While i'm searching rom firmware ,i decided to investigate on commands data flow between CPU board , display ,keyboard , IR receiver (RC5 encoding) , Analog Board.
At the moment i've found in IC2Bus 7 timed access , 1 to 5 are blank(no data , only clock and data end bit),
6 do write operation at address 0xAE (may be Analog Board) 7 do write operationsat address 0x70 ( to display).
Keyboard is readed by a SAA3007 (infrared remote transmitter) and output go thru a 74HC132 (NAND) to a CPU pin P1.0 ,while ir receiver TDA3047P go to CPU P1.1 .
Conclusion : P1.0 and P1.1 are gpIO and in my mind i think philips used a ir encoding for keyboard to be able to read keyboard and remote in the same way , so i think the remote IR has the same infrared remote transmitter.
I have some waveforms of this but need to organize it , for the moment i will do a small remote with a pic 12f1840 to veryfy if what i think is true.
Soon i will post some waveforms.
Someone has a remote ir to read transmitted codes?
Best regard.. Claudio