JVS Device Discovery and Address Assignment, Byte by Byte (JVS-002)

Why enumeration is more than a serial handshake

JVS I/O boards do not simply boot with a permanent address. A conventional host resets addressing, detects an eligible unassigned node using the SENSE sideband, assigns a node number with broadcast F1, and builds a record of each successfully discovered board.

Transport, addressing and capabilities are distinct. Seeing 115200 8N1 bytes only establishes traffic, not a completed address assignment. A readable node ID establishes command 10 response, not working controls or vendor-specific compatibility.

This JVS-002 companion to JVS-001 explains a reproducible host algorithm and source-scoped Sega/Namco findings. It is not a qualified cabinet wiring guide.

A state machine for the host

A useful host model retains assigned nodes, next candidate address, an outstanding transaction, a validated response and SENSE classification. A generic one-board demonstration is not enough to prove daisy-chain behaviour.

F0 reset normally solicits no reply. F1 assignment is also broadcast but normally does produce an acknowledgement from the eligible unaddressed node. Distinguishing those responses avoids false timeouts.

LINK READY
   |
   v
BROADCAST F0 D9 (reset)
   |
   v
OBSERVE SENSE
   |                     \
   | unassigned present? +-- no --> DISCOVERY COMPLETE
   v yes
BROADCAST F1 <next address>
   |
   v
VALIDATE ACK + RECHECK SENSE
   |
   +----> repeat while next node is eligible
   |
   v
QUERY 11/12/13, 10, 14 PER NODE
   |
   v
BEGIN SUPPORTED INPUT POLLS

SENSE is analog state, not packet data

The host observes a separate SENSE electrical line in addition to RS-485 A/B. Common implementations use high voltage for no eligible unaddressed node, an intermediate diode-drop region for an unaddressed board and a low region after the addressed-state sink engages. These are qualitative interpretations, not universal comparator thresholds.

Our original Sega 838-13683-93 Rev.B study traced a passive path through D3/D4 and a second switched path to ground. The firmware's P7.2 output activates that sink after accepted F1. Its exact SOT-89 device and diode internals have not yet been identified; do not infer a specific component number.

Historical descriptions of roughly 5 V / 2–3 V / 0 V must not be treated as safe MCU input levels or a universal design recipe. Actual host thresholds and chain wiring require measurement.

The F0 D9 broadcast reset

A conventional reset command consists of F0 followed by fixed parameter D9, sent to destination FF. Its logical LEN is 03, covering F0, D9 and the checksum; the checksum is CB. A valid reset normally does not generate an ordinary JVS acknowledgement.

The recovered Sega SP5001-B reset handler at ROM 0965 checks D9 and initiates an internal initialization path only on a match. Hosts may repeat reset and wait for hardware settling; such delays are implementation policies, not universal constants.

HOST -> ALL:
E0 FF 03 F0 D9 CB
   FF = broadcast destination
   03 = LEN (F0, D9, SUM)
   F0 = RESET
   D9 = required parameter
   CB = (FF+03+F0+D9) & FF

Ordinary per-node reply: none.

Assigning the first address with F1 01

F1 carries a one-byte proposed address. The address-01 request is E0 FF 03 F1 01 F4. Unlike reset, successful assignment is normally acknowledged by the eligible node, even though the request went to FF.

A normal F1 acknowledgement consists of packet status 01 and report 01, addressed to the host at 00. E0 00 03 01 01 05 is a calculated example. Do not increment the discovered-node count merely because a request was transmitted; validate reply length, SUM, status and report.

REQUEST: E0 FF 03 F1 01 F4
             |  |  |  |  +-- SUM F4
             |  |  |  +----- address 01
             |  |  +-------- command F1
             |  +----------- LEN 03
             +-------------- broadcast FF

REPLY:   E0 00 03 01 01 05
             |  |  |  |  +-- SUM 05
             |  |  |  +----- command report 01
             |  |  +-------- packet status 01
             |  +----------- LEN 03
             +-------------- host destination 00

What the Sega F1 handler enforces

The recovered SP5001-B F1 handler at ROM 0991 checks that address-state variable FF5A equals FF (unassigned) and that (P7 & 03) is not equal to 02. The exact wiring behind P7.0 and P7.1 remains incompletely identified, so this eligibility test must not be relabelled as a known voltage threshold.

On success it writes the requested address to FF5A, appends report 01 and sets bit P7.2. Independent board tracing shows that P7.2 controls the active SENSE sink. This board-specific source-to-hardware relationship is stronger evidence than assuming all JVS boards implement SENSE with the same circuit.

A board that accepts F1 repeatedly without a reset may pass simple software tests while differing from this original Sega firmware.

A second node requires a new eligibility decision

After a valid F1 acknowledgement the host observes SENSE again. If another unassigned downstream board is eligible, it broadcasts F1 with candidate address 02: E0 FF 03 F1 02 F5. The reply uses the same normal structure as the first acknowledgement.

An already assigned node must not claim the next broadcast. A real chain depends on proper downstream SENSE propagation and per-node address eligibility, not on sending F1 blindly to a shared serial bus.

If SENSE suggests an unassigned node but F1 gets no valid reply, report a discovery fault or follow the documented retry policy. If SENSE indicates completion, do not invent more nodes.

HOST -> NEXT UNASSIGNED NODE:
E0 FF 03 F1 02 F5
   FF = broadcast
   03 = LEN
   F1 = set address
   02 = proposed address
   F5 = (FF+03+F1+02) & FF

Recheck SENSE after a validated acknowledgement.

Query revisions before normal input polling

A node that accepted an address is not yet qualified for the host's preferred input commands. Read command-format revision 11, JVS revision 12 and communications revision 13; version fields use packed BCD, not plain decimal. Hosts may combine the three queries into one logical packet.

The calculated combined request to address 01 is E0 01 04 11 12 13 3B. A synthetic reply for revisions 1.1, 2.0 and 1.0 is E0 00 08 01 01 11 01 20 01 10 4D. There is one overall packet status and three success-report/data pairs in request order.

Check each command report independently. An overall normal packet does not make every command succeed; reject incomplete or mismatched revisions rather than silently filling a default.

REQUEST: E0 01 04 11 12 13 3B
SUM = (01+04+11+12+13) & FF = 3B

REPLY (example 1.1 / 2.0 / 1.0):
E0 00 08 01 01 11 01 20 01 10 4D
          |  |-----| |-----| |-----|
          |   RPT+11  RPT+20  RPT+10
          +-- overall packet status 01

SUM = (00+08+01+01+11+01+20+01+10) & FF = 4D
The three RPT bytes are 01 (command succeeded).

Read and validate the board identification

Command 10 returns a NUL-terminated board-identification string, commonly divided by semicolons into manufacturer, product, version and remarks. The host must find the terminator within a checksum-validated packet boundary, not assume a pointer refers to an unlimited trusted string.

Our Sega SP5001-B study identifies SEGA ENTERPRISES,LTD.;I/O 838-13683B ;Ver1.07;99/06. A Namco FCA-1 and the publicly captured Taito K91X1130A return different strings. Do not infer the exact installed firmware solely from a label on a PCB.

A public 98701-labelled converter returned an unexpected No Brand identity; the original reporter questioned its firmware provenance. Record the raw bytes and trace source rather than rewriting uncertain captures as factory claims.

Function command 14 builds the polling contract

Command 14 supplies function tuples, each made of code, parameter 1, parameter 2 and parameter 3. A single 00 byte ends the list. The host should reject a missing terminator, any record that crosses the payload boundary and any function claim inconsistent with the response length.

A synthetic two-player/ten-switch and two-coin capability set consists of 01 02 0A 00, 02 02 00 00, and terminating 00. The reply below shows the distinct packet status and per-command report. It is calculated, not an observed model of a specific board.

Only after parsing valid capabilities should the host choose switch, coin or analog polling parameters. Advertised features can depend on switch settings and firmware; they do not prove all cabinet wiring is populated.

REQUEST: E0 01 02 14 17
SUM = 01+02+14 = 17

REPLY:   E0 00 0C 01 01 01 02 0A 00 02 02 00 00 00 1F
          └─┘ │  │  └────────┘ └────────┘ │  │
          LEN ST RPT 01 02 0A 00  02 02 00 00  END SUM

01 02 0A 00 = 2 players, 10 switches/player
02 02 00 00 = 2 coin slots
00 = feature-list terminator
LEN = 0C, SUM = 1F

Namco WAJVIO: a concrete host timing case

Our static reconstruction of the Namco System ES WAJVIO Ver2.04 Windows host library finds an 18-state first-discovery machine, serviced on an approximately 16 ms worker tick. It issues a first reset after 30 ticks (~480 ms), another reset after 30 more and waits 40 ticks (~640 ms) before addressing.

After successful F1, it waits three ticks (~48 ms) before consulting SENSE for more nodes. A failed address operation enters a separate slow recovery lane with three 120-tick delays (~5.76 s nominal) around repeated resets. These are host-library-specific software-derived numbers; the serial link and Windows scheduler add time.

The library then reads combined revisions, individual board IDs and function lists before normal input polling. Its later recovery engine is a different 21-state machine that can re-address and revalidate saved identities. Do not present these delays or state counts as requirements for all JVS masters.

Troubleshooting and a defensible validation checklist

Keep four categories separate: electrical SENSE/RS-485 problems, framing/checksum defects, address-assignment failures and capability/command disagreements. No reply after valid F0 is ordinary reset behaviour; no valid reply after F1 requires investigating eligibility, timing or transport.

Save physical escaped wire bytes and decoded logical frames as different artifacts. Check the reply's destination, packet status, each report and checksum before using it; re-enumerate from reset after a bus fault rather than trusting stale address/input state.

Original Sega source and board observations support the SP5001-B gate and SENSE details; the Namco timing sequence comes from static software analysis; public board ID captures belong to their reporters. Our packet examples are calculated teaching data, not live hardware captures.

• Record host and game, I/O model, hardware revision and chain order.
• Validate address and checksum with synthetic fixtures before live hardware.
• Test reset, F1, SENSE transitions, 11/12/13, ID and capabilities in order.
• Treat driver-enable and 5 V SENSE as physical engineering, not software constants.
• Never connect JVS to ordinary USB or claim USB2JVS hardware qualification from source tests.