Decoding the PG-200

Just did something cool - I used a logic probe and decoded the PG-200 protocol :) I've identified the address of every switch, button and potmeter. However, since two of the rotary switch shafts on my PG-200 are loose, I have to get the multimeter out and do some measuring of the various position to verify that some of the logic measurements are correct.

So far I can tell the following about the PG-200 (partially from the service manual, partially from my research.

The manual says that the dataformat is asyncronous serial start-and-stop. The PG uses a 0 as a start bit and 1 as a stop bit (or stop period, as it runs untill a new start bit is encountered).

The data format is 9 data bits, no parity. The 8 first bits are address or data bits, the 9th selects either data or address. 1 is address, 0 is data.

Each potmeter sends two frames, one with the address and the second with the value
Switches are sent as three frames and are grouped as they only require 1 bit per state (or two for up to four states as is the case with the rotary switches). The first frame is the address of the group, the second is a bitmask saying which bits in the third frame to look at, the third frame is the state of all switches within that group.

From experimenting I've figured out the following:
The output from the PG is inverted, 0 is high and 1 is low
The bitrate is 31.5kb/s, which makes sense since the transfer line is connected to the same data RX line as the MIDI in (which of course is also 31.5kb/s

There are three switch groups, with addresses 1-3
There are 18 potmeters with addresses from 16 to 33

I will add the addresses and bits in groups for all controllers as soon as I have decoded the last rotary switches.