=1954 maxGap=0.22s wedges=0
[ 132.35s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-62500] ==
run : 132s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 530 / 530 (238 presses/min)
analog replies : 2115 (~2400 poll slots; 88.1%), sentinels 0
framing / NAK : 24 / 69
gap histogram : <100ms:2103 100-250ms:11 250-500ms:0 0.5-1s:0 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.25s@132.3s, 0.22s@1.8s, 0.14s@54.9s, 0.14s@117.2s, 0.13s@43.6s, 0.13s@14.8s, 0.13s@43.1s, 0.13s@115.0s, 0.12s@124.0s, 0.12s@94.9s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-62500-20260718-130333.log
@@ -0,0 +1,29 @@
== RIO mash test :: COM1 @ 62500 8N1, 300s, chip label 'patched-62500-retx' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-62500-retx-20260719-131037.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 33.03s] progress: presses=245 (245/min) analog=515 maxGap=0.27s wedges=0
[ 63.05s] progress: presses=568 (541/min) analog=992 maxGap=0.27s wedges=0
[ 93.11s] progress: presses=709 (457/min) analog=1470 maxGap=0.27s wedges=0
[ 95.30s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-62500-retx] ==
run : 95s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 709 / 710 (440 presses/min)
analog replies : 1522 (~1727 poll slots; 88.1%), sentinels 0
framing / NAK : 61 / 321 (NAK-triggered resends: 321)
gap histogram : <100ms:1510 100-250ms:9 250-500ms:2 0.5-1s:0 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.27s@1.8s, 0.25s@95.3s, 0.13s@77.1s, 0.13s@26.6s, 0.12s@26.3s, 0.12s@57.4s, 0.12s@12.7s, 0.12s@11.5s, 0.12s@18.8s, 0.12s@31.3s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-62500-retx-20260719-131037.log
@@ -0,0 +1,28 @@
== RIO mash test :: COM1 @ 62500 8N1, 300s, chip label 'patched-62500-sw' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-62500-sw-20260719-132841.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.90s] progress: presses=115 (115/min) analog=492 maxGap=0.22s wedges=0
[ 61.94s] progress: presses=224 (217/min) analog=968 maxGap=0.22s wedges=0
[ 80.54s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-62500-sw] ==
run : 80s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 285 / 285 (209 presses/min)
analog replies : 1279 (~1454 poll slots; 88.0%), sentinels 0
framing / NAK : 22 / 48 (command resends NAK/timeout: 67)
gap histogram : <100ms:1261 100-250ms:17 250-500ms:0 0.5-1s:0 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.24s@80.5s, 0.22s@0.6s, 0.13s@47.9s, 0.13s@77.5s, 0.12s@21.2s, 0.12s@20.4s, 0.12s@22.9s, 0.11s@21.4s, 0.11s@49.3s, 0.11s@28.9s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-62500-sw-20260719-132841.log
@@ -0,0 +1,27 @@
== RIO mash test :: COM1 @ 62500 8N1, 300s, chip label 'patched-62500-sw' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, app auto-recovery DISABLED
log: C:\VWE\riojoy\riomash-patched-62500-sw-20260719-133628.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 300s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.90s] progress: presses=72 (72/min) analog=497 maxGap=0.21s wedges=0
[ 58.27s] operator stop (Ctrl+C) — ending run, snapshotting counters...
== MASH SUMMARY [patched-62500-sw] ==
run : 58s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 123 / 123 (124 presses/min)
analog replies : 931 (~1054 poll slots; 88.3%), sentinels 0
framing / NAK : 7 / 20 (command resends NAK/timeout: 34)
gap histogram : <100ms:921 100-250ms:9 250-500ms:0 0.5-1s:0 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.22s@58.3s, 0.21s@0.6s, 0.14s@41.9s, 0.14s@26.8s, 0.13s@23.6s, 0.11s@12.4s, 0.11s@24.4s, 0.10s@54.1s, 0.10s@53.4s, 0.10s@16.5s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : C:\VWE\riojoy\riomash-patched-62500-sw-20260719-133628.log
@@ -0,0 +1,28 @@
== RIO mash test :: COM1 @ 9600 8N1, 120s, chip label 'patched-e0t5-9600' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, poll 55ms, app auto-recovery DISABLED
log: c:\VWE\riojoy\riomash-patched-e0t5-9600-20260719-154259.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 120s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.88s] progress: presses=44 (44/min) analog=496 maxGap=0.63s wedges=0
[ 61.96s] progress: presses=226 (219/min) analog=952 maxGap=0.63s wedges=0
[ 91.97s] progress: presses=236 (154/min) analog=1428 maxGap=0.63s wedges=0
== MASH SUMMARY [patched-e0t5-9600] ==
run : 120s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 236 / 236 (115 presses/min)
analog replies : 1919 (~2181 poll slots; 88.0%), sentinels 0
framing / NAK : 75 / 0 (command resends NAK/timeout: 69)
gap histogram : <100ms:1911 100-250ms:5 250-500ms:0 0.5-1s:2 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.66s@121.8s, 0.63s@0.6s, 0.14s@40.3s, 0.13s@42.0s, 0.13s@37.2s, 0.11s@76.9s, 0.11s@58.3s, 0.10s@53.4s, 0.10s@112.9s, 0.10s@35.4s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : c:\VWE\riojoy\riomash-patched-e0t5-9600-20260719-154259.log
@@ -0,0 +1,28 @@
== RIO mash test :: COM1 @ 9600 8N1, 120s, chip label 'rio43rc1-9600' ==
lamp echo ON (drives reply/lamp collisions), wedge threshold 2.0s, poll 55ms, app auto-recovery DISABLED
log: c:\VWE\riojoy\riomash-rio43rc1-9600-20260719-164901.log
firmware: 4.2
counters before: RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
>>> MASH NOW: two hands, 8 lamp buttons, as fast as you can. <<<
>>> Test runs 120s. A wedge alarm will beep + banner. <<<
>>> Ctrl+C ends the run early and still prints the summary. <<<
[ 31.92s] progress: presses=258 (258/min) analog=474 maxGap=0.64s wedges=0
[ 61.98s] progress: presses=588 (569/min) analog=918 maxGap=0.64s wedges=0
[ 91.98s] progress: presses=922 (601/min) analog=1356 maxGap=0.64s wedges=0
== MASH SUMMARY [rio43rc1-9600] ==
run : 120s on COM1, lamps on, wedge threshold 2.0s
firmware : 4.2
presses/releases : 1129 / 1118 (549 presses/min)
analog replies : 1811 (~2181 poll slots; 83.0%), sentinels 0
framing / NAK : 298 / 0 (command resends NAK/timeout: 247)
gap histogram : <100ms:1778 100-250ms:29 250-500ms:0 0.5-1s:3 1-2s:0 2-5s:0 >5s:0
longest gaps : 0.68s@121.9s, 0.64s@0.6s, 0.57s@122.6s, 0.15s@32.2s, 0.14s@84.3s, 0.13s@52.3s, 0.13s@51.5s, 0.13s@93.5s, 0.13s@60.1s, 0.13s@15.2s
wedge events : 0
counters before : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counters after : RestartCount=0 AbandonCount=0 FullBufferCount=0 [board/lamp faults reported!]
counter delta : RestartCount=+0 AbandonCount=+0 FullBufferCount=+0
verdict : PASS — no wedge; compare gap histogram + counter delta to baseline
log file : c:\VWE\riojoy\riomash-rio43rc1-9600-20260719-164901.log
@@ -0,0 +1,34 @@
# Why your pod's stick sometimes "died" mid-battle — and why it won't anymore
*A plain-language explanation for pod owners. The technical write-up is in
[RIOv4_2-ANALYSIS.md](RIOv4_2-ANALYSIS.md).*
Inside every pod is a small computer board from 1994 (the **RIO**) whose job
is to tell the game what you're doing: which buttons you pressed, and where
you've moved the stick, throttle, and pedals.
The board and the game talk like two people on walkie-talkies. Every time the
board reports your stick position, it waits for the game to answer *"got it."*
During calm flying that works fine. But in a frantic firefight — lamps
flashing, buttons hammering — the channel gets crowded, and once in a while
that little *"got it"* gets drowned out.
When that happens, the board repeats itself a few times and then, sensibly,
gives up and moves on. Here's the bug: while it's sending a position report,
the board puts up a mental sticky note that says *"busy — already sending
one."* When a report goes through normally, it takes the note down. But on the
give-up path, the 1994 programmers forgot one line — **the note never comes
down.** From that moment the board looks at the sticky note, decides it's still
busy, and quietly throws away every stick and throttle update forever after.
That's the "wedge" you may have felt: mid-mission, your stick and throttle
just stop doing anything, while the buttons and lamps still work fine —
because those travel a different path that the sticky note doesn't block.
Starting a new mission always cured it, since a new game tells the board to
clean house, sticky note included.
The **RIO 4.3** firmware adds the one missing instruction: whenever the board
gives up on a report, it now takes the sticky note down too. We stress-tested
it by mashing buttons at over nine presses *per second* for two minutes
straight — the old board wedged under that abuse; the new one never misses a
beat.