Add PlasmaNew: plasma display reverse-engineering reference

Historical reference for recreating the cockpit plasma display in hardware.
The original Babcock plasma panels are failing; the end goal is a drop-in
replica — a modern microcontroller driving a 128x32 LED array that reads the
same RS-232 serial bus and speaks the same command protocol as the original
PD01D221. vPLASMA (the C# app) is the executable spec and test oracle for
that firmware.

Contents:
- PD01D221.pdf — Babcock datasheet (doc 9200-0109 Rev A)
- Board photos: controller overview, Cherry silkscreen, EPROM/SRAM, JP1
- README.md — full investigation: hardware ID (stock Babcock PD01D221,
  Cherry PCB 4317-C), chip inventory, recovered ESC command protocol, the
  JP1 config-jumper map (MODA/MODB hardwired to expanded mode), and the
  firmware-dump plan.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PlasmaNew/README.md

@@ -0,0 +1,177 @@
+# PlasmaNew — reverse-engineering the real cockpit plasma display
+
+Working notes and reference material for the cockpit plasma display.
+
+**End goal: a hardware replica.** The original Babcock plasma panels are
+starting to fail and are effectively irreplaceable. The plan is to drive a
+modern **128 × 32 LED array** with a **modern microcontroller** that reads
+the same RS-232 serial bus and speaks the same command protocol as the
+original PD01D221 — a drop-in replacement, functionally identical from the
+host's side, with none of the plasma physics or high voltage.
+
+[vPLASMA](../src/VPlasma.App/) (the C# app in this repo) is the software
+counterpart and serves the replica directly: it is an **executable
+specification** of the display's behavior and a **test oracle**. Every
+command semantic pinned down in `VPlasmaDevice` ports straight to the
+replica's firmware, and the same differential-test rig (real panel vs.
+vPLASMA) validates the replica. vPLASMA today is built from *observed
+traffic* (the game's driver + a factory test tool); grounding it in the
+*actual hardware* — protocol, fonts, and timing — feeds both the emulator
+and the replacement firmware.
+
+## What the display is
+
+A **commercial off-the-shelf Babcock Display Products Division PD01D221** —
+"128 × 32 dot-matrix, gas-plasma display with controller and DC-DC
+converter," with an RS-232C serial interface and a dedicated microprocessor
+for refresh and the user interface. Built by **Cherry** (PCB assembly
+**4317-C**, Made in Taiwan, © 1994). See [`PD01D221.pdf`](PD01D221.pdf)
+(Babcock doc 9200-0109 Rev A).
+
+Product family (the suffix letter = how much is on the board):
+
+| Model | Contents |
+|-------|----------|
+| PD01**B**22B | 128×32 panel + driver electronics only (host refreshes it) |
+| PD01**F**221 | + on-board DC-DC converter |
+| PD01**D**221 | **+ controller: RS-232C, dedicated microprocessor** ← this unit |
+
+**VWE used it stock — no custom fonts or bitmaps were installed.** So the
+display's behavior is entirely the standard Babcock PD-series firmware, and
+the `ESC P` "graphics" the game drew were rendered at runtime by the game,
+not preloaded. Nothing on the display is VWE-specific.
+
+## Board inventory
+
+Chip IDs read from the photos below.
+
+| Ref | Part | Role |
+|-----|------|------|
+| U1 | **Motorola MC68HC11D0** (44-pin QFP, mask 1C17F, wk 28/94) | ROMless HC11 MCU — the controller. Runs from external bus in expanded mode. |
+| U3 | **TI TMS27PC512** (PLCC-32, −150 ns, Singapore) | **64 KB OTP EPROM = the firmware** (stock Babcock code + fonts). Standard 27C512. |
+| U2 | QFP ~100-pin, label **"35GWP004 REV A 3994"** | Custom Cherry display/scan **ASIC** (wk 39/94). Drives the HV stage. *Not* the firmware. |
+| U4 | **Mosel MS62256L-10** | 32 KB SRAM — frame buffer / scratch. |
+| U7 | **Supertex HV7708** | 32-channel high-voltage plasma driver (more HV off-frame). |
+| U5 | **Maxim MAX202CWE** | RS-232 transceiver — the serial interface. |
+| — | **MAX707** | Reset / watchdog supervisor. |
+| Y1 | **7.3728 MHz** crystal | E-clock = 1.8432 MHz; gives exact standard baud rates. |
+
+Memory picture: ROMless HC11 + external 64 KB EPROM (code + fonts) + 32 KB
+SRAM + custom scan ASIC + HV drivers. A 64 KB program EPROM for a 128×32
+panel implies far more feature set than the game ever used.
+
+## Reference photos
+
+| File | Shows |
+|------|-------|
+| [`mpul-2026-07-07-152834.jpeg`](mpul-2026-07-07-152834.jpeg) | Controller overview: MC68HC11D0 (U1), the "35GWP004" ASIC (U2), HV7708 (U7), MAX202, MAX707. |
+| [`silkscreenl-2026-07-07-152841.jpeg`](silkscreenl-2026-07-07-152841.jpeg) | Cherry silkscreen: PCB **4317-C**, © 1994, "Made in Taiwan". |
+| [`unknown-2026-07-07-153818.jpeg`](unknown-2026-07-07-153818.jpeg) | The **TMS27PC512 EPROM** (U3, initially unidentified), Mosel SRAM (U4), HC11. |
+| [`jumpers-2026-07-07-163733.jpeg`](jumpers-2026-07-07-163733.jpeg) | The **JP1** config header next to the HC11. |
+
+## Datasheet-confirmed facts (`PD01D221.pdf`, doc 9200-0109 Rev A)
+
+- Serial format **8N1**, baud **jumper-selectable 4800 / 9600 / 19.2K /
+  38.4K** (the game uses 9600).
+- "Choice of standard fonts and styles" (= `ESC K` / `ESC H`); "program
+  custom characters" (a custom-char download command — **exists but VWE
+  didn't use it**); "graphic input commands / overlays" (= `ESC P`).
+- Serial is **bidirectional**. Connector **J1**: pin 2 TxD (display→host),
+  pin 3 RxD (host→display), pin 4 CTS, pin 8 DTR ("display ready"), pin 5
+  GND. The game drove it write-only (flow control disabled, TxD ignored),
+  so vPLASMA's listen-only model is faithful.
+- Also carries an 8-bit **parallel** port (J2), unused by the game.
+- **The datasheet does *not* contain the `ESC` command table.** That's a
+  separate Babcock programming/user manual, which is **not available online**
+  (checked general web, datasheetarchive, bitsavers, archive.org, resellers;
+  only this datasheet was ever digitized). Sources for it: ask Babcock
+  directly (La Mirada CA, (714) 994-6500, babcockinc.com), or reconstruct it
+  from the dump + the sources we already have.
+
+## Command protocol recovered so far
+
+From the game driver (`TeslaRel410\CODE\RP\MUNGA_L4\L4PLASMA.CPP`) and the
+factory test tool (`…\VWETEST\VGLTEST\PLASMA.EXE`). Full grammar lives in
+[`../src/VPlasma.Core/Protocol/PlasmaProtocol.cs`](../src/VPlasma.Core/Protocol/PlasmaProtocol.cs).
+
+| Bytes | Meaning |
+|-------|---------|
+| `ESC @` | Clear screen, reset text state |
+| `ESC L` | Home cursor |
+| `ESC G n` | Cursor mode (00/FF hidden, 01 steady, 03 flashing) |
+| `ESC K n` | Font select (0–7; FF = default) |
+| `ESC H n` | Text attributes (intensity / underline / reverse / flash) |
+| `ESC P s y x w h  data…` | Graphics write: MSB = leftmost pixel |
+| BS / HT / LF / VT / CR | Cursor motion |
+
+The Babcock manual (or a firmware dump) would fill in exact operand
+encodings, tab stops, the `ESC P` "screen" byte, and any commands the game
+never used.
+
+## JP1 configuration header
+
+Traced pin-by-pin (see the jumper photo). **JP1 is firmware-read
+configuration, not CPU mode select** — each shunt ties a GP port pin the
+firmware polls at boot. Shunt to GND = logic 0.
+
+| JP1 pos | HC11 pin | Function |
+|---------|----------|----------|
+| 1 | pin 24 / PA0 | Baud select bit 0 |
+| 2 | pin 22 / PA2 | Baud select bit 1 |
+| 3 | pin 21 / PA3 | Option (unknown) |
+| 4 | pin 15 / PD5 | Option (unknown) |
+| 5 | pin 14 / PD4 | Option (unknown) |
+| 6 | pin 13 / PD3 | Option (unknown) |
+| 7 | J2 SEL → +5 V | Parallel interface select |
+
+Positions 1–2 = the datasheet's baud "JUMPER 1 / JUMPER 2." Positions 3–6
+are four unknown firmware option bits — candidates for a hidden factory
+self-test / diagnostic mode.
+
+HC11 pin map cross-checked while tracing: PD0–PD5 = pins 10–15, PA0–PA7 =
+pins 24–17 (descending).
+
+**MODA/MODB are hardwired high (expanded mode) through a diode to +5 V — not
+jumper-selectable.** So bootstrap mode cannot be entered by moving a jumper;
+it needs a mode-pin override. (Exact diode circuit still to be characterized.)
+
+## Firmware-dump plan
+
+Goal: get the 64 KB EPROM image, disassemble the HC11 code to recover the
+full command table + font bitmaps + timing, then differential-test vPLASMA
+against the real panel on identical byte streams. The recovered spec feeds
+**both** vPLASMA and the replacement firmware.
+
+1. **Free, no-solder — hunt for a diagnostic mode.** Capture J1 TxD while
+   power-cycling normally (may emit a banner/version), then step the four
+   unknown config jumpers (PA3, PD5, PD4, PD3) through combinations watching
+   TxD for a factory self-test or ROM dump.
+2. **Serial bootstrap (conditional).** Bootstrap needs MODA = MODB = 0 at the
+   reset edge; they're pulled to +5 V via a diode. If that circuit has a
+   series resistor (or a diode-OR node), pull both low during a reset pulse
+   and run the standard **Motorola AN1060** dump loader out J1 — no cutting.
+   If hard-tied, a single trace cut/lift is needed. *Blocked on the diode
+   details.*
+3. **Reliable fallback — read the EPROM directly.** PLCC-32 test clip on U3
+   with the HC11 held in reset, or hot-air U3 off and read it in a 27C512
+   adapter. Guaranteed image.
+
+Safety: the panel runs on a few hundred volts from the on-board DC-DC. Keep
+all work in the logic corner (HC11 / EPROM / MAX202); never probe the HV
+section or the panel connector while powered.
+
+## Open items
+
+- Characterize the MODA/MODB diode circuit → decide if serial bootstrap is a
+  tack-a-wire job or needs a trace cut.
+- Capture J1 TxD across config-jumper combinations (path 1).
+- Obtain the Babcock PD01D programming manual, **or** dump the U3 EPROM.
+- Once we have the command table + fonts: fold into `VPlasmaDevice`, replace
+  the public-domain 5×7 stand-in with the real Babcock glyphs, and
+  differential-test against the hardware.
+- **Prototype the replica.** A modern MCU (RP2040 / ESP32 / Teensy) reads the
+  J1 serial bus into the same command parser and drives a 128×32 LED matrix
+  from the same frame buffer — the per-pixel lit / half-intensity / flash
+  flags in `VPlasmaDevice` map directly onto PWM brightness + blink. Match
+  the J1 pinout, the baud jumpers, and the DTR-ready line so it drops into
+  the original harness. An amber matrix best mimics the neon-orange plasma.