Hey, look, it's only been two months! And this time I have a really juicy update!

I finally completed the schematics for ALL boards on the phone, including those pesky "hybrid" ceramic modules! Well, almost, the one thing that's missing is the ceramic module that contains the head amplifier/analog interface circuitry for the card reader; however, its inputs and outputs are pretty easy to identify based on the rest of the schematics, so we can basically treat it as a black box without any issue. (I did think about tracing it, but it has multiple layers on the same side of the module, so there's pretty much no easy way about it).

You can find the schematics on my Github, but here's some highlights:

The pesky ceramic modules

These are the modules that initially confused me: why did they go through all the effort and cost of putting SMD circuitry on a ceramic substrate instead of simply putting it on the main board?

Turns out the circuitry on those modules is what interfaces the delicate main board logic to the outside world. Basically, some of buffer all the inputs coming from the various switches, photointerrupters and the line interface board, to protect the main board, whereas someothers contain circuitry to buffer the outputs and to drive motors and actuators.

So the reason they're ceramhic has probably to do with better isolation and/or RF shielding.

LIOD

The LIOD (card reader) is a weird beast in itself. First of all, it's designed to be pretty much a self-contained system: it's got its own power regulation circuitry (it only takes power directly from the battery) its own MCU and ROM, and any communication with the rest of the phone goes through some buffers/drivers; however, contrarily from what I suspected, it doesn't actually interface directly with the "data communications" phone line. All of its digital I/O lines go through the small "LIOD interface" board to the main board and then to the main CPU card (HOWEVER, the other connector on the LIOD interface that according to the pictures I found online is for a "debit reader", does have a direct connection to the comms phone line; I've never seen that connector used for anything though)

Also, as I anticipated before, there's an expansion connector on the bottom of the LIOD board, which on one of my readers has an 8051 plugin module plugged in. I still have to dump the internal ROM from the 8051 (if it can even be dumped, it might have protection bits set), so I'm not sure what the module is used for; I however found it interesting that said 8051 is only connected to the main LIOD boarc with a handful of digital lines, all of which go directly either to I/O ports on the main MCU (except for the two TIMER/E signals).

The LIOD also has its own custom chip, this time from ST, marked "ICWA/B22WE9335". More on that later.

Mistery SCL1054 custom chip

From the die photos, it was pretty clear that this chip contains only digital circuitry. I initially thought this handled the data communication with the phone company; however, if you look at the schematics, the comms phone line is connected, through some optocouplers and buffering circuitry, to the main MCU. The SCL chip is instead connected to a bunch of digital inputs/outputs which go to sensors/actuators and to the line interface and LIOD interface boards. So is the chip just a bunch of glue logic to interface the Hitachi MCU's address and data busses to the various digital I/O lines + the "config" ROM and the external RAM? Or is it something smarter, so to speak, that is actually handling all the mechanical section's I/O independently from the main CPU? But, then, where would be the code for that be stored? The so-called config ROM is almost empty. It might be loaded at runtime in the external RAM chip, possibly, and that would explain the weird "activation procedure" I found in one of the manuals, which talks about the need of putting the phone in configuration mode and pressing a couple of buttons every time the backup batteries run out (or are disconnected for storage) before you can put the phone into service; however, this seems a bit too convoluted.
Again, more investigation required.

TPDC and Rotor OV

I managed to get my hands on pictures from the Rotor O.V. and from the TPDC. Looks like I was wrong about both.

It turns out the OV one is basically a normal Rotor 2 with a shiny new line interface card and a slightly newer revision of the digital main board with very little differences from the older Rotor 2 one (looks like they just added a two pin connector for some kind of expansion). The slightly different main board in OV might be reason I have two different CPU card variants (there's the variant I mapped in my schematics, which has a couple SMD chips under the ROM socked for address decoding, and there's a variant where those chips aren't populated and the decoding logic is bypassed by a jumper). Anyway, my previous theory that the Z80 on the line interface card was used to replace the main CPU in the system turns out to be completely wrong.

About the TPDC: I finally managed to find some decent photos of the inside and it turns out that it does indeed use the same line interface card as to the OV, BUT it's got a newer and much simpler main board (since it doesn't need all the sensor input/actuator driver circuitry used for handling coins), equipped with the same Hitachi MCU as the other phones and another "ICWA/B22WE9335" chip as found on the LIOD. Does this mean the B22WE9335 is a newer substitute for the SCL1054 chip? Not sure for now, but that's any hypotesis.