Home Page

TMS-09xx/1xxx thread (was New Dumps)

Posted By: seanriddle

TMS-09xx/1xxx thread (was New Dumps) - 11/23/14 12:07 AM

Originally Posted By hap

Hmm, wizatron issue could also be due to how the digit leds work. They obviously should take some time to decay so strobing them doesn't look like a flickering disco. Maybe related to that.

TI-1270: do you have the post-acid pic? I can see the microinstructions, but barely see the output pla and main opcode pla.

Yeah, the change to SETR and removal of RSTR may have something to do with it. I still haven't read enough to understand that change yet. I don't have any working TMS-0970s left, but I have a couple of TMS-0980s, which likely output the same. I could do some logic captures if you think it might help.

I uploaded the TI-1270 post-acid pic.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/14 11:11 AM

I looked at the Stop Thief output PLA and found 0-9, C, d, F, G, t and blank. But the game also displays - and r. Do you know how? The TMS1x00 output PLA used the 4-bit accumulator and the status flag to index into a 20-byte table of outputs, but I only see 16 outputs on the Stop Thief die.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/14 04:29 PM

It doesn't work the same way as TMS1000. Instead of outputting all segments at once, it updates digits per-segment. This way, it's possible to make a digit partially blank.

It's not that simple. There are 2 PLAs involved, the segment PLA and output PLA. The chip checks for a coincidence between the two to determine whether or not a digit should be updated.

For details, see TI-30 patent description of fig.13
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/14 09:22 PM

OK, so you could tell it to display 8, but only segments e and g, and that would display r?

Stop Thief's segment decoder has different patterns for several digits- 6 and 9 don't have the "tail" segment (a for 6 and d for 9), and 1 is scooted to the left, using segments e and f instead of b and c. It also has a C (adef), d (abcdg), F (aefg), G (acdef), and t (defg). The game also displays - and r which aren't in the segment decoder.

I uploaded ROM dumps for TI Programmer and Business Analyst I, and updated the pinout files and output PLA info. I need to clean the output PLA of TI Programmer to transcribe it, although I think we know enough to reconstruct it if need be. Along with 0-9, it displays A b C d E and F.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/24/14 02:51 AM

"OK, so you could tell it to display 8, but only segments e and g, and that would display r?"
Yes I believe so. Though I don't have anything with TMS0980 emulated yet to confirm it (I only have TI-30 hooked up, but it gets stuck in a loop very quickly).

BTW I forgot to ask before: could you also post your script (or description with pseudo code) to convert a raw dump to tms1000-order dump?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/24/14 05:51 AM

Here's the pseudocode. It's just a few loops around the code I posted before:

Code:
roworder[]={
  3  4 11 12 19 20 27 28 35 36 43 44 51 52 59 60
  0  7  8 15 16 23 24 31 32 39 40 47 48 55 56 63
  2  5 10 13 18 21 26 29 34 37 42 45 50 53 58 61
  1  6  9 14 17 22 25 30 33 38 41 46 49 54 57 62
}
  
rx=0
for chapter=0 TO 1	// TMS1100 has 2x ROM
  for page=0 TO 15	// 16 pages in each row
    for pc=0 TO 63	// 64 rows = program counter
      for bit=7 to 0 step -1
        if page<8
          rawbitindex=chapter*8192+roworder[pc]*128+bit*16+page
        else
          rawbitindex=chapter*8192+roworder[pc]*128+bit*16+23-page
        endif
        rom[rx]=rom[rx]*2+rawbits[rawbitindex]
      next
      rx=rx+1
    next
  next
next
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/24/14 04:27 PM

Ah, right.
Anyway, buttons (1/x), (x^2), and 3,6,9 don't work right on my ti1270 emulation. I checked the bits on the die pic under the smudge for faults. I found 1 bad bit! But frown seems to have no effect at all on the emulation.

ti1270raw.bin offset $174, change $11 to $51.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 12:36 AM

Status update of tms0980.c rewrite:
- microvsn, merlin, simon: work as good as before
- tisr16: boots, can input numbers, but lots of bugs and can't do calculations. If it's an emulation problem it's strange, since others with tms1xxx work well. I see black lines on the die pic, is it possible your rom extract algorithm gets confused there?

- wizatron: works
- comp4: works
- cnsector: at first glance, it works. Still need to flesh out the MESS driver.
- ti1270: boots, can input numbers and some calculations, but some buttons don't work (see above, it's as if they function as RCL and STO)

- ti30, tiprog, tibusan1, stopthie(also the patent one): execute nonsense code and get stuck in a loop quick. Either CPU emu problem or the word/bit order is different.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 12:50 AM

Originally Posted By hap
Ah, right.
Anyway, buttons (1/x), (x^2), and 3,6,9 don't work right on my ti1270 emulation. I checked the bits on the die pic under the smudge for faults. I found 1 bad bit! But frown seems to have no effect at all on the emulation.

ti1270raw.bin offset $174, change $11 to $51.

D'oh- sorry about that bit. I just checked the full die again and I didn't notice any other errors.

That's a weird collection of buttons not to work- I'd expect a full row or column, not a mix of buttons on 3 different columns and 4 different rows.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 12:57 AM

Originally Posted By hap
Status update of tms0980.c rewrite:
- microvsn, merlin, simon: work as good as before
- tisr16: boots, can input numbers, but lots of bugs and can't do calculations. If it's an emulation problem it's strange, since others with tms1xxx work well. I see black lines on the die pic, is it possible your rom extract algorithm gets confused there?

- wizatron: works
- comp4: works
- cnsector: at first glance, it works. Still need to flesh out the MESS driver.
- ti1270: boots, can input numbers and some calculations, but some buttons don't work (see above, it's as if they function as RCL and STO)

- ti30, tiprog, tibusan1, stopthie(also the patent one): execute nonsense code and get stuck in a loop quick. Either CPU emu problem or the word/bit order is different.

Cool!
The SR16 die got stuck on the metal frame and cracked, which are the lines you see. I thought everything was readable, but I'll double-check.
Maybe the Stop Thief patent code is in LFSR order, not execution order. I reordered the raw 0980 bits to match it, so that would explain why they all wouldn't work.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 03:55 AM

I verified the SR16 ROM dump. I also confirmed that the ROM word address decoder is the same as other TMS-1000s. The instruction TDO is modified from a standard TMS-1000 to also decrement Y, but that's the only difference I've found.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 06:04 PM

I got a better view of the TI Programmer output PLA. Not great, but what I transcribed makes sense. Here are the bits from top to bottom, left to right:

00100000 01101001
00000000 10101001
01100101 01010110
11011110 01010101
10000000 10010110
10001000 10010101
10100000 01100110
00000110 01100101
01100010 10100110
10001001 10100101
00100100 01011010
10000010 01011001
00001100 10011010
01000000 10011001
01100111 01101010
00000001 10101010

This maps to
9 9
8 8
7 7
F r
6 6
E E
5 5
D d
4 4
C C
3 3
B b
2 2
A A
1 1
0 0

It's interesting that they used 0xF for "r" instead of "F", since "r" is only used to display "Error".
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 06:42 PM

Got it, thanks!

You reordered them upside-down, I suppose?
FWIW this is my temp. one. I rotate the die pic so RAM is at bottom-right and literally type the bits manually.

Code:
or?:        and?:(assume default)
            n  n  n  n
00000001    10 10 10 10
01100111    01 10 10 10
01000000    10 01 10 01
00001100    10 01 10 10
                       
10000010    01 01 10 01
00100100    01 01 10 10
10001000    10 10 01 01
01100010    10 10 01 10
                       
00000110    01 10 01 01
1010....    01 10 01 10
10......    10 01 01 01
........    10 01 01 10
                       
........    01 01 01 01
........    01 01 01 10
........    10 10 10 01
........    01 10 10 01
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/14 10:29 PM

Gotcha- I left the die so the text is upright (with the RAM in lower left), then read the bits TtoB, LtoR. That is the same as rotating the die CCW 90 degrees and reading the bits LtoR, BtoT.

4-5 of the bits are really still unreadable, but they are in the digits 9-8-7, so there's not really any question. And the ones in the AND section can be deduced if you can see the adjacent bits. Next time I use some acid on a chip I'll give this one another minute to be sure.

I was thinking some more about the 0980 word order. I used the ROM word address decoder to reorder the bits, and that made it match the patent word order, so that makes me think that it is correct. The object code in the Star Wars patent specifically stated "Program Counter Sequence" - I wish this one did, too.

I guess another possibility is that reset starts execution somewhere else. The other games start out by initializing RAM, so these should, too.

Do your changes allow disassembling the 0980 code so we can see if it makes any sense?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/26/14 12:36 AM

Nope, the disassembler/debugger is still not very good. Though I can see there are no 'illegal' instructions in your raw_to_980 conversion, so that part should be good.

Could you post your algorithm of it? Maybe I can try out a few combinations.

*edit* ok, i tried the 16 possible reset vectors for the current 0980 dumps(set pa/pb at reset, default value: $0F), none of them init RAM
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/26/14 10:44 AM

I just found in US4064554 that the 0980 program counter and ROM page address register are both set to 0 by power-up clear circuitry.

Now I've confused myself about "program counter sequence". I interpreted that to mean execution order, but the bytes in the Star Wars patent 4270755 are in the same order as I read them off the die, which is not execution order. The 6-bit LSFR sequence has to be used to execute them.

For the 0980, are you using the 7-bit LSFR sequence that the circuit in Fig 19 generates?

0 1 3 7 15 31 63 127 126 125 123 119 111 95 62 124
121 115 103 79 30 61 122 117 107 87 46 92 56 112 97 67
6 13 27 55 110 93 58 116 105 83 38 76 24 49 98 69
10 21 43 86 44 88 48 96 65 2 5 11 23 47 94 60
120 113 99 71 14 29 59 118 109 91 54 108 89 50 100 73
18 37 74 20 41 82 36 72 16 33 66 4 9 19 39 78
28 57 114 101 75 22 45 90 52 104 81 34 68 8 17 35
70 12 25 51 102 77 26 53 106 85 42 84 40 80 32 64
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/26/14 03:26 PM

doublechecked, yes I am.
Underneath, the LFSR is exactly the same as TMS1000, just 1 bit more.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/26/14 11:25 PM

Grasping at straws, have you tried executing the bytes sequentially, not using the LFSR sequence? The 0980 ROM array rows are in a different order from the TMS1000/1100/0970, so maybe???
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/26/14 11:43 PM

yup, i've tried that too.
Could you post your algo for converting 0980 raw to good?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/27/14 12:26 AM

Here you go. It's very similar to TMS1000 of course, except no chapter bit, PC goes to 127, and there are 9 bits instead of 8.

Code:
rx=0
FOR page=0 TO 15    && 16 pages in each row
  FOR pc=0 TO 127	&& 128 rows = program counter
    FOR bit=8 TO 0 STEP -1  && 9 bit ROM
      IF page<8
        rawbitindex=pc*144+bit*16+page
      ELSE
        rawbitindex=pc*144+bit*16+23-page
      endif
      rom[rx]=rom[rx]*2+rawbits[rawbitindex]
    NEXT
    rx=rx+1
  next
NEXT
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/27/14 06:33 AM

Ok, TI-30 is alive here, but with bugs due to incomplete emulation I assume (microinstructions like SSS and CME). I'm also not sure if page decoding is correct yet. Row decoding should be right though. It's the same as on TMS1000.

That big lookuptable is basically a translation of the 1-of-32 selector, right?

10000 16 -> roworder[16+0]=0, roworder[16+32]=1
00000 0 -> roworder[0+32]=2, roworder[0+0]=3
00001 1 -> roworder[1+0]=4, roworder[1+32]=5
10001 17 -> roworder[17+32]=6, etc.
10010 18
00010 2
00011 3
10011 19
...

On TMS0980, the 1-of-64 selector is sequential (0,1,2,3,4,...), so decoding it is not as complex.

Code:
	int lut1[2]={0,3};
	int lut2[2]={1,2};

	for (page=0;page<16;page++)
	{
		for (pc=0;pc<128;pc++)
		{
			for (bit=8;bit>=0;bit--)
			{
				int myrow=pc;
				if (myrow<64) myrow=(myrow&0x3e)*2 +lut1[myrow&1];
				else myrow=(myrow&0x3e)*2 +lut2[myrow&1];
				
				int mypage=page; // TODO/verify

				mypos=myrow*144+bit*16+mypage;
				mybit=in_raw[mypos/8]>>(mypos&7)&1;

				outpos=page*128+pc;
				out_dump[outpos]=out_dump[outpos]*2+mybit;
			}
		}
	}
Posted By: etabeta78

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/27/14 07:02 AM

thumbs up! the work so far is amazing! thanks to both of you
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/27/14 08:30 PM

I wanted to be sure there are no bugs left with TMS1000/0970 emulation before starting on getting TI-30 working. I couldn't find any in the code, so I had to look for errors in the die-to-rom translation.

I checked tisr16, comp4, wizatron, ti1270.

sr16_raw: change offset $114 $db to $eb. change offset $3e0 $d2 to $e2.
comp4: change offset $3b5 $54 to $74.
wizatron: no error found.
ti1270_raw(initial ver!): change offset $174 $11 to 51. change offset $3e6 $f7 to $47.

ti1270 and sr16 problems i reported the other day are gone now. I hope this helps to improve your bitfinder tool. Also, maybe you can make the tool modify the image it searches to write an alpha blended mask over the found bits? This way it's much easier to see errors by eye. We should doublecheck all dumps smile

I'll check the ti30 image next. Boring work but I need to be certain the dump is correct when improving currently-incomplete 0980 emulation.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 12:22 AM

Originally Posted By hap
sr16_raw: change offset $114 $db to $eb. change offset $3e0 $d2 to $e2.
comp4: change offset $3b5 $54 to $74.
wizatron: no error found.
ti1270_raw(initial ver!): change offset $174 $11 to 51. change offset $3e6 $f7 to $47.

ti1270 and sr16 problems i reported the other day are gone now. I hope this helps to improve your bitfinder tool. Also, maybe you can make the tool modify the image it searches to write an alpha blended mask over the found bits? This way it's much easier to see errors by eye. We should doublecheck all dumps smile

I'll check the ti30 image next. Boring work but I need to be certain the dump is correct when improving currently-incomplete 0980 emulation.

Aw, crap! I had changed those 2 bits in the SR16 raw file, but hadn't updated the reorganized ROM dump on my web site. Sorry about that! I fixed the CompIV and TI1270 bits you found. I had looked at those files several times but didn't see anything wrong.

I have 2 programs that display parts of the ROM array pic overlaid with the bits from the raw dump file- one shows 8 bits at a time, and the other shows about 2000. I was hopeful that looking at them both ways would reduce the risk of missing some bits, but obviously more eyes are needed.

I'll also check the 0980 dumps again.

You need to double-check all the Microvision dumps now! smile

Thanks!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 05:15 AM

Urg- 6 bit errors in TI-30:
$21C from $46 to $56
$49D from $CC to $CD
$500 from $C3 to $A3
$51C from $14 to $94
$5D1 from $10 to $90
$783 from $20 to $10

5 errors in Stop Thief:
$1ED from $04 to $05
$2CA from $62 to $72
$4E5 from $C0 to $C1
$87C from $55 to $D5
$8A4 from $02 to $2D

2 errors in TI Business Analyst I:
$06F from $C8 to $C9
$72B from $44 to $45

No errors found in TI Programmer, but I need to check a few obscured bits.

No errors found in Code Name: Sector.

I put new raw and cooked files on my web page.

I picked up a Coleco Amaze-A-Tron; it's another Ralph Baer game that has a TMS-1100. It should be warm this weekend to get it decapped.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 03:44 PM

TI-30, yup, confirmed. Also found $6d9 from $4f to $5f.

BTW I wonder which commercial product was the 1st use of TMS1000 series mcu. That should be interesting to see if it has differences compared to newer ones. **edit**: oh, I'm reading that it was the SR-16.

TI-5025 looks curious too, it's like a 0980 but the output PLA differs.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 05:03 PM

I'm morbidly curious about the Speak and Spell now, since afaik the TMC0270 cpu it uses is a hybrid of the cpu portion of the tms0980 (9-bit words), the VFD drivers of the tms1100 (0980 normally can only drive an LCD), a very large output PLA (handles A thru Z, 0 thru 9, ', _, +, -, and maybe one other symbol which isn't used?), and a bunch of added logic to re-use a few of the segment pla pins as a direct i/o output from the accumulator to talk to the tms5100 chip and read back speech status from it overriding the usual K input bus.

The segment outputs of the PLA are listed here (from experimentation on a 1978 'test release' speak and spell which has a slightly different rom from the later ones):
https://dl.dropboxusercontent.com/u/79094972/Speak%20and%20spell%20segment%20PLA.txt

Pinout for tmc0270 (based on a bunch of sources but no decap yet) is here:
https://dl.dropboxusercontent.com/u/79094972/TMC0271NL%20pinout%200.9h.txt

LN
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 05:31 PM

Also what is on the tms1000 M32018 die?

http://www.visual6502.org/images/TMS1000/TMS1000_20x_1b_6500w.jpg

I'm not sure what game or device that chip is from. We have another intact M32018 masked chip if anyone wants to probe it some...

LN
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 06:16 PM

L_N: if that's all true I imagine these guys could have one playing in MESS in like a week given a chip to decap.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 06:20 PM

SPEAK & SPELL!!! Let's get it done! laugh
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/14 06:36 PM

Originally Posted By hap
TI-30, yup, confirmed. Also found $6d9 from $4f to $5f.

TI-5025 looks curious too, it's like a 0980 but the output PLA differs.

D'oh!

I got the TI-5025 on accident. I won an auction for a TI 5050M, which uses a TMS1100, but was sent the 5025 instead. The 5025 has a VFD and built-in printer.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/29/14 12:39 AM

Originally Posted By Lord Nightmare
Also what is on the tms1000 M32018 die?

http://www.visual6502.org/images/TMS1000/TMS1000_20x_1b_6500w.jpg

I'm not sure what game or device that chip is from. We have another intact M32018 masked chip if anyone wants to probe it some...

LN

That's the one that Kevtris sent to the Visual 6502 guys. I transcribed the bits and ran it in my little TMS1000 emulator, but didn't figure out what it did. Could be a game - some of the Microvision carts have 5 digits, and Cosmic Hunter is labeled M34017. Or it could be a microwave oven controller smile I uploaded the ROM dump, but it might have some bit errors. It's harder to check because the only pictures are of the top metal layer. http://www.seanriddle.com/tms1000.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/29/14 12:41 AM

Originally Posted By Lord Nightmare
I'm morbidly curious about the Speak and Spell now <snip>
LN

I feel dumb- I thought SnS was all figured out. I'll see if I can get one for not too much dough.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/29/14 08:56 PM

I didn't see K1/2/4/8/3 in your 0980 hw descriptions, so, FYI here they are for ti30 and tiprog (probably others too).
// pin 10 k1
// pin 9 k2
// pin 8 k4
// pin 7 k8
// pin 6 k3

TI0980 emulation is pretty much working here. The algorithm to convert the raw dumps to 0980 is still valid, except for this line:
int mypage=page; // TODO/verify
change it to this:
int mypage=(page<8)?(page^7):page;

And by the way, do you have a die pic for that TMS1100 Star Wars game? The dump should be correct, but we don't have the PLAs.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/29/14 09:29 PM

Lord Nightmare: mayhaps Speak & Spell mcu core is the same one TI-5025. That one has loads of output PLA terms. **edit**: 32 terms, "0262C, T 0260A" marked on die

see pic on sean's site, on this page http://www.seanriddle.com/ticalcs.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/30/14 12:06 AM

Great!

TI30, Programmer and Business Analyst I all use the same PCB, so their pinouts should be identical.

So the page "reversal" is different from the other chips, huh? The TMS1000, 1100 and 0970 pages are arranged 0-7 then 15-8.

Can you upload or email me one of the ROM dumps that you have reordered properly?

All I can find is a top metal shot of Star Wars: http://www.seanriddle.com/mp3438a_rough_2k.jpg

I'll see if I've got a full post-acid scan that I can assemble. If not, I'll probably just shoot the instruction and output PLAs.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/30/14 12:11 AM

Originally Posted By hap
Lord Nightmare: mayhaps Speak & Spell mcu core is the same one TI-5025. That one has loads of output PLA terms. **edit**: 32 terms, "0262C, T 0260A" marked on die

see pic on sean's site, on this page http://www.seanriddle.com/ticalcs.html


I'm *guessing* the tms0260 is the immediate predecessor of the speak and spell MCU which is tmc0270 (well, ti numbered the first few masks of each chip by incrementing the last digit i.e. tmc0271 tmc0272, tmc0274 etc, though later chips are tmc0270-xyz)

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/30/14 01:13 AM

Ok, email sent to the address on your webpage index
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/30/14 06:39 AM

Got it, thanks! I updated my converter program to match. I found 2 bits in TI Programmer that were obscured by dirt: $3CB from $81 to $A1 and $3EF from $03 to $13.

I decapped the Amaze-A-Tron TMS1100 but the top metal layer is pretty dirty, so I'm going to try to clean it in H2SO4 to get a nicer pic before using Whink to remove the metal.

I uploaded the Star Wars Battle Command instruction and output PLAs: http://www.seanriddle.com/tms1100.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/30/14 07:43 AM

Ok, Starwars microinstructions are the same as standard TMS1100, just in a slightly different order. (kinda same case as Simon)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/01/14 09:05 PM

The tms1xxx rewrite is uploaded finally, see:
https://github.com/mamedev/mame/blob/master/src/emu/cpu/tms0980/tms0980.c

And for the TI calculator driver, see:
https://github.com/mamedev/mame/blob/master/src/mess/drivers/ticalc1x.c
(ah I see I still have to do the default button mapping)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/02/14 10:10 PM

Thanks! I've been busy with work, but I got Amaze-A-Tron decapped and photographed. I'll composite the pictures and dump the ROM and post on my web page. I also bought Maniac, which is another Ralph Baer TMS-1000 game. And I picked up a couple of Speak and Spells. They should get here in a few days.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/03/14 03:11 AM

Ok, we finally have a decap of the TMC027x/TMS027x/CD270x die:
http://siliconpr0n.org/map/ti/cd2708n2l/top_metal_mit20x/

This is the die from the Speak and Math (French/Canadian version), CD2708N2L.

Note that the Speak and Math (USA) version uses an MCU labeled CD2704 so there probably is some as-of-yet unknown code change between this die and the USA one.


Comparing it to Sean Riddle's decap of the TMC0260 from the TI 5025 (see http://www.seanriddle.com/ti5025fulldie.jpg ), this die is definitely based on the tmc0260, but with more ROM, more RAM, and everything moved a bit farther apart from each other to make space for the extra routing lines etc. The segment PLA is larger with 48 terms instead of 32.

It uses 9-bit ROM words like the TMS0980.

The Segment PLA of the CD2708 probably does not match the speak and spell Segment PLA as it should have a few more math related characters in it.

The pinout of the CD2708 should match or nearly match the TMS0270 pinout, there may be a minor difference to allow driving a 9th digit of the VFD.

NOTE: the pinout chart of the TMS0270 I made was created before this decap was done and is likely to have errors and omissions! Do not hesitate to make corrections and/or stick the diagram in the MESS source code somewhere.


There is a patent on the Speak and Math which includes a code listing which should match (probably) the CD2704 USA version, US Patent 4,970,659 http://www.google.com/patents/US4970659. The source code is in the text area as a TABLE so it doesn't show up in images in Google patents, so best is to use pat2pdf.org instead http://www.pat2pdf.org/patents/pat4970659.pdf

As far as I know, the Speak and Math code has never been typed up like the Speak and Spell patent code has been.


There are two different sets of two VSM(TMS6100 or TMS6125) speech ROMs for the Speak and Math:

CD2392 and CD2393 are two 16KiB VSM ROMs used on the apparently older speak and math units.

CD2381 and CD2614 are a 16KiB and a 4KiB VSM ROM respectively used on the apparently newer speak and math units, despite the first VSM being a lower number than the other two from the 'apparently older' units. (There's probably a story here...)


LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/03/14 03:52 PM

Nice! That decap should be useful (sean: hopefully you didn't purchase this specific revision =p)
I see they changed the way the TDO opcode works again. And it looks like RSTR opcode is back too. (I can't see RSTR on the instruction decode tho)

*edit*
Quote:
this die is definitely based on the tmc0260, but with more ROM, more RAM
0260 and 0270 have same amount of ROM and RAM as 0980.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/03/14 07:20 PM

Originally Posted By Lord Nightmare

There is a patent on the Speak and Math which includes a code listing which should match (probably) the CD2704 USA version, US Patent 4,970,659 http://www.google.com/patents/US4970659. The source code is in the text area as a TABLE so it doesn't show up in images in Google patents, so best is to use pat2pdf.org instead http://www.pat2pdf.org/patents/pat4970659.pdf

As far as I know, the Speak and Math code has never been typed up like the Speak and Spell patent code has been.


...That's the wrong patent (it contains the speak and spell code), due to a now-corrected error in my notes.

The correct patent for Speak and Math is US Patent 4,946,391 http://www.google.com/patents/US4946391 http://www.pat2pdf.org/patents/pat4946391.pdf

The code starts at pdf page 23 and there's a lot of headers/comments/address map info which even the speak and spell source code lacks, which should be quite helpful.

A k-line to keyboard map/schematic is in there too (in ascii-art), as well as a symbol lookup for the Segment PLA.

LN
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/05/14 06:55 AM

sean: can you get scans of the playfield, the control panel and the instructions for codename: sector?

There was a remake which had some nice (but not accurate except maybe the compass rose and some of the button art) artwork done up for it by CaptGlub AKA Captain Crybaby which used to be hosted at http://web.archive.org/web/20131208005953/http://stillmixtup.com/CNS.html which had some scans of the manual, playfield and the playfield reconstruction.

Unfortunately, none of those docs nor the executable seem to be up on archive.org and the site is down. I may see if I can ask CaptGlub if he can rehost the data if he still has it.

EDIT: Hasbro has a copy of the manual up, though it is a black and white scan, while I think the original was color:
http://www.hasbro.com/common/instruct/codenamesector.pdf
We still need a good scan of the playfield, preferably in color, and of the control panel (which due to its angle is probably best photographed rather than scanned)

LN

P.S. Do you have a copy of the manual and grid pad for Star Wars: Electronic Battle Command?

P.P.S: Are all the bits right in the Codename: sector rom dump? The game starts up after reset (and in teach mode) in MESS with Ship 1 at 35,24, which is wrong; the ship should start at 35,25 in both cases.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/05/14 05:27 PM

Sean already double-checked codename sector dump. If you want to check too, this is my method: compare the bits with the rom array acid pic. (for 0970, takes about an hour for me)

http://pastebin.com/mYXcFCTa

*edit* I will doublecheck it later myself, and stopthief too http://pastebin.com/69CGSKC3 the more eyes to doublecheck the better..
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/06/14 01:00 AM

cnsector(raw) change offset 3e6: 0e to 0f

Next stop is stop thief :|
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/06/14 07:53 AM

Sorry, I've been busy, and I've probably got another week of it.

Hap- thanks for the CN:S bit.

LN- I've got a used CN:S from ebay that is in OK shape. I'll scan the parts and manual. The SW:EBC is pretty rough (I go for the cheapest ones I see since I'm just going to ruin them), but I can scan it until something better comes along. No manual, though.

I got one of the S&S units- non-working, but good case. 4 chips on the MB and a "Vowel Power Word Module" plugged into the expansion port. 40 pin DIP TMC0271NCL NBS 7910, 28 pin DIP TMC0351NL NBU 7906, 28 pin DIP TMC0352NL DAU 7901, 28 pin SDIP TMC0281NL D 7906. Vowel Power has 28 pin DIP TMC0350NL CD2302 DAU 7914. I haven't desoldered them yet to see what's on the bottom.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/06/14 07:29 PM

No problem. In the meantime, I got all dumped games to working state in MESS. Except for the stopthief patent listing.
Speaking of stopthief, I'm pretty certain there's a bit under the bigger smudge (cf instead of 8f).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/06/14 08:36 PM

Yep, definitely CF.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/07/14 03:35 AM

Originally Posted By seanriddle


I got one of the S&S units- non-working, but good case. 4 chips on the MB and a "Vowel Power Word Module" plugged into the expansion port. 40 pin DIP TMC0271NCL NBS 7910, 28 pin DIP TMC0351NL NBU 7906, 28 pin DIP TMC0352NL DAU 7901, 28 pin SDIP TMC0281NL D 7906. Vowel Power has 28 pin DIP TMC0350NL CD2302 DAU 7914. I haven't desoldered them yet to see what's on the bottom.


That is a very early speak and spell; that very likely has the location test 1978 firmware rather than the final late 1979-1980-onward one. (in confusing ti fashion, both cpus are called TMC0271N; the TMC0351 and TMC0352 VSM roms on the location test and final firmware are also different with the same part numbers. Yay TI for confusingness. The newer parts are SDIP on mine though while the old location test parts I believe are DIP, as on yours.)
Can you check the back red plastic case of the speak and spell, the lower left corner should have a code impressed in it.
On my location test unit with buttons, it says: MTA1179 (USA) (1979 week 11)
The 'final firmware' one with buttons says PII8020 (Philippines) (1980 week 20)
So it is VERY likely the one you have has the location test firmware!
Later ones made after mid 1980 use a membrane keypad instead of buttons, and have HALF AS MANY WORDS! (and 1 instead of 2 vsm roms! yay for cost-cutting!)

If the speak and spell could be made to work, there's an easy way to tell if it is location test or final firmware:
Put batteries in it, and without the vowel power or other module in it, press 'module select', then press 'spell it'
If it is the 1978-1979 location test firmware (which I'm guessing it is), it will say 'spell it', then a complete gibberish word. Advancing words will cause more gibberish words to be spoken, often with impossible characters such as numbers in their spelling.
If it is the 1979-1980+ final firmware, it will not do anything (no sound at all, if no module is inserted) on pressing module select. Spell it and other modes will continue to use internal words.

Also, on the 1978-79 location test firmware, pressing module select with a module in place has no feedback at all other than all new words come from the module.
On 1979-1980+ final firmware, you will get the '4 tones' sound played when you press module select and a module is inserted.

Addendum: The Location test firmware was famously shown on the Today show (where I believe someone demonstrated the bug/lack of checking of the cart presence). I call it the 'location test' firmware since it was used in 10,000 or so units given to parents and students in several cities in Texas and other states for parent-student usage testing in mid 1978. The units were I believe sold holiday 1978 and onward, and technically the first big batches of units up until sometime in 1979 still have the old firmware.

P.S. The TMC035x VSM ROMs (AKA TMS6100 when sold to non-consumer division customers) are dumpable with an arduino/pic microcontroller/etc without decapping (though they use odd logic levels for input and output, and the power pins are odd too: VDD is -9v and VSS is 0v; see http://www.ti99.com/exelvision/website/telechargement/tms6100-80-data-manual.pdf ). I'm curious if the onboard roms and vowel power cart you have matches the ones that have been dumped already, or are different. In particular, Vowel Power was the first cartridge made, and has 2 or 3 words in it disabled in the dump we have (the word index tables are patched so those words are never called, and are replaced by duplicates of other words on the cart; the word LPC and spelling data still exist, though).

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/08/14 12:00 AM

This case has MTA1279 (Midland Texas America, 12th week 1979) stamped on it. There is also a sticker on the back "NOTICE Sometimes your Speak&Spell will turn on in the "SAY IT" mode instead of the "SPELL A" mode. When this happens, you should press the # key and then the ON key again. Press GO to start the activity." It doesn't power up- no display or sound - I haven't tried to figure out why. I will try to dump the ROMs before decapping the chips. Another unit is on the way with broken buttons, so I was going to swap parts until I get a working one, then decap the other.

I hadn't read Gene Frantz' article until this weekend. Pretty interesting: http://cnx.org/contents/b3014cd9-6e3a-474f-bbaa-c948cbc8e205:1/The_Speak_N_Spell_
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/08/14 04:06 AM

So yours was put together one week after mine, and mine has that same sticker on the back as well. I suspect both have the location-test/early firmware.

The schematic for the speak and spell can be found here:
http://furrtek.free.fr/noclass/speakandspell/sns_full.png
and a low quality scan of the less accurate (several errors) older schematic from the book "Electronically Speaking" by John P. Cater (ISBN: 0-672-21947-6) here: http://www.casperelectronics.com/images/other/schematics/spknspl.jpg

I would check the power getting from batteries to the board as well as the tmc0271 pin 37 signal which tells, under software control, the power supply to shut off after a certain timeout, and the power supply module itself (whose schematic is on the furrtek schematic, the top link).

Also check the speak and spell for 'bending damage' from 'circuit benders' mutilating the hardware because they have no idea what they're doing. Depending on what was done this can be easy to fix or very difficult.

LN
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/09/14 05:53 PM

Originally Posted By Lord Nightmare
I'm curious if the onboard roms and vowel power cart you have matches the ones that have been dumped already, or are different.


I also dumped at least one Vowel Power cart and it matched your CRC (C9B82E72)... I might have more than one. dont recall If I've compared all of them on my dumping setup.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/10/14 09:01 AM

I got another S&S- this one works, but is dirty and many buttons are broken. No Word Module. I'll swap parts and make one good one. Date code is MTA4078, and the date codes on the chips are several weeks earlier than the other unit. Board is revision 1D versus 3G on the other. An obvious change is the trace to pin 18 of the VFD has been cut and a resistor put inline. Flux around the display pins, so I guess it was replaced. Speaker wires were also resoldered. Everything else looks stock. Chips are the same numbers as the other unit, but earlier date codes.

Also got a Maniac game, designed by Ralph Baer (RIP).
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/10/14 07:56 PM

Originally Posted By seanriddle
Chips are the same numbers as the other unit, but earlier date codes.


This is problematic, as I've noticed that the tmc0351 and 2 from a MTA1179 board and the tmc0351 and 2 from a 1980 board do not have the same contents, but do have the same part numbers. Same with the TMC0271 from the MTA1179 (which has the module 'bug') and the one from the 1980 board (which doesn't).
(maybe at some future date we can try to dump them? I think it may be possible to do using probes on the 4 data lines and otherwise through the edge connector itself)

LN
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/12/14 03:56 AM

I need to remember to check the forums more often. Thanks for decapping those TMS chips, Sean, and to everyone helping with reading and emulating them. There were a lot of interesting devices using these MCUs.

Do you still have the APF Mathemagician games from incog? Those use a TMS1100.

http://www.mess.org/people/incog#apf_mathemagician

http://www.handheldmuseum.com/Misc/APFMathemagician.htm
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/12/14 11:33 AM

I sent that one on to Kevtris, and he was able to dump it with his beast (http://blog.kevtris.org/blogfiles/allpro88/)

This folder has most of his TMS work: http://blog.kevtris.org/blogfiles/TMS1000/

It looks like his multi-platform hardware emulator is coming along nicely, too.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 07:01 PM

Does anyone have the manual for APF Mathemagician? I have no clue at all how to play this.. nothing on YouTube either
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 07:45 PM

Good to hear, Sean. Is there any sort of list for wanted TMS chips (or other microcontrollers)? You might find some interesting items on this page:

http://www.mess.org/dumping/have

I don't know that I have any more TMS chips. I do have a few old handhelds, like Mattel Auto Race, which is a really early electronic game. Here is an interesting interview with the programmer:

http://www.digitpress.com/library/interviews/interview_mark_lesser.html

hap, I know that the Mathemagician had overlays for various games. I'm not sure exactly how it worked, though.

https://www.flickr.com/photos/68858344@N05/6537511313/in/photostream/

Incog had some overlays. I haven't seen him on here lately, but I'll try to get in touch to see if he can re-upload them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 07:47 PM

As for Speak & Spell hardware. I should be able to get the CPU core in MESS working to support TMC0270. But I think improving the speech chip emulation is not in my alley of expertise, more for Lord Nightmare and maybe couriersud.

I typed in the Speak & Math ROM from patent 4946391, both the HEX codes and the source code (I can be nearly certain the type-in is correct by verifying it with a quick assembler tool i wrote)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 07:55 PM

ranger_lennier yes I know about the overlays, scans should be useful for MAME Artwork.

'wanted' TMS1000 chips, hmmmmm. Personally I'm glad with the TI-30, already decapped. If I look around online, "Master Merlin" and "Split Second" by Parker Brothers sound like fun. As well as TI's "Little Professor".

I've been told that Mattel Auto Race has a Rockwell PPS4. Same for Missile Attack (which was decapped by Sean?? - any idea how to interpret the ROM?)
Posted By: incog

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 08:56 PM

https://www.sendspace.com/file/22f9i9 - APF overlay scans, manual, box, pcb
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 09:16 PM

Cool, thanks! I will let you know in this topic when APF Mathemagician emulation is finished (should be very soon if I don't encounter problems)
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 09:38 PM

Wow, that's really complete collection. Thanks for sharing!

I don't know about the ROM layout for Auto Race, but the interview says it only has 511 bytes of ROM. Does anyone know of a smaller game than that?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 10:18 PM

Paul Robson sent me the Battle Star Galactica Space Alert game- it has a Rockwell B6001, which is a modified calculator chip. I made a pretty nice die shot from it, but we could never find any documentation on the processor, so we didn't know where to start on the ROM dump or how to interpret it if we did. He even contacted the original programmer, but didn't get much info. There is a Rockwell patent (US4339134) with code for a calculator/blackjack game that probably uses a similar processor.

BSG:SA also only has a 512-byte ROM. My understanding of the 511-byte size is that the processor uses an LFSR like the TMS-1x00 chips, but doesn't have the extra circuitry to handle the all 1's state, so one byte can't be accessed. The Sharp SM51x processors are similar. TI must have had a patent on accessing the extra byte.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/13/14 11:01 PM

Originally Posted By Lord Nightmare
Originally Posted By seanriddle
Chips are the same numbers as the other unit, but earlier date codes.


This is problematic, as I've noticed that the tmc0351 and 2 from a MTA1179 board and the tmc0351 and 2 from a 1980 board do not have the same contents, but do have the same part numbers. Same with the TMC0271 from the MTA1179 (which has the module 'bug') and the one from the 1980 board (which doesn't).
(maybe at some future date we can try to dump them? I think it may be possible to do using probes on the 4 data lines and otherwise through the edge connector itself)

LN

I frankensteined a working S&S from the two that I got, using the PCB with the older chips. It definitely has the "no module bug". I pulled all the chips from the other PCB. I was hoping they'd have some further ID numbers on the bottom, but they do not. A couple of them do have different die revisions than the other chips- the "newer" ones are TMC0271NL NBS 7910, TMC0351NL NBU 7906, TMC0352NL DAU 7901, TMC0281NL D 7906. The "older" ones are TMC0271NL DBS 7832, TMC0351NL DBU 7832, TMC0352NL DAU 7832, TMC0281NL D 7832.

I'll dump the ROMs, then decap the 4 chips from the broken board.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 01:26 AM

here's the APF Mathemagician driver: http://git.redump.net/mame/tree/src/mess/drivers/mathmagi.c

tandy12 is next, hmm https://www.youtube.com/watch?v=rnOaN6rlly4
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 03:17 AM

That was fast, hap!

Does anyone know what the Blackjack game was released as, or if it even was released?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 07:32 AM

I bought a Tandy EC-21 Calculator/Blackjack game (http://www.handheldmuseum.com/Tandy/Blackjack21.htm) because the instruction manual and patent had a few similarities that I thought were more than coincidence. They both automatically shuffle when the 38th card is dealt, and the first example game in the manual is almost identical to the example game in the patent. But the chip in the Tandy unit is an NEC D1021C, and the die looked completely different. I also cracked the die into 3 or 4 pieces, so I pretty much gave up on it.
Posted By: Robbbert

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 07:41 AM

Same processor as this?

http://www.datamath.org/Related/Toshiba/BC-1010BJ.htm


btw there's hundreds of calculators on that site, mostly TI ones.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 12:04 PM

Nice find. That's the same part #- the chip in Radio Shack unit also had K8X056 on the top. Same VFD as well, but the PCB and keyboards are laid out differently.

I've spent a lot of time on Datamath the past few months....
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 09:31 PM

BTW, this January 1978 magazine article specifically says Mattel Auto Race, Missile Attack and Football are Rockwell PPS-4/1.
http://blog.modernmechanix.com/new-1978-electronic-games/4/

But Handheld Museum (and others) says Football is Rockwell B6100-15 (modified calculator chip).
www.handheldmuseum.com/Mattel/FB.htm

Magazine article here:
https://archive.org/stream/creativecompu...ge/n27/mode/2up
also says Rockwell B6000 series.

Patent says Rockwell "B6000 Series"
http://www.google.com/patents/US4322074

Anyhow, this is not TMS09xx/1xxx related, hap, but we know Sean is interested. wink
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/14/14 10:15 PM

Yes, I'm more than OK with this topic being about other antique microcontrollers too.

(articles keep calling them "calculator chips", but seriously, they're the 1st gen. of MCUs)
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/15/14 05:54 AM

Originally Posted By hap
Yes, I'm more than OK with this topic being about other antique microcontrollers too.

(articles keep calling them "calculator chips", but seriously, they're the 1st gen. of MCUs)


I agree, on both counts. smile

This guy also agrees that B6001 is a PPS-4/1 microcontroller, while others disagree.
http://marc.info/?l=classiccmp&m=131921587007366&w=2
Keep clicking "next in thread" for more fun smile

We may never know until someone traces out the circuit to compare with the PPS-4/1 pinouts, or decaps a standard PPS-4/1 to compare.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/15/14 05:10 PM

Judging from that calculator/blackjack patent, I don't think it is PPs4.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/16/14 02:28 AM

I traced some of the pins on the Battle Star Galactica PCB. 9v battery negative goes to pin 19, positive (through the on/off switch) to pin 20. Pin 32 has a cap and resistor connected to it, so it seems like that would be the oscillator input. Pins 36 and 39 are connected together and to one side of the movement switch; pin 37 goes to the other side of the movement switch, and the middle of the switch is +9v. The fire button connects pin 38 to +9v. The piezo is connected to pins 1 and 42, and the LEDs to pins 2 and 4-18. That's it- there are 12 pins not connected at all, and 5 pins that are connected to pads that are unused- I guess for testing?

That doesn't seem to match up with any PP4 pinouts I've seen.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/16/14 08:17 PM

That's disappointing. Seems weird that Popular Electronics would be so specifically wrong though.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/16/14 10:48 PM

What's disappointing?

That patent description contains more than enough information to make an emulator for Rockwell B6000.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/17/14 04:41 AM

Originally Posted By hap
What's disappointing?

That patent description contains more than enough information to make an emulator for Rockwell B6000.


Oh, really? I hadn't even looked at it.

[EDIT] I guess? Still seems pretty high-level to me, not what I'm used to seeing in datasheets. If you say so, then that's good. smile
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 10:31 AM

I've looked through a few boxes of stuff recently and noticed that I also have a Mattel Baseball handheld.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 10:52 AM

I dumped the S&S TMC0351NL and TMC0352NL and the Vowel Power TMC0350NL/CD2302, and got the same bytes as the previous dumps.
I do have one odd issue- the data is dumping at a different address than it should be. Something about how I'm setting the address must not be correct, since all 3 VSMs are offset by nearly 1K.
I built a very simplified interface- just power and ground and 4 signals (CLK, M0, M1 and DATA/ADD8). I tied the address lines to ground with resistors so that the address is loaded with 00000, then read 262,144 bytes to cover the full 18-bit address range (it takes 54 seconds).
The '352 and '350 dumped all the correct bytes, but about 1K sooner than they should have. The '351 started dumping in the middle of the ROM, then dumped a bunch of zeros, then dumped the beginning of the ROM. When I cut and pasted the two parts together, they were correct.
It appears the address is somehow getting loaded with 3F000+/- instead of 00000. It's usually 3F002, both when doing sequential dumps and powering off between the dumps.
I've used a logic analyzer to compare the signals to the datasheet's timing diagram and everything looks OK. My timing is not rock steady; it varies a bit but stays within range (100-200KHz). But all the bits are dumping correctly; it's just the address that's wrong....

I blowtorched the S&S TMC0271NL and TMC0281NL. Unfortunately, the '271 die stuck in the plastic, and when I was working on it I must have stressed one corner, because about 1/4 of the chip flaked off. Of course that included part of the ROM array frown The '281 came out fine. I've only got quickie ICE composites so far- www.seanriddle.com/tmc0271quickice.jpg and www.seanriddle.com/tmc0281quickice.jpg ICE didn't do a very good job, and I'll replace them when I have time. Not surprisingly, the '281 looks a lot like the '280 on siliconpr0n, and the '271 looks a lot like their '2708.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 10:57 AM

Originally Posted By ranger_lennier
I've looked through a few boxes of stuff recently and noticed that I also have a Mattel Baseball handheld.

Can you open it and check out the CPU? The case might have those funky triangle head screws, but I can usually get a small flat blade screwdriver to work.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 02:35 PM

that's unfortunate, better luck next time =)

I've added a mix bag of roms to the new tispeak.c driver in MESS:

For snmath: the mcu rom from the patent i typed in recently, the 2708 PLAs from the recent die pic, and the vsm dumps we had.
snspell: the mcu rom typed in by Lord_Nigh, the 2708 PLAs, and the vsm dumps of the 1st US snspell release.

After improvements to the CPU core emulation, the roms boot up and look like they're trying to communicate with the 5100 speech chip. I believe the next step is to improve our 5100 emulation: it currently lacks ctl-read support. The speak & spell hardware relies on it not only for speech, but it also reads text from it.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 06:12 PM

Originally Posted By seanriddle
Originally Posted By ranger_lennier
I've looked through a few boxes of stuff recently and noticed that I also have a Mattel Baseball handheld.

Can you open it and check out the CPU? The case might have those funky triangle head screws, but I can usually get a small flat blade screwdriver to work.


It does have the triangle screws. I couldn't get any of my screwdrivers to work. I'm visiting my parents in a few days, and I'm sure my dad has a much better screwdriver collection than I do. So I could try that.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 06:23 PM

Originally Posted By seanriddle
I've only got quickie ICE composites so far- www.seanriddle.com/tmc0271quickice.jpg and www.seanriddle.com/tmc0281quickice.jpg ICE didn't do a very good job, and I'll replace them when I have time. Not surprisingly, the '281 looks a lot like the '280 on siliconpr0n, and the '271 looks a lot like their '2708.


The PLAs are all visible on the tmc0271, and 80% of the rom is intact; between that and the patent rom we may be able to get something that runs.

High res images plz :P

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/19/14 07:34 PM

I figured out the VSM dumping issue- I was waiting the extra time (80us at 200KHz = 16 clocks) after the dummy read in the initialization, but not after the dummy read after setting the address. I guess starting to read early interrupts the address load. Now all the VSMs are dumping as expected. I'll dump the 2 chips on the working S&S just to make sure there are no surprises, and I'll blowtorch the '351 and '352 from the other S&S just to take a look at the dice.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 04:00 AM

We got Speak & Spell and Speak & Math to a playable state. The output PLAs differ though, and we only have the one from snmath. So indeed, if you have higher resolution photos of tmc0271, it'd be very useful even though the bottom-left part is a great piece of liquorice. (yeah i'm craving candy a bit right now;p)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 04:07 AM

Bonus link to imgur album for people who haven't compiled their own MESS: http://imgur.com/C7qxS6A,ovl9du5,BIE0lzZ,sbQOy1h,yEOeHt3,Iyx8qLf,0qpG0kQ#0

1) Code Name: Sector
2) Comp IV
3) Mathemagician
4) Merlin
5) Simon
6) Star Wars: Battle Command
7) Tandy-12
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 06:00 AM

Sweet! After I get the '271 composited, I'll finish up Amaze-a-tron. I've got Maniac but haven't decapped it yet, Electronic Detective just arrived and Computer Perfection is on its way. I've got a list of 6 games that I'm looking for better deals on, and there are still a few interesting calculators (I had a TI-57, so that would be fun).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 08:32 AM

I put up a composite of the TMC0271NL pics that I've taken so far: http://www.seanriddle.com/speakandspell.html There's a 6000 pixel GIMP image at http://www.seanriddle.com/tmc0271nl.xcf
I'll re-shoot the output PLA above RAM and the instruction decoder PLA at top right with a higher magnification objective and post those. Any other areas?
I dumped the '351 and '352 from the other S&S and the contents are identical to the other unit's chips.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 10:29 AM

I put up some higher magnification pics: http://www.seanriddle.com/tmc0271nlopla.xcf, http://www.seanriddle.com/tmc0271nlinstpla.xcf,
http://www.seanriddle.com/tmc0271nlromdec.xcf.
Let me know if you need any other areas.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 06:45 PM

Not for me, I only needed the output PLA myself. Thanks! =)
I double checked instpla, and it's same as the TI30 0980 one, as expected.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 06:51 PM

The TI-57 and others of the same series, interesting indeed. I wonder what TMS1500 specs are, I see it differs a lot from default TMS1000 according to datamath.org.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 09:36 PM

siliconpr0n comes through again- http://siliconpr0n.org/map/ti/tmc1501nc/

Looks like 16-bit wide ROM and different RAM from TMS1x00- I believe TI-57 kept RAM contents when off. It just looks like 256 bytes. What's in the upper right- registers, or separate program memory (or both)? TI-57 had 8 memories and could hold 50 programming steps.

I'll probably still pick one up to get pics with the top metal layer removed.

Also, I opened the Maniac case, and instead of a TMS-1x00, there's a GI PIC1655A! I haven't decapped one of those before. The current PICs make ROM extraction difficult, but this one is so old I bet it can be visually dumped.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 09:56 PM

The memory map of the ti-57: http://www.rskey.org/CMS/index.php/the-library/100

The memory is volatile. It's the ti-57 lcd that had non-volatile memory, and it was a very different beast. In particular you had to partition between program steps and memory registers.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 10:08 PM

Originally Posted By seanriddle
I figured out the VSM dumping issue-


I actually dump VSMs using a TMS5200 and TMS51XX setup, so they take care of the dummy reads, maybe its why I didn't see those.
Note the TMS6125 are little more fiddly to dump
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 10:21 PM

Originally Posted By Olivier Galibert
The memory map of the ti-57: http://www.rskey.org/CMS/index.php/the-library/100

The memory is volatile. It's the ti-57 lcd that had non-volatile memory, and it was a very different beast. In particular you had to partition between program steps and memory registers.

Thanks! The patent Claus references, 4125901, shows 13-bit ROM, but it sure looks like 16-bit to me.

It's been so long ago that I can't remember, but I can't believe that I had to re-enter programs every time I powered off the TI-57! The calculator itself disappeared somewhere along the way, but I found the manual.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 10:32 PM

Originally Posted By plgDavid
Originally Posted By seanriddle
I figured out the VSM dumping issue-


I actually dump VSMs using a TMS5200 and TMS51XX setup, so they take care of the dummy reads, maybe its why I didn't see those.
Note the TMS6125 are little more fiddly to dump

Using the '5200 and '51XX, you don't have to level-shift either, do you? I first thought about using a couple of 4066s, since I have lots of those and didn't need a lot of speed. But then I remembered that it takes VDD-1 volts to turn the 4066 switches on, and my PIC couldn't get there. I dug around and found one 4504, so I simplified the circuit to use fewer than 6 IOs. I wound up just using 3, so I could have just used 3 transistors, but this works.

I had the Vowel Power module apart to dump it, and I goofed up and plugged it into the S&S incorrectly and it looks like I fried it. It now drives ADD8 high after initialization, but then it's low for every bit. I'm not sure if I plugged it in upside down (the module's connector only has pins on one side, but the PCB has pins on both) or if I offset it one pin left or right (the PCB has more pins than the module, and the module case has protrusions that align it correctly). I was going to keep it, but now it gets the blowtorch.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/14 11:53 PM

Originally Posted By seanriddle

Also, I opened the Maniac case, and instead of a TMS-1x00, there's a GI PIC1655A! I haven't decapped one of those before. The current PICs make ROM extraction difficult, but this one is so old I bet it can be visually dumped.


PIC1655's can be dumped electrically using a debug mode, kevtris knows details.
PIC16C55 on the other hand is a whole different can of worms.

LN
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 12:00 AM

Originally Posted By seanriddle
I put up a composite of the TMC0271NL pics that I've taken so far: http://www.seanriddle.com/speakandspell.html There's a 6000 pixel GIMP image at http://www.seanriddle.com/tmc0271nl.xcf
I'll re-shoot the output PLA above RAM and the instruction decoder PLA at top right with a higher magnification objective and post those. Any other areas?
I dumped the '351 and '352 from the other S&S and the contents are identical to the other unit's chips.


Can you do a high-res image of the remaining portion of the tmc0271 rom? about 80% of it is still readable, and could be useful to compare against the patent firmware (which i suspect matches the 'bug fixed' 1979 one, hence we need this older rom on the chip).

Also, can you image the 4 rom areas of the tmc0281? It is an older '0280 A / 281' chip, while the tms5100 on siliconpr0n is '0280 B / 281 A' which is newer.
https://dl.dropboxusercontent.com/u/7909...die%20small.png shows the rom areas on a tms5200, but the 5100/0281 has the rom areas in question in (nearly) the same places on the die. (ignore the copyright area, its in the upper right on the 5100/0281 and i can see it in your low res image just fine)

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 06:02 AM

Originally Posted By Lord Nightmare
PIC1655's can be dumped electrically using a debug mode, kevtris knows details.

Thanks. It is a PIC1655A, and I sent Kevin a note. I noticed the TEST pin on the datasheet, so I searched for any info, but didn't find anything.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 06:03 AM

Originally Posted By Lord Nightmare
Can you do a high-res image of the remaining portion of the tmc0271 rom? about 80% of it is still readable, and could be useful to compare against the patent firmware (which i suspect matches the 'bug fixed' 1979 one, hence we need this older rom on the chip).

Also, can you image the 4 rom areas of the tmc0281? It is an older '0280 A / 281' chip, while the tms5100 on siliconpr0n is '0280 B / 281 A' which is newer.
https://dl.dropboxusercontent.com/u/7909...die%20small.png shows the rom areas on a tms5200, but the 5100/0281 has the rom areas in question in (nearly) the same places on the die. (ignore the copyright area, its in the upper right on the 5100/0281 and i can see it in your low res image just fine)

LN

Will do.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 06:52 AM

Originally Posted By seanriddle
The patent Claus references, 4125901, shows 13-bit ROM, but it sure looks like 16-bit to me.

My bad- there are 13 groups of 16 rows, which should correspond to the 16 banks of 13 bits. There are 128 columns, so that gives 2048 13-bit words.
The ROM array is rotated 90 degrees from the TMS1x00; based on Fig 7c in the patent, I think the bottom rows are the msbs. That means rotating the die shot CCW should put it in the same orientation as the others. It looks like the byte decoder is sequential, but I haven't spent the time to figure out if it's top-to-bottom or bottom-to-top. I also don't know the order of the 16 pages- previously they were 0-7,F-8.
I tried to find the first word of the ROM dump in the patent ($1213), but didn't find it by observation. Of course, I'm not sure how similar the actual ROM is to the patent ROM dump.
Claus references HrastProgrammer, who has a TI-57 emulator for HP calculators which he created from reading the patents. I looked briefly for the ROM dump in his emulator, but didn't see it. The patent scan is clear and entering the dump again shouldn't be too difficult.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 07:02 AM

here's a better pic of what needs to be imaged on 0281:
https://dl.dropboxusercontent.com/u/79094972/tmc0281quickice-annotated.jpg

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 11:11 AM

I put the '281 pics here: www.seanriddle.com/tmc0281nlparts.7z
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 11:53 AM

Here's the ROM dump from patent 4125901: www.seanriddle.com/4125901.bin

I'm a little concerned about it, though. In the patent, the letter o was used in several places instead of zero, S was used twice (I replaced it with 5), and H was used once (I replaced it with A). Two of the numbers didn't start with 1 or 0- AC16 and DE08, which I replaced with 1C16 and 0E08. Also, 3 of the line numbers were typoed. It kind of makes me think that someone retyped the hex dump for some reason, which means there could be errors that we can't ID without trying to run the code.

HrastProgrammer said "This code was retyped and analyzed by me from the original TI patents + I fixed various bugs from this ROM in order to make it work correctly." I'm not sure if the bugs were mistakes in the dump, or actual bugs in the version of the code used for the patent.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/14 01:20 PM

Originally Posted By seanriddle

Using the '5200 and '51XX, you don't have to level-shift either, do you?


I pretty copied the schematics of the TI99 speech adapter for my TMS5200 protoboard. (you can hook yourself TTL to that one).

As far as the TMS51XX is concerned, I tried a few things, but the best was to hack the negative voltage the way the Stern Bagman board does it (voltage dropping diodes). But its flaky, it would have benefited from proper leveling that one.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/14 12:23 AM

www.seanriddle.com/4125901.bin is TI-57? I think we'll need a new MCU core for this one. It will be interesting to emulate, but I won't put it on my TODO just yet. smile Maybe other devs are interested too?

Sean, If it's not too much time, could you use your bit-reading tools and make a rom'dump' of the CD2708 MCU from that high res image on siliconporn?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/14 09:01 AM

I guess that's the TI-57- that's the patent referenced on the R/S web page.

I'll start on the 2708, but it'll be slow because there's no contrast. It'd be a lot easier with the top metal layer removed.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/14 05:43 AM

I put the Amaze-A-Tron ROM dump and info up - www.seanriddle.com/tms1100.html

Kevtris sent me the info on dumping the PIC1655A but it didn't work; he's thinking maybe it only works on the non-A version. But it looks like he dumped the Maniac ROM at some point, so I decapped it to compare. I broke the die, but there's plenty of ROM left to compare.

I got Computer Perfection in the mail today. Opened it up and instead of a TMS-1x00, there's a Panasonic MN1400ML. I couldn't find a lot of info about it, but I did find a couple of data sheets. It's pretty similar to the TMS-1100; 1KB ROM, 64 nibbles RAM, output PLA, 300KHz NMOS. I decapped it.

I also decapped the 0980 from Electronic Detective and my busted CD2302 Vowel Power chip. Just for fun, also an Amiga 500 keyboard chip and a Gameboy CPU I had lying around.

I started working on transcribing the 2708 ROM.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/14 09:41 AM

Cool =) So, Amaze-A-Tron is MP3405, Merlin is MP3404. That makes me a bit more curious what the unknown MP3403 dump by kevtris could be. I should have a look at that later. I won't be at my dev pc for a few days.

Panasonic MN1400ML, may be an unlicensed clone? It was(still is?) common to copy designs and sell them yourself.
Posted By: Duke

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/14 10:47 AM

Is the Amiga keyboard controller the 6570-036? If so, it should match the dump we have.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/14 04:57 PM

Originally Posted By hap
Cool =) So, Amaze-A-Tron is MP3405, Merlin is MP3404. That makes me a bit more curious what the unknown MP3403 dump by kevtris could be. I should have a look at that later. I won't be at my dev pc for a few days.

Panasonic MN1400ML, may be an unlicensed clone? It was(still is?) common to copy designs and sell them yourself.

A couple of years ago when I first emailed Kevin about TMS-1100 dumping, he sent me a list of the chips he dumped that had this:
TMS1100NLL MP3403 DBS 7836 SINGAPORE some game board with 7-segs

Since MP3404 and MP3405 are both from Ralph Baer games, it's possible MP3403 is, too. Maybe one of his other games started out as a TMS-1100 and changed processors for some reason? Maniac has 2 7-segment LEDs.

I haven't found enough info about the MN1400ML or looked at the die long enough yet, but it looks like they enhanced a TMS1100. It must be a power hog, though- Perfection used 2 9V batteries in parallel. Here are the data sheets I've found: www.seanriddle.com/mn1400.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/14 05:00 PM

Originally Posted By Duke
Is the Amiga keyboard controller the 6570-036? If so, it should match the dump we have.

Yep. I bought the keyboard many years ago to steal some keycaps from, and just ran across it the other day. Now whenever I see 28- or 40-pin DIPs, the first thing I think of is decapping them smile
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/26/14 04:30 AM

Well, I'm not having much luck opening up the Mattell Baseball with the triangle screws. There are triangle screwdrivers on eBay and such, but does anyone know what size I need? Or alternatively, I could just mail it to Sean or whoever wants to look at it.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/26/14 04:44 PM

I can't do much coding where I am now, but I did read up on some of the TI Speak & Spell related patents that were on a list by Lord Nightmare. Interesting to see that the Touch & Tell (silly game for toddlers) uses a TMS1100 instead of TMS0270.

Like with Speak & Spell and Speak & Math, the ROM contents is included in the patent. It's doable to type it down and then verify that no typos were made by putting the source code (also included) through an assembler. But :P simply put, I'm not interested at all in Touch & Tell.

Language Tutor/Translator is more interesting, it was a gadget for old men too embarrassed to use a traveler's pocket book. ROM contents is available as well, but since it's written down in binary it'd be a pain in the ass to type it over.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/27/14 06:38 AM

It's been too long- I'm not sure of the size. I've also seen someone use the end of a triangular file. And if you don't care about the screws (and the case, depending on how deep they are counter-sunk), you can use a dremel to cut slots in the screws to fit a regular flat-blade screwdriver. I've also seen a screw removal bit at the hardware store - you drill a hole in the screwhead and then insert the bit, which grabs hold of the screw. Or you are welcome to send it to me if you want.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/27/14 06:42 AM

What are the patent numbers? If the text is clear, the OCR at patents.google.com is pretty good and you can cut and paste the hex or binary into a text file for processing.

Speaking of pain in the ass, I transcribed the CD2708 ROM: www.seanriddle.com/cd2708raw.bin and www.seanriddle.com/cd2708.bin
I converted the raw file the same way as the TMS0980s.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/27/14 07:01 AM

Originally Posted By seanriddle
I guess that's the TI-57- that's the patent referenced on the R/S web page.

It looks like each of the TI57 patents (4078251 4079459 4100600 4107781 4125901 4164037) has its own set of typos. I'll put together a combo file by comparing them and taking the majority vote.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/27/14 07:31 AM

Originally Posted By seanriddle
Since MP3404 and MP3405 are both from Ralph Baer games, it's possible MP3403 is, too.

Bah- Merlin (MP3404) isn't a Ralph Baer game, Simon (MP3226) is. Sorry. Merlin was from Robert and Holly Doyle, who also did Code Name: Sector and Stop Thief.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/27/14 11:59 AM

Touch & Tell and Language Tutor patents with src code are:
US4403965_touch&tell.pdf
US4631748_language_translator.pdf

Thanks for CD2708 smile
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/28/14 11:25 AM

Originally Posted By seanriddle

Let me know if you need any other areas.

Can you get the main rom of the tmc0271? I know there's a chip out of the corner of it, but 85% of it is still readable, and that would be enough for me to have a good confidence that it matches either the patent or parts of it.

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/28/14 01:14 PM

IMO it's a better use of time to extract it on a later successful decap.
Sean if you could use a free xmas bonus paypal donation for all these purchases, don't be humble and gimme paypal address laugh
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/14 04:49 AM

Originally Posted By Lord Nightmare
Originally Posted By seanriddle

Let me know if you need any other areas.

Can you get the main rom of the tmc0271? I know there's a chip out of the corner of it, but 85% of it is still readable, and that would be enough for me to have a good confidence that it matches either the patent or parts of it.

LN

Yeah, I can start on that. I will be out for a while at the top of the month for work, but I'll get started.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/14 05:08 AM

Originally Posted By hap
IMO it's a better use of time to extract it on a later successful decap.
Sean if you could use a free xmas bonus paypal donation for all these purchases, don't be humble and gimme paypal address laugh

Hey, thanks. No problem, I've got a little budget for that stuff. I generally look for cheap stuff anyway.

I uploaded the MN1400 die shot from Computer Perfection: www.seanriddle.com/mn1400.html
It turned out pretty well. ROM upper left, RAM upper right, instruction PLA lower middle, output PLA lower right. The ROM bits are more subtle than on the TMS1x00 chips, but easier to see than the F8 PSUs. The 1KB ROM array has 128 columns, which I'm guessing are 16 pages of 8 bits, while each of the 64 rows is selected by the 8-bit program counter, using the ROM word decoder between the ROM and RAM arrays. I don't have a ROM dump from a patent or an electronic dump for the chip, so it'll be interesting to figure out the bit arrangement.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/14 05:42 PM

Ok, definitely not a 1:1 TMS1xxx clone then. (or did I already say that before?)

Coleco Amaze-A-Tron is running fine in MESS. You really need a board+playing pieces to play though. I fixed 1 bad bit before writing the driver: amazeatronraw.bin offset $596, change $1A to $9A.

Right now I'm tinkering with MP3403. We're in luck: it has a 1-bit speaker on R9 and plays short jingles when I press random buttons. My 1st guess is a horse racing game.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/01/15 12:08 AM

Thanks for the bit. I changed it in my files.

Cool detective work on MP3403! Do you have any samples of the jingles? I don't remember any horse racing games off the top of my head. Now how about that M32018 TMS1000 from Visual 6502?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/01/15 02:04 AM

That one I have no idea. Kevtris had at least two of them, he sent one to visual6502 and I have the other one intact here, though no means of doing meaningful tests to it right now. (I can return it to Kevtris if you have any ideas...)

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/01/15 06:46 AM

I transcribed the ROM and ran it through a simple TMS1000 emulator I rigged up from Paul Robson's MicroVision emulator. It does something, but I didn't think to listen to any of the ports.
www.seanriddle.com/m32018a.bin

www.seanriddle.com/m32018araw.bin
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/01/15 04:38 PM

Originally Posted By seanriddle
Cool detective work on MP3403! Do you have any samples of the jingles? I don't remember any horse racing games off the top of my head.


It's easy to hear them if you bash random buttons. MESS 0.157 was released yesterday. Try it :-) you can also see R and O activity.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/01/15 06:51 PM

press s and x a bunch and you'll hear it.
I thought it might be mattel's football II since the jingle is similar to the touchdown sound, but am not certain. (also mattel supposedly used rockwell chips at least for football I and baseball?)
It could be 'long bomb' as well, but that was an early lcd handheld and the process used to make its lcd was crappy, so very few if any examples have the lcd functional anymore (most have died of 'tunnel vision', similar to the powerbook 170 lcds)

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/02/15 11:28 AM

Originally Posted By seanriddle
Originally Posted By Lord Nightmare
Originally Posted By seanriddle

Let me know if you need any other areas.

Can you get the main rom of the tmc0271? I know there's a chip out of the corner of it, but 85% of it is still readable, and that would be enough for me to have a good confidence that it matches either the patent or parts of it.

LN

Yeah, I can start on that. I will be out for a while at the top of the month for work, but I'll get started.

OK, I got a preliminary file done. Here's the ROM pic and the raw and 0980-translated files. I used 0s for all the bits in the damaged area, and there are some bits of plastic obscuring some bits, so I did the best I can there. It's been too cold to play with hydrofluoric acid on the driveway, but when it gets warmer I'll do it and compare the transcriptions.

www.seanriddle.com/tmc0271nlrom1280.jpg

www.seanriddle.com/tmc0271nlrawpartial.bin

www.seanriddle.com/tmc0271nlpartial.bin
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/02/15 11:28 AM

Originally Posted By hap
Originally Posted By seanriddle
Cool detective work on MP3403! Do you have any samples of the jingles? I don't remember any horse racing games off the top of my head.


It's easy to hear them if you bash random buttons. MESS 0.157 was released yesterday. Try it :-) you can also see R and O activity.

Just built it. Are the PLA files available anywhere?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/02/15 12:47 PM

Should be, but I don't know where people get download their roms nowadays (not to mention posting a link to a romsite is probably against forum rules).. I'll send you a mail
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/02/15 10:45 PM

Hmm, I didn't think about the output PLA files being copyrighted, but I wouldn't put it past someone to try to copyright the equations for a 7-segment decoder! I guess they could have put the digits in a different sequence to make a unique file....
Posted By: smf

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/03/15 12:22 PM

I don't believe it would be copyrightable in the US

"If a pictorial, graphic or sculptural work is a useful article, it is copyrighted only if its aesthetic features are separable from its utilitarian features. A useful article is an article having an intrinsic utilitarian function that is not merely to portray the appearance of the article or to convey information. They must be separable from the functional aspect to be copyrighted."

However it's probably safest to assume that all roms are copyrightable as it avoids getting involves with layers.
Posted By: Golden Child

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/03/15 04:27 PM

There's a cool interview with Mark Lesser (who created a lot of Mattel's early led handhelds) at digital press. It's a pretty good read.

http://www.digitpress.com/library/interviews/interview_mark_lesser.html

And one at Popular Mechanics too.

http://www.popularmechanics.com/technolo...-games-15987495
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 10:52 AM

I did a search for "vintage teardown" on youtube and got a few interesting hits. mr1968geek has several handheld game teardowns, including a couple that I've bought- Entex Space Invader and Coleco Quiz Wiz. My Space Invader has a National Semi COP444L, but his has a TI chip, likely a TMS1x00 (MP1211). The Quiz Wiz has completely different markings, but that's a custom chip, so I'm not surprised. He also has vids of Coleco Digits (like Comp IV) with a GI AY-3-8400, Entex Electronic Baseball with a TMS1000 (MP0914), Videomaster Colourscope TV Games with a National NS/743 MM57105N, and an Invicta Electronic Mastermind with a Rockwell MM75 (the smaller PPS-4/1). That's a nice selection of chips, but unfortunately no MP3403....
Posted By: shattered

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 12:38 PM

There's a Lisa teardown over at EEVblog -> http://www.youtube.com/watch?v=_hxdz6c8bHg
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 02:01 PM

I had no idea a Lisa was a handheld game running on a 4-bit microcontroller ;-) No wonder the driver's all wrong!
Posted By: Al Kossow

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 04:56 PM

Originally Posted By R. Belmont
I had no idea a Lisa was a handheld game running on a 4-bit microcontroller ;-) No wonder the driver's all wrong!


What is the current setup people are using to dump COP 420's?
I was going to try dumping all the HP-HIL chips. The last one I
did was for Looping back in the 90's. I think I still have the code for talking to a PCI parallel port card that I used.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 10:16 PM

I don't actually know, I remember the Lisa COP 420s being dumped at least 2-3 years ago now but I don't remember who did it.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 10:49 PM

IIRC it was done as a decap and segher figured out the bit order, but there's actually a way to dump cop420s without decap at all, electrically, explained on a natsemi application note.

LN
Posted By: Al Kossow

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/04/15 11:34 PM

Originally Posted By Lord Nightmare
IIRC it was done as a decap and segher figured out the bit order, but there's actually a way to dump cop420s without decap at all, electrically, explained on a natsemi application note.

LN


yes, that's what I used when I dumped the one on Looping.
I never really followed up if the information got used or was correct.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/05/15 08:13 PM

Anyone know the appnote #? I looked through a bunch on bitsavers but didn't come across it. Thanks!
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/05/15 09:41 PM

I believe this one: http://application-notes.digchip.com/006/6-9487.pdf

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 07:52 AM

Very handy- thanks! It looks very similar to the 3870.

The TI57 patent mentions a test pin, and describes how to dump the TMS1500 ROM. It looks much simpler than the TMS1000/1100! HrastProgrammer mentioned that a friend of his was able to dump the ROM, so I guess there is enough info in the patent. I'll probably still decap one, even though the instruction PLA is likely stock (since his emulator runs the ROM dump) and the output PLA would be easy to figure out.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 09:17 AM

The ti57 is already decapped there: http://siliconpr0n.org/map/ti/tmc1501nc/mz_mit20x/ http://siliconpr0n.org/map/ti/tmc1501nc/single/

OG.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 12:18 PM

Any clue if TMS1400 can be read this way as well? (Used in Coleco Talking Teacher and its 5 million variants, which I'm due for a blog post about)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 06:12 PM

Oh yeah, that's right, we can get the PLAs from that pic.

With the top metal view, there's so little contrast between the 1s and 0s in the ROM array that my program can't differentiate them, though. That pic is so clear that with a program could look across each row and column and pick out the bits, but it would be a lot easier with the metal layer removed.

I picked up a TI55 that has the same chip, part # TMC1503.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 07:23 PM

About a year ago, Kevtris told me his method for dumping TMS1000s/TMS1100s didn't work on the TMS1400s that he tried it on. But his method also didn't work on the G die revision TMS1100s that we found, and had issues with the E die revision.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 07:30 PM

Ha so perhaps he's tried that for the "MP7324 ML/_\51802" inside the Talking Teacher then (he has a few IIRC).
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/06/15 08:21 PM

TMS1400 is derived from TMS1100. If we have a decap of it, it should be fairly easy to emulate. I'd suggest starting with a straightforward 1-chip device, like a calculator.

S&S-related: I'll start on 'extracting' the ROM from the language tutor patent. All those 1s and 0s may look dazzling, but it should be a fun side project making a custom helper tool to read it out.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/07/15 12:19 AM

I couldn't find any calculators that use the TMS1400, but I should get a Split Second in a few days. I'll decap it and upload the pics. Maybe entering test mode requires some other pins to be held high or low, and we might get a hint from the die shot.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/08/15 05:40 AM

I decapped the TMS0980 from the Ideal game Electronic Detective. I think it was the first product to use the TMS0980- the die says 0980B-00. The ID # on the chip is MP6100A; Stop Thief, a somewhat similar game, is ID MP6101B, and has 0980B-01A on the die. http://www.seanriddle.com/0980.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/08/15 03:42 PM

Thanks, I'll have a MESS driver for it in a week or so.

Don't forget TI-30 was obviously the 1st TMS0980 product. =p The new hardcoded opcodes in it were specifically added to make calculation loops faster (especially in the case of sin/cos/tan)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/08/15 08:11 PM

Yeah, they must have set the high bit for the internal products: the TI calculators have die IDs 81, 82 and 83, and the games are 00 and 01. But the TI30 came out something like 3 years before the games.

Speaking of calculation loops, I had forgotten how slow the TI30 is- it can take a couple of seconds to do sin/cos/tan, depending on the argument. At least they did a cool segment twirl on the rightmost digit to show it's thinking.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/09/15 07:22 AM

I uploaded a die shot of the TMC0350NL CD2302 from the Speak and Spell Vowel Power chip that I fried: http://www.seanriddle.com/speakandspell.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/09/15 10:15 PM

Originally Posted By seanriddle
Yeah, they must have set the high bit for the internal products: the TI calculators have die IDs 81, 82 and 83, and the games are 00 and 01. But the TI30 came out something like 3 years before the games.

Speaking of calculation loops, I had forgotten how slow the TI30 is- it can take a couple of seconds to do sin/cos/tan, depending on the argument. At least they did a cool segment twirl on the rightmost digit to show it's thinking.


Yup, it does that in MESS too, when I 1st saw it I thought it was a bug. I don't know the right clockspeed btw. Could you add RC OSC(resistor/capacitor) info to your hardware descriptions? =) Not just for the TI-30.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/10/15 07:27 AM

I'm trying to list all the components and connections in the hardware descriptions. I just double-checked, and TI-30, TI-Programmer, Business Analyst II, Electronic Detective, Comp IV and Code Name: Sector do not have any oscillator resistors or capacitors on their PCBs. That must have been another cost-cutting move TI made. Unfortunately, I didn't try to measure the clock speeds on those devices. But I do have a second TI-30; I'll try to measure the clock speed on its OSC pins. I assume the other 0980 devices run at the same speed.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/10/15 08:54 PM

I forgot I also have a working Stop Thief.

I can't find an oscillator output on any of the TMS0980 pins, though. I used an oscilloscope to measure the pulses on pin 14 of the chips, and found that when the TI30 is first turned on and displaying just 0, that pin 14 has a period of 5.8mS. When Stop Thief is turned on and displays "1 Cr", pin 14 alternates between periods of 7.0mS and 9.1mS as the display blinks.

Doing informal count comparisons, I estimate the TI30 emulation takes nearly 50% longer to do calculations than the real unit.

Also, for some systems, I can not exit the emulator screens in MESS 157 without doing an alt-tab, then right-clicking on the icon in the task bar and choosing close window, which returns me to the MESS menu to select another system. I can hit escape from any of the information windows that pop up when I select a system before it starts running, but once some systems are running, I can't find any keystrokes to return to the menu or select controls. This is on Windows 7 Ultimate 64-bit, running MESS64 from the command line.

For example, tab and escape work in Merlin and Simon, but not in TI30, Speak and Spell, Stop Thief, or Wizatron.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/10/15 09:15 PM

I estimated Stop Thief to be between 400 and 450khz from the pitch/length of the sound effects. The osc is on-die? :|

Your MESS UI problem: set ui_active in mess.ini to 1 (you can create the .ini with mess64.exe -cc)
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/10/15 10:29 PM

If you have a full keyboard you can toggle if Esc goes to the emulated system or to exit MESS with ScrLk (Windows/Linux) or Delete (Mac). On a laptop, hap's hack works.
Posted By: smf

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/11/15 01:00 AM

Originally Posted By R. Belmont
On a laptop, hap's hack works.


fn+num lock is scroll lock on dell laptop keyboards.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/11/15 01:34 AM

That's clunkier though, and there are a number of laptops that don't have scroll lock at all.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/11/15 10:25 AM

Thanks guys! My (Samsung) laptop does not have scroll lock, so I set ui_active. I must have had that set in my previous install, but forgot about it and didn't move it over to the new install.
Posted By: smf

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/11/15 06:36 PM

Originally Posted By R. Belmont
That's clunkier though, and there are a number of laptops that don't have scroll lock at all.


Some don't have it written, but they have a padlock icon on one of the function keys (on some dells it's fn+f5 for example, on Toshiba satellite it seems to be fn+f10) so you don't necessarily know you have it.

You can remap it so it's not scroll lock as well. Is it because some of them have "keyboards" that it's needed for some games and not others?


Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/11/15 06:51 PM

IPT_KEYBOARD triggers the modal behavior. Arguably it should be slightly finer grained: if the system maps Esc, Tab, P, or any of the F-keys then modal.
Posted By: etabeta78

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/12/15 06:50 AM

possibly these systems should use IPT_KEYPAD which does not trigger the modal behavior and was introduced for this exact reason wink
Posted By: smf

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/12/15 10:28 AM

Originally Posted By R. Belmont
IPT_KEYBOARD triggers the modal behavior. Arguably it should be slightly finer grained: if the system maps Esc, Tab, P, or any of the F-keys then modal.


We need to be able to "focus" keyboards, so you can emulate a system with two keyboards and type on them both using one keyboard. If we had a system that allowed that then controlling the emulator could just be another "keyboard".

Basically it would need to detect mapping conflicts and if there are any then somehow allow you to select which device wins.

It probably shouldn't be limited to keyboards, but the method to switch between other devices may get complicated. You might for example have two keyboards and two joysticks, the keyboards could have some conflicts with each other and the joysticks conflict with each other. But one of the keyboards could conflict with one of the joysticks. The non conflicted keys should always work no matter what device is selected.

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/13/15 05:41 PM

Here's the driver for elecdet:
https://github.com/mamedev/mame/blob/master/src/mess/drivers/elecdet.c

I have no clue how to play this game, but I think I have everything right. The romdump looks fine as is, I could double-check it when you've make a post-acid die shot.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/14/15 07:28 AM

I'm hopeful it will be warm enough on Thursday to Whink some chips.

I torched the TMS1400 from Split Second today and took pics: www.seanriddle.com/tms1400.html

I also uploaded a 6000x5000 pixel XCF: www.seanriddle.com/splitsecond.xcf

It has double the ROM space of the TMS-1100; the ROM array is twice as wide. I haven't figured out the mapping yet, but my guess is that the rows are mapped the same as the TMS1100, the first 16 bits in each row are bit 7 for the 16 pages in chapter 0 (in the top half, chapter 1 in the bottom half), and the second 16 bits in each row are bit 7 for the 16 pages of chapter 2 (in the top half, chapter 3 in the bottom half). The next 16 bits would be bit 6 for chapter 0, then bit 6 for chapter 2, etc.

The O output PLA looks the same, but with the full 32 possibilities instead of the 20 that the TMS1100 was limited to.

The instruction PLA looks the same but rotated 90 degrees counter-clockwise on the die.

The only datasheet I've found for it is on Kevtris' site, linked from my page above. To handle the additional ROM chapters, the COMC instruction was changed to TPC. It also has a 3-level subroutine stack!

The rest of the Split Second hardware is pretty simple: 6 buttons, a speaker, and 53 LEDs in a 7x8 matrix.

Posted By: etabeta78

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/14/15 07:50 AM

Originally Posted By hap
I have no clue how to play this game, but I think I have everything right.


I think these are the instructions

http://www.samstoybox.com/toys/instruct/electronicdetective/elecdetect01.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/14/15 05:17 PM

Sean: do you have the raw romdump of Split Second?
eta: yup that's the manual, thanks =)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/14/15 09:09 PM

Not yet- I haven't removed the top metal layer, so the contrast between 0 and 1 bits isn't enough for my program to detect. I'm transcribing them manually, but there are 32768 bits! If not for this pesky job, I'd be done....
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/15/15 05:50 AM

Here's the two NatSemi application notes for dumping the COPS mcus.
I didn't link this before because I thought what I linked WAS this:
http://www.ti.com/lit/an/snoa631/snoa631.pdf
and here's what I linked before, which is an addendum to the above:
http://application-notes.digchip.com/006/6-9487.pdf

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/15/15 11:26 AM

LN- thanks. I think the addendum has all the info you need, but the appnote has even more!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/15/15 11:33 AM

I uploaded the Split Second raw ROM dump and a rearrangement like the TMS1100, but with every other column of 16 bits treated as chapter+2 (that's just a guess without trying to disassemble the resulting code; it could easily be that the chapter+2 column comes first). There are about 7 obscured bits that I'll double-check after removing the top metal layer.

www.seanriddle.com/splitsecondraw.bin

www.seanriddle.com/splitsecond.bin

I'll document the hardware tomorrow.

"Ahhh, what an awful dream. Ones and zeroes everywhere... and I thought I saw a two."
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/15/15 09:33 PM

I documented the Split Second PCB. The TMS1400 has a different pinout than the TMS1100- probably because the die is wider due to the additional ROM and had to be rotated to fit. I guessed at the signals, assuming the relative positions of the pins are mostly the same. So my assignment of the R0-R10 and O0-O7 signals could be reversed.

The OSC pins are connected together and to a 100pF cap to Vss and a 24K resistor to Vdd. I couldn't measure the clock rate directly, but did measure a 1.5mS period on pin 11 directly after power on with "1" displayed, and a 2.2mS period on pin 25.

www.seanriddle.com/splitsecond.txt
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/16/15 12:18 AM

http://marc.info/?l=classiccmp&m=104965276917315&w=2 has tms1400 pinout (presumably?)
That thread also HAD dark tower pcb pics, but they're long gone. Its possible the person who posted them back in 2001 still has them around somewhere.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/16/15 01:05 AM

Excellent! So I got everything correct except I had reversed O7-O0. I updated my doc.

I'll wind up with a Dark Tower someday. Wildfire Pinball is on the way.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/16/15 07:46 PM

I removed the top metal layer from Split Second and found some bit errors in my previous transcription: $2F4 from $30 to $40, $4DB from $FC to $EC and $909 from $78 to $68. I updated the files on my web site and uploaded the new pic.

http://www.seanriddle.com/tms1400.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/16/15 08:37 PM

Great work =) I should get started on emulating it in MESS soon.

"I'll wind up with a Dark Tower someday. Wildfire Pinball is on the way."
Hmm, according to the patent, Wildfire runs on an AMI S2150 MCU. http://www.google.com/patents/US4334679 (includes rom data).
Dark Tower is likely a TMS1400.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/17/15 12:32 AM

I also found an error on Electronic Detective: $64D from $DD to $CC. I updated the files on my web site and uploaded the new pic. www.seanriddle.com/0980.html

The Wildfire IC is an AMI, labeled C10641. Thanks for the patent. It looks like you can add external ROM- I wonder if you can program an EPROM to dump the internal ROM?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/17/15 02:01 AM

From glancing over the programming manual... I don't think so. The MCU always boots at bank 0 which is the internal ROM bank. Besides, like many other similar-to-TMS1000 MCUs of the time, every byte is an opcode: it doesn't have the concept of data bytes.

ref: http://bitsavers.trailing-edge.com/pdf/ami/s2000/
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/17/15 08:51 AM

Page 2 of that manual says "built-in production test mode", but I don't see anything else in the manual about that. But bitsavers also has a data book with S2000 info that has more detail: http://bitsavers.trailing-edge.com/pdf/ami/_dataBooks/1979_AMI_MOS_Products.pdf

The ROMS input is tied high for internal ROM only, low for internal and external ROM, but can also be tied to the SYNC output to "override bank 0 with an external program" or tied to inverted SYNC to "verify internal ROM contents". That sounds promising!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/17/15 08:40 PM

I typed in the Wildfire code from the patent. It's in SREC format, so there is address and checksum info to help validate the bytes.

www.seanriddle.com/wildfire4334679.txt

www.seanriddle.com/wildfire4334679.bin

It's 1.5K, non-contiguous (0000-03FF, 0600-07FF), with 5 unused bytes.

The Wildfire PCB connections to the microprocessor don't quite match the AMI S2150 pinout. Pin 1 is ground and 29 is +9v like the pinout shows, but +9v is also connected to pins 2 and 6- pin 2 is supposed to be D2 and pin 6 is an output. Also, pin 7 is not connected, but that should be A12, which is shown on the patent schematic. The PCB generally matches the patent schematic otherwise. I'll trace all the connections and see what's different between the chip used and the S2150 pinout.

I'll see if I can dump the chip before I decap it.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/17/15 08:59 PM

hmm, Stiletto can you find out which other worth-to-emulate devices use the AMI S2000 series MCU? (I poked him on IRC so he knows I called him)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/18/15 12:34 AM

Yeah, I keep picking up games with different processors-

AMI S2000
GI PIC1655A
National Semi COP444L
NEC D1021C
Panasonic MN1400
Rockwell B6001
Rockwell B8610
Rockwell MM75
Sharp SM510

Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/18/15 06:43 AM

Originally Posted By hap
hmm, Stiletto can you find out which other worth-to-emulate devices use the AMI S2000 series MCU? (I poked him on IRC so he knows I called him)


I was about to say "yeah, we acquired the datasheet/manual for the AMI S2150 a while back because of the" and then had to stop myself, because it had been Lord Nightmare who had asked me, way back in 2009, to look for it because it had been used by Wildfire electronic pinball. wink Ultimately, it was Bitsavers who acquired the data book, though I think I acquired the datasheet before them through other means.

Nothing has leapt out at me so far so I may expand the search to others in the S2000 family.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/18/15 08:59 PM

I checked elecdetraw, found 1 error: Change offset $632 val $EC to $FC.
splitsecondraw: Change offset $528 val $EC to $FC. Change offset $867 val $C8 to $C9.

Also, a typo in splitsecond.txt bottom table, correction here:
Code:
LED matrix

    R7  R6  R5  R4  R3  R2  R1  R0
O6  51  45  44  34  24  14   4   1
O5  41  35  31  25  21  15  11   5
O4  52  47  46  36  26  16   6   2
O3  42  37  32  27  22  17  12   7
O2  53  49  48  38  28  18   8   3
O1  43  39  33  29  23  19  13   9
O0  -   -   50  40  30  20  10   -  


*edit* I had to make more changes to the LED matrix to make it look correct, see: https://github.com/mamedev/mame/blob/master/src/mess/layout/splitsec.lay (note: lamp0=R0,O0, lamp10=R1,O0, lamp63=R6,O3, etc)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/18/15 11:48 PM

As for the TMS1400 ROM decode: page,pc,bit order is the same as on TMS1xxx, but chapters are interleaved in the columns, like so:

ch1 bit 0, ch2 bit 0, ch1 bit 1, ch2 bit 1, etc.

As you can see, the last 2 columns (of total of 32) have the fewest bits in them. This is bit 7, used on branch/call opcodes.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/19/15 12:05 PM

I fixed the bits on my site, and the 28/29 typo in the text file, thanks. I haven't looked at your additional changes yet.

I figured the chapters were interleaved, but I had a bug in my bit-rearranger that messed up the file on my site. (I see in my original post I reversed bits 0-7, but my program did that part correctly.) In the top half of the array, for each row, I see chapter 0 pages 0-7 F-8, then chapter 2 pages 0-7 F-8, repeated for bits 0-7. In the bottom half I see the same, but with chapters 1 and 3.

I should get Parker Brothers Bank Shot Electronic Pool in a few days. That was created by Garry Kitchen, and the patent says it uses a TMS1400. Any other known TMS1400 games? A patent search for TMS1400 brings up some Coleco games, but I'm not sure which ones.

Oh, yeah, and Dark Tower.
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/19/15 05:07 PM

A quick google brings up the Coleco Total Control 4, which uses two patents (linked in first link).
http://www.handheldmuseum.com/Coleco/TC4.htm
http://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=32032
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/19/15 05:20 PM

"Oh, yeah, and Dark Tower."
The reason why I think it's TMS1400 is because the MCU label is the same series as Split Second.

Split Second: MP7314-N2 (date 8027)
Dark Tower: MP7332-N1LL (date 8131)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/19/15 08:13 PM

Thanks, TC4 it is. Interesting that the CPU has all 4 games preprogrammed, and the "carts" just change the overlay and provide a signal to tell the CPU which cart is inserted. I just picked one up.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/19/15 08:25 PM

That thing where the cartridges are just jumper blocks was common for Pong systems.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/23/15 05:33 AM

For future use, I uploaded my transcription of the siliconpr0n TI57 die shot: www.seanriddle.com/ti57raw.bin

I also uploaded a jpeg of the ROM array rotated (CCW) to match the other dice, with a square overlaid on each 1 bit from my transcription: www.seanriddle.com/ti57rombits.jpg I've checked it several times, but I wouldn't be surprised if there were a couple of stray bits.

It looks like the physical layout is pretty simple; the 13 columns of 16 bits per row are the 13 bits of each word (MSb on the left) for each page, and the rows are in order. The only complication is that the page order is reversed every bit- bit 12 has them in order 0-F, but bit 11 has them reversed F-0. I uploaded this ordering as www.seanriddle.com/ti57.bin

I compared it to the ROM dump in patent 4125901, and it is very similar; Hrastprogrammer told me they were different, so that was expected, but I didn't know how similar they would be. It turns out that most of the calls and branches are 2-3 bytes different, but the other opcodes are generally the same.

I'll get a TI57 eventually and try to dump the ROM electronically to compare. I picked up a TI55, which uses the same chip, and I'll dump it, too.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/25/15 09:34 PM

Good work as usual =) unfortunately I'm not interested much in TI57 at the moment. Don't stop gathering info tho, it will be useful in the future.

I'm now reading up on the AMI S2000, and will probably start on a driver for Wildfire.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/29/15 11:42 PM

Originally Posted By seanriddle
I typed in the Wildfire code from the patent. It's in SREC format, so there is address and checksum info to help validate the bytes.

www.seanriddle.com/wildfire4334679.txt

www.seanriddle.com/wildfire4334679.bin

It's 1.5K, non-contiguous (0000-03FF, 0600-07FF), with 5 unused bytes.


Woops, the .bin does not match the .txt here, it's on intervals of nibbles instead of bytes.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 01/30/15 02:47 AM

Sorry- I updated the bin.

Sean
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/01/15 10:45 AM

The Wildfire I got was busted. I was hoping it would be an easy fix- most of the time those old games have battery corrosion which can be cleaned up, or a broken wire, but I couldn't get it working. I pulled the chip and tried to dump it electronically, but I couldn't get that going either. So I'll decap it and try to match the ROM bits to the patent ROM dump and see how they differ.

The pinout is slightly different from the datasheet- it looks like VDD was moved from pin 12 to pin 2, and pins 2-11 were slid down one spot. All the other pins seem to be in the right places.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/01/15 06:40 PM

Emulation of Wildfire is showing signs of life. The patent describes that the included ROM data is the same as the commercial release, if true then figuring out bit decoding shouldn't be too difficult.

I think the S2000 on-die 0-9,A-F led7segment decoder is programmable too. Numbers 0-9 are looking fine here, but:
SP shows up as Sb
PL shows up as bd
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/01/15 10:41 PM

Is the backdrop in good quality btw? MAME/MESS Artwork guys could make use of a good photo (even better if you have a scanner).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/03/15 01:13 PM

I uploaded a scan of the Wildfire front panel: www.seanriddle.com/wildfire.jpg It's tough for me to scan or get a good pic of because it's one piece with a bend.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/03/15 01:22 PM

Don't worry about that, MAME artwork guys are able to clean the pic up.
Looks good to me, thanks! =)
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/03/15 02:12 PM

Is there a real ball in that game, or an LED matrix?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/03/15 02:21 PM

completely LED based, even the flippers
http://patentimages.storage.googleapis.com/pages/US4334679-3.png
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/03/15 03:05 PM

Neat!
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/03/15 07:41 PM

Impressive work on this guys, thanks for your effort. These kind of systems weren't something that I was particularly interested to begin with, but since this thread popped out I've been following it with great attention.

Have you scanned (or taken pictures of) artwork for any other games btw? Artwork for some of these would be very important to go along with emulation.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/05/15 09:25 AM

I scanned some stuff for Code Name:Sector, but that's it so far.
www.seanriddle.com/cic.xcf

www.seanriddle.com/compassrose.xcf

www.seanriddle.com/cnspfallflat.xcf

I usually try to buy the cheapest games I can, and those are generally not in the best shape, or are missing pieces. Also, a lot of the games are molded plastic in odd shapes, making it tough to get good pics or scans.

I didn't get the cards for Electronic Detective, but I was glad to see the instructions etabeta found included all the info from them.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/05/15 09:31 AM

I uploaded info about Parker Brothers Bank Shot Electronic Pool: http://www.seanriddle.com/tms1400.html

There's a wiring diagram and ROM dump.

70 LEDs!
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/05/15 10:00 AM

Thanks for the scans sean.

Yeah I understand some of them will be difficult, especially the games with plastic pieces. But some good pictures for those would be better than nothing I guess.
But to play the games that require extra plastic pieces or boards best way would also be to actually own the physical pieces or boards. Can't really see other way of playing them.

I mostly meant scans for the overlays or game cards or high resolution pictures of the actual handhelds like Merlin or Split Second for instance since those games could definitely use an overlay.

I wouldn't be too much worried if they aren't in the best shape, a bit of photoshop work can do wonders.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/05/15 09:07 PM

Cool, I'll add it next week. In the meantime if someone else wants to add it to MESS, please go ahead! =)
At the moment, I'm writing a NEC uCOM-4 series emu core.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/06/15 09:04 AM

What system is the NEC chip in? Another 4-bitter to add to the pile!

I also got a Coleco Total Control 4 with the Football cart, but it'll be the end of the month before I've got the time to transcribe it.

I read here that Garry Kitchen (who designed Bank Shot) took the prototype of Wildfire from the Doyles (who designed Merlin, Code Name: Sector and Stop Thief) and turned it into a product.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/06/15 02:40 PM

The NEC chip was used in some vfd tabletop games. Kevin Horton is able to dump them, he's dumped Epoch Dracula and Tomy Alien Chase.

It's also used in old Roland synths, such as the TB-303.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/09/15 10:02 PM

Does anyone know what the Entex Select-A-Game uses? It's a VFD system that has carts with MCUs, but I don't believe I've ever read what MCU they used.
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/09/15 11:59 PM

Speaking of Entex anyone looked into any Entex led games yet to see what chip they use? I mean games like Entex Baseball 1 to 3, Hockey, Soccer, etc.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/10/15 01:31 AM

I've got a couple of Entex Space Invaders that have the COP 444L, but there's a teardown on youtube showing one with a 28-pin TI chip, MP1211.
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/10/15 02:41 AM

Space Invader 2 included in Entex Select-A-Game is very similar to the standalone Space Invader so they might be using the same chip.

I think the Led Sports games are a completely different beast though, there are a few cheap on ebay right now, I'd buy one just for the sake of checking it out, but the overseas shipping costs the seller is asking is just ridiculous. Most of these end up not selling at all from what I've seen lately.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/10/15 08:29 AM

I don't mind picking some up if they are cheap enough. Any suggestions?
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/10/15 09:31 AM

This one was already relisted because it didn't sell so probably can be bought for the initial bid value:
http://www.ebay.com/itm/181663385103

Others:
http://www.ebay.com/itm/281592170250
http://www.ebay.com/itm/271769483566

Right now most of the cheap stuff are the Baseball games, but normally these games end up selling cheap or not selling at all when they come up for auction.

If you are in the US I'm fine paying for a couple of those if you want to have a look at them, just don't want to buy them myself as like I said the shipping costs here are ridiculous (4 to 5 times what I'd pay for the actual game) and I'm not interested on keeping the games anyway it would be for dumping purposes only.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/10/15 03:25 PM

BTW since it hasn't been mentioned here yet, Kevtris is on a roll. He figured out how to dump NEC ucom-4 42-pin devices (upd55x PMOS and upd65x CMOS, used in many VFD games from 1979-1984), and figured out (with Sarayan's help both of them figuring out most of the opcodes since these were not documented anywhere) how to dump Hitachi hd3880x 4-bit mcus, also used in VFD (and maybe LED?) games.
Both of these types can now be dumped without decapping using the test modes and/or test code built into the chip.


LN
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/10/15 03:47 PM

Being able to dump stuff non-destructively is always good when the target is 35-years-out-of-production games, since we can resell them afterwards.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/11/15 08:23 AM

OK, I bid on a couple of those. I'll see what chips they have and let everyone know.

Every time I read Kevin's stuff, it makes me realize how inefficiently I use my time.... That guy zooms through projects!

Beyond reselling the games, I feel bad destroying the chips if we already have die shots. And reading them electronically is much more elegant than blowtorching them!
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/11/15 09:31 AM

Great, thanks.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/11/15 03:37 PM

I finished Bank Shot emulation yesterday. It's almost the same hw as Split Second, so I've put it in the same driver. opla and mpla are identical.

As usual I did also double check the rom for errors, but found none =)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/11/15 09:39 PM

Cool! I improved my ROM transcription code a bit, so it's probably catching a few more mistakes. I still manually check each bit as well, but that gets pretty tiresome, especially with these 4K chips.

I put some info about Total Control 4 on my TMS1400 page- www.seanriddle.com/tms1400.html, but I won't have the ROM dump or the full hardware description until next week at the earliest.

I just picked up Entex Electronic Baseball 3.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/13/15 08:00 AM

sean, if entex electronic baseball has a d55x mcu or a hitachi hmcs40 series mcu in it, can you lend the chip to kevtris to try to dump it electrically first?

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/13/15 10:00 PM

Yeah, sure, or if the methods are documented, I can try them. Looks like it will get here Tuesday. I'll check some other devices I already have and see if any of them use either of those chips.

I also picked up some TI calcs: TI-57 LCD, TI-55 and "The MBA". I'm not sure how similar the TI-57 LCD code is to the TI-57 (there could be some differences because the LCD calc has constant memory), but the TI-55 and The MBA use the same chip as the TI-57.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/14/15 10:05 AM

Originally Posted By seanriddle
I also picked up some TI calcs: TI-57 LCD, TI-55 and "The MBA". I'm not sure how similar the TI-57 LCD code is to the TI-57 (there could be some differences because the LCD calc has constant memory), but the TI-55 and The MBA use the same chip as the TI-57.


The lcd shares memory between the registers and the program steps. That should make the program quite different...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/15/15 08:19 AM

Oh yeah, I remember you telling me that before, like 14 pages ago smile That's a bummer that it has so much less programming space. I guess because it's CMOS and the gates take up more space on the die?
Is the 2nd chip to drive the LCD?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/15/15 08:21 AM

I finished transcribing the Total Control 4 ROM and put it and the wiring info on my web site: www.seanriddle.com/tms1400.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/15/15 09:09 PM

Alright =) expect a working TC4 driver in a week or so.

Also, Parker Brothers Wildfire (AMI S2150) is playable in MESS now. The last major problem remaining is the sound, I don't know what the F-pin is supposed to do. AMI docs says it can output the internal state of the MCU. Maybe the wildfire mcu decap will teach us.

http://git.redump.net/mame/tree/src/mess/drivers/wildfire.c
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/15/15 11:38 PM

I just checked the schematic in the patent and the Wildfire PCB that I have. The patent schematic shows the speaker connected to 2 transistors- one on A12 and the other on F. The Wildfire PCB also has one transistor connected to A12, but the other goes to pin 32, which is shown as input line K4 in the 1979_AMI_MOS_Products doc. That doc does not show an F pin (or C pin, also in the patent).

AMI_S2000_Programming_Manual_Rev2_Jun78 says instruction LAI "discharges to VSS the K lines corresponding to the bits containing zeroes". So maybe they are using K4 as an output? That would make more sense than using an internal state of the MCU, although I've heard of games that use the carry flag to toggle the speaker.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 01:37 AM

F pin: I assumed they meant the Status pin (it writes internal states to it like carry flag).

K4 pin, hmm interesting, but I can't get it working. I tried a few things with that but the only sound I get are mosquitoes and bees :P
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 07:42 AM

I know that the pinout of the chip on the PCB is not the same as in the 1979 doc; at the very least Vdd was moved from pin 12 to pin 2 and pins 2-11 moved down one spot. And from looking at the die, I think other pins are different, too.

When I decapped the chip some plastic stuck to the center of the die, but the edge of the die is clear, so you can see the bonding pads. I uploaded a 150MB Gimp file: www.seanriddle.com/wildfire.xcf

Pins 1-20 look like they match the pinout (with pin 12 moved up to pin 2), starting at the top center of the die and going counter-clockwise. A3-A0 at bottom left are beefier than A12-A4 because they can drive 25mA instead of 5mA. And going clockwise from top center, pins 40-36 along the top look like the rest of the data bus. But pin 21 looks like it is connected to pin 1 (and is a NC on the Wildfire PCB). There are only 38 pads on the die, so at least 3 of the chip pins are no-connects. Pin 29 on the lower right side looks like Vgg, but it's hard for me to tell what the other pins are.

With a transistor on each side of the speaker, I wonder if one supplies pulses to make various frequencies and the other just turns the sound on and off. Maybe the K inputs were replaced by some frequency generating circuitry? Pins 30 and 33 (K1 and K8) are no-connects on the PCB, 31 is connected to a cap to Vss and 32 to a transistor, like pins C and F in the patent schematic. I wonder if the cap on C sets the frequency that's output on F.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 08:09 AM

I found the 1980 version of the AMI MOS Products catalog: http://electronicsandbooks.com/eab1/manual/Electronic%20Component%20Databook%20Datasheet/Brand/AMI/Databook/1980%20AMI%20MOS%20Producs%20Catalog%20c20120824%20%5B512%5D.pdf

Sure enough, it lists the S2152, and the pinout matches the Wildfire PCB. "The S2152 is an extension of the S2000/S2150 and is software compatible with them. It has the following enhanced features:
Digital-to-Frequency Converter (4-bit)
Programmable Divide-by-N Counter/Timer
15 Outputs, 4 Inputs, and 8 bi-directional three-state lines
one open drain output and
high current outputs"

A comparison chart shows it has the same ROM and RAM as the S2150 (1.5KB ROM, 80 nibbles RAM). I don't see any info about the D-to-F or counter/timer registers, though.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 10:35 AM

PDF link doesn't work here, but I can see the pinout here: http://www.cpu-world.com/info/Pinouts/S2000.html

No K-pins at all huh... yet Wildfire does use a K-pin related opcode. And it is used during the time when you'd expect sound(big hint!). Maybe that is for loading the digital-to-frequency converter, and the Fout pin is the freq.

wildfire.xcf: Too bad about the smudge. Can you see something looking like a mask programmable 7seg decoder?
*edit* could you upload it as .jpg? MS Windows isn't very xcf friendly.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 02:31 PM

Ok good, wget eventually got the pdf while i was out. Not a lot of info indeed, but what it does say is that the frequency converter is "for enhanced sound generation".

Also, it clearly says that the 7seg decoder is not user definable for the S2000/2150/2152.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 07:18 PM

I uploaded the jpg: www.seanriddle.com/wildfiredie.jpg

I haven't had time to try to clean the die. I could Whink it, but that would remove the top metal layer, and I'd like to get a clearer pic with it first.

Maybe the 7-seg decoder isn't mask programmable but they paid to change a couple of digits?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 07:50 PM

I think I have the F_out pin working in MESS. Maybe not at the exact frequency, but the 'mini melodies' sound good enough if I ignore the A12 problem below..

A12 is behaving badly: it enables the speaker, and then quickly disables it again. What's the connection from A12 to the speaker like on the PCB? Is there a capacitor involved causing it to stay active longer?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 08:41 PM

It looks like the same connections as on the schematic: the 2 resistors are 10K and the cap is a 4.7uF electrolytic.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 10:00 PM

Ok I'm done with wildfire for now.
http://git.redump.net/mame/tree/src/mess/drivers/wildfire.c

It's annoying how limited the MESS/MAME artwork system is: "when the game strobes a led faster, it should appear brighter, for example when the ball hits one of the bumpers"

It also happens in Parker Brothers Bankshot, where the cue ball appears to be brighter than the others.
Posted By: Haze

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 11:22 PM

many of the fruit machines also do it to do dimmer / brighter effects.

there's one that does a 'photo finish' (can't remember which) by holding the lamps on for an excessive amount of time to make them much brighter, apparently not popular with the ops because it was both distracting, and burnt them out.

we need some generic simulation code for bulbs / leds with attack / decay / max saturation parameters etc. at that point you make the lamps in the artwork not on/off things, but ones that take a parameter. IMHO that code lives outside the actual artwork system, much like any other discrete simulation. The actual artwork just takes a value.

of course MAME is still limited, there are cases where coloured lamps close together need to mix to form new colours, another issue entirely tho, the basic lamp sim needs to live somewhere.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 11:23 PM

I'm terrified of how slow an artwork system with a PLL to determine how fast something is strobing might be. Be *real* careful what you wish for.
Posted By: Haze

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 11:24 PM

Originally Posted By R. Belmont
I'm terrified of how slow an artwork system with a PLL to determine how fast something is strobing might be. Be *real* careful what you wish for.


one of the fruit machine emus manages it in Visual Basic 6 just fine ;-)
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/16/15 11:53 PM

They're hard coded for what they're doing. We wouldn't be. Oldest story in emulation smile
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/17/15 01:31 AM

Couldn't we just fake it with a simple 'stupid' R/C lowpass emulation in the brightness output? i.e. an accumulator which accumulates at a configurable rate when output is on, then leaks out at another rate when it is off?

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/17/15 04:35 PM

Yes, something simple. Let the outputs from MAME's side be the same as now of course (1 or 0), and let our artwork side handle the decay stuff.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/17/15 07:48 PM

TC4 rom double checked, 1 error found:
raw file offset $D1F, change $E6 to $F6
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/17/15 08:44 PM

I got Entex Baseball 3 today. It's got a TI 28-pin SDIP labeled

6007
MP1204
MSL^8014

From the wiring, I'm guessing it's a TMS1100.

Entex Baseball (1) should get here in a few days.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/17/15 08:54 PM

Thanks! I'm not sure how I missed that- I just fired up the comparison program again and it found it, so I must have skipped it for some reason. There are a few partially obscured bits that the program doesn't like, so I skip those, but $D1F is perfectly clear.
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/18/15 08:35 AM

Good news sean, if that's a TMS1100 it would make emulation doable I guess smile
Curious to see if Baseball 1 will use the same chip.

Not really related to this, but could you please confirm what's the CRC32 for your latest Pinball dump for Microvision? I just realized the rom bundled with Paul Robson's emulator doesn't match the one in the MESS software list.
I know you corrected an error you found at a later point, but I'm not sure which one is the correct version anymore.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/18/15 11:23 AM

The latest pinball.bin I've found is dated 3/17/2014 and has a CRC of 906544EA.

I need to double-check all of those MicroVision dumps just to be safe.
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/18/15 02:36 PM

Then the one in the software list is the old one as I was suspecting, Paul Robson's emulator contains the correct version.
Someone needs to correct this.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/19/15 04:05 PM

Speaking of that, Sean do you have good quality die pics of your Microvision games(ROM area especially)? And TMS1000 Simon?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/19/15 07:26 PM

Over the next couple of weeks, as I get time, I'll find the Microvision ROM pics and upload them.

The Simon ROM pic is already out there: www.seanriddle.com\simon_acid_rom1280.jpg


Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/19/15 10:56 PM

Well, I found the Microvision ROM pics quickly, so I uploaded them: www.seanriddle.com/mvroms.7z

I don't have ROM pics of Blockbuster, Mindbuster or Phaser Strike, which are ones that Kevin dumped.

I only have O Output PLA pics of Blockbuster and Vegas Slots.

I don't have instruction PLA pics of any of the chips.

As I get time, I'll put together O PLA and instruction PLA pics.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/19/15 11:10 PM

Cool, thanks =)
this will take a while to verify :P
http://pastebin.com/yRhEua73

A couple of weeks ago, I have already obtained the O PLAs for Pinball, Blockbuster, Bowling, Vegas Slots.
The microinstruction PLAs for Pinball, Blockbuster, Bowling is the default one (tms1100_default_mpla.pla, matching TI documentation). I couldn't read the one for Vegas Slots but we can assume they all use the default microinstruction set.

On another note, the MESS driver for Coleco Total Control 4 is uploaded: http://git.redump.net/mame/tree/src/mess/drivers/tc4.c
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/20/15 02:20 AM

Nice!

I forgot that I had put some of those image on my web site before. I agree that the games probably all use the default instruction PLA. And the games likely wouldn't display properly if the output PLAs were wrong. My guess is that I just looked at the OPLAs on the dice and told Paul which game used which. I checked the ROMs several times, but as you know, it wouldn't be too surprising if there were a few bit errors.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/20/15 08:27 AM

Am I correct in assuming that Kevin's Microvision dumps were done electronically, and those games were never decapped? (As I recall, he was only able to dump the earlier TMS1100 revisions this way.)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/20/15 01:51 PM

Yes.

Sean decapped Blockbuster, though.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/20/15 07:12 PM

Yeah, Kevin was able to dump the B-revision chips. On the E-revisions, he could only get the lower 7 bits, and he didn't get anything from the G-revision chips (or TMS1400s).

My notes show that he dumped Blockbuster, Phaser Strike, Mindbuster and Vegas Slots. I decapped Blockbuster and Vegas Slots.

I had tried dumping the chips electronically using the info in the patents and never got it to work. Kevin started with the patent info and tweaked it until he got it to work. He told me a couple of years ago that he had an idea to get all the bits off the E-revision chips, but I don't know if he's worked on it any more.

We now have a die shot of the G-revision chip (and TMS1400s), so he might be able to figure out how to modify his method to work with those.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/21/15 07:22 PM

Entex Baseball (1) has a TMS1000 labeled MP0914; this one is dated 7949.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/21/15 08:32 PM

Ok, looking forward to the decap and pinout info =)
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/22/15 01:56 AM

Interesting, so they ended up using different chips after all.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 01:52 AM

I've checked the Microvision roms, and only found 1 error:

seaduel_raw.bin, offset $66A, change $AA to $AB.
(for seaduel.bin, this maps to offset $5F9. oldval $50, newval $70. newcrc="77a8f71b")
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 02:05 AM

I've also checked one I had in the backlog: cd2708. To freshen your memory: it was the arduous-to-transcribe Speak & Math decap from Siliconpr0n.

cd2708raw.bin:
One error: offset $3A8, change $A0 to $AF.
Also, from reading the disasm, I conclude there's one under the smudge too: offset $108, change $14 to $15.

It looks like it works in MESS now. I'll update the driver in a bit. Did you have more decaps planned for TI Speak stuff?
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 03:09 AM

Originally Posted By hap
I've checked the Microvision roms, and only found 1 error:

seaduel_raw.bin, offset $66A, change $AA to $AB.
(for seaduel.bin, this maps to offset $5F9. oldval $50, newval $70. newcrc="77a8f71b")


Thanks for checking those again. Do you feel like we can be reasonably confident in the accuracy of the dumps at this point?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 11:56 AM

Yes. Even without the error I found(ignorance is bliss?), we could be reasonably confident. You can't get much better with optical method dumping.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 07:22 PM

That's good news on the Microvision carts. I think part of the reason that there weren't many wrong bits found is that I play-tested the games in Paul's emulator, which uncovered many of the errors. But some of the games are pretty difficult to figure out, and some of them seem to have odd quirks even playing on an original unit, so it's good to have another pair of eyes checking them out.

As for Speak and Spell stuff, I don't think I've got anything else that's undumped. Let me know if there's anything in particular you're looking for.

I tried for a couple of Dark Towers on Sunday. One game with a broken tower went for something like $70 shipped, which is more than I'm willing to pay. Another auction was just for a broken tower, so I figured I could get that, but it went for over $50 shipped.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 07:48 PM

I dumped the ROM from Entex Space Invaders. After I type up the wiring diagram, I'll post the link.

I bought one unit a few months ago and decapped the COP444, but the die stuck to the plastic and I had to really torch it to get it off. That toasted the passivation layer, so I couldn't get pics of the top metal layer. I Whinked the die and the results were good, but I couldn't see the ROM bits, so I bought another game to try again. In the meantime, Lord Nightmare posted the app notes on dumping the chip electronically, so I tried that.

I actually took a much simpler route than the app note describes- I put the chip on a breadboard with power and a cap and resistor for the oscillator, used a couple of AA batteries and a couple of resistors to enter ROM dump test mode, then clipped on a Saleae Logic 16 to capture the bytes.

Since the game uses the L pins to drive LEDs, they are set up as outputs, but it also uses the SK pin as an output, so that didn't output the byte valid signal that you get if you follow the app note. But it was very easy to track the bytes outputted and sample them in the middle of the bit times.

The entire 2K gets dumped every 40mS or so, but there's no indication of the beginning of the dump- it just rolls from 7FF to 000 and keeps going. Since I had to enter test mode while the game was running to make sure the L pins were outputs, I had no idea at what address the dump started. I captured for about 2 minutes and verified that all of the 2K sections (about 3000 of them) were identical. The game uses 6 AA batteries, but the datasheet says Vcc is 5V, so I dumped at both voltages and got the same results.

Because the chip breaks ROM up into 32 pages of 64 bytes, it turned out to be pretty easily to figure out the 64-byte boundaries; many of the pages are padded out with zeroes. And the chip has a quirk that requires the first instruction executed after reset (at address $000) to be a CLRA ($00), so I looked for a zero at 64-byte offsets. There were only 5 possibilities, so I used unidasm to figure out which one was most logical for a reset routine (looking for RAM initialization, setting the L pins as output, etc).

That's where I got confused- there were lots of "Invalid" messages in the disassembly. After a bit of investigation, I figured out that the COP444 disassembler imposes the same 1K ROM limits as for the other COP chips, although the COP444 has 2K of ROM. That was causing various instructions like JP, JSR, LDD, XAD and LBI to say the operand was invalid. I patched that up and figured out which 0 was the start of the ROM and shifted the bytes to bring it to the front.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 09:31 PM

Originally Posted By seanriddle
As for Speak and Spell stuff, I don't think I've got anything else that's undumped. Let me know if there's anything in particular you're looking for.


We only have Speak & Math US newest release (CD2708) so far: http://www.datamath.org/Speech/SpeaknMath_86.htm

The other Speak & Math and the Speak & Spell rom code was typed in from the patents. The Speak & Math one is definitely pre-release. The Speak & Spell one, might be the same as the 1978 commercial release. We still need to verify TMC0271(hmm, didn't you buy two?). Then there's the Language Tutor rom, also typed in from the patent, but doesn't work in MESS yet.

So yeah, anything except CD2708. IMHO CD2705: Speak & Read would be at the top of the list.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 09:38 PM

We have a COP400 series emulator in MESS, let's hope Entex Space Invaders gets running with ease =)

After looking at youtube (I never heard of the game..), it looks like this is another candidate for external artwork. Can you make a scan of the.. erm.. plastic screen/mask/thing?:P
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/23/15 10:59 PM

I posted the Space Invader info: www.seanriddle.com/cop444l.html I'm trying to get a good scan of the mask without destroying it.

Handheld Museum says that the grey version has the COP chip and the black version has the TI chip (MP1211, probably a TMS1100), so I bought a black one.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 12:47 AM

Here's a scan of the Space Invader mask: www.seanriddle.com/entexsi.jpg I peeled it off, cleaned it, and stuck it to a piece of paper to scan. It looks pretty good, but there are some scuffs. There is a reddish/purplish bezel that goes over this and hides the unlit enemies.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 01:16 AM

Thanks, it looks fine.
Does it say anywhere why they changed MCU supplier? It'd mean they reprogrammed it, like when MB went from Intel to TI on Microvision games.
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 02:06 AM

Would be pretty cool to see games like Entex Space Invaders or Pac-Man 2 emulated, fingers crossed it won't be too hard smile

Impressive progress that's being made here lately.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 04:46 AM

ssj: pac man 2 is dumped and the vfd vectorized by kevtris; all we need is a hitachi hmcs4x (not the later hmcs4xx, dunno what actually used that later one) cpu core. Stiletto is working on scanning some docs and once that's done work can begin.

LN
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 07:40 AM

oh nice, wasn't aware of that!

You guys should have some sort of index of what has been dumped/emulated already within the range of this "little" project smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 07:57 AM

Originally Posted By hap
Does it say anywhere why they changed MCU supplier? It'd mean they reprogrammed it, like when MB went from Intel to TI on Microvision games.

As well as the cost to reprogram the game for a different chip, they had to redesign the PCB, so there had to be a good reason.

I'm guessing there weren't enough COP444's available. Handheld Museum says over 800,000 games were produced. I bet it sold better than expected and they had to scramble to keep up with demand.

But that doesn't explain why they changed the case. It seems like they would have used the same molds. Maybe there was some rights issue, and they owned the general design but not the specific implementation? Once the game took off, it was cheaper for them to redesign everything?

I found some interviews with Rick Dyer, but they pretty much skim over the handheld games he worked on and concentrate on Dragon's Lair.

Oh, and I picked up a Speak and Read.

Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 08:40 AM

Originally Posted By ssj
oh nice, wasn't aware of that!

You guys should have some sort of index of what has been dumped/emulated already within the range of this "little" project smile


Lord Nightmare has some items for Speak & Spell and friends listed here, which could probably be updated:

http://www.mess.org/dumping/have#in_lord_nightmare_s_possession

But if we're talking about every handheld game with an MCU, it's quite a large category, I'd imagine.

Has anyone looked into the Game & Watch? I just read an interesting interview about designing those.

http://www.plasticpals.com/?p=23596

They're described as using an unmodified calculator chip. It seems that the first ones were more discrete logic type games like Pong. But at some point they switched to programming a CPU.
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 09:12 AM

I was mostly speaking of the ones you guys dumped/emulated since this thread has started which has been quite a few already I know I've lost count, so yeah I guess that would fall in every handheld games with an MCU since this doesn't seem to be limited to only TMS-09xx/1xxx any longer.

Game & Watch games with an MCU? Now that's something completely new to me, not that I'm very familiar with them, but always thought they all used discrete logic like most similar LCD based handhelds.
Madrigal Game & Watch simulators are very decent especially the new versions, but if there is an MCU involved emulation would be far more interesting. These games are pretty expensive though so it wouldn't be something cheap that's for sure.

Bookmarked that link to read later, seems like an interesting one thanks for posting.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 02:33 PM

Yup, Game & Watch stuff has an MCU, most of them by Sharp I think.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 04:19 PM

Originally Posted By ssj
Game & Watch games with an MCU?


Say hi to Mickey&Donald: http://siliconpr0n.org/map/nintendo/dm-53/mz_mit20x/

Segher&I hand-dumped the rom and I've done a svg of the lcd.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 05:05 PM

If someone wants to maintain a list of this, here's a start..
2014/2015 dumped and emulated:
did I miss any? maybe.

handhelds/tabletop:
APF Mathemagician - still need decap for PLAs verify
Coleco Amaze-A-Tron
Coleco Total Control 4
Epoch Dracula
Ideal Electronic Detective
Kenner Star Wars Battle Command (prototype from patent & commercial release)
MB Comp IV
MB Microvision & all cartridges - would be nice to see more dumps of Intel cartridges?
MB Simon - TMS1000 version, also have decap of hardwired no-rom version
Parker Brothers Bank Shot
Parker Brothers Codename Sector
Parker Brothers Merlin - still need decap for PLAs verify
Parker Brothers Split Second
Parker Brothers Stop Thief (prototype from patent & commercial release)
Parker Brothers Wildfire (prototype from patent) - have decap too
Tandy Radio Shack Computerized Arcade - still need decap for PLAs verify
TI Language Tutor (prototype from patent) - preliminary emulation
TI Speak & Math (prototype from patent & 1986 commercial release)
TI Speak & Spell (prototype from patent, with VSMs/modules from multiple sets)
Tomy Alien Chase
Tomy Tennis
<unknown> MP3403

calculators:
TI-30
TI-74 Basicalc (TMS7000 MCU)
TI-95 Procalc (TMS7000 MCU)
TI-1270
TI Wiz-A-Tron (handheld toy or calc?)
TI Business Analyst-I
TI CC-40 (TMS7000 MCU)
TI Programmer
TI SR-16
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 05:59 PM

I've got a top metal die shot of Merlin. I'll post the PLAs. I can't find pics with the top metal removed, but I assume I have some somewhere. But I think the PLAs can be verified from the top metal shot.

I'm pretty sure Kevin dumped Maniac (from Ideal); he's got a file on his site that has the same code number that was on the chip I decapped. My game had the PIC1655A version and I was unable to dump it, and I cracked the die when I decapped it. I might be able to match up enough bits to confirm that they are the same, or I can write up the PCB wiring and you can see if Kevin's code works.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 07:05 PM

I'm interested in the whole Merlin die shot too, to confirm if one of the bits was dumped bad or not. (see notes at the bottom of this file: http://git.redump.net/mame/tree/src/mess/drivers/merlin.c )
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 09:24 PM

Originally Posted By Olivier Galibert
Say hi to Mickey&Donald: http://siliconpr0n.org/map/nintendo/dm-53/mz_mit20x/
Segher&I hand-dumped the rom and I've done a svg of the lcd.

Nice! This is totally new to me, so emulation might be possible one day great news. Anyone knows if all Game & Watch games use an MCU or do some rely on discrete logic only?

Thanks for the list hap, nice to have it all put together in one place.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 10:15 PM

Originally Posted By Olivier Galibert
Say hi to Mickey&Donald: http://siliconpr0n.org/map/nintendo/dm-53/mz_mit20x/

Segher&I hand-dumped the rom and I've done a svg of the lcd.

That pic reminds me that to learn more about the MCUs in the R-Zone Ranger sent me, I decapped the handheld LCD games TopGun and TMNT, which used similar Sharp chips: http://www.seanriddle.com/tiger.html

The ROM for TopGun is on my page as well as a scan of the PCB. If anyone's interested in emulating those games, I can figure out how the segments of the LCD are controlled and I can upload TMNT.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 10:18 PM

Originally Posted By hap
I'm interested in the whole Merlin die shot too, to confirm if one of the bits was dumped bad or not. (see notes at the bottom of this file: http://git.redump.net/mame/tree/src/mess/drivers/merlin.c )
I'll find the pics or re-shoot the die with the top metal layer removed.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/24/15 10:34 PM

According to the interview, the first few were discrete logic. Of course, there's been great work emulating discrete logic arcade games lately, so I'd say there's still hope there.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 12:41 AM

I uploaded the Merlin ROM array and output PLA:
www.seanriddle.com/merlinromacid1280.jpg

www.seanriddle.com/merlinopla.jpg

I'll upload the instruction PLA later.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 04:36 AM

I uploaded the instruction PLA:
www.seanriddle.com/merlininstpla.jpg

I also converted the fixed Merlin dump back to raw bit order and superimposed the bits on the ROM array picture, and didn't find any differences. Then I changed byte $96 from $1E to $5E and converted that file to raw bit order and I can see the extra bit. So for whatever reason, Kevin's dumping method added that one bit. It would be very interesting to figure out why.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 08:46 AM

I uploaded Entex Baseball (1) info:
www.seanriddle.com/tms1000.html

Here's a scan of the bezel:
www.seanriddle.com/entexbb1bezel.jpg

And here's a scan of the PCB for the LED positions:
www.seanriddle.com/entexbb1pcb.jpg
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 03:51 PM

Ok, I've updated the MESS merlin driver.
I'm impressed your tool could read the Baseball game ROM data. It took me a while to verify, especially the denser areas.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 07:08 PM

I did Baseball manually, since it's too cold to go out and Whink the chip. TMS1000 only has 8192 bits smile I will verify it with my other program after I remove the top metal layer, but I'm pretty confident of the dump (even more so after you verified it).

If I were better at image processing, I'd write a program to take the top metal ROM array pics and highlight the 1 bits.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 07:15 PM

Anyone have any info about dumping Rockwell MM76EL chips electronically? I picked up a Scrabble Sensor game (that's more like a word version of Comp IV than Scrabble), and it's got a Rockwell chip labeled B8610-11. The pinout matches the MM76EL, which is one of the PPS4/1 microcontrollers. The data sheet says pin 7 is TEST, which puts the chip "into a test mode which tests ROM and allows testing of the RAM and instruction logic", but I don't see any details.

Also, are there any data sheets around for non-PPS/4, non-6502 Rockwell MCUs/CPUs? I'd love to get a hint on the calculator chips used in the Mattel handheld games. The B6001EA from Battlestar Galactica looks much simpler than the PPS/4 chips, but maybe it's in the same evolutionary branch.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 07:37 PM

Originally Posted By seanriddle
Also, are there any data sheets around for non-PPS/4, non-6502 Rockwell MCUs/CPUs? I'd love to get a hint on the calculator chips used in the Mattel handheld games. The B6001EA from Battlestar Galactica looks much simpler than the PPS/4 chips, but maybe it's in the same evolutionary branch.


You have a die shot?

OG.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 07:46 PM

Here's a 2Kx2K pixel jpg. I've got a higher-res XCF if you want it. http://www.seanriddle.com/bsg.html
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 07:58 PM

Nice, and hmmm. I don't recognize that tech.

It looks simple enough to vectorize and simulate, but damn, I really don't recognize that tech. The high-rez one could be more readable though :-)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 08:12 PM

Here's a 9K x 10K GIMP file: http://www.seanriddle.com/bsg.xcf

It looks like 180 bits of RAM and 512 bytes of ROM.

I like the pattern of the ROM array with the top metal layer removed.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 08:26 PM

I haven't looked at this for a while, but it seems that I guessed at pin numbering based on the PCB. I've got pin 3 in the upper left, with numbering going CCW. The chip was a 42-pin QIL, but there are only 31 pads on the die. It looks like pins 21-22, 27-33 and 40-41 were N/Cs to the die.

I transcribed the raw bits, but since I had no idea of the instruction set, I didn't try to figure out how to put them in logical order. www.seanriddle.com/bsgraw.bin
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 10:50 PM

by the way, maybe we can pretend to emulate the XBOX: https://www.youtube.com/watch?v=PhMpr9v27EU

note: I think there's a pretty good chance this has a TMSxxxx
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/25/15 11:24 PM

Just put a bid on one. I got a Kosmos Astro (has a TMC1470) but missed out on an Entex Raise the Devil pinball because I forgot to check on it this morning. D'oh!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/28/15 12:41 AM

I won the Lightfight. I'll let you know what chip it uses.

I just noticed that the Entex Baseball (1) that I have has a three-position power switch- off/am/pro. Pics of the game just show off/on. But I don't see it routed to an input; instead, it looks like pro connects a 150K resistor to VDD (+9v). The other side of the resistor goes to pins 18 and 19, which are the oscillator pins, which are also (always) connected through a 47pF disc cap to ground. When the switch is am or off, the resistor is floating. So I'm guessing pro mode just makes the chip run faster?

It looks like it's wired the same on Baseball 3, but pro/am is on its own switch.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/28/15 12:59 AM

Interesting, Tomy Tennis uses the same trick. Could you measure the osc with it on Baseball 3 before taking it apart?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/28/15 01:13 AM

D'oh. I didn't think to do that since it was "just" a TMS1000 and we have data sheets. But more info is always better.

And my post was unclear- Baseball 1 has a 47pF cap and a 43K resistor always connected, and the switch adds in the 150K resistor.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/28/15 11:14 PM

Well I'm finally here! Sean, did you ever get the TMS1xxx chips to dump electrically? I don't know if I heard if you did or not.

If we can get a better die shot, I might be able to poke around on the TMS1400 to see if I can figure out how to electrically dump it vs. the blowtorch and typing method.

I successfully used the die shot for the NEC D650 to figure out how to electrically dump it, which is how I got the D552/3 dumps for emulating 4 different VFD games.

Turns out a similar method worked on the HD38800/HD38820/HD38750. I actually found factory test code in these parts which I then used to properly dump every bank including the "pattern ROM".
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/28/15 11:42 PM

Cool! No, I see the "cycle alignment pulse" or whatever you want to call it, and I have gotten the same repeating sequence of bytes from different chips, but never an actual ROM dump. I got frustrated and have been just blow torching them. I'm building a huge stack of boxes, cases and PCBs with no chips. I kinda feel like a rogue Santa's elf who's destroying games instead of making them....

I've got 3 big Gimp XCFs of TMS1400s: a 6000x5000 top metal shot of Split Second, an 8000x6500 acid shot of Bankshot, and an 8000x6500 acid shot of Total Control 4.

http://www.seanriddle.com\splitsecond.xcf

http://www.seanriddle.com\bankshot.xcf

http://www.seanriddle.com\tc4.xcf

I've also got a 9Kx10K top metal shot of the TMS1100-G die from Super Block Buster that was undumpable.

http://www.seanriddle.com\sbb10000.xcf

I can make other pics as needed- just let me know.

Hap emulated a TMS1100 that you dumped, but we don't know what it is. It's not the TMS1000 M32018 that you also sent to Visual 6502 to decap, but a TMS1100 labeled MP3403 DBS 7836 that you said came off some game board with 7-segment LEDs. Any chance you still have that game board to help ID the game? The reason it's interesting is that MP3404 is Merlin and MP3405 is Amaze-A-Tron. Hap hooked one of the outputs up to a virtual speaker, and it plays different tunes when you mash the keys.


Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 02/28/15 11:46 PM

I uploaded the Entex Baseball (1) ROM array with the top metal layer removed. I checked the bits and I didn't find any differences.

I also got the Speak and Read and the black Entex Space Invader with the TI chip. I'll measure the clocks before I decap it. As well as the case and MCU, the overlay is different from the gray one. Makes me wonder what happened that they couldn't use anything from the original run.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 12:16 AM

Originally Posted By seanriddle
Cool! No, I see the "cycle alignment pulse" or whatever you want to call it, and I have gotten the same repeating sequence of bytes from different chips, but never an actual ROM dump. I got frustrated and have been just blow torching them. I'm building a huge stack of boxes, cases and PCBs with no chips. I kinda feel like a rogue Santa's elf who's destroying games instead of making them....

I've got 3 big Gimp XCFs of TMS1400s: a 6000x5000 top metal shot of Split Second, an 8000x6500 acid shot of Bankshot, and an 8000x6500 acid shot of Total Control 4.


I've also got a 9Kx10K top metal shot of the TMS1100-G die from Super Block Buster that was undumpable.

http://www.seanriddle.com\sbb10000.xcf

I can make other pics as needed- just let me know.


Yeah I will take a look. I am not sure if resolution will be good enough to make out the transistors though. Right now I have been dumping CPUs for VFD games, and so far there's only two or three games with TMS parts. The rest appear to be mostly HD388xx and D553's and their friends.

Quote:

Hap emulated a TMS1100 that you dumped, but we don't know what it is. It's not the TMS1000 M32018 that you also sent to Visual 6502 to decap, but a TMS1100 labeled MP3403 DBS 7836 that you said came off some game board with 7-segment LEDs. Any chance you still have that game board to help ID the game? The reason it's interesting is that MP3404 is Merlin and MP3405 is Amaze-A-Tron. Hap hooked one of the outputs up to a virtual speaker, and it plays different tunes when you mash the keys.


The story on that is kind of a weird one. Had a friend visit me from canada about 10 years ago. He got two boards from a surplus electronics place for $1 each. The boards had 5 7-seg LED displays on each and the MP3403 along with lots of the world's crappiest sockets for incandescents, and some driver chips.

The boards are fairly large, around 10-12" across by 6-8" high. He wanted the displays, so he desoldered those and left me the balance. I still have them, but they are at the bottom of my board box. I talked to hap about it and was going to find them and take pictures and trace it out.

I don't know what game it went to, and it's possible the game was never released.

So far I have been doing pretty good on dumping handheld game micros, I've got 16 or 17 games now and have pulled the VFDs, vectorized them, and dumped some of the micros. I am waiting to confirm my rom dumps are good before I dump the rest because I made a custom adapter to dump the QFP ones, and I don't want to desolder them until I know the dumps are good.

So far I haven't actually killed a game, I will be putting these all back together when we're done.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 08:06 AM

Aha, I wonder if maybe that board is from some kind of redemption game. Seems like a board like that would cost too much for a home game, let alone a handheld.

Have you dumped any Rockwell chips, especially the PPS4/1 MCUs like the MM76EL? The data sheets mention a test mode to verify ROM contents, but I haven't found any details. When I have some time I'll try activating the test pin and see if I get lucky and it just starts spitting out data, like the COP444L.

Also, do you have any info on Rockwell calculator chips? We've been trying to figure out the Mattel handhelds, which seem to be B6001 and B6100 series chips, but haven't found anything but a few mentions in magazine articles and a couple of patents. I bought a couple of calculators with Rockwell chips, but they both are PPS4/1s, and the B6001 is much simpler.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 10:34 AM

Originally Posted By seanriddle
Aha, I wonder if maybe that board is from some kind of redemption game. Seems like a board like that would cost too much for a home game, let alone a handheld.


That's very possible- there's edge fingers on the board where spade terminals plugged in it looks. I will do a full board trace in a few days maybe.

Quote:


Have you dumped any Rockwell chips, especially the PPS4/1 MCUs like the MM76EL? The data sheets mention a test mode to verify ROM contents, but I haven't found any details. When I have some time I'll try activating the test pin and see if I get lucky and it just starts spitting out data, like the COP444L.


Not yet, but I will poke it soon. I bought a game (Mattel World Championship Football) that has no less than TWO MM78 chips in it. I have them removed and was going to try and poke around with the test pin to see if I get lucky.

I have a COP411 to dump also but there's a complete procedure fully documented to dump them so I'm not worried there. It's the sound chip in the handheld Turtles game. Nope it's not the same as the one on the Adventure vision even though both are made by entex.

There's another mitsubishi CPU that's in the Coleco Frogger tabletop that also seems to have a test pin. I hope I can dump that as well. The datasheet calls it by a strange name which implies it's probably a test pin.

Quote:

Also, do you have any info on Rockwell calculator chips? We've been trying to figure out the Mattel handhelds, which seem to be B6001 and B6100 series chips, but haven't found anything but a few mentions in magazine articles and a couple of patents. I bought a couple of calculators with Rockwell chips, but they both are PPS4/1s, and the B6001 is much simpler.


Not a thing unfortunately. I have one of those mattel football games with the chip in it. It's board-only and the chip is dead from what I recall so you can have it if you want it for decapping.

My handheld directory is located here with dumps, pictures, and pinouts for all the things I have worked on:

blog.kevtris.org/blogfiles/Handhelds/

Once Hap verifies my HD388xx dumps (hint hint :-) I will dump the other HD38820's. I won't remove them from the adapters until they are verified. I'm 99.9999% sure the code on them is good but the proof is in the emulation. We really need that HMCS programming manual. I know it's being scanned so hopefully that will be done soon.

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 08:30 PM

Originally Posted By seanriddle
I'm pretty sure Kevin dumped Maniac (from Ideal); he's got a file on his site that has the same code number that was on the chip I decapped. My game had the PIC1655A version and I was unable to dump it, and I cracked the die when I decapped it. I might be able to match up enough bits to confirm that they are the same, or I can write up the PCB wiring and you can see if Kevin's code works.


Yup, I got it from him a few days ago and added a very preliminary MESS driver for it moments ago. PCB wiring info would be great =)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 08:56 PM

Will do!
Posted By: Justin

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 09:28 PM

http://www.seanriddle.com/bankshot.xcf and http://www.seanriddle.com/tc4.xcf seem to be 404.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 09:28 PM

BTW I combined the misc. dedicated 1-game drivers into one, per MCU family. This got rid of a lot of code duplication.

http://git.redump.net/mame/tree/src/mess/drivers/hh_tms1k.c
http://git.redump.net/mame/tree/src/mess/drivers/hh_ucom4.c
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 10:47 PM

And you created the handheld version of cave.c/metro.c in the process. Wait 5 years and it'll be an imperative to split it back up so it's readable (actually, I believe that's true *now*, but there's always a lag time with MAMEdev).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/01/15 10:49 PM

Oops, should be

http://www.seanriddle.com/bankshotacid.xcf

http://www.seanriddle.com/tc4_acid.xcf
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 12:10 AM

Here's the Maniac wiring:

http://www.seanriddle.com/maniac.txt
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 02:32 AM

Well I started playing around with the MM78. I got it doing something but doesn't seem to be terribly useful yet. I have it in test mode and am feeding a binary counter into the 8 inputs which causes some of the bits to flow through to the RIO1-8 pins. Not all do, just a few do. Might need a decap to get more information on how the test pin works- it might need to be set to an odd voltage like on the 3850's.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 03:04 AM

Hmm I verified that all 8 bits that go into PIx comes out RIOx. Though, interestingly, the bits are swapped around a bit.

I am guessing this is going to work similar to the F8 microcontrollers where you get access to the internal CPU's data bus. So theoretically you feed instructions into the chip using the PI pins and then make it do load or store instructions or whatever, and then turn the ROM enable on at the right time to snag the ROM data. If there's some way to run the ROM code and get access to the bus it'd be easy to slurp the ROM contents this way and make it execute jumps to get into new banks to read the entire ROM.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 05:02 AM

I've decapped an MM75 that I can get pictures of, if that would help. I've also got an MM76EL that I haven't decapped yet.

The 3870 has one test pin that you apply two different voltages to: one disables ROM and forces in an opcode to be executed, and the other enables ROM and outputs the databus to a port. I dumped them by forcing in the instruction to reset the data counter to 0, then continually forcing in a load memory instruction, which put the ROM byte on the bus and incremented the data counter. When dumping the ROM, the signals on the port are inverted and ORed with the ROM data, so you have to put $FF on the port when reading or else you corrupt the ROM data read.

The COP444L is similar- you force signals on the SPI data in and data out lines to get into 2 different test modes. One lets you force opcodes, the other dumps ROM continuously to a port. I didn't force any opcodes, just read in the ROM dump and figured out where the start was.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 05:47 AM

yeah I remember that because we talked about it and I got F8 dumping working. I tried setting the MM78's test pin to different voltages but it only seems to put it in or out of test mode. I tried 0 to -10V (normal range) and then all the way to -20V via a resistor.. no change. the IOs are good to -30V so claims the sheet so this was safe.

I tried poking data into the other pins but didn't get any different behaviour; this chip has a serial port on it too so I applied a clock to the clock pin for it and could shift data through the chip's serial port but I don't think this was doing anything useful internally.

The MM76 chip dieshot would probably help a bit, since this 78 is very similar I think, so both will most likely dump the same way.

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 09:16 AM

I think I might have something! I was running the chip at 10V, which was wrong. This chip runs on 15V (checked the output of the converter on the game's PCB... 14.8V). I bumped it up to 15V and now the test mode appears to be dumping the ROM! I have a whack of data coming out the RIOx pins, about 20.8ms long with a bit time of approximately 10.2us. This divides out to around 2040ish bits!

The chip has 2K of data so this is pretty close, well within the measurement error of my scope.

The voltage range for data dumping is fairly critical and I thought I saw something earlier while it was running at 10V. At around 12V on test, the chip dumps its data it looks. 11.6V to around 12.4V. Below 11.6V it just relays data from the input ports. (possibly throwing data into the bus to execute). Above 12.4V it runs the code in the ROM.

Going by PMOS standards, this would be -2.6V to -3.4V.

Looks like I will have to make yet another dumping rig for these- I will make it a three play. MM78, COP411, and the mitsubishi CPUs maybe. Will be good to get my allpro 88 going. I got a replacement PCB for it about half done.


Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 05:15 PM

Good progress there on the MM78! smile

RB Yeah I understand why you could think that, but I don't think it's *that* bad. A better comparison to MAME is 8080bw.c

Sean: Maniac has 2 piezo speakers?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 05:15 PM

Good progress there on the MM78! smile

RB Yeah I understand why you could think that, but I don't think it's *that* bad. A better comparison to MAME is 8080bw.c

Sean: Maniac has 2 piezo speakers?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 06:09 PM

That was unclear. The two pins go to the two wires on a single piezo.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 06:18 PM

Originally Posted By kevtris
I bumped it up to 15V and now the test mode appears to be dumping the ROM! I have a whack of data coming out the RIOx pins, about 20.8ms long with a bit time of approximately 10.2us. This divides out to around 2040ish bits!


Awesome!

Do we have any ideas on dumping the pre-Microchip PICs (ie, back when they were made by GI)? There's one that was used in a lot of mid-80s Macs I'd love to have the real code for eventually. I don't mind sacrificing one to decap, but not having to do it would be even better smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 07:54 PM

I heard that old chips without the "C" are dumpable, ie. 1655 but not 16C55.

Maniac (note:it's a PIC1655A) was dumped by kevtris a couple of years ago. I can make it playable in MESS, but not without a few hacks in the MCU core. Apparently the customer could provide I/O config, this isn't implemented in MESS yet.

Oh, and I forgot to mention new additions, Entex Baseball(1) works great in MESS, as does Tomy Pac Man.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 08:07 PM

Sean do you have a list of interesting TMSxxx decap subjects? I'd like to do some nominations. smile

MB Dark Tower(though I know you are already looking for one) - definitely TMS1400
MB Super Simon - likely TMS1100
TI Little Professor - http://www.datamath.org/Edu/Professor-76.htm says TMS0975
TI DataMan - http://www.datamath.org/Edu/DataMan.htm says TMC1982, I wonder, maybe a TMS0980 derivative?
TI-45 - http://www.datamath.org/Sci/MAJESTIC/TI-45_1.htm says TMC1983, not as interesting, just that it has this 198x MCU too.

I also wonder, who were the first customers for TI TMSxxx. Currently the oldest ones we have are from 1977: MB Comp IV (serial 904) and Parker Bros Codename Sector(serial 905)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 10:06 PM

Originally Posted By hap
I heard that old chips without the "C" are dumpable, ie. 1655 but not 16C55.

I had no luck dumping the PIC1655A from the Maniac I bought, although Kevin game me notes. So it might be that the A versions aren't dumpable the same way as the non-A versions.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 10:23 PM

Originally Posted By hap
Sean do you have a list of interesting TMSxxx decap subjects? I'd like to do some nominations. smile

MB Dark Tower(though I know you are already looking for one) - definitely TMS1400
MB Super Simon - likely TMS1100
TI Little Professor - http://www.datamath.org/Edu/Professor-76.htm says TMS0975
TI DataMan - http://www.datamath.org/Edu/DataMan.htm says TMC1982, I wonder, maybe a TMS0980 derivative?
TI-45 - http://www.datamath.org/Sci/MAJESTIC/TI-45_1.htm says TMC1983, not as interesting, just that it has this 198x MCU too.

I also wonder, who were the first customers for TI TMSxxx. Currently the oldest ones we have are from 1977: MB Comp IV (serial 904) and Parker Bros Codename Sector(serial 905)

I have Dark Tower and Super Simon on my watch list. I can start looking for cheap Little Professors and DataMans (DataMen?)
I agree that the DataMan is probably an 0980 and Little Professor is likely an 0970.

The Speak and Read I got looks much more professional inside than the old Speak and Spells I have. The chips are CD2705B-N2L MES 8149, CD2801A-N2 ME 8144, CD2394A-NL MBU 8144 and CD2395A-NL MBU 8149. The CD28 and CD23s are 28-pin SDIP, and the CD27 is a cute 40-pin DIP that's the length of a 28-pin DIP.

I've got a backlog of chips that'll have to wait until work slows down a bit: Entex Baseball 3, Entex Space Invader with the TI chip, Kosmos Astro, and Light Fight should be here this week.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 10:27 PM

Originally Posted By kevtris
I think I might have something! I was running the chip at 10V, which was wrong. This chip runs on 15V (checked the output of the converter on the game's PCB... 14.8V). I bumped it up to 15V and now the test mode appears to be dumping the ROM! I have a whack of data coming out the RIOx pins, about 20.8ms long with a bit time of approximately 10.2us. This divides out to around 2040ish bits!

The chip has 2K of data so this is pretty close, well within the measurement error of my scope.

The voltage range for data dumping is fairly critical and I thought I saw something earlier while it was running at 10V. At around 12V on test, the chip dumps its data it looks. 11.6V to around 12.4V. Below 11.6V it just relays data from the input ports. (possibly throwing data into the bus to execute). Above 12.4V it runs the code in the ROM.

Going by PMOS standards, this would be -2.6V to -3.4V.

Looks like I will have to make yet another dumping rig for these- I will make it a three play. MM78, COP411, and the mitsubishi CPUs maybe. Will be good to get my allpro 88 going. I got a replacement PCB for it about half done.

Good news! Are you putting anything on any ports to get it to dump, or just setting the test pin and clocking the OSC pin?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/02/15 11:31 PM

maniac only has one but they are probably using an H-bridge style drive. i.e. HL then LH to hit it with effectively 12V instead of just 6.

I will be building a dual purpose dumping rig tonight to try dumping the MM78's and I will dump this COP411. The dumping technique is fully documented and looks easy enough, so I will be doing that too.

Dumping and vectoring two games tonight too: Qbert VFD (first 4 colour VFD) and Bambino Football (VFD, D553C)
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 05:15 AM

Re: that weird TMS chip on the mystery board. I brought the board home today and I know what it's for now. It was from some kind of bowling game.

There's a set of 10 'pin' light bulbs in the usual bowling pin pattern (5 on the top, then 4, 3, 2, 1) and three more bulbs, and then one group of 2 7-segs for frame # (the first digit can only show "1" so it does frames 1-10 I think) and the group of three digits is most likely the score (since a perfect game is 300).

Along the right side are fingers to slide those spade terminals on that go to the guts of the machine (pin detection and stuff I guess). there's 8 driver chips and some transistors and such.

I need to find the other one so I can check out both because some parts are missing and there's some added wiring fixes.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 05:21 AM

hap: ah nice that you got pac-man working. I have another D553C game to add soon; bambino superstar football. I dumped the micro but I have to vector the VFD and trace the PCB first... not sure if I will get to it tonight or if it will be tomorrow.

re: dumping PIC's. I can dump PIC1655's and maybe PIC1655A's (I think the ones I dumped were A's) and PIC1650's which is the 40 pin version with more IOs. I found my dumping rig but I don't know how it works now. I would have to find the code, and the CPU is missing.

sean: MM78's. nope, in ROM dumping mode it does not seem to accept anything on the inputs. reset appears to make the sequence it dumps reset too, so this is the best possible case. I am in mid process wiring up sockets to another PIC to do this triple play dumper (COP411, MM78, and the mitsubishi chip)

all: over on the handheldmuseum forum, we're talking about VFD game dumping and someone posted a picture of the CPU in the select a game machine for football, and it's a TMS1xxx part. I was wondering if this had the same mask # as one of the entex football games, because the select a game was made by them. The part on the cart is an MP7573.

The thread and pictures are here:

www.handheldmuseum.com/forum/viewtopic.php?t=2146&start=30

there's a real sexy PCB shot of the coleco frogger game with the mitsubishi chip that I think I can dump. been trying to buy a frogger off ebay but $50+ is a bit steep.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 07:32 AM

Cool. I'll try the MM76EL I have, but it'll be this coming weekend at the earliest.

I don't think anyone's looked at the Entex football games yet. From what I've read, their handheld Space Invader is not identical to the Select-A-Game Space Invader, but I've got one handheld Space Invader with a COP444L and another with a TMS-1100, so maybe one of them is the same as the S-A-G cart.

That MP7573 is a 40-pin chip, so it's not a TMS-1000 or -1100. I guess they needed the extra outputs. And it looks like they didn't use a VFD chip or they wouldn't need the transistors?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 08:09 AM

I will be able to test my MM78 tomorrow along with the COP411 dumping, though unfortunately the 411 is an RC oscillator version so I will have to write some tricky code.

I got the dumper built. You can use a pot to set the voltage on the test pin. it's got a very high input impedance and a 10K pot between ground/15V seems to work OK. if you have the L version I am not sure if it will work or what voltage it needs vs. these "normal" chips.

To put the COP411 into test mode I am using a PNP transistor to 5V and four diodes in series to drop around 2.4V or so, which should make it sit at 2.6V. The data sheet says 2.5-3V max to prevent damage so this should work fine.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 08:51 AM

Yeah, the COP444L in Space Invader was RC, too, which was one of the reasons I first tried dumping it without doing the setup stuff- I wasn't sure how to drive it. Luckily, the game sets the L port as all outputs, so that part of the setup was taken care of for me. I just used 2 AA batteries on the SO pin with SI grounded to get into ROM dump mode. That worked fine when I powered the chip with 9V, but at 5V I had to add a resistor to SO to get it to go into test mode. The game uses SK as an output, so I lost the data ready signal, but it was easy to figure out the center of the bits
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 12:34 PM

MP75xx logical guess: TMS1600?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 12:45 PM

Originally Posted By kevtris
hap: ah nice that you got pac-man working. I have another D553C game to add soon; bambino superstar football. I dumped the micro but I have to vector the VFD and trace the PCB first... not sure if I will get to it tonight or if it will be tomorrow.


There's still 1 thing I'd like to confirm about Tomy Pacman: Is plate#8 always-on? And if it isn't, how does the game access it?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/03/15 10:26 PM

sean: hmm isn't that a 5V only part? 9V could've blown it out. the COP411 at least is 5V only so claims the datasheet. I am going to use the PIC to monitor SK then feed it instructions each time it goes low, and then capture data on the falling edge during capture mode to read the ROM data.

hap: yes that is correct. I just fixed my pinout to say plate 8 is always on. Interestingly when I started dumping these I never thought that they'd just leave some plates on all the time and others tied together but that's what some of the games do.

I received that VFD galaxian 2 today, and desoldered the two CPUs from my adapters (HD38820A28 and A29, the two revs of coleco pac-man) and will solder two more down tonight and dump them.

Also I should be able to test dumping of COP411 and MM78.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 01:14 AM

Oops, there is a Zener on the PCB; didn't notice that before smile I just plugged the chip in and played a few games, and it still seems to work fine - lucky me. But the sound is annoying as hell!

With 6 AA batteries installed, I measure 6-7 volts between VSS and VDD at the chip depending on how many LEDs are lit. The 444L data sheet says standard operating voltage is 6.3 max, with an absolute max rating of 10V at any pin with reference to ground. So I guess it could handle 9V for the 2 minutes or so that I dumped the ROM.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 07:02 AM

Well, the good news: I have dumped 2K of data out of this MM78. I dumped it 32 times and the data is the same on all copies except the first few bytes after reset. This is fairly typical since pipelines are being filled, etc.

The bad news: There's no damn opcode documentation for these parts! grrrrrr. there's some data sheets on bitsavers (see link at end) but like the HMCS docs, there's a list of opcodes but no bit patterns for them.

I checked the other PPS-4/2 docs and the opcodes are almost totally different between the two systems. boooo. There's tons of new opcodes and lots of removed ones, so the two are totally incompatible it looks.

I guess we're stuck until more data about how the chips work shows up. oh well, at least dumping seems to work. I will post my dumps here if anyone wants to play with them: (note: the first 4 bytes it looks are wrong, but 2K later in the file they are right. this is my raw dump with zero processing.)

Data is in bit-order from the chip's RIOx bits. i.e. RIO1 -> D0, RIO2 -> D1, RIO8 -> D7. The data might be inverted coming out, I don't know. bit orders could be wrong too.

When TEST is in the "pass data to CPU bus" mode, the bit mapping looks like this:

PI1 -> RIO8
PI2 -> RIO6
PI3 -> RIO1
PI4 -> RIO2
PI5 -> RIO5
PI6 -> RIO7
PI7 -> RIO4
PI8 -> RIO3

So the bits could really be in "PI" order instead.

My dumps are here:

http://blog.kevtris.org/blogfiles/Handhe...Preliminary.bin

http://blog.kevtris.org/blogfiles/Handhe...Preliminary.bin


The PPS-4 stuff is here:

http://bitsavers.informatik.uni-stuttgart.de/pdf/rockwell/PPS-4/

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 08:31 AM

After a bit of wrangling I got the COP411 to run. When in test mode the SK pin outputs the CPU clock which makes it easy to synchronize the PIC to the internal operations. I have not yet gotten it to spit any data out but it's looking promising.

sean: what did you do to make it spit out the data? I reset the chip, let it run then threw it into test mode but SK didn't wiggle and it didn't spit out anything on the L lines.

When I try to enter test mode according to the data sheet, things worked OK with regards to SK going active but I haven't been able to make it spit anything out because I have to enable the L lines.

I will try the data sheet method tomorrow.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 08:31 AM

D'oh- I thought the PPS-4/1 opcodes would be the same as the other PPS-4 chips. It looks like we need the PPS-4/1 Programmng Manual #29410N38 and/or the PPS-4/1 Operator's Manual for Universal Assemulator #29400N37 ([homer]MMMM assemulator[/homer]).

A quick patent search came up with source and object code for a telephone that uses the MM77: 4203011. Maybe the opcodes are the same as for the MM78, or maybe there's a patent with MM78 code.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 08:43 AM

Reset inits the L port to input, and makes SK output the CPU clock. The Entex Space Invader game sets the L port and SK to outputs, so when I let it run and then went into ROM dump mode (SO=3V, SI=gnd), it started dumping the ROM contents at whatever address the program counter had.

If the game didn't set the L port to all outputs, I would have had to do the forced instruction setup to do that. Because the game uses it as an output, I did lose the SK sync, but that was no big deal; I just looked for edges and sampled in the middle.

When I went from reset directly to ROM dump mode, I got what you got- a clock on SK, but nothing on L.

Since I was able to figure out where the ROM dump started, I didn't try to force instructions.

If your chip should be setting L to output, try tweaking the voltage on SO a bit. I had to adjust it depending on VCC I used.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 12:41 PM

Originally Posted By seanriddle
The Speak and Read I got looks much more professional inside than the old Speak and Spells I have. The chips are CD2705B-N2L MES 8149, CD2801A-N2 ME 8144, CD2394A-NL MBU 8144 and CD2395A-NL MBU 8149. The CD28 and CD23s are 28-pin SDIP, and the CD27 is a cute 40-pin DIP that's the length of a 28-pin DIP.

I've got a backlog of chips that'll have to wait until work slows down a bit: Entex Baseball 3, Entex Space Invader with the TI chip, Kosmos Astro, and Light Fight should be here this week.


CD2705 is the MCU
kevtris dumped the CD23xx already (also rev.A, same as yours). CD2801A I don't know if anything's needed with that, lemme summon Lord Nightmare...

Speak & Spell Compact, Touch & Tell, and TI Vocaid are assumed to be dumpable TMS1100.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 01:22 PM

kevtris can I impress you with my google skills again? wink

electronic bowling game by Marx
https://www.youtube.com/watch?v=7b5UXmiqKcE

http://www.worthpoint.com/worthopedia/vintage-marx-series-300-electronic-108643511
http://auctionnearyou.maxsold.com/view-auctions/catalog/id/811/lot/93451/?url=%2Fview-auctions%2Fcatalog%2Fid%2F811%2F
http://www.worthpoint.com/worthopedia/1978-marx-300-series-electronic-154318122
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 05:57 PM

CD2801A-N2 ME 8144 is the speech chip (variant of tms5100). I've never tested one, but plgdavid has, let me see...
EDIT: see post below

LN
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 09:08 PM

//Matches "TMC0280NLP CD02801 W 8048 PHILLIPINES" (from a Language Translator)
//Matches "CD02801A-NL MFU 8231 PHILLIPINES" (from a Speak & Math 80)

These share common ROM tables, different than TMS5100(A and not)
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 10:01 PM

Yeah, its TMS5100 'patent' K coefficients and pitch table, but it uses the 'later' energy table from tms5110. The speak and math should use this same chip variant.

However, because of the way the tms51xx driver does variants selection (i.e. you must have a device of type tms5100 or tms5110a or etc and it must be declared as <required device ... > in the source code, it is a pain to have multiple drivers which use slightly different speech chips. There isn't any TMS_SET_VARIANT(*tms, variant) macro that can be used, each different speech chip has to have its own whole device, which is a giant mess, because the vsm rom module emulator has to point to the CORRECT device! It isn't possible to re-use the vsm definition from the 'speak and spell' as a root and have all other systems derive their config from that.

That's why I haven't touched tispeak.c to try to fix each device to use the appropriate speech chip yet.

The 'ME' on the chip sean has however implies it is revision E, while MFU would be revision F. There could be a change between those. Sean, do you want to try dumping the chip prom tables electronically (and testing the frame interpolation behavior?)

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 10:57 PM

hap: yep that looks like it! the LED displays and lamps are all in the same places and the size is right. I googled some but came up empty. Good now to give it a name.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/04/15 11:16 PM

re: the MM78. That patent with the code in it shows a polynomial program counter, but I clearly dumped 2048 bytes. The patent code's PC shows 64 byte banks or so it seems, which would be similar to the HD38800 and the TMS1000. But clearly the chip dumps all 2K!

Do they have a 5 bit binary counter that increments every bank, or what? Is the PC really just incremental? (the data sheet says the PC increments... but this is ambiguous I think, though implies binary IMO).

I suspect the 5th byte of my dumps is the 3C0h reset address, which is FFh on both dumps, and my data is inverted.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/05/15 07:12 AM

Marx Bowling patents (showing the funky greycode-ish sensor array they used for reading the ball position):
https://www.google.com/patents/US4265449
https://www.google.com/patents/USD255806

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/05/15 08:11 PM

It's too bad Rockwell was so closed-mouthed about the PPS-4 internals (not even publishing the opcodes in the datasheets!) I assume that the code in the patent is real, which sure implies an LFSR PC, at least for the MM77. Maybe the test pin enables circuitry to increment the bank register?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/05/15 08:13 PM

OK, I'll decap the 2705 from the SnR. LN, how do I dump the 2801 electronically?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/06/15 02:13 AM

Hmm. I'm not sure, you might be better off lending it to plgdavid for that, unless you can make an 'vsm-emulator' device to do it.

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/06/15 06:27 AM

Here's the complete schematic for the marx 300 bowling board I have:

http://blog.kevtris.org/blogfiles/Handhelds/Marx%20300%20Bowling/marx300.PDF

Enjoy!
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/07/15 12:53 AM

with the help of sarayan that did most of the work, we figured out most of the MM78 stuff now. Including bit order, and that it looks like my dumps are good. All of the opcodes except a couple have been figured out now and the code looks pretty decent.

It looks like I was correct in that the CPU starts dumping at the reset vector, after 4 "junk" bytes. Address 0004h in my dumps is address 03c0h in the CPU space. The init code happened to be the same on both chips which helped a bit. Having more than 1 example is very useful in determining how close you are.

The tentative disassemblies are here:

http://dspnet.fr/~galibert/c6.txt
http://dspnet.fr/~galibert/c7.txt

Thanks a bunch to sarayan for the help!

I still am mystified how I got all 2K of data out of the chip, seeing how it has a polynomial program counter (verified) and a bank latch. Apparently the bank latch is really a counter, and every time the polynomial PC wraps it increments it. The other 4 bitters sure don't do this.

There's hundreds of examples in the disassembly of this not being a fluke. I particularly liked the jmp slide which appears at 0522h of c6.txt. They used jumps (they call them "transfers", or T) because each one takes 2 cycles instead of 1 cycle like a NOP, and the possibility of them properly pointing to each other like that by chance is impossible because it's in polynomial order.

Each usage of the TAB instruction is also "proper". the jump itself doesn't occur until 2 cycles later, so they nop them out or have another instruction or so before the jump table itself.

Also, every time the skisl instruction is used, there's a NOP before it because it takes a cycle to read the port bit in question, selected by B.

016 [017] 1b lb #b
017 [00b] 00 nop
018 [005] 01 skisl

On other micros, I finished dumping all my HD38820's. I had 8 of these surface mount chips to dump and finished doing that finally. So I think we got 14 or 15 games backed up waiting to be emulated, only being held up by lack of documentation.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/07/15 04:11 AM

I uploaded the ROM dump and hardware info for Entex Baseball 3:
http://www.seanriddle.com/tms1100.html

Scan of the bezel: www.seanriddle.com/entexbb3bezel.jpg

Scan of PCB showing LED placement: www.seanriddle.com/entexbb3pcb.jpg
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/07/15 04:17 PM

Cool =) I'll let you know when it's emulated.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/07/15 07:08 PM

Ah, on ebball3 where's the Speaker connected to?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 07:58 AM

It's connected to pins 3 and 4 (R10 and VDD). I updated my doc. Thanks.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 10:23 AM

Well I finished up a few more vector + dumps. There's 2 new D553C games and one HD38820 game. I have 2 more to finish (another D553C and HD38800) and then I'm through all my games, except dumping the COP411 on turtles.

This one game I have, tandy kingman, has an HD38800B on it. This is the first time I have come across the B revision of this chip- it appears to be a die revision and is most likely a die shrink. It does not dump properly, and upon inspection the first 10-15 words are OK then it just sort of falls apart.

I am guessing it's because I am clocking it too slowly, so I will adjust my clocking doodad see if it behaves then. This would lend credence to a die shrink since the gate capacitance will go down making clock speed more critical. I am running it at something like 20-50KHz which is way below datasheet spec.

These chips needed a special circuit to clock them because it only uses an RC oscillator, so you have to "simulate" an RC circuit for it to work properly. You cannot just stuff a clock in because the oscillator pin is both input AND output. (it lets the resistor charge the cap up to a certain voltage, then it turns a transistor on to dump the capacitor to a lower voltage, then the cycle repeats).

New games:

http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Laser%20Fight/
http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Superstar%20Football/
http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Galaxian%202/

Tomorrow I will try to get the last two done (kingman and astro command which is the D553C game).

Looks like I am up to 19 games done!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 10:37 AM

I got a Funtronics Jacks game. Opened it up, and the CPU die (COP410L) is bonded directly to the PCB with no packaging, like the Channel F carts. So I won't have to decap it, but it'll be awkward to photograph since my XY platform is only about 1" square. I guess I'll use a little double-sided tape to hold it in place. I'm not sure if the pins needed to dump it are bonded out. If not, it'll be tough for me to electronically dump it.

I also got a 1978 TI Little Professor, which is the one where they added the On/Off and Level buttons. The chip is marked TMC1993. I decapped it and the die is marked 1990C-c3C. It looks a lot like the 0970, but it has a different pinout; all the LED connections are on one side and all the keypad connections on the other. There's no oscillator input, and the keypad rows and LED digits are on different outputs.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 01:33 PM

Originally Posted By seanriddle
OK, I'll decap the 2705 from the SnR. LN, how do I dump the 2801 electronically?


the 2801 ROM tables have already been dumped. Of course it could be different from variant to variant. I could run the tedious PROMOUT logic on your unsoldered chip, though I do have a SnR here. Also dumped two new SnR carts. Only two left to dump now.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 02:22 PM

Originally Posted By seanriddle
I also got a 1978 TI Little Professor, which is the one where they added the On/Off and Level buttons. The chip is marked TMC1993. I decapped it and the die is marked 1990C-c3C. It looks a lot like the 0970, but it has a different pinout; all the LED connections are on one side and all the keypad connections on the other. There's no oscillator input, and the keypad rows and LED digits are on different outputs.


1990? Interesting =) I wonder what else they changed from TMS970. Is the OFF button done with discrete logic, or on-die?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 06:22 PM

Like the TI-30, there's nothing but the chip, LED bar, battery clip and keyboard, so the power circuitry is on-die, like the 0980. 9 pins of the chip go to the 4x5 keyboard matrix, 16 pins go to the display, 2 pins are power and one pin is a no-connect.

Here's a really poor die shot: www.seanriddle.com/lp78.jpg

It looks like the middle of the die was just copied-and-pasted from the 0970.

From Datamath.org, the TI-1000 also uses the 1990. Dataman and TI-45 use the 1980, which I think is just the VFD version of the 0980.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 09:30 PM

TI really put a lot of effort into making their high volume stuff like that 1 chip. I remember as a kid opening up some TI stuff and quickly being disappointed at how there was literally almost nothing inside of them except the chip/display/keypad like you said.

re the COP410 bonded out, shouldn't be too difficult to determine if it's dumpable or not, just find pin 1 and count bond wires? I've had to do that for NES pirate cart mappers before to figure out the pinout.

sean: did you get that MM77 tested out?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 10:45 PM

Looks like the HD38800B part dumps the same as the A. the problem was stupid. my socket pins got bent a bit by my HD38820 adapter so they weren't making good contact on the chip. Measuring with the meter showed a few opens so once I bent the pins in slightly it worked. Unfortunately no one makes 42 pin ZIF sockets. They make 48 pinners so I will have to use one of those.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/08/15 11:41 PM

Originally Posted By plgDavid
Originally Posted By seanriddle
OK, I'll decap the 2705 from the SnR. LN, how do I dump the 2801 electronically?


the 2801 ROM tables have already been dumped. Of course it could be different from variant to variant. I could run the tedious PROMOUT logic on your unsoldered chip, though I do have a SnR here. Also dumped two new SnR carts. Only two left to dump now.


Its just that the cd2801 sean has is a revision E part, the one you dumped is revision F, so there might be a interpolation behavior or lpc/pitch/energy table difference? (probably a minor one if any)

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/09/15 10:12 AM

Originally Posted By kevtris
TI really put a lot of effort into making their high volume stuff like that 1 chip. I remember as a kid opening up some TI stuff and quickly being disappointed at how there was literally almost nothing inside of them except the chip/display/keypad like you said.

re the COP410 bonded out, shouldn't be too difficult to determine if it's dumpable or not, just find pin 1 and count bond wires? I've had to do that for NES pirate cart mappers before to figure out the pinout.

sean: did you get that MM77 tested out?

Yeah, the Kosmos Astro astrological calculator is the exact opposite- it's crammed full of components. But it was for a different market.

I just haven't had time to get the Jacks PCB under the scope yet to see what pins are bonded out. I'm not sure if they would bond the pins used for test mode- I guess they might.

I've just got an MM76EL right now. The game runs it with a 9V battery, so I tried dumping it at 9V and got nothing. With the test pin at VSS it looked like it was running normally, but at VDD there was nothing at all, even it I reset it. The chip takes 6.5V to 11V, so I tried 7.5, but that didn't work either. I was probing the RIO port with my Logic16, which isn't really supposed to be used over 6V, although I've used it at 9V before. I didn't want to risk it at 11V, but I gave it a quick try and actually got something. So I'm going to add a level shifter to help make sure I don't burn it up.

The data I got is weird- on power up I got about 1/4 second of pulses on RIO1-RIO8. Zooming in, it's actually 18 groups of pulses. All 8 signals go high for 3.3mS, then there's about 0.5mS of pulses. The 18 groups are similar but not the same. So I'm wondering if I'm in some other test mode, not ROM dump mode. The data sheet says test mode "tests ROM and allows testing of the RAM and instruction logic".

I'm letting most of the pins float, including PIx. Were you driving any other pins when you got your data?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/09/15 08:52 PM

Sean: on Entex Baseball 3, is it possible without the MCU to measure the output frequency of the RC circuit? (with and without the PRO switch enabled)
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/09/15 09:47 PM

sean: I saw some weirdities on the data output of the MM78 when it was near the edges of the test voltage range (i.e. 11.5 and 12.5) where it'd seem to oscillate between test mode and operation.


re: cop 411 dumping. I had a hard time trying to get this chip to dump. turns out the damn docs are WRONG! they tell you to use 04h on the LEI instruction (33 04) but then the signals are showing it as 33 44. turns out it has to be 33 64 or else it won't work.

the docs for the chip say the second byte of LEI is 6x, so I changed it and sure enough now data is coming out. I found you can drive the RC input with a regular clock and it works fine, the even mention that this is possible.

The charge dump transistor is very weak sauce so a regular PIC IO had plenty of oomph to overcome it. I checked on the scope and it looks good, no funny business.

The timing on the data into the chip is kinda stupid- you have to input data 0-200ns after the rising edge of SK so what I did was let CLKIN go high, then waited about 15-17 nops, and then output the new data so it occured at 100ns after the rising edge.

This seems to work fine and I got a dump out that repeats every 512 bytes. I am not sure it started in the proper place though, so I was going to poke around with it some more. I ran out of time last night but did finally get data to come out.

Today I received a tandy "cosmic 1000 fire away' and wouldn't you know it, the damn thing has a bastard TI part in it. drat.

Also got a ms pac-man tabletop that I can dump (HD38820) and the frogger tabletop with the mitsubishi micro I will try dumping
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/09/15 11:35 PM

After adding some pullups to the L pins, I have what looks like a good and proper COP411 dump now. Disassembly shows what looks like proper code, setting up RAM and ports and then getting stuck at a loop on the port pin that connects to the other CPU.

Then code after that is reading the L port to get the command from the CPU and it pings it to say it received it and then it does god knows what to generate the audio. the end!

Tonight's goal is to dump the ms pac CPU (easy/fast) and then play around a bit with the M58846 mitsubishi chip from frogger.


Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/10/15 07:14 AM

I went to the Louisville Arcade Expo Saturday, and picked up a Sears Team Play Basketball handheld. handheldmuseum.com has a picture of a very similar game, though the art on mine is a bit different. It says it's licensed from Coleco Head To Head Basketball.

http://www.handheldmuseum.com/Sears/TPBasketball.htm

http://www.handheldmuseum.com/Coleco/H2HBasketB.htm

It's easy to open up. The MCU is a TMS1000:

TMS1000NLL E
MP3320A
WE 8018
SINGAPORE

The PCB also says:

COLECO
(C) 1979
73796 / 73803 REV E


Also, I got to play an Atari Video Pinball Model C-380, which is a dedicated console. This one wasn't for sale, but I definitely found it more interesting than your typical Pong system. Pong Story describes it as using "possibly a microcontroller" labelled C011500-1.

http://www.pong-story.com/atpong2.htm
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/10/15 07:20 AM

Originally Posted By hap
Sean: on Entex Baseball 3, is it possible without the MCU to measure the output frequency of the RC circuit? (with and without the PRO switch enabled)

I don't think so, but I've got another TMS1100 that I could connect the same cap and resistors to and measure the clock on it.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/10/15 07:23 AM

I've got the white model of Atari Video Pinball, but I've never opened it up. I'll take a look at it.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 12:47 AM

Ok, Entex Baseball 3 is working in MESS. I'll update the notes if you worked out how to measure its osc freq.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 04:39 AM

I've tried recently to contact people who previously posted about wanting to get microcontrollers dumped. I just heard back from mellery, and I believe the only undumped item he currently has is the Milton Bradley Omega Virus electronic board game, which he says uses a "TI 3253ACT / CSM11161AN (custom chip?)". Any interest in this one?

http://en.wikipedia.org/wiki/Omega_Virus
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 06:12 AM

*YES*. That and the 1989 MB electronic talking battleship use TSP50Cxx 8-bit micros (there are TWO speech synth devices which do too, one being the 1989/1990 version of the appleII ECHOII, as well as at least one vtech product). I was looking to (but did not bid) get an omega virus board off ebay just yesterday. I own an electronic talking battleship but was looking to nab a cheap one as well since mine is missing the box.

EDIT: http://q7.neurotica.com/Oldtech/Apple/EchoII-1L.jpg is the 1989/1990 echoII, tsp50cxx mcu is at U6.

there is an even later 1991 version which also uses it which has a capacitor mounted on top of the mcu due to a board layout issue?

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 06:19 AM

I played around a bit more with that M58846 tonight and I believe I figured out how to make it dump its ROM. Pin 20 (CnVSS says the data sheet) seems to be the test pin.

if you disconnect this pin, it will pulse every instruction cycle, and reading some of the older docs they have a 'T4' timing output pin. This appears to be T4.

When the pin is pulled low, the chip enters a test mode where D5 high causes what I believe is the program counter to be emitted on D1, 3, 4, 6, 7, 9, and 10. A 7 bit binary count appears here, incrementing once per instruction cycle. The output pulses high in time with T4 for a "1" and stays low for a 0.

Pulling pin 20 to half supply puts it into what appears to be a ROM dump mode. During the time when T4 is low, the chip appears to accept a program counter value on 11 of the D lines, and when T4 is high it outputs the data on D1 and 3-10. 9 data bits, just like the ROM width.

Posted By: Sharkpuncher

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 07:08 AM

I don't know if this belongs here, per se...but I figured I'd ask since I just came across it the other day and have been following this thread with some interest. Is there any interest in a Dungeons & Dragons Electronic Labyrinth game? I actually have no idea what's inside of it, though since it's presumably fairly primitive. I can probably pop it open and look at chips if someone wants.

They don't seem to be terribly sought after and mine's in less than pristine condition, and I'm going through another wave of trying to shed random crap I've over-accumulated, so...
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 08:29 AM

Originally Posted By Sharkpuncher
I don't know if this belongs here, per se...but I figured I'd ask since I just came across it the other day and have been following this thread with some interest. Is there any interest in a Dungeons & Dragons Electronic Labyrinth game? I actually have no idea what's inside of it, though since it's presumably fairly primitive. I can probably pop it open and look at chips if someone wants.




I have a good bet it's probably a TMS1xxx in there, going by the age. Checking out on ebay, it looks like it runs on a single 9V so that reenforces the TMS1xxx theory.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 10:41 AM

Originally Posted By hap
Ok, Entex Baseball 3 is working in MESS. I'll update the notes if you worked out how to measure its osc freq.

I connected the cap and resistors from BB3 to 4 other TMS1100s - two were B-revision dies and two were E-revision. Interestingly, the Es are faster than the Bs- B amateur = 169K, B pro = 218K, E amateur = 188K, E pro = 244K. The original chip was a B, so I guess 169K/218K is the way to go.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 11:05 AM

Originally Posted By ranger_lennier
Also, I got to play an Atari Video Pinball Model C-380, which is a dedicated console. This one wasn't for sale, but I definitely found it more interesting than your typical Pong system. Pong Story describes it as using "possibly a microcontroller" labelled C011500-1.

http://www.pong-story.com/atpong2.htm

I took a quick look at the Atari Video Pinball that I have. The chip has a different code: C010755-01 C02751. The date code is 7734, and it was made in Korea. It's a 40-pin DIP made by AMI. There's also a single 2112 RAM chip (256x4=1024 bits). The 8 RAM address bits are connected to the AMI chip pins 5-12, and the 4 data bits are connected to pins 20-23, and R/W is connected to pin 22. Ground is on pin 1 and VCC is on pin 25. Pins 26-34 and 36-38 are not connected. Pins 2 and 3 look like the oscillator inputs- there is a crystal (no frequency marked) and trimmer cap connected to them. Pin 4 connects to the speaker. Pin 40 connects to the paddle, so maybe an ADC. The buttons connect through a 4019 to pins 17, 18, 19 and a couple more that I think I wrote down wrong.

I'll take a closer look later.
Posted By: Just Desserts

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 11:05 AM

Can I just say how fricking awesome it is, in the span of about 6 months, to be seeing dumps and emulation of these handheld (and other) games to be just absolutely pouring into MESS?

These sorts of games have been like the last bastion of completely undumped and unemulated games for the entire life of the emulation community, and in like half a year you guys have just blown it wide open. You all are doing great!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 11:16 AM

Just for fun, I measured several of the TI dice:

Little Professor 1978 1990C - 3.35mm x 4.44mm
TI-1270 0970 - 4.05mm x 4.80mm
Entex Baseball 1 1000 - 4.47mm x 4.63mm
Stop Thief 0980 - 4.57mm x 4.93mm
TI-30 0980 - 4.59mm x 4.93mm
Merlin 1100 - 4.75mm x 5.56mm
Total Control 4 1400 - 4.76mm x 5.79mm
Entex Baseball 3 1100 - 4.77mm x 5.73mm
Speak&Spell CD2302 - 4.88mm x 6.34mm
Speak&Spell 0281 - 5.36mm x 5.45mm
Speak&Spell 0271 - 5.44mm x 5.85mm
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 08:00 PM

I got the LightFight. This one has a National Semi COP421L, with additional markings HLA/N /B119. The COP444L from Entex Space Invader was marked HRZ/N /B139, so I'm guessing HLA/N specifies the ROM contents and /B119 is the date code. I should be able to electronically dump this one, although I might have more difficulty finding the start since it has less ROM space and therefore probably has less unused space, which helped me with Space Invader.

Worst case, I'll have to force opcodes to start the dump at 000. Now that Kevin found the errors in the app note, that'll be easier!
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 08:31 PM

Unexpected, but if it's dumpable, no problem smile
The COP400 emu in MESS looks good, I just need to make a handheld driver for it (and that space invaders game too).

Quote:
I connected the cap and resistors from BB3 to 4 other TMS1100s - two were B-revision dies and two were E-revision. Interestingly, the Es are faster than the Bs- B amateur = 169K, B pro = 218K, E amateur = 188K, E pro = 244K. The original chip was a B, so I guess 169K/218K is the way to go.
Thanks! It's probably times-2? eg. (169K*2)hz: approx 340khz.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/11/15 11:22 PM

natsemi had weird markings on chips; the original ceramic mask roms for the digitalker (ssr1/ssr2 word set) one of them has GUD/D on it as a rom code.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 12:04 AM

Originally Posted By hap
Quote:
I connected the cap and resistors from BB3 to 4 other TMS1100s - two were B-revision dies and two were E-revision. Interestingly, the Es are faster than the Bs- B amateur = 169K, B pro = 218K, E amateur = 188K, E pro = 244K. The original chip was a B, so I guess 169K/218K is the way to go.
Thanks! It's probably times-2? eg. (169K*2)hz: approx 340khz.

I didn't think about that last night, but those numbers are pretty slow. I used an oscilloscope on pin 18 and measured about 6uS between peaks for amateur and about 4.5uS for pro. To get more accuracy, I measured the time for multiple peaks and divided. I averaged the timing for the two B chips, but they were pretty close.

The frequency vs resistance chart in the TMS1000 manual doesn't have a plot at 33pF, but extrapolating, 47k ohms could easily be 340kHz (just noticed that's at 15V and I measured at 9V, not sure how that affects it). That would put Pro at 436kHz, which is a little over the maximum recommended oscillator frequency of 400kHz. The manual does indicate a +/- 20% frequency variation, though.

I'll measure some other TMS1100s in their original circuits and see how they compare.

Posted By: mellery

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 02:49 AM

Here's a picture of the omega virus pcb
parts - https://imgur.com/Sx6DeY5
solder - https://imgur.com/aTE26PN
game info - http://www.boardgamegeek.com/boardgame/3086/omega-virus

BOM
U1 - TI 3253ACT OMEGA VIRUS CSM11161AN
C1 - 103
C2,C3 - 30
C4,C5 - 10uF
R1 - 41K
R2 - 21
R3,R4,R5,R6 - 410
Q1,Q2,Q3,Q4 - 324 PN 2907A
Y1 - 7.68MHz
pwr - 4 AA batteries
spkr - 8ohm 0.3w
case has 1992 on it

let me double check those resistors with a meter, the bands look brown in person, but purple in that picture
Posted By: Robbbert

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 03:46 AM

47 and 27 makes more sense than 41 and 21
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 06:03 AM

looks like I got M58846 dumping now. The bit order isn't 100% sure but it does look rather good. The initialization code appears to be 100% correct.

I found that the code uses 4 undefined opcodes- 008h, 009h, 018h, and 019h. There's plenty of others but only those show up. I found that the M58845 uses them for the ADC so I added them for that but they don't really make much sense. After tracing through the VFD update code, I'm 99% sure 018h is a left rotate or acc=acc+acc. (which is the same thing) The code here illustrates that:

Code:
01-00    005                EI		;external interrupt vector
01-01    046                RTI
01-02    041                LCPS 1	;timer 1 interrupt vector
01-03    01A                TEAB	;move AB into E
01-04    0CC                LXY C	;point to RAM 0ch
01-05    064                TAM 0	;get memory in 0Ch (grid #)
01-06    00C                TYA		;old grid
01-07    014                RD		;turn off old grid
01-08    002                INY		;next grid #
01-09    03C                SEY #C	;is it 12? (there's 12 grids)
01-0A    1A5                B 25	;no
01-0B    0EC                LXY C	;address 0ch
01-0C    021                SZB 1	;do we read buttons?
01-0D    1A0                B 20	;do not read buttons
01-0E    0B1                LA #1	;check left+down buttons
01-0F    081                OFA		;acc to port F
01-10    04D                SB 1	;we read buttons

;buttons are on bits 0 and 1 of K port which is loaded into A
;via the IAK instruction.  bit 2 isn't used and bit 3 is skill.

01-11    0CD                LXY D	;L+D buttons go into 0dh
01-12    057                IAK		;read button register
01-13    060                XAM 0	;store in RAM
01-14    0B2                LA #2	;check up+right buttons
01-15    081                OFA		;acc to port F
01-16    05F                RB 3	;clear bits 2/3 of 0dh
01-17    05E                RB 2
01-18    048                RC		;clear carry
01-19    057                IAK		;read button register
01-1A    018                *XAL	;shift left I think
01-1B    048                RC		;clear carry
01-1C    018                *XAL	;shift left I think
01-1D    00A                AM		;add DL00 to 00RU in RAM 0dh
01-1E    060                XAM 0	;store into 0dh (DLRU buttons)
01-1F    1A4                B 24	;done

01-20    0E8                LXY 8	;if we do not read buttons
01-21    000                NOP		;waste time instead
01-22    002                INY
01-23    1A2                B 22	;loop

01-24    0C0                LXY 0	;fall thru (if grid = 12 sets to 0)
01-25    065                TAM 1	;get data at addr 0Y
01-26    01C                TBA		;put it into B
01-27    067                TAM 3	;get data at addr 1Y
01-28    01B                OSAB	;put it into A then output to port S
01-29    065                TAM 1	;get data at addr 2Y
01-2A    084                OGA		;output it to port G
01-2B    064                TAM 0	;get data at addr 3Y
01-2C    081                OFA		;output it to port F
01-2D    015                SD		;turn on grid Y (new grid)
01-2E    01D                TAY		;grid # into Y
01-2F    0CC                LXY C	;point to 0ch
01-30    060                XAM 0	;store grid # into 0ch


The full disassembly is here:

http://blog.kevtris.org/blogfiles/Handhelds/m58dxx.txt

and ROM is here (you only need 2K words, I dumped it a lot of times to make sure it dumped OK)

http://blog.kevtris.org/blogfiles/Handhelds/m58d.bin

these links will probably go dead when I finalize the ROM and put it into the proper /Coleco Frogger/ dir.

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 01:02 PM

Originally Posted By Sharkpuncher
I don't know if this belongs here, per se...but I figured I'd ask since I just came across it the other day and have been following this thread with some interest. Is there any interest in a Dungeons & Dragons Electronic Labyrinth game? I actually have no idea what's inside of it, though since it's presumably fairly primitive. I can probably pop it open and look at chips if someone wants.

They don't seem to be terribly sought after and mine's in less than pristine condition, and I'm going through another wave of trying to shed random crap I've over-accumulated, so...


Since kevtris already guessed on TMS1xxx, my bet is on a Rockwell MCU cause it's a Mattel game. Open her up and tell us who won the imaginary bet?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 05:56 PM

I'll put 5 MESScoins on National Semiconductor.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/12/15 09:58 PM

I got lucky with the Lightfight COP421L - it was easy to dump by just giving it power, a resistor and cap for the oscillator, 3V on SO, and grounding SI. I had to let it run normally for a bit so that the code set up the L port as output, then 3V on SO put it in ROM dump mode. Since SK is used as an output it doesn't indicate when the ROM bits are valid, but they are wide enough that I could find the centers easily. There were 32 zeroes at the end of the dump that helped ID the start, and I confirmed it by disassembling the code and checking JSR addresses.

I posted the ROM dump and hardware info:
http://www.seanriddle.com/cop421l.html

I couldn't measure the clock rate from the oscillator pin; the capacitance of my 'scope probe slowed it down. Maybe the same thing was happening with the Entex BB3 TMS1100. When you turn on power, it continually displays a dot, then a small square, then a large square, and it beeps each cycle. I counted 30 cycles in 23.3 seconds. The resistor and cap used are listed in the datasheet as giving a 19uS instruction time, +/- 15%.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/13/15 09:29 AM

I picked up a couple of Dark Tower PCBs. I contacted an ebay seller who offers a repair service and asked him if he had any broken PCBs, and he sold me one. Right after that, a tower came up for buy-it-now at a (somewhat) reasonable price, so I got that, too.

The bare PCB has some battery acid damage, but the chip looks OK. I decapped it and I'll Whink it tomorrow to make transcribing the bits easier.

The bare PCB is Rev C, while the PCB in the tower is Rev B. The Rev B board has a DIP TMS-1400; the Rev C board has an SDIP. They are wired the same except that Rev C runs an additional output to the chip enable of a hex driver that controls the speaker and lamps. I'm not sure why; maybe to make it easier to blink all the lamps at once, or maybe to shut them off to save power? The Rev B board also has another transistor hacked onto it for motor control. I guess the original design wasn't robust enough.

The motor rotates an inner plastic shell with 21 different different images that the lamps can illuminate. An LED and phototransistor are positioned to detect notches in the shell for indexing. I haven't figured out how to remove the inner shell to get pictures of the images, and I'm not sure how to get good scans since it is curved.

The tower was listed as not working, but after I put it back together it seems to be fine.

I put the wiring info up, and I'll add the ROM dump when I finish that. www.seanriddle.com/tms1400.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/13/15 04:28 PM

That's great! =)
Could you also make photos of both PCBs and of the cardreel mechanics?

Scans of the cards are on this site too: http://www.bigfloridacountry.com/darktower.htm
Posted By: Sharkpuncher

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/14/15 04:26 AM

Heh. I thought I knew where the D&D game was, but it seems I might have left it at the storage unit. I'll let you guys know in a few days who the winning bet is.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/14/15 07:46 PM

I uploaded the Little Professor 1978 ROM array pic and ROM dump. When I run the code in an emulator, it gets stuck in a loop. This is likely because opcodes are slightly different from the TMS1000, since the TMS1990 has separate keyboard strobe outputs.
I compared the ROM word address decoder and the ROM page address decoder circuits, and they appear to be the same, so I think the ROM dump is correct. Unfortunately, there is a glob of plastic covering part of the instruction decoder. I just ordered some stronger Nitric acid to help clean dice.
www.seanriddle.com/tms1990.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/14/15 10:39 PM

lilprof78 ROM looks good, and the instructions PLA looks the same as Wiz-A-Tron (ignoring what's under the smudge). I see no indication on extra opcodes such as an Power-OFF opcode.

I'll add it to MESS now and post an update soon.

*edit* hmm I'm going to cleanup the driver a bit 1st. Also:

6 row 1
7 N/C
8 col 1
9 row 2
10 col 2
11 row 3
12 col 3
13 row 4
14 col 4
15 row 5

rows are write-R pins, cols are read-K pins?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/15/15 03:54 AM

Yeah, I assume that there are 4 K inputs. I mostly matched up the pads on the die shot to the pins, but there are actually 29 pads. The top right pad is segment B, with +9v below it.
I can't see an obvious difference between the row and column pads, but if the outputs are just used for the keypad, they don't need much drive, unlike the O output pads at the top of the die.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/15/15 02:47 PM

Ok, it is working in MESS. The keypad row pins are the same internal output bits as the O-pins.
1 small emulation problem though, probably due to another unknown difference in the MCU: the equals sign (aka O-pin 7) is always on.

The 1976 TMS0970 version would still be interesting to acquire, to see the differences in the code.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 09:39 AM

That's interesting about the keypad rows. At those quantities, the cost savings on a simpler PCB must have justified the redesign.

Good news/bad news- I got the 1976 version, but some plastic stuck to the die: http://www.seanriddle.com/0970.html

I'll try to clean it off without damaging the bits below. I transcribed as much as I could. I see lots of similarities, but lots of differences.

The die from Entex Space Invaders also stuck to the plastic, and it took a lot of heat to get it free. The passivation layer crackled and obscured the die, which I've seen before. But previously I could still remove the metal layer with Whink and transcribe the bits. This time, Whink isn't working. So I guess the heat cooked the passivation layer enough that mild HF isn't able to dissolve it. I'll try some other acid.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 09:42 AM

Kevin- Are you putting VDD on the Rockwell MM78 test pin, or a different voltage? I got an MM75 as well as the MM76EL, and I'm not getting anything from either of them. I've tried several different voltages on VDD and the test pin.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 03:09 PM

Aww, good luck on round 2 with those dies(dice?).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 06:28 PM

I've heard it both ways. I think dice is preferred.

I got Super Simon (MP3476NLL 4050 WE 8022 PHILIPPINES) and Entex Baseball 2 (MP0923 G70019 MS ^ 7923). Both 28-pin SDIPs. Probably 1100 for the Simon and 1000 for BB2?
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 06:36 PM

Originally Posted By seanriddle
I've heard it both ways. I think dice is preferred.


I use "dice" when talking about 6-sided or 20-sided used for playing board games and roleplaying games.

I use "dies" when talking about silicon chip cores embedded within ceramic (or whatever).

Maybe I'd be wrong, dunno...
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 06:51 PM

See the top comments section for a list of known serials: http://git.redump.net/mame/tree/src/mess/drivers/hh_tms1k.c

Yes, it's very likely that S.Simon has a TMS1100 and BB2 a TMS1000.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 07:17 PM

I've got a couple more chips here that I've either not gotten to, or they are broken.

Science Fair (Radio Shack) Microcomputer Trainer - MP1312 MAS^8414 (chipped die, part of ROM damaged)

Kosmos Astro astrological thingy - TMS1400NL MP7314-N2 W 8027 PHILLIPINES (the die is labelled MP1133) (new, some plastic stuck on die)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 07:34 PM

Hah, that thing looks awesome laugh https://www.youtube.com/watch?v=r6rJWwbNM6k

Kosmos Astro: MP1133 sounds like TMS1100, and the label is a fab error? TMS1400NL MP7314-N2 is Parker Bros SplitSecond!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/16/15 08:46 PM

I don't understand the die marking on the Astro, but I just double-checked the die shot and it's definitely a TMS1400 labeled MP1133.

Let me check my notes and pictures on the package labeling. I might have confused the 2 chips.

Edit: That's what I get for scribbling notes on slips of paper. The Astro chip package is labeled
TMS1470NLHL
MP1133
ML 7936
SINGAPORE

But the die says TMS1400. I haven't assembled a full die shot from the tiles yet, but it looks like a TMS1400. And the PCB has a bunch of transistors, so maybe they used a 1400 instead of a 1470?

I put up a quick composite of the Astro die: www.seanriddle.com/astrometal.jpg

I expected that the outputs would look different if it were a TMS1470 with VFD outputs, but it looks the same as the LED version. But the code number at the bottom of the die starts out 28H, whereas the other 4 TMS1400s start out 28L. I assume that means 28 pins, high or low voltage.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/17/15 04:50 AM

Originally Posted By seanriddle
Kevin- Are you putting VDD on the Rockwell MM78 test pin, or a different voltage? I got an MM75 as well as the MM76EL, and I'm not getting anything from either of them. I've tried several different voltages on VDD and the test pin.


These are MM78's and not the L version. they run on 15V (or -15V depending on your perspective). I connect ground to pins 4 and 6, then 15V to pin 7, and finally 12V (via a pot between ground/15V) to pin 8.

5 connects thru a 56K resistor to ground, clock goes into pin 3 at 15V swing levels, and there's another output at 15V levels driving reset. The 8 RIO lines are pulled to ground thru 22K resistors and that's where the data should appear.

1 byte per clock, starting at address 3C0h (reset vector) 4-5 bytes after reset.


dumping news:

I got 7 more games today, with a total of 9 CPUs inside. two games have dual CPUs (sound + game CPU). I have dumped 7 of these CPUs... one COP411, HD38820, HD38800 (two), D552C (two) and D553C.

Got a D1771-11 and D7528 which will be 'fun' to dump/RE. I am not sure if I can get them to dump but I will give it a try some time soon.

The D1771 is a bone of contention up to this point since not a single document about it to speak of has ever been found, just a patent and a few other scraps. The D7528 has no test pin so I will have to try and coax it into test mode by trying a few things like pulling pins above 5V thru a resistor and seeing if it has a protection diode or not. (no diode = likely test pin sometimes).

The ROM dump production line is really moving in full swing now. I have 18 games now using the HD388xx parts which we still need opcode bit docs for.

Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/17/15 09:55 PM

Kevin- thanks for the info. The MM75 is also a 15V part. I had hooked it up like you said, except I'm not sure if I tried 12V on the test pin. When I get some time tomorrow I'll try that.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/18/15 01:16 AM

I dug through some old electronics of mine and found a Video Technology Mini Wizard game, copyright 1987.

The chip is labelled:

VTEL27-0693 JAPAN
4270N9211 9018H

Anyone know what this is?

Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/18/15 04:31 AM

I don't know it. What package is it in? 24, 28 or 40 pins, DIP or skinny DIP, etc. Figuring out what pins are power and ground, and, if possible, oscillator input (resistor to one power rail and capacitor to the other is typical) would help, too. If you can, a scan of both side of the PCB would be useful.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/18/15 04:55 AM

Do these show you what you need?

https://www.flickr.com/photos/53002952@N03/16231008273/in/photostream/player/

https://www.flickr.com/photos/53002952@N03/16663590970/player/
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/18/15 07:13 AM

Yeah, that's pretty good. So a 28-pin SDIP, but likely not a TI chip- looks like ground on pins 14 and 15, and +6v on 28. Maybe caps for the oscillator on pins 1 and 2? Pins 10, 18, 20-23, and 26 unused.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/18/15 07:09 PM

Originally Posted By kevtris
(...) I have 18 games now using the HD388xx parts which we still need opcode bit docs for.

It's getting pretty close to working already. Entex Galaxian2 and Pacman2 do their little jingles(off-tune:P) and are controllable.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/18/15 09:33 PM

Originally Posted By hap
Originally Posted By kevtris
(...) I have 18 games now using the HD388xx parts which we still need opcode bit docs for.

It's getting pretty close to working already. Entex Galaxian2 and Pacman2 do their little jingles(off-tune:P) and are controllable.


Ah nice, that's a lot farther along than I thought it'd be! Well there's plenty of test cases now...
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/19/15 05:46 AM

Well I figured out how to dump the D1771 chips. Just call me the ROM whisperer... turns out it's stupidly easy.

Fire up the chip, apply a clock, and pull pin 17 high. The ROM will now come out pins 5-1, then 28-19.

512 words come out followed by 3.5K words of 0's, which is exactly what you would expect because the PC is 12 bits. There was an unreleased? version of the chip with all 4K on it. This one only has 1/2K though.

1 word comes out for every 8 clock pulses. Reset will reset the PC back to 0.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/19/15 09:46 AM

Sweet! Gotta love those easy ones. Of course, they are only easy because of your expertise. You obviously don't get frustrated as quickly as I do!

I saw a reference to the D1771 here: https://www.facebook.com/2kboffun
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/19/15 12:54 PM

Originally Posted By kevtris
Well I figured out how to dump the D1771 chips. Just call me the ROM whisperer... turns out it's stupidly easy.


Damn, how do you DO that? Amazing.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/19/15 10:32 PM

I put it on the proto board, then powered it up and started poking the pins while watching on a scope to see what happened. After doing a double take of data flying out, I checked it with the die shot to make sure this is probably what was happening and sure enough the 16 ROM lines go to those 16 pins. So that was that.

I still haven't captured the data yet, I have to make a rig to do it and haven't done that yet.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/20/15 04:44 AM

I found a TMS1000 on ebay that we can all pitch in and buy smile

http://www.ebay.com/itm/251822939309

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/20/15 05:09 AM

loool. That's as bad as the $800 D650C's some idiot was selling. Let's see what he's down to now. Oh looks like $75 now. What a deal! (not)

http://www.ebay.com/itm/Roland-TR-606-CP...=item3f475e7844

Even at that stupid price he sold two of the three he had in the last day. LN has one of these lined up for me to dump actually. I tried and D650C's appear to dump the same as the D553C's do- it's just the CMOS version of the same chip.

Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/20/15 01:18 PM

Originally Posted By kevtris
I still haven't captured the data yet, I have to make a rig to do it and haven't done that yet.


Since I have both the uPD1771C-017 and -011 parts loose here I could do it over the weekend. Just a breadboard+clock+voltage and my LA/capture code and I should be good.

Unless you've done it already?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/21/15 12:38 AM

I guess you can do it. I haven't made a rig yet. I will eventually add it to my allpro 88 when I get there. I will then verify when I dump this one that it matches your dumps.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/21/15 01:27 AM

I've done the LA grabs on both, just need to do the 5 minute code to fetch the values from the data. (no clock since I ran out of pins.)

https://twitter.com/plgDavid/status/579091482893635584/photo/1

Cheers for the test mode, you rule.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/21/15 02:06 AM

Did two LA dumps of each uPD1771C's

Since the PC wraps around I got a huge amount of similar dumps each time. (2MB total once converted to 16bit raw. and they bin diffed fine with correct framing).

Still these dumps are from decapped units, so the rom data _could_ in theory be corrupt, so verify would be good.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/21/15 02:47 AM

yes, the digital dumps are to be verified against the decaps. I suspect the decaps would have errors vs. the digital dumps. It'd be good to verify data integrity and bit ordering in the ROM arrays.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/21/15 08:00 PM

The HMCS40 games I have hooked up and have test-artwork for are fully playable now.
*edit* here's epacman2: http://imgur.com/tP0Zfy8

Other HMCS40 games will have to wait a bit for Sarayan's finished svg2lay tool. smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 12:05 AM

I noticed 1 bad bit on Entex Baseball 2 raw romdata: offset $128, change $7a to $3a.
@sean: can you also upload a pcb and bezel photo of it?

BTW if you want a complete Entex Baseball collection, there's also this one: http://www.handheldmuseum.com/Entex/HPB.htm
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 12:18 AM

I posted the Entex Baseball 2 and Super Simon info:

www.seanriddle.com/tms1000.html

www.seanriddle.com/tms1100.html

And the PCB and bezel of Baseball 2:

www.seanriddle.com/entexbb2bezel.jpg

www.seanriddle.com/entexbb2pcb.jpg

Edit: I posted without seeing your post- I'll fix the bit.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 01:18 AM

hap: that looks awesome! Glad that the dumps are working.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 05:38 AM

I posted the Dark Tower info: www.seanriddle.com/tms1400.html

There are also lots of pics of the cylinder and parts: www.seanriddle.com/darktowerpics.7z
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 04:32 PM

Cool! I'm double-checking the romdata right now.

Can you clarify these a bit?
darktower.txt:
- What is R8 index pulse?
- R9: which way does the motor rotate?
- How does the game know the reel position? If there's a sensor I'd expect it to be on the input matrix (K pins)
Posted By: The Flying Ape

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 04:40 PM

Originally Posted By seanriddle
There are also lots of pics of the cylinder and parts: www.seanriddle.com/darktowerpics.7z

Oooh, if the Dark Tower centerpiece toy can get emulated, I can make use of its playboard and plastic pieces without the need for "C" (or "D") sized batteries any longer. smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 06:28 PM

Hmm, not sure what I was thinking- there is a slot at the top of the PCB with an LED on one side and a phototransistor on the other; one is connected to R8, and for some reason I was thinking that was the input. I'll double-check the PCB and figure out which of the K inputs is used.

The top of the cylinder has a black plastic cylinder attached that has 8 slots; one for each position. One of the slots is a lot larger than the others. There are several pics of it from different angles.

The cylinder rotates counter-clockwise as seen from the top of the game. It takes about 3.5 seconds to make one revolution.

Edit- OK, I found it in my notes; the phototransistor (they might actually both be LEDs- I can't tell any difference between them) is connected to K8.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 10:23 PM

K8 is already on the keypad matrix. Or is R3 used to select the sensor?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/22/15 11:27 PM

R8 is connected to the LED and K8 to the receiver. I'll update the doc.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/23/15 12:39 AM

Ok I understand. I'll start on the emulation tomorrow (I found no bit errors, neither on ssimon).

Did you have any luck removing TI Little Professor stuck plastic?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/23/15 01:18 AM

I haven't received the stronger acid yet. I should get it in the next couple of days.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/23/15 04:23 AM

I posted the Speak and Read CD2705B die shots and ROM transcription. There are also higher resolution die shots:

www.seanriddle.com/speakandread.html

www.seanriddle.com/2705bmetal.xcf

www.seanriddle.com/2705bacid.xcf
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/23/15 06:29 PM

Looks good =)
I will start on it after finishing Dark Tower & Super Simon. MESS is scheduled for release in 2 days (it's every last sundaywednesday of the month)
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/23/15 10:51 PM

Other MB electronic games not dumped yet:
* Plus One (a board game with a tetrahedral shaped electronic piece)
* Electronic Battleship (1982, does not talk, has a red codebook of setups which probably needs to be scanned since I don't see it on hasbro's manual site; used locking sliders to set the x and y to be shot at on either side. shares most of the same plastic molding as the later talking 1989 one)
* Electronic Stratego (1982)
* StarBird Space Avenger (1981? a handheld toy which makes a few sounds when buttons are pressed and makes lights light up. MAYBE has a ?16 pin? chip inside, may not be an MCU at all)

Non MB games:
* Lakeside Computer Perfection


LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 12:24 AM

I've looked at Electronic Battleship; it looks like there are a couple of versions even before the talking variation. I think the original didn't have the code book, so it took a long time to get a game started because both sides had to manually enter every space of every ship. Then they added the code book which entered all your ships at once for you when you typed in a code. My brother had the game, and I don't remember a code book.

I've got Computer Perfection. It has a Panasonic MN1400.

Seems like all the Electronic Stratego's I've seen have been pretty expensive.

I just picked up a Plus One.

I've looked a little at Big Trak's, too.
Posted By: Vas Crabb

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 02:44 AM

Originally Posted By seanriddle
I think the original didn't have the code book, so it took a long time to get a game started because both sides had to manually enter every space of every ship. Then they added the code book which entered all your ships at once for you when you typed in a code.

The versions with the code book allowed manual ship positioning as well, but you didn't have to enter every space of every ship - just the location of one end and the direction it was facing (north/south/east/west). It would verify that this didn't clash with any of the ships you'd already placed. It was quick enough.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 02:47 AM

Originally Posted By Vas Crabb

The versions with the code book allowed manual ship positioning as well, but you didn't have to enter every space of every ship - just the location of one end and the direction it was facing (north/south/east/west). It would verify that this didn't clash with any of the ships you'd already placed. It was quick enough.


The 1989 talking version does this as well. I'm wondering if we shouldn't attack that version first, as the boards seem reasonably common on eBay, and I don't really want to destroy the one I have here. (once we figure out the test mode for dumping tsp50cxx devices though, I wouldn't mind lending mine out for non-destructive dumping)

The 1989 version (but not the 1982 one)'s codebook (i.e. the black codebook) is on Hasbro's site: http://www.hasbro.com/common/instruct/Battleship(electronic)talking.PDF

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 03:39 AM

sean: I poked around and I might be able to dump the MN1400. It has a test pin anyways. I found fairly complete documentation on it and pinouts and such. How many pins is it?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 03:49 AM

Kevin- it's a 28-pin DIP, labeled MN1400ML, but I torched it several months ago:
http://www.seanriddle.com/mn1400.html
I haven't tried to transcribe the bits. The ROM array looks similar to the F8 3853 PSU's array.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 03:50 AM

Big Trak has a TMS-1000, labeled MP3301A:

http://www.djibnet.com/photo/big+trak/bigtrak-pcb-with-component-numbers-150691242.html

http://commons.wikimedia.org/wiki/File:Big_Trak_-_Mother_Board.jpg
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 08:05 AM

I got the stronger HN03 Monday afternoon and used it on several dies. It helped with most of them, including Little Professor 76. I still need to Whink the dies again since the plastic protected the passivation and top metal layers, but I can see the bits under the metal layer. I updated the raw and execution order dumps: http://www.seanriddle.com/0970.html

I'll try to Whink that one as early as possible tomorrow and double-check the dumps.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 07:58 PM

I verified the Little Professor 76 dump and uploaded a new ROM array picture.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 07:58 PM

had to check wiki.. http://en.wikipedia.org/w/index.php?title=Nitric_acid
Great that it works on the pesky plastic smile

I will add it to MESS when you finished the full-die shot without glob, since pieces of the PLAs were obscured as well.

Can you also remove the smudge from the TMC1990 version? A small section of the instruction PLA was obscured.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/24/15 11:13 PM

I've added Little Professor (1976 version), it works but I marked the PLA files as possible bad dump.

The main opcode PLA and output PLA are probably ok.
The microinstructions PLA(sans glob) matches the one from TI1270 so I used that.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/25/15 12:46 AM

Dark Tower added and working. I'll do Super Simon after the new MESS release.

http://git.redump.net/mame/tree/src/mess/drivers/mbdtower.c
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/25/15 07:09 AM

Cool! I posted the full Little Professor 76 die shot. I didn't clean the TMC1990 in HNO3 this time, but I'll do it next time.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/26/15 06:27 AM

If you aren't bored with TI calcs, one of the dies that I cleaned was for SR-16 II, using a TMS-1000: www.seanriddle.com/tms1000.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/26/15 05:24 PM

Of course I'm not, this is where it all started. =)
Do you still have the SR16? I don't know the R/C values, and I'd also like to know if the special case digit3/12 wiring is the same as the one you documented in SR16-II.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/26/15 11:39 PM

SR16 has a 43K resistor to VDD and 68pF cap to VSS.

I can't find any info on the display driver ICs used- they are labeled ITT 506-5N. I'm guessing they are equivalent to 75493 or 75494, but I'm not sure. So that makes tracing everything a little more difficult.

By connecting power to the LED board pins, it does look similar- digit 12 segment B actually lights up digit 3 segment G. I could not get digit 12 segment C or DP to light up, nor any other segments on digit 3. The other digits have all the segments, except digits 1 and 2 don't have DP.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/26/15 11:43 PM

Milton Bradley Plus One has an 8-pin DIP marked with National Semi's logo and /029 MM 57405N. 2 pins are power and ground, 4 are inputs from the orientation sensor, one is an output to a piezo, and one is connected to a resistor to power and a cap to ground, so oscillator? I'm not sure if this is a microcontroller in a smaller package, or an ASIC like Simon.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/26/15 11:55 PM

Also, on sr16ii.txt:
"18 OSC1 - OSC2 and 100 cap to VSS, 400K resistor to VDD"

400K is way below spec, but if true, it'd be running at around 50kHz or maybe even less.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/27/15 01:41 AM

The resistor is yellow-black-yellow, but I measured it and it's 30K, so I guess orange faded to yellow.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/27/15 02:52 AM

Ok, I added it to MESS and it works.
one rombits correction: sr16iiraw.bin offset $331 change $7F to $3F

I also added Speak & Read to the tispeak.c driver. smile
also had 1 bit wrong: 2705braw.bin offset $799 change $7E to $6E

Lastly, Super Simon is also working in MESS, I just need to do some finishing touches.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/27/15 06:53 AM

sean: wow, 8 pin DIP in plus one? that's pretty insane. Wonder if it's some kind of COPS chip or maybe it's simply a full on ASIC? Pretty surprising it's so few pins.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/27/15 10:15 AM

Yeah, I guess we'll find out when I torch it. If it is a COPS in a small package, I doubt it's electronically dumpable; at the very least, there aren't 8 I/O pins. Unless there's a way to dump the ROM serially....

I hope it's not a COPS, since I can't visually see the bits on those chips. Of course, if it's an ASIC or an unknown CPU, it'll be harder to emulate.
Posted By: Just Desserts

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/27/15 10:37 AM

Could it be a Sharp SM-series microcontroller? I seem to recall that they came in pretty small packages and were used as security lockout ICs for the NES up through the N64.

Incidentally, although this isn't TMS or handheld-related, if you would be willing to take a crack at torching them to see if they're optically readable, it would be really cool for MESS to up the accuracy ante on Nintendo consoles by actually emulating the lockout ICs. They are in fact microcontrollers, after all. It would also be very helpful for the N64, since the IPL does some handshaking with the lockout ICs. Not only that, the IC that handles peripheral I/O on the N64 is theorized to be a microcontroller - it also supplies the 2k or so IPL ROM, so it would be nice to get that torched and read as well.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/27/15 09:47 PM

The Plus One chip has the Natl Semi wavy lines logo, so it's likely a custom or one of their CPUs, possibly simplified.

I've decapped the Sharp SM-510 from the Top Gun handheld LCD game and the Sharp SM-511 from the TMNT LCD game, and I know how to reorder the physical bits into execution order. So if the lockout chips are the same family, I should be able to read them visually.

If they aren't, and are a newer process that's significantly smaller, I may not be able to do anything useful with them. For instance, the bits on the Stop Thief die are about 11.5um by 8um, which is huge, and easy to read. Ten times smaller would be pretty tough for my setup. Also, if it uses implant ROM, my simple experiments with staining haven't successfully revealed those bits.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/28/15 12:03 AM

Originally Posted By Just Desserts
it would be really cool for MESS to up the accuracy ante on Nintendo consoles by actually emulating the lockout ICs. They are in fact microcontrollers, after all. It would also be very helpful for the N64, since the IPL does some handshaking with the lockout ICs. Not only that, the IC that handles peripheral I/O on the N64 is theorized to be a microcontroller - it also supplies the 2k or so IPL ROM, so it would be nice to get that torched and read as well.


The lockout chips have all been decapped and imaged from what I recall. The ROM bits for the NES lockout chips have been around for 7 or 8 years. The ROM/info for the "rabbit" (tengen's clone) is out there too. I traced out the die schematic for this part quite a few years ago.

the lockout chips on the NES/SNES wouldn't help to increase accuracy (unless you want to simulate the annoyance of a blinking power light and screen flashing) though it would help on the N64.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/28/15 10:46 AM

I posted info on that goofy astrological calculator, the Kosmos Astro: www.seanriddle.com/tms1400.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/28/15 05:26 PM

Oki, I will doublecheck the rombits 1st as usual.

Does anyone know what the TMS MCU is in this? (page 2, 2nd post) http://www.handheldmuseum.com/forum/view...3eaddee9211993a
If it's of the TMS1000 series, I think it's likely a TMS1470. The other chip(TMS1024) is an I/O expander chip.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/28/15 06:23 PM

TMS1470 would be 28 pins; that's what was in the Astro.

Any scans of the back of the PCB? Seeing what connects where might help.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 12:38 AM

I stand corrected- in an interesting coincidence, I got 2 Entex card games today; Electronic Poker and Black Jack / Gin Rummy. They are essentially the same hardware; an 11-digit 8-segment VFD with symbols for the 4 suits around each digit, and a 40-pin TI SDIP. I torched one open and it's a TMS-1400 (probably actually a 1470, since the games have VFDs). I'll post more info later.

Edit: I guess technically the 40-pin VFD version is the TMS1670, but the die is labeled TMS1400.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 02:20 AM

Entex Jackpot Gin Rummy Black Jack has a TMS-1670 labeled
MPF553
MHL ^ 8027

Entex Electronic Poker has a TMS-1370 labeled
MP2105
MSHL ^ 7940

Both PCBs are marked Gakken.

I also got a TI-1000 with a TMS-1990 labeled
TMC1991NL
ATP 7736

and I cleaned the other TMS-1990 die.

Unfortunately, the 8-pin DIP from Plus One is a COP410, so I don't think I'll be able to see the ROM bits.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 02:43 AM

ah nice, was wondering what was in those entex card game... games. Surprisingly it's got that much horsepower in there, though they probably need it for the RAM to store the card deck.

Yes, gakken made a few of entex's games. Gakken actually made tons of handheld VFD games for various manufacturers, like those coleco tabletop games- but their name does not show up anywhere on the boards. The pac-man/ ms pac coleco tabletops are made by Gakken too and Gakken even released pac-man as their own game with very minor changes, in the same cabinet.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 02:45 AM

oh didn't see what you said about plus one. That's really freaky that they have a COP410 in there! I wonder how they tested it? must've tested the dice, packaged them up, and hoped for the best. Does it have enough pads for 20 pins or whatever?
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 09:34 AM

Originally Posted By seanriddle
I've decapped the Sharp SM-510 from the Top Gun handheld LCD game and the Sharp SM-511 from the TMNT LCD game


Do you have the pictures? I'd like to compare with the game&watch, which is somewhere between the sm3903 and the sm510.

OG.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 05:10 PM

OG: http://www.seanriddle.com/tiger.html -> http://www.seanriddle.com/topgun.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 07:43 PM

Originally Posted By seanriddle
TMS1470 would be 28 pins; that's what was in the Astro.

Any scans of the back of the PCB? Seeing what connects where might help.


Rik replied over here: http://www.handheldmuseum.com/forum/viewtopic.php?t=2146&start=45
It seems like he's having trouble registering on bannister forum. He also says that Entex Hip Pocket Baseball is not an MCU.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 11:42 PM

Originally Posted By seanriddle
Entex Jackpot Gin Rummy Black Jack has a TMS-1670 labeled
MPF553
MHL ^ 8027


not MP7553?

TMS13xx/16xx are not emulated yet at all smile It'll be interesting to see what they changed this time.

Quick question: on TMS1990, do you know which pad(as visible on die edge) goes to which pin?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/29/15 11:58 PM

Mark- it looks just like the die on the Funtronics Jacks PCB. I'll post some pics soon. The game is pretty simple, so they may have just tested its functionality, instead of verifying the ROM contents.

OG- I'll post a much better die shot of Top Gun minus the top metal layer.

Hap- I just noticed that I don't have any pinouts for the TMS1600 - and where did we get the pinouts for the TMS1400? Did we just figure them out by PCB wiring and code? Was there info in a patent?

I did a quick compare of that pachinko PCB to the 2 Entex card games but I'm unable to give you an answer yet. I see some similarities to the 1670 and some to the 1370, but I also see differences.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 12:03 AM

No, it's definitely MPF553 on the package and the die. I think the only differences between the 1400 and 1670 are the voltages (which don't matter to MESS) and more outputs. The 1670 die looks identical to the 1400.

I'll look at the 1990 die and figure out the pins. Almost always they are in order, numbered counter-clockwise. So if you can find power and ground, you can usually get the rest pretty easily. I posted a cleaned up die shot for Little Professor 1978, and I took pics of the TI-1000 die.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 12:48 AM

TMS1400 pinout is from here: http://marc.info/?l=classiccmp&m=104965276917315&w=2

TMS16xx has 16 R outputs, that's trivial to emulate. And it also has a "K/L" select pin, L1,L2,L4,L8 input pins, and a Mode pin.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 01:37 AM

Oh, yeah- I forgot about that email; I was looking for a datasheet. I can probably figure out some of the other pins from the 1670 die shot, but it would be nice to find a full data sheet on those newer chips.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 05:56 AM

Originally Posted By hap
Quick question: on TMS1990, do you know which pad(as visible on die edge) goes to which pin?

I'm pretty sure that the top left pad in my pics is pin 24, with numbering going CCW. So the top of the die has all the O outputs. The first pad down the right side (partially under the plastic blob) is VSS (positive power), with VDD below it.
Notice that there are 29 pads! It looks like the one that's fourth down on the right side is also connected to VSS. I guess it was connected to the paddle?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 07:27 AM

Here are the Plus One and Funtronics Jacks die shots:
www.seanriddle.com/plusonemetal.jpg
www.seanriddle.com/plusoneacid.jpg
www.seanriddle.com/jacks.jpg

The Plus One die stuck to the plastic, but it looks like there was also a black overlay of some sort. I've seen something similar with a few 3851 and 3870 dies.

It looks like Jacks has all the signals bonded out that are needed to dump the ROM. Pin one is the octagonal pad at center bottom, and all pins but 17 are bonded. I'm a little confused since that's G0 and it seems like if they used the other G outputs that they'd use G0 first.

Under higher magnification, I can see the ROM bits! So I'll dump Jacks electronically and transcribe the bits visually and figure out the physical to logical bit ordering. Then I'll see if I can clean up the Plus One die enough to read all the bits visually.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 09:14 AM

Originally Posted By Olivier Galibert
Originally Posted By seanriddle
I've decapped the Sharp SM-510 from the Top Gun handheld LCD game and the Sharp SM-511 from the TMNT LCD game


Do you have the pictures? I'd like to compare with the game&watch, which is somewhere between the sm3903 and the sm510.

OG.
I posted a 55M pixel die shot of the SM510 from Top Gun with the top metal layer removed:
www.seanriddle.com/topgunacid.xcf
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 07:34 PM

Originally Posted By seanriddle
I posted a 55M pixel die shot of the SM510 from Top Gun with the top metal layer removed:
www.seanriddle.com/topgunacid.xcf


Very nice, it looks identical (except for the rom contents of course), so now we have a high res of metal and active.

Do you agree with having your die shots posted on siliconpr0n.org btw?

OG.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 08:11 PM

Oh yeah, that's fine. John previously posted some of my Williams Special Chips shots there. I added a Creative Commons license logo to my decap page to be more clear.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/30/15 11:14 PM

I uploaded the TI-1000 info: www.seanriddle.com/tms1990.html
Edit: there was a bit under the spot of dirt in the lower left, so I updated the dump.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/31/15 07:10 AM

I posted the top metal die shot of the TMS1670 in Entex Jackpot Gin Rummy Black Jack: www.seanriddle.com/entexjackpotmetal.jpg
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 03/31/15 09:49 PM

Kosmos Astro and TI-1000 are added and working smile

note that TMS1470 doesn't have R10, pin 11 is Vpp.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 06:16 AM

Thanks!

I guess Vpp is the voltage that the chip uses for I/O, and the 1470 didn't have enough pins for both it and R10.

It'll be interesting to see if anything uses the L inputs or the K8 divider.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 03:31 PM

more Hitachi HMCS40 MCU games confirmed playable in MESS:
- Bambino Basketball
- Bandai Packri Monster
- Bandai Zackman
- Coleco Pac-Man
- Coleco Ms. Pac-Man
- Parker Brothers Q*Bert
- Tomy Kingman
- Tomy Tron

Coleco Galaxian is suspected to be a bad dump =(
Coleco Donkey Kong has a problem with sound emulation

*edit* also, in demo mode, Ms.Pac-man refuses to eat the dots in the upper two rows. bug? or just a picky eater?
Posted By: etabeta78

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 04:02 PM

btw, any news on the artwork side? are there preliminary drafts for these that can be tested out?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 05:16 PM

Almost all LED/7seg display ones have working internal artwork in MESS already. The VFD games are not possible, you'll need external artwork. Kevin Horton has traced the VFDs to SVG files that we can use, and OG made a tool to convert that to MESS style artwork. It's working good, but it's not up to me to make it public.

If you want better(bezels etc.), ask around the MAMEWorld artwork forum?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 05:19 PM

hap: lol at picky eater.

it's very possibly a bad dump. it was the first chip I dumped, so I can redump it tonight.

donkey kong's sound is very strange so it's not surprising you're having issues. I didn't fully reverse engineer it I don't think. there's 2 or 3 IOs involved with sound from what I recall, and a mess of resistors and transistors and stuff.

galaxian's sound is weird too.

ms pac obviously normally eats the dots in the top two rows; smells like a RAM banking issue maybe.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 05:25 PM

It works fine in play mode, it only happens in demo-mode that she refuses to walk to the top 2 rows. Though on rare occasion I did see her walk to there, maybe once every couple of minutes (fastforward emulation).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 07:08 PM

What's the deal with the TI30 in this auction?
http://www.ebay.com/itm/151396502777
The connector looks pretty robust for a homebrew hack. Looks like 10, maybe 12 pins, with 2 wires run to the battery connector. But full power, keyboard, and LED connections would take 25 pins. It would be interesting to look inside but it's a bit pricy.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 07:46 PM

The tool is on my github, and the artworks are for now http://dspnet.fr/~galibert/artwork/

They should eventually end up on MrDo's site and everywhere else, but only after hap validates them, because there are still some errors in them.

OG.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 07:56 PM

MrDo's site was last updated going on a year and a half ago.

I'm not going to enjoy it when all these 4-bit toys end up unusable by anyone other than hap, but I'm calling it right now that that's what's happening.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 10:45 PM

hap: oh yeah. I think on the real ms pac, the movement in demo mode is really weird and it tends to ignore parts of the maze for a long-ass time, going over previously eaten areas for some reason. I believe this is normal.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/01/15 10:56 PM

Ok got it =)

RB: Now that the link to his WIP svg2lay artwork stuff is posted (didn't you see it?), anyone can download them and try them out, just no wide public release until bugs are ironed out.

enjoy smile
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/02/15 12:22 AM

Originally Posted By Olivier Galibert
The tool is on my github, and the artworks are for now http://dspnet.fr/~galibert/artwork/


Wow, thanks for this, you totally just made my day...

Oh, and 'Hi' everyone, I'm Rik... I run www.handheldmuseum.com, and have been following all of this with eager anticipation since I found out it was being done a few months ago... Incredible work all around, I never thought I'd actually see the code being dumped from these games, and now I'm playing Entex Pac-Man 2 on my computer... This is just beyond cool.

You will definitely get some play testing out of me. smile
Posted By: The Flying Ape

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/02/15 12:39 AM

Ooh, I got little excited seeing mbdtower in action... if it helps any, I zipped up a digital photo along with an edited version as a bezel and the player's card, if any of it could be of use. smile

Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/02/15 02:26 AM

Originally Posted By R. Belmont
MrDo's site was last updated going on a year and a half ago.

I'm not going to enjoy it when all these 4-bit toys end up unusable by anyone other than hap, but I'm calling it right now that that's what's happening.


Actually the "official" source for MESS artwork is Duke's mess.redump.net AKA mess.org. Mr. Do never officially took it over, although he expressed the intention IIRC.

I'm the last person to update the mess.org wiki page regarding artwork, but I don't particularly want to be "that guy who does the MESS artwork." smile

Particularly when I'm no Photoshop expert nor .lay file expert. laugh
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/02/15 04:19 PM

Coleco Donkey Kong is working in MESS now, with the speaker volume decay implemented. I'm still interested in the circuit schematic, so someone experienced with MAME/MESS discrete audio emulation can add it.

Sean: I wouldn't risk purchasing that TI-30, maybe it's simply a homebrew power-supply?
Rik: welcome! =)
Flying Ape: external artwork is possible for Dark Tower, you could ask around on the MAMEWorld Artwork forum. Sean also made many photos that should be useful(go back a few pages where he posted them)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/02/15 10:39 PM

Hap- there are other wires going into the body of the calculator where the chip is, but I just don't see it being anything cool enough for the money. I found an old article by Forrest Mims about using a calculator as a stopwatch or counter by tying into the keypad wires to simulate pressing the equals button, then manually typing 0+1. Each timer tick or counter event presses the equals button, incrementing the display. This might be something like that. Still, that's a hefty connector!

I'm out of pocket for the next few days, but Mattel Armor Battle, Big Trak, Talking Battleship, Head-to-Head Football and Baseball are on the way. And I've still got those Entex card games, Funtronics Jacks and Plus One to work on.

Posted By: The Flying Ape

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/03/15 12:41 AM

Thanks Hap, that link was very useful. So I made a new layout file from those instructions with an improved cropped image of the toy and with all the tiles in place:



Thanks all for making this happen.
Posted By: Dagarman

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/03/15 03:21 AM

Originally Posted By The Flying Ape
So I made a new layout file from those instructions with an improved cropped image of the toy and with all the tiles in place:

Sorry to pile on, but you use this mbdtower.lay for clickable art.
Posted By: The Flying Ape

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/03/15 12:39 PM

That's awesome, did not know you could do that, because I had always had the mouse option enabled. I see now how the onscreen pad can work with the -nomouse option in play. I was looking for the ui_mouse to takeover for that, but that's not the case.

Just for giggles, I digital photoed my toy's lamp and added that tile in with a few minor tweaks to the overall rendering. The zip file link is updated. It looks and feels like the real thing now, thank you!!
Posted By: TSCHAK

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/03/15 03:56 PM

Is there a list of emulated 4-bit systems and their machine names? I'd love to take a look.

-Thom
Posted By: Waremonger

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/03/15 05:55 PM

hap's post has a list of some (all?) of them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/03/15 06:09 PM

http://git.redump.net/mame/tree/src/mess/mess.lst#n2180
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/04/15 08:32 PM

Mr. Do's artwork site has always posted art only after extensive digital cleanup. On the one hand, that leads to some great looking art. On the other hand, there's a ton of artwork that's been scanned, but isn't available to the general public. For handhelds, it might make more sense to just put unmodified scans out there as soon as the games are emulated. If someone wants to spend a lot of time improving them (color correcting, removing scratches, etc.), they can always be updated later.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/04/15 08:39 PM

one big problem I have with taking pictures of game cases and stuff is my camera sucks, and they are usually very... "3D".

I was going to take pics of bezels and the important things required for play (i.e. maze for pacri monster) and internal artwork, like bezels and that 'circuit pattern' for tron. But I am not sure how much help I can be for outside stuff.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/04/15 10:28 PM

You might look into using a good dedicated scanner. There's a lot of variation in how good scanners are at resolving 3D objects. Here's what I got for Mattel Baseball using an Epson Perfection 4490 Photo. I used the software's photo mode. The document settings would mess up an image like this.

https://mega.co.nz/#!bIh1ULTK!UZEHmekRnB1_PT9XLPblEQgIBnEyeCCTxHhDhhy6TE4

It looks like that particular model's been discontinued, but they're pretty cheap on eBay.

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/04/15 11:03 PM

The only photos I'm interested in is of the PCB :P

Speaking of that: Sean could do that for the stuff you purchase(d) too? Whether or not the MCU is already desoldered doesn't matter.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/04/15 11:43 PM

I'll take some pictures this weekend of a couple (especially Packri Monster, since that is required just to play...)

Here's the existing pics I have of Packri Monster and Tron:
http://www.handheldmuseum.com/Z_Imgs/MESS/

Taken years ago with a 'basic' camera... So I can definitely improve those.

The Japanese versions of Tron has much cooler bezel art too... You can kind of see it here:
http://www.handheldmuseum.com/Tomy/Tron.htm
I think I have one of these, I'll photo them both if I can find them.

Sometimes you can get the bezel out of the game and it will fit on a scanner, but I have a semi-professional camera setup (being operated by a semi-amateur photographer. smile ), so I can definitely get some good pictures of these (the only delay is finding them in all the boxes of games... smile )

Is the ultimate plan to have a full picture of the entire game, or just the screen?
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/05/15 12:23 AM

Speaking of artwork and also regarding the discussion that was going on the other day, about frontends with 3D artwork like that thing at digitalcybercherries.com:

In the event that some of us come across the possibility of 3D scanning any devices/cartridges/etc that we have lying around, either with a Kinect or a 3D scanner... What kind of format should we stick to for making the 3D scans, in case that they may be supported by MESS in the future?

Perhaps having some kind of public guidelines might encourage more people to contribute this kind of stuff, for future use.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/05/15 03:25 AM

I have PCB pics (both sides) and VFD pics (lit, unlit, back) for every game I dumped and vectored. they are in the usual place:

http://blog.kevtris.org/blogfiles/Handhelds/

Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/05/15 03:56 AM

Originally Posted By Rik

Is the ultimate plan to have a full picture of the entire game, or just the screen?


I think we'd want the entire game. You can add multiple view options if the player wants to see the screen only.
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/05/15 01:20 PM

After reading the Wikipedia article on "Handheld electronic game", what are the chances of emulation of the Bandai LCD Solarpower games which used 2 stacked LCD screens (https://en.wikipedia.org/wiki/Bandai_LCD_Solarpower), the Tomytronic 3D games which also used 2 LCD screens with a window to let in external light to simulate the 3D effect (https://en.wikipedia.org/wiki/Tomytronic_3D) or the Tuttuki Banko with it's finger control (https://en.wikipedia.org/wiki/Tuttuki_Bako)? I'd be willing to donate towards getting something like these into the hands of a dumper.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/05/15 04:16 PM

Tomytronic 3D: interesting smile MCU is UCOM-75, not known how to dump yet, and not emulated yet.
Bandai LCD Solarpower: find out what MCU it uses.
pokey thing: still being sold by Bandai/made profit on?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/05/15 10:17 PM

I have one of the bandai solar power LCD games. it does not have two stacked LCDs I didn't think. It has two "screens" for the game, but it appears to do this by simply lighting up different segments.

The game I have is "nazono pyramid". Of course it's a glop top so there's no way to know what CPU it has or dump it nondestructively unfortunately.

Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/06/15 12:12 AM

It depends on the game, the ones he is talking about are called 'Double Panel', like the LCD Zaxxon or Terror House: (Pretty sure the clam-shell flip games are just single LCD)
http://www.handheldmuseum.com/Bandai/TerrorHouse.htm
http://www.handheldmuseum.com/Bandai/ZaxxonLCD.htm

There's at least 5 different Double Panel games (each one linked to on the top of either of those pages above). Pretty sure they all have the 'glop' chip... Can those be uncovered easily enough to see the die? I think I have a beater version of Zaxxon I'd be willing to sacrifice, if I still have it... (Too much crap, I keep loosing track of what I have and what I've sold over the years... Must get an inventory system in place. smile )

There's also ones like this:
http://www.handheldmuseum.com/Bandai/PenguinLand.htm
with two LCD screens for head-to-head play

And then these crazy things:
http://www.handheldmuseum.com/Bandai/Gundam.htm
with a second hinged LCD panel, so sometimes you playing panel #1, sometimes panel #2, and sometimes both panels stacked on top of each other...

The Tomy 3D games I think just use a single LCD with only half being visible in each eye. So you could emulate half the screen for 2D playback, and then just support Oculus Rift at somepoint... smile smile

[Edit] Yeah, patent for Tomy 3D games here:
https://www.google.com/patents/US4561723
Shows the single LCD. So implementation of 2D emulation might be simple enough if we can figure out the chip.

And, Kevin, games on their way to you tomorrow:
Bandai Dokodemo Dorayaki Doraemon
Bandai Machine Man
CGL Earth Invaders
CGL Super Kong
Entex Select-a-Game with Space Invaders and Football carts
Gakken Dig Dug
Mego Mini-Vid Sea Battle (LCD)
Vtech Invaders
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/06/15 12:47 AM

Originally Posted By Rik
Pretty sure they all have the 'glop' chip... Can those be uncovered easily enough to see the die? I think I have a beater version of Zaxxon I'd be willing to sacrifice, if I still have it...

I've de-globbed several dies using heat, acid and/or a chemical called Decap.

On another front, Mattel Armor Battle has a Hitachi HD38133 28-pin DIP. Anyone have info on it? The closest I could find is HD38702/HMCS42, but the pinout is different. The PCB has jumpers for TANK/SUB, so Sub Chase probably also uses it.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/06/15 06:01 AM

rik: cool, sounds awesome that some games are on the way. I'm working hard on HDMI NES but need a break. hehe. I have 15-17 games here backed up that need VFD vectoring. I dumped most of the CPUs. hopefully this week I'll get that done.

I was involved in a bad car wreck a bit over a week ago on friday, but I'm fine. my car sure wasn't though so I had to go through the hassle of dealing with all that. I got most of it done now, however. Making a left and someone ran the red light and demolished my car and that drove me into a 3rd car. Got another car saturday and took the rental back tonight.

sean: not heard of that part yet. Did you check out bitsavers and poke thru the hitachi databooks on there?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 04:48 AM

ucom75 we don't yet know the trick to dumping them; they're used in a few vfd games, and in the Epson PX-8 'Geneva' as a slave/battery control MCU.

LN
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 05:56 AM

Interesting note on Entex Pac-Man 2... I have two of these here, both the same chip number (A23), and in demo mode, they both do the _exact_ same thing every time. I can turn them both on at the same time, and the pac-man and ghosts will follow the same pattern, every time. There's two different patterns- one is triggered by starting demo without the VFD test, and the other is triggered by doing the VFD test.

MESS does the same thing (two patterns, triggered by with or without the VFD test), but the patterns are completely different than what I get on the actual units...

Normal game play seems to work fine, just curious why the demo patterns would be different...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 06:05 AM

One or more registers might be getting initialized differently in the emulation than in the actual games, or the game might read an address to seed the random # generator and that address returns a different value in the actual games. In the same vein, the hack to make arcade Ms Pac ROMs run on a Pac Man PCB makes the normal patterns not work because the random # generator uses the ROM contents.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 06:12 AM

I posted the Funtronics Jacks info: www.seanriddle.com/cop410l.html

I'm pretty certain about the ROM dump- I got the same data for the hundreds of dumps that I captured, but I just did the simple dump where I didn't force any instructions, so it started at a random location. Since the ROM is only 512 bytes, there's not a lot of empty space like Space Invaders and Light Fight had to help me align the dump, so it was harder to find the start. But the position I chose made the JMPs and JSRs in the code consistent.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 06:16 AM

Kevin- glad to hear you're OK. Hope you got a new car! I did check out bitsavers and the datasheet archives, but didn't see that chip or any others more similar than the HD38702. That one has a test pin, and the Armor Battle chip has a couple of pins tied to Vss that I'll play with. On the Hitachi chips you are dumping, does the chip dump ROM when you tie the test pin to Vdd or do you have to do more?
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 06:28 AM

Originally Posted By seanriddle
One or more registers might be getting initialized differently in the emulation than in the actual games, or the game might read an address to seed the random # generator and that address returns a different value in the actual games. In the same vein, the hack to make arcade Ms Pac ROMs run on a Pac Man PCB makes the normal patterns not work because the random # generator uses the ROM contents.


If it was random, I could probably chalk it up to any number of things... But these patterns actually seem pre-programmed, both Pac-Man and the ghosts move _exactly_ the same way _every_ time... Unless the 'random' pattern is seeded from a CPU clock/cycle or something. Since it starts up the same way every time (from off with no memory, and you can't delay the start of the demo), that might explain it. And MESS just getting a different start for some reason. At least they both duplicate their patterns consistently. Just thought it was weird. smile

For actual games, you leave the system on for a random amount of time before starting... Maybe that does explain it.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 07:38 AM

Could you make a quick youtube vid of it for both patterns?
(tag as unlisted if you don't want it to show up in your channel)

Sean: I haven't checked out COP400 yet, but I will eventually. Or maybe another dev can make a driver for it. Good thing we have the CPU core emulation already.

About that Hitachi MCU: How does the pinout compare to HMCS42C? (HD44700)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 07:56 AM

The best the games can do is create a pseudo-random sequence, which will be exactly the same on every power up since the exact same code path is taken. Input timing can be used to seed the PRNG, but if no buttons are pressed, every run will be the same.

It should be easy enough to debug the code in MESS and see how the PRNG is seeded, and that may help figure out the difference between the two.

I hacked the Robotron ROMs to always read the player 2 start and move up inputs as set, then turned on both of my games. Since there was no user input to give timing differences to the PRNG, the 2 games played identically. But the same ROM in MAME plays differently since there isn't perfect low-level emulation of the entire Williams system.

In this case, I bet they are using an uninitialized register or RAM location to seed the PRNG, and it turns out that it's always powering up the same, but MESS is initializing it to a different value.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 08:11 AM

Hap- HD44700 is very similar to HD38702, except CMOS instead of PMOS, with a max voltage of 5.5V.

The HD38133 in Armor Battle has VDD on pins 1 and 21, OSC on pin 2, button inputs on pins 4-7, LED segments on pins 9-13 and 15-16, VSS on pins 3 and 14, LED rows on Pins 18-20 and 22-24, another button on pin 26, and the piezo connected to pins 27 and 28. 17 and 25 are no-connects, and 8 is tied to VDD through a resistor. I'm guessing one of the VDDs is reset and one of the VSSs is the test pin. It uses a 9V battery with no zener, so it's PMOS.

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 10:04 PM

Originally Posted By Rik
Interesting note on Entex Pac-Man 2... I have two of these here, both the same chip number (A23), and in demo mode, they both do the _exact_ same thing every time. I can turn them both on at the same time, and the pac-man and ghosts will follow the same pattern, every time. There's two different patterns- one is triggered by starting demo without the VFD test, and the other is triggered by doing the VFD test.

MESS does the same thing (two patterns, triggered by with or without the VFD test), but the patterns are completely different than what I get on the actual units...

Normal game play seems to work fine, just curious why the demo patterns would be different...


Guessing it could be RAM contents? MESS probably initializes RAM to all 0's. the real chips might initialize it to randomish data that could be mostly 1's.

At least it does the same two patterns every time which is a good thing. That means it most likely is working correctly or nearly so.

Guess it'd be easy to try loading RAM with different contents to see what happens.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/07/15 10:12 PM

Originally Posted By seanriddle
Kevin- glad to hear you're OK. Hope you got a new car! I did check out bitsavers and the datasheet archives, but didn't see that chip or any others more similar than the HD38702. That one has a test pin, and the Armor Battle chip has a couple of pins tied to Vss that I'll play with. On the Hitachi chips you are dumping, does the chip dump ROM when you tie the test pin to Vdd or do you have to do more?


yeah I did. got another CRZ. had a 2011 but got a 2014 now.

Dumping them is a huuuge pain in the ass. I am honestly not sure how I figured it out. If I hadn't dumped the D552/3 parts I don't know if I would've succeeded.

It involves basically creating a jump tree and following the branches in a recursive fashion to find more banks, and then following said banks and stuff. all without resetting the program counter.

frankly I'm surprised it works at all, but it does. Rik had pics of the inside of "monster burger" (and there's 3 other games in this series) with a D1080 in it, which is totally undocumented too.

No clue what it is, except it must be a 4 bit CPU with LCD drivers.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/08/15 09:10 PM

I posted info on the Entex Space Invader LED game with the TMS-1100: www.seanriddle.com/tms1100.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/08/15 09:47 PM

Cool, I'll get on it.
Is this the black 1980 version or the grey 1981 version?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/08/15 11:08 PM

It's the black one. I've actually bought 2 black ones and 2 grey ones now. I first got a grey one and I torched the COP444L and couldn't see the ROM bits (although I think I can now), so I bought another. LN posted the COP dumping info, and by dumb luck the 2nd one was also grey and I dumped the COP electronically. I saw a teardown of a black one on youtube that showed the TI chip, so I bought one of those, but plastic stuck to the die and I roasted it trying to get it off. I bought another along with Head-to-Head baseball and football games.

I'm surprised the TI version is older than the COP version- game over on the COP is very irritating; it keeps beeping over and over again. The TI version only does one set of beeps. Also, the overlay graphics on the grey one look more like the arcade space invaders. I figured they got in trouble because the graphics were similar and had to change them.

I uploaded scans of the overlays: www.seanriddle.com/entexspaceinvader.jpg

I shot some cellphone video of it in Amateur and Pro mode if that would help you with timing.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/08/15 11:32 PM

Originally Posted By kevtris
[quote=seanriddle]Rik had pics of the inside of "monster burger" (and there's 3 other games in this series) with a D1080 in it, which is totally undocumented too.

No clue what it is, except it must be a 4 bit CPU with LCD drivers.


Mr. Do/Mr. Go (from that same series) is even more cryptic, although I suspect it's probably the same CPU:

Other side:


The Monster Burger pics are in that same folder...
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 12:02 AM

The tidbit that the grey version is newer than the black one is on Rik's site, especially this part: "Interesting note: the second wasn't supposed to be gray, someone accidently trans-posed 2 numbers on the paperwork where the Pantone color code was listed (it was supposed to be the same black color)"

http://www.handheldmuseum.com/Entex/SI.htm
Yes, a recording of the game on ama/pro would be useful =) I can determine MCU speed change by sound pitch.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 05:44 AM

OK, I posted the video. It's pretty boring- I turn on the game in amateur mode and let it kill off my men to get to the game over tones, then turn it off and back on in pro mode.
www.seanriddle.com/entexsiti.mp4
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 08:55 AM

Thanks, it's added to MESS and working. The overlay will have to be external artwork.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 03:59 PM

I found a video that shows Entex Pacman 2 demo mode, and can confirm that it's wrong in MESS. I tried changing a few things like initial RAM contents and register values, but the only thing that changes demo mode behaviour is opcode/interrupt timing.

It means timer interrupts happen 1 or 2 cycles too late/too early, and/or one of the opcodes takes more cycles than stated in Hitachi docs.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 04:01 PM

anyone recognize this unknown target shooting game of my childhood? laugh
http://imgur.com/mltk2Nj
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 04:25 PM

Originally Posted By Rik

Mr. Do/Mr. Go (from that same series) is even more cryptic, although I suspect it's probably the same CPU:

Other side:


The Monster Burger pics are in that same folder...


That CPU reminds me of the one from Mickey & Donald Game&Watch, which is a sharp cpu.

LN
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 09:51 PM

Originally Posted By hap
I found a video that shows Entex Pacman 2 demo mode, and can confirm that it's wrong in MESS. I tried changing a few things like initial RAM contents and register values, but the only thing that changes demo mode behaviour is opcode/interrupt timing.

It means timer interrupts happen 1 or 2 cycles too late/too early, and/or one of the opcodes takes more cycles than stated in Hitachi docs.


Oh cool, glad you found a video. I was going to try to get one recorded this weekend. Do you still need something video'd, or is the YouTube video good enough?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/09/15 10:47 PM

nop, not needed anymore =)
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/10/15 05:10 AM

Looks like the chip on Mr. Do is a different pin count as well as different maker. I'm kind of surprised they didn't use the same chip on it.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/10/15 07:27 AM

Huh, you're right... Didn't even think to count the pins, just kind of assumed... smile

Now I have to look at BMX Flyer and Thomas the Tank Engine to see what they look like...
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/10/15 10:33 AM

These things are all over the place...
BMX Flyer looks to be the same chip as Mr. Do:

But Thomas is using yet another chip, Oki M6502B-15

Looks like there's at least info on that one... 4-Bit CPU with built-in LCD driver.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/10/15 09:10 PM

I found the datasheet for the MSM6502 (stupid OKI, reusing "6502") and the good news is it has no less than FOUR test pins. looks like 2 in, and maybe 2 out. The docs don't say a whole lot about it, but it does have a complete opcode listing with hex values so there is that.

It's a later sheet (1986) so it cuts out most of the more interesting parts, but I think there's enough there to go on.

Connecting to the QFPs is a pain because you have to make custom adapters- there's no ZIF sockets for most of these non-standard sized chips unfortunately.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/11/15 07:15 AM

That was pretty weird to name it 6502! And 4 test pins is odd. Good luck!

I posted pics from the TMS1000 out of a Big Trak - www.seanriddle.com/tms1000.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/11/15 09:00 AM

When I decapped Electronic Talking Battleship, the die got stuck in the top plastic and I toasted it pretty badly trying to get it free. Unfortunately, Whink didn't clean it up very well. The ROM bits look like they are possibly a little small for me to read anyway. It looks like 8K of ROM. Here are a couple of 5Kx5K GIMP files:
www.seanriddle.com/electalkbshipmetal.xcf

www.seanriddle.com/electalkbshipacid.xcf
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/11/15 10:37 AM

I re-dumped Coleco Galaxian. The ROM matches the existing dump.

I also finished vectoring a couple more games.

The new games are here:

http://blog.kevtris.org/blogfiles/Handhelds/Mattel%20Starhawk/
http://blog.kevtris.org/blogfiles/Handhelds/Mego%20Breakfree/
http://blog.kevtris.org/blogfiles/Handhelds/Tandy%20Caveman/
http://blog.kevtris.org/blogfiles/Handhelds/Tomy%20Scramble/

Looks like I got around 11 more games left to do after this.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/11/15 01:23 PM

Nice! =) +thanks for double-checking Galaxian.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/11/15 07:35 PM

hap: no prob. what does galaxian do? it just doesn't run?

btw galaxian does something neat with the VFD. when something blows up, it will stop scanning the grids and turn the grid on that is over the object that is blowing up, and hold it there for awhile. this makes it light up really bright for 100-200ms.

so far this is the only game that does that.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/11/15 08:08 PM

Galaxian: sprites flicker, sound zooms/glitches, and eventually it resets itself and does the same again. Unable to start the game.

The brightening trick is pretty common on LED games. =)

sean: what hw revision Big Trak is yours? Or will you post that in a hw/pinout info txt later?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 03:04 AM

Originally Posted By seanriddle
When I decapped Electronic Talking Battleship, the die got stuck in the top plastic and I toasted it pretty badly trying to get it free. Unfortunately, Whink didn't clean it up very well. The ROM bits look like they are possibly a little small for me to read anyway. It looks like 8K of ROM. Here are a couple of 5Kx5K GIMP files:
www.seanriddle.com/electalkbshipmetal.xcf

www.seanriddle.com/electalkbshipacid.xcf


404s frown
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 05:52 AM

Oops, I uploaded jpgs, not xcfs -
www.seanriddle.com/electalkbshipmetal.jpg

www.seanriddle.com/electalkbshipacid.jpg
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 06:36 AM

Originally Posted By hap
sean: what hw revision Big Trak is yours? Or will you post that in a hw/pinout info txt later?

The PCB is Rev D; the serial # on the bottom is 1260863. The board is hard-wired into the unit, so it's a little tough to trace the wiring. I want to sub in a little PIC processor for the TMS1000 I pulled, so I don't want to cut the wires. The link I posted has lots of good info, including schematics. So far, the things I have checked match up with his info.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 08:20 AM

Well, now we know exactly what's in electronic talking battleship: a TI TSP50C10A

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 05:46 PM

Yeah, that bigtrak site looks informative enough for making emulation happen. =)

If someone wants to add it now, the romdump is confirmed and here are the PLA files:
tms1000_bigtrak_opla.pla: http://pastebin.com/Fpkv235j
tms1000_bigtrak_mpla.pla: http://pastebin.com/Vs7F6UyL
If not, I can add it later, in a week or so.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 06:36 PM

There's a great doc on the TSP50C10A: http://www.ti.com/lit/ml/spss011d/spss011d.pdf

But I didn't see any obvious way to electronically dump the ROM contents.

Datamath.org says the chip is also in the Super Speak and Math.

If there's no way to electronically dump the ROM, I can pick up another Battleship and try decapping again. But there's no guarantee that I'll be able to read the bits, or if I can, that we can figure out the bit order.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 06:41 PM

I'm almost sure there IS a way to electronically dump the rom; the trick is we have to find it from the decap.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 10:49 PM

The doc mentions "test code" at $1FE0-1FFF, which is the top of the ROM address space for the '10. Reset jumps to $0000, but maybe certain inputs cause a jump to the test code instead?

I scanned the docs for hints (the TMS1xxx data sheets mention things like "don't drive K1-K4 within 6 clocks of reset", or "expect R0 to output unexpectedly when device is reset"), but didn't notice any.

I did get confused about the D/A options; in one place it says the '10 only has options 2 and 3, but the pin assignments show DA2, which is option 1. The Battleship PCB looks like it uses the option 1 4-transistor amplifier.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/12/15 11:12 PM

That warning about k1-k4 6 clocks from reset sounds like an invitation for probing.

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/13/15 04:30 AM

Another day, another game. This time it's frisky tom.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Frisky%20Tom/

This VFD Was a huge pain because each glyph is different pretty much.

Down to 10 or so left.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/13/15 09:13 AM

More finished dumps and VFD Vectors!

Here's 3 more games.

http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20UFO%20Blaster/
http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Crazy%20Climber/
http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Stargate/

Enjoy!
Posted By: AntoPISA

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/13/15 09:34 AM

Fantastic jobs!
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/14/15 12:13 AM

MB Electronic battleship versions:
1977/79: uses 2 9v batteries, a tms1000(?) cpu, no codebook/instant programming, higher pitched sound; game has a RED light bulb *below* the ship in the 'ship' lower backdrop which is clear/untextured, and the text next to the white switches on each side (FIRE, ON/OFF, LOAD/GO) is painted white

1982: uses 4xAA batteries, an unknown cpu (???tms1400???), has the RED-ORANGE codebook for instant programming, lower pitched sound; game has a RED ?LED? *above* the ship in the 'ship' lower backdrop which is red and textured, and the text next to the white switches on each side (FIRE, ON/OFF, LOAD/GO) is unpainted (and hard to read); bezel is same design as 1977/79 version.

1989: Talks. uses 4xAA batteries, a TSP50C10A cpu, has the BLACK codebook for instant programming, mixed LPC Speech/PCM/Synthesized sound; game has a RED LED *above* the ship in the 'ship' lower backdrop which is red and textured. Has a 1-player mode. The 'entry' control panels on each side are completely different from the 1977/1979 and 1982 versions, with a single row of yellow rubber buttons and a larger yellow fire button, plus a green ON button on player 1's side. The 'bezel' of the upper 'target area' has a different design printed on it than the older versions.

1977/79 version demo and 1982 version comparison: https://www.youtube.com/watch?v=j7vKyQlWpbA
1982 version demo: https://www.youtube.com/watch?v=Rr5TD34z8FQ
1989 version demo: https://www.youtube.com/watch?v=4TuhedOCP-8

LN

EDIT: Btw Sean, since you ripped apart one of the 1989 ones, I realized one of the clear blue plastic target grid panels on mine has a crack in it. Is there any chance you can spare one from the one you tore up?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/14/15 05:06 AM

Yeah, you bet. Send me your address and I'll mail one off.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/15/15 02:03 PM

I wonder what MCU 1977 Electronic Battleship has then =) TMS0970 or TMS1000.

-----
new games emulated, with kevtris:
- uPD552C-017 1979, Bambino UFO Master-Blaster Station (ET-02)
- uPD553C-170 1982, Bandai Crazy Climber
- uPD553C-192 1982, Tomy Scramble (TN-10)
- uPD553C-209 1982, Tomy Caveman (TN-12)
- HD38800A73 1982, Bandai(Mattel) Star Hawk*
- HD38800A77 1982, Bandai Frisky Tom

*was this ever released in Japan?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/16/15 04:28 AM

hap: pretty sure star hawk was a Mattel exclusive. It looks like Bandai didn't make many/all? of their own games, either.

They were both made by "Kaken" according to the PCBs. I don't know who they are or could I find much about them on google so I dunno.

New dump time!

I dumped 9 of the CPUs from the games Rik sent me tonight, so the only CPU from his lot I didn't dump was the 8048 from the mego game (need to fire up the DOS thin client to do it) and the TMS???? from one of the select a game carts.


http://blog.kevtris.org/blogfiles/Handhelds/Epoch%20Football/
http://blog.kevtris.org/blogfiles/Handhelds/Epoch%20Galaxy%20II/
http://blog.kevtris.org/blogfiles/Handhelds/Tomy%20Cosmic%20Combat/
http://blog.kevtris.org/blogfiles/Handhelds/Epoch%20Invader%20from%20Space/

Galaxy II is very interesting: apparently there's no less than FOUR revisions of the VFDs in this game. I have revision B and D, which have totally different graphics.


Also, I have mostly decoded NEC's VFD part numbering scheme. It appears to be so:

FIP5CM33T (machine man) for example.

FIP = fluorescent indicator panel
5 = number of grids (5 in this case)
C = revision of the VFD (A is rev 1, B is rev 2, etc)
M = custom display
33 = unique display part number

This seems to hold true for all of the displays except 1. Turtles is a FIP15BM32T for example.

It's got 15 grids and must be revision 2.

The odd one out is Cosmic Combat. It's marked FIP32AM18Y. The only one with Y on the end instead of T. Not sure what that means.

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/16/15 09:21 AM

2 more dumps.

http://blog.kevtris.org/blogfiles/Handhelds/Vtech%20Invaders/
http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Safari/

Enjoy!
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/16/15 10:39 AM

I've read that Kaken was a subsidiary of Bandai.

found a mistake on Cosmic Combat svg: in yours, invaders are like:
xxxx
yyyy
xxxx
yyyy

but should be:
xyxy
yxyx
xyxy
yxyx
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/16/15 09:25 PM

oh yeah you're right. not sure how I screwed that up. I'll fix it tonight.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/16/15 10:41 PM

Could you upload Epoch Football svg as well?
And please doublecheck Mego Break Free MCU label =) uPD552C-049 is Bambino Safari.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/16/15 11:33 PM

I fixed the cosmic combat SVG, uploaded the football SVG, and the two CPUs are OK. Break Free is a D553C-049 and Safari is a D552C-049. Confusin'.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/17/15 07:05 AM

I posted Coleco Head to Head Football info: www.seanriddle.com/tms1100.html

I've still got Head to Head Baseball and the Entex card games in queue, and I picked up Entex Raise the Devil Pinball and Master Merlin.

I added a shaky video that might help with the timing: www.seanriddle.com/h2hfb.mp4
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/17/15 08:27 AM

Another game done:

http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Boxing/

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/17/15 02:50 PM

Master Merlin smile that one is rare.

kevtris: boxing Identification.png grid 3/5 there's an unlabeled plate in the middle

*edit* I added it to MESS. I'm guessing it is plate #8.
According to your pinout description, pin 13 is speaker-out, but in MESS I only get sound out of pin 11.

I also added VTech Invaders, but it's not playable. Hopefully that makes it easier to find out what causes the remaining MCU emu problems (for this game, and Coleco Galaxian).
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/17/15 09:50 PM

oh, Bambino Safari folder is missing pinout.ods
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 03:02 AM

I uploaded it but it didn't work because the file was still open so open orifice locks it. it's there now (safari pinout).

The missing plates are 10 btw. I forgot to mark them.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 03:06 AM

New dump. this rounds out my bambino collection. There's still two bambino games not done because I don't have 'em. (classic football and ice hockey)

http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Soccer/

I fixed the VFD ident for boxing for completeness sake.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 06:15 AM

I posted Coleco Head To Head Baseball info: www.seanriddle.com/tms1100.html

I also posted a video for timing comparison: www.seanriddle.com/h2hbb.mp4

And I posted scans of the bezels and PCBs of both boards:
www.seanriddle.com/h2hfbcase.xcf
www.seanriddle.com/h2hfbpcbf.xcf
www.seanriddle.com/h2hbbbezel.xcf
www.seanriddle.com/h2hbblabel.xcf
www.seanriddle.com/h2hbbpcbf.xcf
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 09:05 AM

I posted Entex Raise The Devil info: www.seanriddle.com/tms1100.html

And a video: www.seanriddle.com/raisethedevil.mov

And scans of the bezel and PCB:
www.seanriddle.com/raisethedevilbezel.xcf
www.seanriddle.com/raisethedevilpcbf.xcf
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 09:49 PM

2 more games:

(Select a game Space Invader 2)

http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Select%20a%20Game/

http://blog.kevtris.org/blogfiles/Handhelds/Gakken%20Dig%20Dug/

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 09:57 PM

Originally Posted By kevtris
New dump. this rounds out my bambino collection. There's still two bambino games not done because I don't have 'em. (classic football and ice hockey)

http://handheldempire.com/manufacturer.jsp?manufacturer=5
07 is Race N Chase
08 is Ice Hockey
Classic Football is the same game as Superstar Football, the difference is the case/buttons color and a 3-color VFD.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 09:59 PM

I doublechecked the ROM data of 2 Coleco h2h games and Entex Raise The Devil, no errors were found but I still want to recheck the bits behind a bad smudge via disasm (h2h football, row 5 col 10)
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/18/15 10:47 PM

This one was easy. I vectored the keypad for it since it does not have a display.

http://blog.kevtris.org/blogfiles/Handhelds/Lakeside%20Le%20Boom/
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 05:05 AM

I posted Entex Electronic Poker Info: www.seanriddle.com/tms1100.html

And a video for timing: www.seanriddle.com/entexpoker.AVI

This one is a TMS-1370. The only pinout I could find was a one-page diagram of various TMS chips showing the TMS-1300, but it has errors. So there's a chance my assignments are incorrect, but they mostly make sense.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 05:27 AM

Aaand another. CGL Super Kong is done.

http://blog.kevtris.org/blogfiles/Handhelds/CGL%20Super%20Kong/

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 05:30 AM

Originally Posted By hap
Originally Posted By kevtris
New dump. this rounds out my bambino collection. There's still two bambino games not done because I don't have 'em. (classic football and ice hockey)

http://handheldempire.com/manufacturer.jsp?manufacturer=5
07 is Race N Chase
08 is Ice Hockey
Classic Football is the same game as Superstar Football, the difference is the case/buttons color and a 3-color VFD.


Oh yeah I forgot about race n chase. Classic Football does indeed have a different VFD, but I didn't know if there were other changes or not. It's the only Bambino game with a multicolour VFD. The rest are all zinc sulfide (cyan) with various filters over the top, usually blue or green.

Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 11:47 AM

I posted Entex Jackpot Blackjack Gin Rummy: www.seanriddle.com/tms1400.html

And a video: www.seanriddle.com/entexjackpot.AVI

This one's the first TMS-1670, but I think I figured out the pinout from the PCB wiring.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 03:14 PM

Could you post a PCB photo of these two?
And what's the VFD serial? it's probably on the back of the VFD panel.

*edit* On Entex Poker, I'm pretty sure there's a bit hiding under the smudge in the rightmost column. If you have a high res die pic, can you double check it with that?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 04:16 PM

As for Entex Select-A-Game. I thought we had a skeleton driver for it in MESS but I must have confused it with Entex Adventurevision (drivers/advision.c).

It will have to await its turn. Or does another dev want to take it?

http://blog.kevtris.org/blogfiles/Handhe...0Inside%202.jpg
The Football cart was mentioned here before, it must be TMS1x70.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 06:43 PM

I'll scan the PCBs and upload them. The VFDs are Itron FG1114.

Edit: I uploaded the PCB scans with the other pics. Sorry about the crappy desoldering job on the chips- my desoldering iron tip pretty much fell apart and I had to order more, but I didn't wait.

It's odd that 9 and DL are mapped to the same input on Poker, since it has a 4x7 button matrix and almost 1/2 of the positions are unused. But I took apart the keypad to make sure.

I didn't realize that inside the back glass of VFDs that you can see the traces going from the pins to the various grids and segments. I guess it's conductive paint like rear window defoggers use. It helped me figure out the pinout. www.seanriddle.com/pokervfdb.jpg

I don't have a top metal shot of Poker because the die was stuck in plastic, but here's the highest res pic I've got. I don't think there's a bit there, but I'll clean the die and take another look.



Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 07:35 PM

Thanks, obviously no bit behind the smudge then, it looked suspicious on the lower-res scan. =)
Yeah, it's cool how all traces are visible on the back of the VFD panel. kevtris has made loads of photos of them.

So, these games are Gakken made, as you mentioned before it's labeled on the PCBs. I can find the Japanese Poker game on Google, but not the other one.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 08:30 PM

to process a VFD, here is how I do it:

First, I solder all the pins together with a fine wire (single strand of a stranded wire) except the heater connections. Then I hook the heater up to the usual place on the board and ground the fine wire. this will light all segments up.

Next I take a picture for vectoring, using a high rez cam on a tripod head on. I usually take 5-10 pics at different exposures so that I can get the zinc sulfide ones without blooming since they are by far brighter than the rest.

After that, I vector it, and then desolder the wire while still leaving the heater hooked up, and finally I use a micro hook clip lead + a wire to do the pinout. connecting plate 0 (left most one) to ground, then touching the grids to see where it connects. This is repeated with each plate connection until all of them are traced out. It doesn't take a terribly long time to do even though it sounds like it.

Lots better than squinting at traces on the VFD which can sometimes not tell the whole truth. See the back side of bambino boxing. the traces go along the top, but there's connections down to the plates.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/19/15 10:37 PM

Thanks, I'll try that out. It was easy to figure out the grids and the normal segments for the poker VFD, since they were connected to the TMS correctly, but I wasn't sure how the extra segment and the suits were connected. The traces on the VFD showed me the suit pins, and through the process of elimination I figured out the extra segment.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/20/15 01:02 AM

yeah grids is easy- you can see where they come out at but plates can be trickier. though on that particular VFD it looks really simple since it's a calculator style display with a few minor additions.

good job on all those TMS games btw. I might send you this cosmic fire away CPU to fry open if I can't electrically dump it. It's a 40 pin TMS-something or another.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/20/15 02:51 AM

Yet another game done. I have 3 or 4 left it looks.

http://blog.kevtris.org/blogfiles/Handhelds/CGL%20Earth%20Invaders/

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/20/15 09:58 PM

emulated since last update:
- Bambino Boxing
- Bambino Soccer
- Bambino Safari
- Epoch Invader From Space
- Epoch Football
- Epoch Galaxy II (Astro Wars)
- Mego Breakfree
- Tomy Cosmic Combat
- Gakken Heiankyo Alien (CGL Earth Invaders)
- Gakken Crazy Kong (CGL Super Kong) - random lockups frown
- Gakken Dig Dug
- Coleco Galaxian - was already added, but fixed bugs, works now

necessary artwork is at OG's site when he uploads them: http://dspnet.fr/~galibert/artwork/
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 07:26 AM

Ooo... I love this site. smile Gotta do another compile.

I have the missing Bambino games (among many others...), I'll put those on the list to send out in the next batch or two.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 08:10 AM

Originally Posted By hap
http://dspnet.fr/~galibert/artwork/


Done. We really need to move that to mess.org.

OG.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 08:15 AM

I posted Master Merlin info: www.seanriddle.com/tms1400.html

And a video for timing: www.seanriddle.com/mastermerlin.mp4

The chip is a TMS1400, but with the TMS1100 pinout. The die says 1400CR and the die revision marking on the package is DCRS.
Posted By: AntoPISA

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 08:16 AM

Originally Posted By Olivier Galibert
Originally Posted By hap
http://dspnet.fr/~galibert/artwork/


Done. We really need to move that to mess.org.

OG.


Oliver, can also add them to my page?
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 08:20 AM

Originally Posted By AntoPISA
Originally Posted By Olivier Galibert
Originally Posted By hap
http://dspnet.fr/~galibert/artwork/


Done. We really need to move that to mess.org.

OG.


Oliver, can also add them to my page?


Sure.

OG.
Posted By: AntoPISA

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 08:30 AM

Thanks!
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 03:20 PM

I can add them this week to mess.org.

AntoPISA, it would be really helpful if someone made screenshots of these and all the other artworks seen here:
http://www.mess.org/artwork
if you have time to spare smile
Posted By: AntoPISA

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 04:09 PM

Like the "Artwork Preview" category of MAME?
It is a good idea, I think I will! wink
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 09:21 PM

AntoPISA: when you download new ones, please 'sort by date' to make sure you download possible fixed/updated ones as well =)
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 09:44 PM

Is there any effort made to tidy up the amount of files in the artwork? (Like instead of having 80 Pac-Man images that are identical, just have one image referenced 80 times)... Or do we really care as long as it works? smile

It looks like it would require manual editing of the layout file to do it, so it's probably not worth the amount of time... Just curious about it. (I was going to change an image just for fun and realized it meant replacing a lot of images... smile )

Originally Posted By AntoPISA
Like the "Artwork Preview" category of MAME?
It is a good idea, I think I will! wink


Kevin has an 'all sprites on' PNG of each of them on his website, you could probably use those... Like this one for Bambino Basketball:
http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Basketball/Bambino%20Basketball%20Final.png
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 10:54 PM

All those pngs are autogenerated with svg2lay. I believe OG's plan is to eventually support built-in SVG artwork.

BTW you only need to place the zipped file in the artwork folder. No need to decompress it.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/21/15 11:28 PM

Oh yeah, I know... I was just playing with the graphics for fun when I noticed all the files... smile
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 07:05 AM

Originally Posted By AntoPISA
Like the "Artwork Preview" category of MAME?
It is a good idea, I think I will! wink


Great! It's really appreciated, and I will use them on www.mess.org smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 11:47 AM

2 errors in mastermerlinraw.bin:
offset $E34: change $29 to $A9
offset $FF5: change $9B to $DB
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 08:15 PM

Master Merlin is added and playable.
sean: if you compare the guts (sans MCU) to the old 1978 Merlin, is it identical? Because from an emulation point of view, it is.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 08:18 PM

Thanks; I'll fix my files. The rows in the ROM array were much closer than on the other chips, so I had to use a different algorithm to ID the 1-bits, and I was left with more bits to correct than usual.

Were there any emulation differences due to the chip being a 1400CR? The die looks like a TMS1100 with 4K ROM.

Edit: I'll pull out my Merlin carcass and compare.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 08:22 PM

I'd have to look at the disasm to see if it uses typical TMS1400 features such as nested(max 3?) calls.

And I'd really need to fix up the debugger disasm view for that; currently it's unsorted LFSR, hard to follow.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 08:49 PM

Urg, yeah, that would be a pain. No biggie, I just wondered if you had to change anything to get it going. I couldn't find anything about the 1400CR anywhere. But I guess that's not too surprising since we only have an email a mailing list post with the pinout of the TMS1400, and nothing about the TMS1600.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 08:59 PM

I did a quicker test, and indeed it's using nested calls (I checked by simply printf-ing a counter: increment on call, decrement on return)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/22/15 11:32 PM

Cool!

I dug up Merlin, and the PCB is practically identical to Master Merlin. The size is the same and all the components are in the same place. The only differences are that the traces are wider, which caused a few re-routes, and the OSC cap and resistor are different.

In fact, the date code stamped on the Master Merlin PCB is 8027; the copyright on the case is 1982, so I'm pretty sure that means the PCB was meant to go into a Merlin. Probably sales dropped off and they were left with an inventory of PCBs.

I guess that explains the genesis of the 1400CR - they wanted the extra ROM space, but needed the same pinout. I wonder if any other devices use the 1400CR.

The "buttons" are a single sheet of plastic folded in thirds with conductive paint applied to 2 of the sections. The 3rd section folds in between the other 2 and has holes to allow the other 2 sides to touch when you press on it. The Master Merlin version is also mostly identical to the Merlin version; there are only a few minor differences. The button layout, mounting holes, and connector are the same. I can't find a date code on it, but I assume it was also leftover from Merlin.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/23/15 03:51 AM

I've talked to the Doyles about Merlin in the past (the inventors), and they apparently programmed a 'bunch' of games for it. Only 6 were used in the first one. We didn't talk about Master Merlin for some reason (short conversation, focused on the original game and Wildfire Pinball), but I bet when the idea for a sequel came up, they just used some of the other things they already had... Minimizes R&D a lot I'd expect... smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/23/15 04:32 AM

Another one bites the dust!

http://blog.kevtris.org/blogfiles/Handhelds/Mattel%20World%20Champ%20Baseball/

This one had a really weird VFD in it, with strangely laid out grids, which are marked up on the ident image.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/23/15 10:54 AM

kevtris is it possible to determine the number of stack levels in HD388x0 by altering your dumping program? For example, call from address A 1 time, then from address B xx times, and return xx+1 times to see whether or not address A is lost.

The reason is, CGL Super Kong works ok if I increase the stack size in the mcu emu core. This game has the B revision of the MCU. Hitachi docs say the stack size is 4, maybe they increased it on the B rev.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/23/15 07:19 PM

Entex Raise The Devil and Electronic Poker are working.

Is there anything non-standard about the speaker setup in the poker game? If so, can you make a schematic? In MESS, I'm getting messy farts instead of beeps.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/23/15 07:41 PM

There is a lot of circuitry connected to the piezo. I'll trace it out.

OK, it's an oscillator that R15 enables. It's got the same wiring as this: http://rayshobby.net/learning-electronics-1-multivibrator/

C1 and C2 are 0.003uF, R1 and R4 are 1K, R2 and R3 are 100K.

Instead of a battery, the common resistor leads are connected to the TMS's R15 output and one side of the piezo. The other side of the piezo is connected to T1's collector.

I connected a resistor between pin 5 of the TMS socket on the PCB and VSS, and measured a 2.4kHz signal at the piezo.

And that works out well with the equation on that web site, which gives 2.405kHz.

Entex Jackpot Blackjack/Gin Rummy has the same circuit, but the components are laid out a lot easier to trace! Pretty much exactly like that schematic was drawn.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/23/15 10:50 PM

Got it, thanks. =)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/24/15 01:00 PM

sean do you have the top-metal die pics of the Coleco h2h games?


Originally Posted By kevtris
Another one bites the dust!

http://blog.kevtris.org/blogfiles/Handhelds/Mattel%20World%20Champ%20Baseball/

This one had a really weird VFD in it, with strangely laid out grids, which are marked up on the ident image.

Added and working.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/24/15 06:16 PM

Originally Posted By hap
sean do you have the top-metal die pics of the Coleco h2h games?

I took pics but didn't composite them. I'll stitch them together and post them.

Edit: I posted the H2H Football die with the other info. I'll let you know when Baseball is out there.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/24/15 11:47 PM

Originally Posted By hap
Entex Raise The Devil and Electronic Poker are working.

Is there anything non-standard about the speaker setup in the poker game? If so, can you make a schematic? In MESS, I'm getting messy farts instead of beeps.


Nobody likes messy farts. ewww. I traced out the audio circuit for donkey kong. Looks like pin 53 is the audio itself and pin 35 is the "decay" pin.

There's one transistor that just turns the feeper on and off (via pin 53) and the other controls the pulldown resistor on the feeper which controls its volume. There is a 0.47uf cap and 91K resistor on the base of it, which is connected to pin 35.

This is similar to how le boom does it volume decay.

Galaxian's audio works like you said- pin 40 is the audio output, and pin 41 is the oscillator control. There's a resistor/cap circuit on pin 41 so that it can be controlled.

Looks like when 41 is low, it discharges the capacitor and stops the oscillator. When high, it will oscillate at maximum frequency, and when tristated (input mode) it will slowly decrease in pitch. I was thinking of throwing it on a scope to see what happens.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/24/15 11:48 PM

Originally Posted By hap
kevtris is it possible to determine the number of stack levels in HD388x0 by altering your dumping program? For example, call from address A 1 time, then from address B xx times, and return xx+1 times to see whether or not address A is lost.

The reason is, CGL Super Kong works ok if I increase the stack size in the mcu emu core. This game has the B revision of the MCU. Hitachi docs say the stack size is 4, maybe they increased it on the B rev.


Hmm, not really. I am using the factory test code now to dump these. I wouldn't doubt it however if they increased stack levels and maybe did other things- they did reset the mask numbers. I wouldn't have expected them to do this unless they changed functionality somehow too.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/25/15 04:29 AM

I posted the Head to Head Baseball top metal die shot.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/25/15 05:32 AM

I tried to dump the NEC 8048C that was inside that game... unfortunately I got absolutely nothing out of it. I haven't encountered a "protected" one before; I'm pretty sure I have dumped similar NEC 8048's so I dunno what's going on. I'll have to fire up the allpro and give it a shot on there, since I have an 8048 dumping script for it.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/25/15 12:02 PM

Thanks! I'll start on the h2h football game. Are all those early American football games so complex because they're trying to milk off Mattel Football success and imitate the concept?

Mattel Championship Baseball (the game kevtris dumped) is also very complex. The ones by Entex and Bandai are gambling minigames compared to it.

kevtris: 8048 is from what? The Mego Mini Vid game? As for Galaxian audio, there must be more to it than just decreasing frequency. If my ears are right, I hear a change in duty cycle time too. https://www.youtube.com/watch?v=z4XndQf6NnU
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/25/15 08:38 PM

the 8048 is from that mini vid sea battle game. On Galaxian, what happens is it's a relaxation oscillator I think, so as pitch decreases, I guess the effective duty cycle would change too. The pulse width doesn't change, but the period between pulses does. i.e. the high time is constant but the low time varies.

And yes, that baseball game is stupidly complicated. The football game I dumped by mattel is also stupidly complicated as well (world champ. football).

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/25/15 08:57 PM

It can be emulated with a netlist (discrete sound) if all components/values are known.

sean: Do you know the R/C values for Big Trak? The schematics online say R=83K, C=100pf, which would imply around 125kHz. But comparing it to YouTube vids, it should be around 200kHz.

The Coleco Football game is also too slow with R=39K, C=100pf. If I had to guess, I'd pick R=30K... orange-black-orange instead of orange-white-orange, hmmmm big difference in contrast.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 01:29 AM

My Big Trak has an 82K resistor (Gray Red Orange) and a 100pF cap (Brown Black Brown). H2H Football has an 39K resistor (Orange White Orange) and a 100 pF cap (101J). I measured the Big Trak resistor in circuit at 83.8K and the H2H Football resistor out of circuit at 39.3K. My meter won't go as low as 100pF to check the caps.

Before I pulled the chips, I measured 195Hz between pins 1 and 4 of H2H Football, and 588 Hz between pins 26 and 4 of Big Trak.

Those are both E revision dies; you think that has anything to do with it? Remember when I hooked up some TMS1100s to the Entex Baseball 3 cap and resistor to measure its frequency? Es were faster than Bs. Measuring the frequency slowed it way down, but it's possible that the ratio of B speed to E speed is correct. That would make Es 11-12% faster.

Originally Posted By seanriddle
Originally Posted By hap
Ok, Entex Baseball 3 is working in MESS. I'll update the notes if you worked out how to measure its osc freq.

I connected the cap and resistors from BB3 to 4 other TMS1100s - two were B-revision dies and two were E-revision. Interestingly, the Es are faster than the Bs- B amateur = 169K, B pro = 218K, E amateur = 188K, E pro = 244K. The original chip was a B, so I guess 169K/218K is the way to go.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 03:37 AM

I got a Tactix game; it's a 1980 Simon/Merlin-type game from Castle Toy Company. The CPU is a NEC D557L, which is listed in the 1980 and 1984 NEC Catalogs. The 1980 book says it's in the uCOM-43 family, but the 1984 book says uCOM-4. Both catalogs say it has 2000 bytes of ROM, not 2048, although other chips are shown having 2048. It has a test pin that the data sheet says "connect to VSS", so I'll see what happens when it's connected to VDD.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 05:11 AM

It is really 2048; the databooks claim the upd553 is some non-power-of-2 ROM size, but it really is power of 2.
Kevtris has a rig set up for dumping upd552 and 553 (and upd650), IIRC it involves selective insert of NOPs and 'jump following' to dump the entire ROM, it isn't straightforward.

The Hitachi MCUs on the other hand have a built in test ROM which can be used to bank in any page arbitrarily and are somewhat more straightforward to dump, if I remember right.

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 05:42 AM

the 557 appears to be a 28 pin version of the 553, so it's probably the same die in the package. I should be able to dump it with my existing rig if I add a socket for it.

And yes, it's really 2048 bytes and not 2000. I don't know why the idiots kept saying 2000 in the data books and data sheets, when it clearly is 2048 on all the dumps I made. The programming manual I saw even re-enforces this lie by saying ROM can only be at 0000-07CF. This is not true at all.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 07:39 AM

Here's another one. Bandai Machine Man. The broken filaments can be seen on the pictures. Segments A, B, and F of the 7-seg area is all connected internally via some kind of leakage path but if I pulled down the other inputs I could determine where things connected.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Machine%20Man/

Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 07:56 AM

I was amazed the VFD still partially works with that kind of damage, especially with the segments partly shorted together by the broken filament debris.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 08:48 AM

I thought maybe 48 bytes of ROM were inaccessible for some reason, like the 3870/42, which loses the top 64 bytes of ROM for RAM.

I spent a couple of hours playing with it. I was hopeful it was one of those that just spews out ROM contents in test mode. When the test pin's at VSS, the game plays normally. At VDD, nothing happens; all the output pins are low. Floating, it looks like it's executing random instructions.
The chip has 1 4-bit input port and 2 4-bit I/O ports, so I tied all those low with 1K resistors to see if the chip was using those inputs as the address, but that didn't change anything.

Can I send you the chip (and maybe a couple of Rockwell's that are hassling me, too)? I'd like to get them back after you dump them so I can torch them and map out the bits.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 09:02 AM

Originally Posted By seanriddle
I thought maybe 48 bytes of ROM were inaccessible for some reason, like the 3870/42, which loses the top 64 bytes of ROM for RAM.

I spent a couple of hours playing with it. I was hopeful it was one of those that just spews out ROM contents in test mode. When the test pin's at VSS, the game plays normally. At VDD, nothing happens; all the output pins are low. Floating, it looks like it's executing random instructions.
The chip has 1 4-bit input port and 2 4-bit I/O ports, so I tied all those low with 1K resistors to see if the chip was using those inputs as the address, but that didn't change anything.

Can I send you the chip (and maybe a couple of Rockwell's that are hassling me, too)? I'd like to get them back after you dump them so I can torch them and map out the bits.


Sure I can dump them. To get the data out, it's a bit more nuanced. 2 of the pins (near the corner.. 39 and 40 I think) control things. One lets it force NOPs and the other lets you execute a jump.

So you have to do a bunch of code that counts clocks after dumping the first bank on reset. Then you count clocks up to each jump/call and then let it execute it get into the new bank. Then you have to keep following jumps/calls to get to all banks.

The HD388xx is like that only worse.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 10:05 AM

Originally Posted By seanriddle
Those are both E revision dies; you think that has anything to do with it? Remember when I hooked up some TMS1100s to the Entex Baseball 3 cap and resistor to measure its frequency? Es were faster than Bs. Measuring the frequency slowed it way down, but it's possible that the ratio of B speed to E speed is correct. That would make Es 11-12% faster.


Ah! Yes, that must be why.

The game with the NEC MCU: Can you make a pinout before you send it off to kevtris? Then we can emulate it when it's dumped. It will fit right into this driver: http://git.redump.net/mame/tree/src/mess/drivers/hh_ucom4.c
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 02:43 PM

Originally Posted By kevtris
Here's another one. Bandai Machine Man. The broken filaments can be seen on the pictures. Segments A, B, and F of the 7-seg area is all connected internally via some kind of leakage path but if I pulled down the other inputs I could determine where things connected.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Machine%20Man/



You mean the 3rd digit? Looks like it can only show 0 and 5.
I added the game to MESS and it works.

Also added Big Trak and Entex Jackpot.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 04:12 PM

sean: on h2h Football, there are 9 digits and 8 LEDs, which R pins select the round LEDs? I'm assuming R0-R7, but it could be R1-R8 too since the game sets R0-R8 in succession.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/26/15 07:46 PM

My notes say R0-R7, but I'll double-check.

I posted the Tactix info: www.seanriddle.com/necd557l.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 12:02 AM

Originally Posted By kevtris
Originally Posted By seanriddle

Can I send you the chip (and maybe a couple of Rockwell's that are hassling me, too)? I'd like to get them back after you dump them so I can torch them and map out the bits.


Sure I can dump them. To get the data out, it's a bit more nuanced. 2 of the pins (near the corner.. 39 and 40 I think) control things. One lets it force NOPs and the other lets you execute a jump.

So you have to do a bunch of code that counts clocks after dumping the first bank on reset. Then you count clocks up to each jump/call and then let it execute it get into the new bank. Then you have to keep following jumps/calls to get to all banks.

The HD388xx is like that only worse.

If it's OK, I'll send the NEC D557L from Tactix, the Rockwell MM75 from Electronic Mastermind, the MM76EL from Scrabble Sensor, and the Hitachi HD38133 from Mattel Armor Battle. Thanks!
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 02:37 AM

Originally Posted By hap
Originally Posted By kevtris
Here's another one. Bandai Machine Man. The broken filaments can be seen on the pictures. Segments A, B, and F of the 7-seg area is all connected internally via some kind of leakage path but if I pulled down the other inputs I could determine where things connected.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Machine%20Man/



You mean the 3rd digit? Looks like it can only show 0 and 5.
I added the game to MESS and it works.

Also added Big Trak and Entex Jackpot.


No, the normal 7-segs. The problem is when the filament blew some conductive material set up a leakage path between plates 0, 1, and 2. I could pull down the affected plates (i.e. light up 0, and plates 0,1,2 all lit, but by pulling plates 1/2 low it extinguished them).
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 02:40 AM

Originally Posted By seanriddle
Originally Posted By kevtris
Originally Posted By seanriddle

Can I send you the chip (and maybe a couple of Rockwell's that are hassling me, too)? I'd like to get them back after you dump them so I can torch them and map out the bits.


Sure I can dump them. To get the data out, it's a bit more nuanced. 2 of the pins (near the corner.. 39 and 40 I think) control things. One lets it force NOPs and the other lets you execute a jump.

So you have to do a bunch of code that counts clocks after dumping the first bank on reset. Then you count clocks up to each jump/call and then let it execute it get into the new bank. Then you have to keep following jumps/calls to get to all banks.

The HD388xx is like that only worse.

If it's OK, I'll send the NEC D557L from Tactix, the Rockwell MM75 from Electronic Mastermind, the MM76EL from Scrabble Sensor, and the Hitachi HD38133 from Mattel Armor Battle. Thanks!


Yeah that's fine.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 05:33 AM

Originally Posted By seanriddle
I posted Entex Raise The Devil info: www.seanriddle.com/tms1100.html

And a video: www.seanriddle.com/raisethedevil.mov


Are you (or Kevin) able to dump the ROM from Raise the Devil non-destructively? I had always assumed Black Knight Pinball was just a re-branded RTD, but I opened it to look at the chip and it is different... It's labeled MP1296 MSL^8223.

It's an extremely rare game, so not one I'd want damaged... smile
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 06:28 AM

If numbering in hh_tms1k holds then MP1296 should be a tms1100; if the chip is rev E or later it cannot be easily dumped due to the addition of what we assume was a security feature on the die (which Kevtris calls the "Fuck-you-FET") which holds the d7 rom line permanently in one state during dumping/test mode, preventing that bit from being read out. Die revisions D and older of the tms1100 will dump fine (although we cannot read the MPLA (custom instructions) or OPLA (segment/output) data without a decap)

Do you have a picture of the chip itself including all markings?

LN
Posted By: Duke

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 06:56 AM

Just wanted to say thanks to everyone working on those old games, but there is a distinct lack of screenshots in this thread!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 07:28 AM

My Raise the Devil is a B-revision TMS1100, so it's certainly possible that Black Knight is, too. Is it a full-size 28-pin DIP or the smaller shrink DIP? If it's the SDIP, then it's probably not a B.

Kevin has dumped many B-revision TMS1100s with no damage.

It might be a pain, but we (Hap smile ) could probably figure out the PLAs.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 07:30 AM

Originally Posted By Duke
Just wanted to say thanks to everyone working on those old games, but there is a distinct lack of screenshots in this thread!
Back on page 61 I posted a lovely pic of a dirt speck smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 07:59 AM

Here's the worst VFD to date I think. It's a late game so it seems the VFD tech advanced a bit before it was made and they were using it to the fullest.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Doraemon/

This is the last Rik game I have to vector, and all are dumped except for the SaG TMS chip and the 8048. I think I can dump the 8048 but I have to set up the allpro to do it.

Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 08:31 AM

I picked up Tandy Baseball and Entex Color Football. I got sniped on a cheap Entex Soccer because I forgot to check the end of the auction, but quite a few of those show up.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 09:56 AM

Originally Posted By Lord Nightmare
Do you have a picture of the chip itself including all markings?

LN


Here's the whole board:
http://www.handheldmuseum.com/Z_Imgs/MESS/BlackKnightPCB.jpg

I can put up the back side too if it will help...
Originally Posted By kevtris
Here's the worst VFD to date I think. It's a late game so it seems the VFD tech advanced a bit before it was made and they were using it to the fullest.


I think the other games in this series (there's two more) will be similar. They have anime characters that appear all over the screen... smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 01:48 PM

Doraemon: emulated and working. It's a fun game! =) Even has a short background jingle that doesn't annoy you.

VFD Artwork link reminder (bdoramon can be downloaded there soon): http://dspnet.fr/~galibert/artwork/
kevtris: If you do an update to svg's, could you do it on these instead of your own? due to them having grid/plates numbered.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 01:58 PM

cry cry cry cry cry cry

Any MESS dev here that wants to do Entex Select-A-Game?
http://en.wikipedia.org/wiki/Entex_Select-A-Game
http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Select%20a%20Game/
it has the MCU on-cartridge, comparable to MB Microvision. 1 cart dumped so far.

cry cry cry cry cry cry
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 04:50 PM

Originally Posted By Rik


Damn! That chip has a datecode of 1982, so it almost certainly has the FuF protection. We could dump 7/8ths of it electronically (and there probably is some as-yet-undiscovered way to get that 8th bit out too), but it really needs a decap to get everything.

There exists a possibility of doing a 'live decap' leaving the bond wires and legs intact of a chip when decapping it (hence leaving the chip alive/functional; this was successfully done by digshadow on the upd1771 scv sound mcu before we knew how to electronically dump those), but it is much more involved than a normal decap is.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 04:52 PM

Rik-

If it's not a big hassle, a pic of the back side could be useful to insure that the pinout matches the TMS-1100 and they didn't switch to another chip.
The PCB layout is extremely similar to RTD; some of the LEDs are in different locations, but the parts seem to be numbered the same, and even the jumpers are in basically the same locations.
It's interesting that the chip has 6011 printed on it; that was printed on the RTD PCB, under the chip.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 04:57 PM

Originally Posted By seanriddle
My Raise the Devil is a B-revision TMS1100, so it's certainly possible that Black Knight is, too. Is it a full-size 28-pin DIP or the smaller shrink DIP? If it's the SDIP, then it's probably not a B.

I just double-checked, and my RTD had a B-revision in an SDIP. But as LN said, I'm not sure if Bs were still made in '82. I'll check some Microvision carts that I have.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 05:01 PM

Originally Posted By hap
Originally Posted By seanriddle
Those are both E revision dies; you think that has anything to do with it? Remember when I hooked up some TMS1100s to the Entex Baseball 3 cap and resistor to measure its frequency? Es were faster than Bs. Measuring the frequency slowed it way down, but it's possible that the ratio of B speed to E speed is correct. That would make Es 11-12% faster.


Ah! Yes, that must be why.

I've still got several of Ranger's Microvision carts along with some that I bought, and I found duplicate carts where one has a B-revision and the other has an E. The PCBs are different revisions, but the OSC cap and resistor are the same. I'll put the carts back together and confirm that E runs faster.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 05:19 PM

Entex Space Invader with the TI chip has an SDIP TMS-1100 marked MP1211 MSL^8114 and it's a Rev B.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 07:19 PM

So it COULD be pre-rev E even in 82, depends I guess when the masks were made. Given the 6011? number on the chip matches the older game its possible this could be a fairly old 'alternate rules pinball mask' which was ramped up later.

Worth a try to dump it electrically, probably.

LN
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 10:09 PM

Here's the back of the board:
http://www.handheldmuseum.com/Z_Imgs/MESS/BlackKnightPCB_Back.jpg

Kind of a quick-and-dirty iPhone pic... I can take a better one if something isn't easy to see... smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/27/15 11:57 PM

Rik- that looks good. I'm pretty sure it's the same pinout. On the front, could you tell me the colors of the 2 resistors below the skill switch? Those and the one to the left (which I can see) are switched in based on the skill setting and change the oscillator speed. Also, can you read the value of the capacitor under the TMS1100? Not the cylindrical electrolytic, but the disc cap between it and the chip? It probably says 47 on it. It also determines the clock speed. Thanks.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 12:05 AM

Originally Posted By Lord Nightmare
So it COULD be pre-rev E even in 82, depends I guess when the masks were made. Given the 6011? number on the chip matches the older game its possible this could be a fairly old 'alternate rules pinball mask' which was ramped up later.

Worth a try to dump it electrically, probably.

LN

I agree it's worth a try. Dumping would not damage the chip if it is an E or G revision anyway. If it's an E and there were just a few changes from RTD's code, I wonder if we could figure out the 8th bits.

The back of the RTD PCB says "ENTEX PONY PINBALL 6011". So I bet RTD is 6011 and BK is 6011A. It's interesting that both PCBs have 39 LEDs, but the RTD LEDs are numbered 1-43. Were 4 removed for cost reasons? Maybe they shrunk the playfield and those 4 no longer fit?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 12:33 AM

Originally Posted By hap
Doraemon: emulated and working. It's a fun game! =) Even has a short background jingle that doesn't annoy you.

VFD Artwork link reminder (bdoramon can be downloaded there soon): http://dspnet.fr/~galibert/artwork/
kevtris: If you do an update to svg's, could you do it on these instead of your own? due to them having grid/plates numbered.


Will do...
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 02:35 AM

Originally Posted By Duke
Just wanted to say thanks to everyone working on those old games, but there is a distinct lack of screenshots in this thread!

Someone wanted screen shots? smile Here's some, just as-is from MESS, left the Windows border there too (didn't feel like editing them... smile )
Bandai Crazy Climber :

Bandai Dokodemo Dorayaki Doraemon :

Bandai Frisky Tom :

Bandai Machine Man :

Coleco Donkey Kong :

Coleco Galaxian :

Coleco Ms. Pac-Man :

Coleco Pac-Man :

Entex Pac-Man 2 :

Gakken Crazy Kong :
This game really needs the overlay to work as the ladders are printed on the game (not perfectly aligned here though...) :


Damn, I was totally going to spam the forum with a massive image post, but it limits you to 10 images it seems... smile More screenshots are here:
http://www.handheldmuseum.com/Z_Imgs/MESS/screenshots/
using the MESS naming...
(Or I can make another post like this if someone wants me to... smile )
It's been fun playing these at work (I can get away with that occasionally) and having people walk by and recognizing them!
Posted By: crazyc

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 02:49 AM

That's really great!
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 03:50 AM

It's actually easier to use the built-in MESS screenshot feature than the Windows Print-Screen feature. If memory serves it won't screenshot with artwork by default but there's some setting change or key modifier that will allow it. (AFK at the moment or I'd check.)
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 04:33 AM

It was making weird, stretched images (forcing them 640x480 it looked like)... I wasn't sure if that was just a configuration problem or what, so I just used the print-screen option. I can do that pretty quick, although it does require an extra step or two... smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 04:38 AM

Wow those screenshots look great! I like it with the emulator border anyways, makes it more "authentic" :-)
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 02:25 PM

This is great to see. I hope that Gakken's Jungler gets emulated eventually. In my oppinion, that one was better than the arcade it was based on.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 02:37 PM

new MESS release is scheduled tomorrow, here's what we done, cheers!


-Bambino Basketball - Dribble Away [hap, Kevin Horton, Olivier Galibert]
-TI SR-16 II [hap, Sean Riddle]
-Speak & Read [hap, Sean Riddle, Kevin Horton]
-Super Simon [hap, Sean Riddle]
-Bandai Packri Monster [hap, Kevin Horton, Olivier Galibert]
-Bandai Zackman [hap, Kevin Horton, Olivier Galibert]
-Parker Brothers Q*Bert [hap, Kevin Horton, Olivier Galibert]
-Tomy Kingman [hap, Kevin Horton, Olivier Galibert]
-Tomy Tron [hap, Kevin Horton, Olivier Galibert]
-TI-1000 [hap, Sean Riddle]
-Kosmos Astro [hap, Sean Riddle]
-Coleco Pac-Man [hap, Kevin Horton, Olivier Galibert]
-Coleco Ms.Pac-Man [hap, Kevin Horton, Olivier Galibert]
-Coleco Donkey Kong [hap, Kevin Horton, Olivier Galibert]
-Bandai Frisky Tom [hap, Kevin Horton]
-Mattel Star Hawk [hap, Kevin Horton]
-Bambino UFO Master-Blaster Station [hap, Kevin Horton]
-Bandai Crazy Climber [hap, Kevin Horton]
-Tomy Scramble [hap, Kevin Horton]
-Tomy Caveman [hap, Kevin Horton]
-Mego Mini-Vid Break Free [hap, Kevin Horton]
-Bambino Knock-Em Out Boxing [hap, Kevin Horton]
-Bambino Soccer [hap, Kevin Horton]
-Bambino Safari [hap, Kevin Horton]
-Epoch Invader From Space [hap, Kevin Horton]
-Epoch Football [hap, Kevin Horton]
-Epoch Galaxy II [hap, Kevin Horton]
-Tomy Cosmic Combat [hap, Kevin Horton]
-Gakken Heiankyo Alien [hap, Kevin Horton, Rik]
-Gakken Dig Dug [hap, Kevin Horton, Rik]
-Parker Brothers Master Merlin [hap, Sean Riddle]
-Gakken Poker [hap, Sean Riddle]
-Mattel World Championship Baseball [hap, Kevin Horton]
-Gakken Jackpot: Gin Rummy & Black Jack [hap, Sean Riddle]
-Milton Bradley Big Trak [hap, Sean Riddle]
-Bandai Machine Man [hap, Kevin Horton, Rik]
-Coleco Head to Head Football [hap, Sean Riddle]
-Bandai Dokodemo Dorayaki Doraemon [hap, Kevin Horton, Rik]
-Coleco Head to Head Baseball [hap, Sean Riddle]

-Coleco Galaxian [hap, Kevin Horton, Olivier Galibert] (was broken, fixed now)
-VTech Invaders [hap, Kevin Horton] (locks up at boot)
-Gakken Crazy Kong [hap, Kevin Horton, Rik] (random lockups)
-Entex Space Invader [hap, Sean Riddle] (external artwork still needed)
-Entex Raise The Devil [hap, Sean Riddle] (external artwork still needed)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 03:38 PM

some notes on VFD artwork that still needs to be done (maybe i missed some)

games with an overlay to add more graphics:
- Tomy Tennis: tennis field
- Bambino Basketball: baskets
- Gakken Crazy Kong: ladders (see example picture on prev page)
- Epoch Football: football field
- Bandai Packri Monster: maze
- Mattel Star Hawk: crosshair
- Mattel World Championship Baseball: baseball field

alt. vfd's:
- Epoch Galaxy II
- Entex Pacman 2 (red pacmans)
Posted By: AntoPISA

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 08:18 PM

Excellent job! Keep it up! laugh
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/28/15 10:36 PM

Originally Posted By ICEknight
This is great to see. I hope that Gakken's Jungler gets emulated eventually. In my oppinion, that one was better than the arcade it was based on.


I'll include this and Amidar in the next batch I send to Kevin...

Bandai Burgertime and Pengo as well... I'm going through my favorites first. Then I'll get into the more boring 'it's basically just Space Invaders' games... smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 12:54 AM

I am putting these games back together, and I discovered a factory test for doraemon. If pin 35 is grounded (pulled high) at power-up it will go through a display and audio test. There's a pad connected to the pin but it doesn't go anywhere, so it looked highly suspicious. turned out I was right.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 04:32 AM

Interesting, I'll add it to the driver. =)
BTW, assuming you have it, could you upload the Entex Turtles COP400 romdump?
Posted By: krick

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 04:47 AM

Originally Posted By Lord Nightmare
MB Electronic battleship versions:
1977/79: uses 2 9v batteries, a tms1000(?) cpu, no codebook/instant programming, higher pitched sound; game has a RED light bulb *below* the ship in the 'ship' lower backdrop which is clear/untextured, and the text next to the white switches on each side (FIRE, ON/OFF, LOAD/GO) is painted white


I got the original version for Christmas in 1977. Out of the box, it didn't work and my step-father had to take it apart and reflow a bunch of the solder joints to get it working. It took far more time to program it for a game than it did to actually play the game afterwards. Not even remotely fun.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 04:55 AM

Well, the one I have works, and it doesn't take too long (in my opinion) to program it. In fact both players can program their side at the same time simultaneously since the game keeps track of both player 1 and 2's sliders. However I can see it being an issue, the sliders sometimes stick. Also, the game doesn't seem to care in the slightest bit whether you're actually programming 17 spaces in the form of 5 ships, you can in theory leave ship spaces randomly all over the board. The game also doesn't keep track of turns either, it is up to the players to decide how many shots each gets etc.

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 04:58 AM

Sorry, I thought I uploaded the ROM dump ages ago with the original data. I didn't. I uploaded it now, it should be sitting in the turtles directory now.

stargate is similar to turtles; nearly identical hardware with a different program in the COP411.
Posted By: krick

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 05:53 AM

Originally Posted By Lord Nightmare
Well, the one I have works, and it doesn't take too long (in my opinion) to program it. In fact both players can program their side at the same time simultaneously since the game keeps track of both player 1 and 2's sliders.


I remember being disappointed when I got it. I was expecting there to be sensors in each hole that would detect where your ships and pegs were.

This reminds me... Has anyone dumped "The Generals Electronic Strategy Game" that came out in 1980? It was kind of like Stratego, except when you were challenging an opponent's piece, both players put their pieces on a little electronic device that read the bumps on the bottom of the pieces and determined which player's piece won the confrontation without actually revealing what the piece was.

You can see a picture here...
http://www.amazon.com/The-Generals-Electronic-Strategy-Board/dp/B000JL2292
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 05:57 AM

There IS an MB electronic Stratego game which sounds like it does something similar to that. Unfortunately it sells for quite a bit on ebay, it seems.

LN
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 11:26 AM

Originally Posted By kevtris
I am putting these games back together, and I discovered a factory test for doraemon. If pin 35 is grounded (pulled high) at power-up it will go through a display and audio test. There's a pad connected to the pin but it doesn't go anywhere, so it looked highly suspicious. turned out I was right.
Speaking of test modes, when I was little I found a sound test of sorts in the first Konami TMNT LCD handheld, which would play every sound one after the other in a loop. You can easily access it by fiddling with the batteries so that there's just a brief power cut, but there may be a more official way to access it as in the Doraemon game.

So... whenever those handhelds are supported, that may be something to look into.
Posted By: Shideravan

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 02:55 PM

Awesome job, guys smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 06:15 PM

Originally Posted By ICEknight
Speaking of test modes, when I was little I found a sound test of sorts in the first Konami TMNT LCD handheld, which would play every sound one after the other in a loop. You can easily access it by fiddling with the batteries so that there's just a brief power cut, but there may be a more official way to access it as in the Doraemon game.

So... whenever those handhelds are supported, that may be something to look into.

I've dumped the ROM from TMNT (and Top Gun); they both use Sharp SM51x MCUs. I'll look into IDing the LCD segments.

The '511 in TMNT has a "melody ROM", so it's possible the power glitch just started it playing.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 08:59 PM

Originally Posted By kevtris
I am putting these games back together, and I discovered a factory test for doraemon. If pin 35 is grounded (pulled high) at power-up it will go through a display and audio test. There's a pad connected to the pin but it doesn't go anywhere, so it looked highly suspicious. turned out I was right.


That's awesome, thanks hap for adding that to mess too... Now I may have to install a little switch under the 'Open' button or something. 'Mod' my handhelds...

I wonder if the other two in the series do that as well... You'll be getting those soon...
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/29/15 10:43 PM

I suspect there's more test modes hidden away in some other games; a lot of the games with D552/553 CPUs in them I dumped have inputs that are pulled down, but do not go to anything. It's possible there's extra things present like test modes, or extra skill/options that didn't make it into the finished game.

It's also possible they just pulled down the other inputs for fun, to make PCB routing easier. One thing I found weird is that most bambino games connect say a 3 position skill switch to three inputs on the micro. You only need two inputs to the micro for this. 2 inputs gives 4 combinations, and 3 inputs give 8. I wonder if you input "invalid" combinations if you get more skill levels or something, or test modes or similar.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 04/30/15 08:33 AM

I took the electronic ROM dump of Mattel Jacks and compared the bits to the picture of the ROM array and figured out the mapping. Then I used that mapping to create a ROM dump from the picture of the Plus One ROM array: www.seanriddle.com/cop410l.html

Since Plus One's COP410L was in an 8-pin DIP, I'm not sure which pins were used for which signals, but hopefully that can be determined fairly easily once it is emulated.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/01/15 09:47 PM

I got those boards today Sean, thanks. I should be able to dump the three of them (MM7x and the D557), but the other two probably not. I can't find a single shred of info about them except this thread and a calculator website saying "yup, this chip is in a blackjack playing calculator!".

I will poke on them a little but probably won't spend a lot of time on them since even if I do get data out, it probably won't be useful.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/01/15 11:30 PM

Sounds good. Let me know when you're done and I'll paypal you return postage.

The Hitachi chip is from Mattel Armor Battle. The stenciling under the IC socket I installed lists 2 similar part #s, one for Armor Battle and the other for Sub Chase, so it might be a standard MCU that's just labeled with Mattel's part #.

When I get them back I'll torch them all and map the bits in the MM7x and D557 ROM arrays to your dumps, and see if there are any hints on the other 2 dies.

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/01/15 11:33 PM

I got a melody madness and a cosmic fire away 3000 coming now so we'll be able to see what's inside both.. Hopefully there's not a TMS1xxx inside the CFA 3000
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/01/15 11:41 PM

sean: OK. I will have to add some 28 pin sockets to my dumper boards to accommodate the new parts but this isn't a problem. I am also reviving my allpro 88 dumping addon device; are you interested in that if I do it? I think you said you had an allpro 88, right?

The idea is a PCB that fits inside the allpro and replaces the three power supply boards, and has a ribbon that plugs into the computer port, and has USB + 12V input on it.

I was thinking of adding a simple LCD (HD44780 type) and some buttons for "mass" dumping maybe. Like you get a tube of 20 EPROMs and want to dump them all, it'd be nice to be able to plug it in and hit the button to dump + auto create the file with an incrementing filename or similar.

I got a prelim PCB design done of the difficult parts (power supplies), so all that was left is an FPGA and some other gubbins to make it all work.



Also was going to add some headers for small fans because cooling is grossly inadequate IMO and make them turn on when the programmer is under bias (i.e. pin drivers are... driving). When not under bias it doesn't get too hot.

Dumping will be performed via "scripts" that are executed on the hardware, and consist of a 45 bit wide VLIW CPU running at 20MIPs or similar, with 8 32 bit registers and built in delay functions and 16Mbyte of RAM. Also was thinking of replacing the existing clock generator with an FPGA output to produce any frequency of clock desired instead of the fixed 5 or 6 the allpro normally does.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/01/15 11:41 PM

What was the status of the Coleco Frogger game? I can't remember if you were able to figure out dumping it or not...

I finally dug up a Gakken Frogger, and it's the same Konami chip, but with a different die code:
M58846-700P
(You mentioned 'P's once before, is that possibly a protected chip, or just a coincidence on this one?) The VFD is a CP5084 GLR, and is slightly different than Coleco's, but mostly in the art style of the sprites.

Another random game: Castle Toy Kingpin II pinball
http://www.handheldmuseum.com/CastleToy/Kingpin2.htm
It's an 'actual' pinball with ball and flippers, but runs on an NEC D550LC
It'd be fun to add that to Visual PinMAME as well... smile

Found a Rockwell B9001-13 in Mattel's Horoscope Computer. Where any of the earlier Mattel LED games (like Battlestar Galactica) dumpable, or was decapping used for that?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/01/15 11:43 PM

If there's an undumpable TMS and you don't mind losing it, I'm happy to visually transcribe the ROM.

Atari Touch Me, Castle Toys Einstein and Jimmy the Greek Blackjack are en route. I'm hopeful the BJ game has the Rockwell chip from the patent.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 12:26 AM

Originally Posted By Rik

Found a Rockwell B9001-13 in Mattel's Horoscope Computer. Where any of the earlier Mattel LED games (like Battlestar Galactica) dumpable, or was decapping used for that?

Interesting; B9000-12 is in Mattel's Brain Baffler.

I've decapped several of the Rockwell chips from Mattel games, but haven't figured out how to emulate them yet. It's definitely high on my list.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 12:29 AM

Kevin- yeah, the AllPro board would be cool. I connected mine to a PIC, but only coded up dumping (slow) for a few chips.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 06:29 AM

Originally Posted By Rik
What was the status of the Coleco Frogger game? I can't remember if you were able to figure out dumping it or not...

I finally dug up a Gakken Frogger, and it's the same Konami chip, but with a different die code:
M58846-700P
(You mentioned 'P's once before, is that possibly a protected chip, or just a coincidence on this one?) The VFD is a CP5084 GLR, and is slightly different than Coleco's, but mostly in the art style of the sprites.

Another random game: Castle Toy Kingpin II pinball
http://www.handheldmuseum.com/CastleToy/Kingpin2.htm
It's an 'actual' pinball with ball and flippers, but runs on an NEC D550LC
It'd be fun to add that to Visual PinMAME as well... smile

Found a Rockwell B9001-13 in Mattel's Horoscope Computer. Where any of the earlier Mattel LED games (like Battlestar Galactica) dumpable, or was decapping used for that?



Yes I dumped it. The VFD artwork and the dump should be sitting in a /coleco frogger/ dir in the usual place. Hmm just checked. the ROM dump is not in there. wonder how it got left out.

I just uploaded the ROM dump and the disassembly of it. Interestingly they are using 3 instructions that are not documented. I know what two of them are- they appear to be a left and right rotate. I documented them in the disasm.

I know they are rotates because the code "makes perfect sense" for them to be that- I reversed the VFD scanning/display and button reading part.

Yes I can dump those; in this case the P does not mean protected as far as I know. the 701 I dumped was a P version too.

As for the rockwell chip I have no clue. if it's an MM7x it's probably dumpable; this would be tellable via the pinout. An NEC 550, let's see... Yeah looks like it's possibly dumpable; there is a test pin on it. This seems to be the same/similar to the 557 I have here I was going to try to dump.

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 06:30 AM

Originally Posted By seanriddle
Kevin- yeah, the AllPro board would be cool. I connected mine to a PIC, but only coded up dumping (slow) for a few chips.


Yep that's how I am using mine right now too. It's slow and it sucks and it's hard to program for. So that's why I kind of want to fast track the board. Then I don't have to keep making PCBs to dump chips.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 10:00 AM

Originally Posted By kevtris
As for the rockwell chip I have no clue. if it's an MM7x it's probably dumpable; this would be tellable via the pinout.

I'll put together the info I've collected on the Rockwell chips. I've found 3 different families so far in the Mattel games: B60xx in Auto Race and Battlestar Galactica, B61xx in Football and Baseball, and B90xx in Brain Baffler and now Horoscope. I've looked closely at the B60xx and B61xx pinouts and die shots, and they are not MM7x, but I think they are related.
Posted By: Anna Wu

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 04:46 PM

Originally Posted By kevtris
Originally Posted By Rik
What was the status of the Coleco Frogger game? I can't remember if you were able to figure out dumping it or not...

I finally dug up a Gakken Frogger, and it's the same Konami chip, but with a different die code:
M58846-700P
(You mentioned 'P's once before, is that possibly a protected chip, or just a coincidence on this one?) The VFD is a CP5084 GLR, and is slightly different than Coleco's, but mostly in the art style of the sprites.

Another random game: Castle Toy Kingpin II pinball
http://www.handheldmuseum.com/CastleToy/Kingpin2.htm
It's an 'actual' pinball with ball and flippers, but runs on an NEC D550LC
It'd be fun to add that to Visual PinMAME as well... smile

Found a Rockwell B9001-13 in Mattel's Horoscope Computer. Where any of the earlier Mattel LED games (like Battlestar Galactica) dumpable, or was decapping used for that?



Yes I dumped it. The VFD artwork and the dump should be sitting in a /coleco frogger/ dir in the usual place. Hmm just checked. the ROM dump is not in there. wonder how it got left out.

I just uploaded the ROM dump and the disassembly of it. Interestingly they are using 3 instructions that are not documented. I know what two of them are- they appear to be a left and right rotate. I documented them in the disasm.

I know they are rotates because the code "makes perfect sense" for them to be that- I reversed the VFD scanning/display and button reading part.

Yes I can dump those; in this case the P does not mean protected as far as I know. the 701 I dumped was a P version too.

As for the rockwell chip I have no clue. if it's an MM7x it's probably dumpable; this would be tellable via the pinout. An NEC 550, let's see... Yeah looks like it's possibly dumpable; there is a test pin on it. This seems to be the same/similar to the 557 I have here I was going to try to dump.



Was the code submitted (GitHub) to support the Coleco Frogger game?
I think OG made already a artwork called cfrogger(?)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 05:01 PM

Games using an unemulated MCU won't be added before the MCU is emulated in MESS.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 05:05 PM

Originally Posted By kevtris
(...)I was thinking of adding a simple LCD (HD44780 type) and some buttons for "mass" dumping maybe.
(...)


Could you try dumping that one by the way?
The LCDC font gfx ROM.
Posted By: Anna Wu

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 05:06 PM

Originally Posted By hap
Games using an unemulated MCU won't be added before the MCU is emulated in MESS.


Understand, thanks.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 09:07 PM

hap: I'm sure that's been done many times. you can't directly dump it (easily) but visually dumping it is no problem. I did this for the noritake VFD displays with HD44780 interface but it was a work project. I just took the documentation and manually banged in the bits into a text file and wrote a program to convert it back into a binary.

Once I got an HD44780 LCD from a copy machine, which had a really strange font ROM in it. Unfortunately I am not sure if I still have the chip; I removed it and put a "Standard" chip on the LCD, and I am not sure if I saved the old one. from what I recall, it had "buttons" made up of ROM characters, like boxes with text in them which showed up next to keys on the display. Display was 40 by 2 line one.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/02/15 10:21 PM

Yeah, that's also how MESS got the chr rom, typed in from the bit patterns in the datasheets.
Which revision did you type in? We only have A00.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 08:42 AM

Originally Posted By seanriddle
Originally Posted By Rik

Found a Rockwell B9001-13 in Mattel's Horoscope Computer. Where any of the earlier Mattel LED games (like Battlestar Galactica) dumpable, or was decapping used for that?

Interesting; B9000-12 is in Mattel's Brain Baffler.

I've decapped several of the Rockwell chips from Mattel games, but haven't figured out how to emulate them yet. It's definitely high on my list.

Looks like we may be partially in luck on Horoscope and Brain Baffler. When I was putting together info on the PPS-4/1 variants, I ran across part # B90xx in the 1981 Rockwell Electronic Devices Division Data Book, which says that's model MM78LA. There's very little info beyond an entry in a comparison chart, but that leads me to believe that it uses the same opcodes as the MM78. It has the same ROM and RAM sizes (2K ROM, 128 nibbles RAM), but has a few new features- speaker output, including an 8-bit tone generator counter, and 14 segment outputs, using a 32x14 PLA. (Brain Baffler has an 8-character 14-segment text display.) MM78s have a test pin, so it's possible that MM78LAs do, too. But I've been unable to find any more info anywhere.

The other PPS-4/1 chips have part #s ranging from A75xx to B86xx, and the chips in Mattel games Battlestar Galactica, Football and Baseball are labeled B60xx and B61xx. I think that indicates that these chips aren't quite PPS-4/1; I have some Rockwell calculators with chips labeled A48xx, B50xx and A59xx. If we're lucky, the chips in the Mattel games share enough characteristics with the PPS-4/1 that we can get them emulated.

I've decapped Battlestar Galactica, Football and Baseball. BSG has 512 bytes of ROM, and Football and Baseball have 896 (the PPS-4/1 chips don't always have power-of-2 pages of 64 bytes).

After Kevin dumps the MM75 and MM76EL chips that I sent him, I'll decap them and see how similar they look to the Mattel chips. If they are close, then I should be able to figure out the bit mapping between his dumps and the ROM array pics, and I can apply those to the Mattel ROM array pics and see what I get. If we're really lucky, the opcodes will be the same as PPS-4/1.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 09:01 AM

Originally Posted By Rik

Found a Rockwell B9001-13 in Mattel's Horoscope Computer. Where any of the earlier Mattel LED games (like Battlestar Galactica) dumpable, or was decapping used for that?

Rik-
Can you read the label on the chip in Mattel Gravity? Patent 4,364,619 shows a QIP chip, which I assume is a B60xx like in Battlestar Galactica (and I think, Auto Race). An interview with Mark Lesser says he programmed Auto Race, BSG, Football, Baseball, Brain Baffler and Horoscope, but doesn't mention Gravity.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 09:43 AM

It's a B6102-11 with a date code of 8020.
Nothing else on it but the Rockwell logo.

The Horoscope chip has MM95 above the B9001...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 11:44 AM

Thanks. Brain Baffler also has MM95 on it. I guess they used that name as well as MM78LA, or maybe MM95 is a later, similar chip.

B6100 is Football and B6101 is Baseball, so I bet Lesser programmed Gravity, too.

Battlestar Galactica is B6001, and I bet Auto Race is B6000. I'm not sure if Football 2 has a Rockwell chip. I know Basketball, Armor Battle and Sub Chase don't have Rockwell chips, and neither do the Funtronics games.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 01:16 PM

I added a driver for the COP400 handhelds, see: http://git.redump.net/mame/tree/src/mess/drivers/hh_cop400.c

Lightfight is fully playable. Entex Space Invader and Mattel Funtronics Jacks are responsive and do some stuff right, but are very buggy overall.

I think the MCU emulation core is not perfect yet. I did fix some small bugs there(eg. Space Invader didn't boot at all at first), but I don't know enough of COP400 (yet) though to see where the problems are.
COP400 emulation core is here: http://git.redump.net/mame/tree/src/emu/cpu/cop400
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 02:03 PM

COP400 is definitely buggy; I ran into a lot of problems trying to hook it up properly to the Lisa driver.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 04:27 PM

Originally Posted By seanriddle
When I was putting together info on the PPS-4/1 variants, I ran across part # B90xx in the 1981 Rockwell Electronic Devices Division Data Book, which says that's model MM78LA. There's very little info beyond an entry in a comparison chart, but that leads me to believe that it uses the same opcodes as the MM78.


Definitely very little info online besides that book. There's two pages in "Microprocessor Data Book" (S. A. Money)
https://books.google.com/books?id=e0SoBQ...ge&q=MM78LA

One page in "Microprocessor and Microcomputer Data Digest": https://books.google.com/books?id=WxUjAAAAMAAJ&q=MM78LA&dq=MM78LA

and one table in a page in this issue of Electronic Design: https://books.google.com/books?id=KuAEAQAAIAAJ&q=MM78LA&dq=MM78LA

You can get a few more summaries this way: https://www.google.com/search?q=%22MM78LA%22&num=100&safe=off&tbm=bks

And these guys digging around in 2004: http://ana-3.lcs.mit.edu/~jnc/cctalk/2004-July/1584.html

But that's all that's leaping out at me... </masteroftheobvious>
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 06:19 PM

Thanks! I hit that first link for every chip I look up! I also had found that last link, but the Microprocessor and Microcomputer Data Digest looks interesting. Luckily AbeBooks had it for $3.50 shipped, so I ordered one. It's probably similar to the Microprocessor Data Book, but maybe there's another hint or two.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 06:36 PM

Originally Posted By hap
I added a driver for the COP400 handhelds, see: http://git.redump.net/mame/tree/src/mess/drivers/hh_cop400.c

Lightfight is fully playable. Entex Space Invader and Mattel Funtronics Jacks are responsive and do some stuff right, but are very buggy overall.

I think the MCU emulation core is not perfect yet. I did fix some small bugs there(eg. Space Invader didn't boot at all at first), but I don't know enough of COP400 (yet) though to see where the problems are.
COP400 emulation core is here: http://git.redump.net/mame/tree/src/emu/cpu/cop400

Cool! I'm confident of all 3 of those dumps, since I did them electronically and compared hundreds (thousands even) of dumps of each chip. But there are probably a few bits wrong in Plus One since I dumped it visually. I'm going to clean the die in nitric acid and take more pics. Funtronics Red Light Green Light is on the way, and I bet it uses a COP410L, too.

When I used unidasm on the Entex Space Invader code, it didn't work quite right because the COP444L has a 2K address space. There might be other little differences between the 3 different COP chips used in those games.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/03/15 10:10 PM

Originally Posted By seanriddle

Battlestar Galactica is B6001, and I bet Auto Race is B6000. I'm not sure if Football 2 has a Rockwell chip. I know Basketball, Armor Battle and Sub Chase don't have Rockwell chips, and neither do the Funtronics games.


I have Gravity listed as:

Invented by: Tim Effler
Programmed by: Peter Oliphant
I don't think Lesser was involved on that one.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 04:04 AM

Cool! I didn't realize anyone else programmed those Rockwell chips. Peter Oliphant sounds interesting- from child actor to game designer, including credits on Defender of the Crown and Rocket Ranger.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 06:51 AM

Poking through some more odd stuff... Found some interesting things:
Coleco Quiz Wiz Challenger:
http://www.handheldmuseum.com/Z_Imgs/MESS/Coleco_QuizWizChallenger_CPU.jpg
TMS1000, but socketed for our convenience... smile
Milton Bradley Arcade Mania (board game with an electronic device) :
http://www.handheldmuseum.com/Z_Imgs/MESS/MB_ArcadeMania_CPU.jpg
TI M34078A-N2LL
Mattel Computer Backgammon (LCD game)
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel_ComputerBackgammon_CPU.jpg
Just labeled T6753 1777-9339 (Toshiba I assume...)
Mattel Diet Trac (an LCD weight-loss calculator basically...)
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel_DietTrac_CPU.jpg
Toshiba T6768

I found these interesting:
Mattel Horse Race Analyzer:
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel_HorseRaceAnalyzer_CPU.jpg
TMS1100 with an LCD driver chip (looks like a Hughes chip)
This was sold by Mattel for a while, and when they stopped selling it, the inventors bought it back from them and sold it under their own name: AHTI
Their version looks like the same on the outside, but this is the board in it:
http://www.handheldmuseum.com/Z_Imgs/MESS/AHTI_HorseRaceAnalyzer_CPU.jpg
HD613901-B62
Obviously completely redesigned... Mattel's version came out in 1979 or so, the AHTI came out around 1994, so I assume that had a lot to do with it... I was just surprised to see it so radically different...

Don't know what's dumpable of all that, but thought I'd share...
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 06:54 AM

I didn't try unidasm with the COP400 myself, but I can see it supports COP410,20,and 44 so in theory it should work.

Entex Turtles and Stargate work fine on MESS, added them this morning. These games have the Hitachi MCU, and a COP411L for handling sound. (oh, still need to add the gamespeed knob on Stargate)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 07:21 AM

Rik-
I've been looking at Quiz Wiz Challengers on ebay. I decapped the chip in Quiz Wiz, and it's not a microcontroller, just some logic that scrambles the question number using the cartridge (which is just some traces on a PCB). I guess they programmed that logic into the TMS along with the extra features.

Unfortunately, the TMSs in your pics are E and G revisions, so not currently completely dumpable. But seeing what's inside helps. Datasheetarchive has several Hughes LCD controllers, but I didn't see 0530.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 07:24 AM

Unidasm on the 444 code gave a bunch of "invalid opcode" errors because it didn't like the opcode bit patterns for the extra address bit. Now that I think about it, that was probably just an output formatting issue, and has nothing to do with the emulation of the chip.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 09:50 AM

That mego sea battle has another unknown hughes LCD driver chip in it, too. I'm sure I can easily RE how it works by examining the 8048 code if/when I can dump it. Seems to be similar to the microvision chip, just a different resolution. 20*14 or so pixels but only 20*13 are hooked up. There's an NC pin on the chip in the middle of the LCD driver pins so it's possible it's a 34 output chip.

Pins 1-6 are the power+inputs to it, while the other 34 are LCD pins, except pin 21 which wasn't hooked up but I suspect might be another LCD pin.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 10:09 AM

Rik- To your knowledge, were the games in these 2 patents released? Thanks.

https://www.google.com/patents/US4582323

https://www.google.com/patents/US4418917
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 11:18 AM

The first one is Look-Alive Football
http://www.handheldmuseum.com/Mattel/LAFB.htm

I have one of those... (They also prototyped Baseball and Basketball like this, but those were never made)
Baseball patent:
https://www.google.com/patents/US4395760

Don't recognize the second at all though...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/04/15 09:12 PM

Cool! The patent shows a COP421L, which is easy to electronically dump.

Mattel Auto Race does have a Rockwell B6000 chip as I suspected (BSG is B6001), and Football 2 has a new one: Rockwell B8000, which is a 40-pin DIP.

Three more: Castle Toy Co. Einstein (Simon clone) has a COP421, so that should be easy to dump. Tandy Baseball has a PIC1650A- maybe I can dump this one; I know Kevin can. Atari Touch Me has an AMI chip labeled C10745. I haven't checked the pinout yet to see if it's standard or custom.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 05:54 AM

I can dump the 1650 right now, btw. I got a Tandy Cosmic Fire Away 3000 today (aka twinvader III, which it says right on the PCB)

This has the exact same chip set that the Tsukada games have, a TMS1024 and an MP1604. both are 28 pinners. It also appears to have the same resistor networks too.

I found TMS1024's on ebay so we might want to get one of those decapped if we can't find a data sheet. I didn't have much luck when I poked around google. Apparently the '1024 is an "IO expander" which would make sense for a TMS11xx which has really crappy IO out of the box.

The 1024 should be fairly to RE too I guess since it'd be trivial to hook it up to my logic analyzer to probe how it functions. If it's an IO expander it should be extremely easy to figure out.

rik: sent back your games today
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 07:01 AM

What's the full numbers on the chips for CFA3000? I have various 'Twinvader' games, if any of them are the same I won't need to send them to you... smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 09:24 AM

it's TMS1024 and MP1604
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 09:46 AM

"This has the exact same chip set that the Tsukada games have", but Tsukuda Pachinko is a 40-pin MCU, can't be the same as Cosmic Fire Away 3000.

Unrelated, this has been nagging me :P Anyone know what chips are in Milton Bradley Dream Phone?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 11:50 AM

I'd guess just a tsp50c10, given when it came out, and how it works.

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 12:22 PM

I'd assume ADPCM for the sound.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 01:53 PM

Reasons for my guess: LPC12/D6 speech (which the TSP50c1x/0x series does) takes up very little rom space, so it can hold quite a lot of it in internal rom. Given the simplicity of the phone device, the TSP50C1x/0x can also do all the button reading etc that is necessary for operation.

Also, MB used (at least) two TSP50C10 series mcus around 1989-1991: One in "Electronic Talking Battleship", and another in "Omega Virus".

Omega Virus, btw, seems to be the spiritual successor to "Dark Tower", the game is played very very similarly.

EDIT: as for the number of words the tsp50c10 contains, here's I think all the words from electronic talking battleship:
"Prepare for battle!"
"select"
"game"
"players"
"skill"
"one"
"two"
"three"
"four"
"task force"
"armed"
"man your battlestations!"
"enter"
"letter"
"number"
"fire"
"direction"
"patrol boat"
"submarine"
"destroyer"
"battleship"
"carrier"
"hit"
"sunk"
(the below sounds are not speech and some may be synthesized by code banging data directly to the tsp50cxx internal DAC)
<6 notes of "anchors aweigh"> (powerup/reset sound)
<beep> (button press, or 'fake' button press by the AI)
<3 siren whoops> (immediately before start of game, after setup)
<sound of missile firing/arcing> (upon player or AI firing; there is some noticeable aliasing in this sample)
<crash/explosion> (hit a ship; this seems to be a PCM sample?)
<6 notes of "taps"> (game over, or auto-power-off timer is about to expire)

LN
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 05:28 PM

Phrases from Omega Virus (from watching several youtube videos, I don't own this):
"zero"
"one"
"two"
"red"
"green"
"yellow"
"blue"
"access card"
"probe"
"disruptor"
"decoder"
"negatron"
"destroyed"
"energize"
"shields"
"code"
"teleported to"
"docking bay"
"found"
"security breach!"
"access denied"
"terminated"
"is attacking"
"take your best shot"
"which room?"
"steals"
"a"
"sector"
"shut down"
<monotone>"enter"
<monotone>"skill"
<monotone>"room"
<monotone>"code"
<monotone>"red"
<monotone>"green"
<monotone>"yellow"
<monotone>"blue"
<monotone>"help me"
<monotone>"do something!"
<monotone>"secret code"
<monotone>"probe"
<monotone>"hurry!"
<monotone>"we are running out of time!"
"-five"
"thirty"
"twenty"
"fifteen"
"ten"
?"five"
"minutes"
"you"
"fool!"
"I"
"missed"
"wrong!"
"human scum!"
"found me!"
"win!"
"I am terminated"
<mocking>"'help me!'"
"heh, hehahahahahaha!"
"until I take over!"
"try and stop me!"
"hee hee heehee!"
"must be"
"too late! this station is mine! I win!"
<radio blip> (this is made using a deliberately scrambled lpc sample, cute!)
<scrambled glitch noise> (another glitch lpc sample)
<beep> (button press)
<klaxon buzz x3 fast>
<klaxon buzz x3 slow>
<high siren x3>
<sound of shield energizing, fast upward sweep>
<sound of laser firing, upward sweep>
<wavering low noise/warble> (when being teleported)
<crash/explosion, identical to talking battleship>

Omega Virus was apparently created by Michael Gray, along with dream phone and mall madness

Omega Virus is also interesting in that it varies both the LPC Rate (for speeding up and slowing down samples without changing pitch) as well as MAYBE altering pitch during speech (for the monotone samples, unless they were separately encoded?)
The tsp50cxx does allow this, IIRC.
Given the large number of speech samples, I suspect Omega Virus has 2 or 4 times as much rom as Electronic Talking Battleship does, on its tsp50cxx.
Either that or it uses a tsp60cxx VSM rom for some of the speech!

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 09:36 PM

Originally Posted By hap
"This has the exact same chip set that the Tsukada games have", but Tsukuda Pachinko is a 40-pin MCU, can't be the same as Cosmic Fire Away 3000.

Unrelated, this has been nagging me :P Anyone know what chips are in Milton Bradley Dream Phone?


Yes, but it's a TMS1xxx and a TMS1024, so I'm saying they are pretty much the same :-)
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 09:38 PM

Originally Posted By kevtris
it's TMS1024 and MP1604

No die codes or anything?


Here's some more interesting ones...
Bandai Space Chaser (LED game)
http://www.handheldmuseum.com/Z_Imgs/MESS/Bandai-SpaceChaser_CPU.jpg
Hitachi HD3813 7B

Bandai Zaxxon LCD (2-layer LCD game)
http://www.handheldmuseum.com/Z_Imgs/MESS/Bandai-ZaxxonLCD_CPU.jpg
Chip says ZG16883 with some Japanese above it...
Other side of the board:
http://www.handheldmuseum.com/Z_Imgs/MESS/Bandai-ZaxxonLCD_MB.jpg

Mattel Look Alive Football:
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel-LookAliveFootball_CPU.jpg
Chip apparently applied directly to the circuit board. Not sure how easy that will be to dump, but at least it will be easy to see visually by popping off the plastic cover (which I didn't do, but not opposed to...)
Saw the 'Copyright Mattel 1998' on the board and thought What the hell? Then realized '1998' is the part number for this game... smile

And the Unknown Grab-Man game: (probably made by Matsushima)
http://www.handheldmuseum.com/Z_Imgs/MESS/Unknown-GrabMan_CPU.jpg
No markings on the chip... That's this game here:
http://www.handheldmuseum.com/Unknown/GrabMan.htm
Same display layout as Tomy Pac-Man in a small LCD handheld (game play is a little different though).

I also have a Mattel Football (the original) that has little round blips instead of the dashes most of them have. Never seen that variation since, but comparing it to a dash version I found this on the chips:
Dash version:
B6100EA
7748
Dot version:
B6100-15
8021
All the boards (including the LED board) had the same revision numbers, but the games appear to be roughly 3 years apart in age. Not sure if there would have been changes to the chip or not though.

Also compared a Bandai Missile Attack to a Battlestar Galactica, and they were identical. So that was definitely just a name change.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 09:56 PM

Originally Posted By Rik
Mattel Look Alive Football:
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel-LookAliveFootball_CPU.jpg
Chip apparently applied directly to the circuit board. Not sure how easy that will be to dump, but at least it will be easy to see visually by popping off the plastic cover (which I didn't do, but not opposed to...)
Saw the 'Copyright Mattel 1998' on the board and thought What the hell? Then realized '1998' is the part number for this game... smile

I also have a Mattel Football (the original) that has little round blips instead of the dashes most of them have. Never seen that variation since, but comparing it to a dash version I found this on the chips:
Dash version:
B6100EA
7748
Dot version:
B6100-15
8021
All the boards (including the LED board) had the same revision numbers, but the games appear to be roughly 3 years apart in age. Not sure if there would have been changes to the chip or not though.

Also compared a Bandai Missile Attack to a Battlestar Galactica, and they were identical. So that was definitely just a name change.

Funtronics Jacks and Mattel Basketball both have the dies glued directly to the PCB also. Jacks has a COP421, and I was able to photograph the die with no damage to the game, but you have to be extremely careful not to touch the bond wires. I also tracked down the traces on the PCB and dumped it electronically.

Basketball actually has 3 chip dies on the PCB. I haven't looked too closely at it yet.

I've heard about the round blips vs dashes, but I don't think the chips would be different. I've decapped one Football and I have another; I'll check the markings. It might just be that they standardized on the -nn style labeling.

I didn't realize that there was a clone of BSG.

I got a Unisonic 21 blackjack/calculator (AKA Jimmy the Greek model D3). As I was hoping, it has a Rockwell chip, so I think it contains the code in patent 4339134. The top of that code has a line that reads NAME A48(8), and the chips is labeled A4821CA. I've also got a Rockwell 63R calculator with a chip labeled A4802CA, so I'll compare the dies. I'm guessing they removed the advanced calculator features and replaced them with the blackjack code.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 10:12 PM

Originally Posted By seanriddle
Funtronics Jacks and Mattel Basketball both have the dies glued directly to the PCB also. Jacks has a COP421, and I was able to photograph the die with no damage to the game, but you have to be extremely careful not to touch the bond wires. I also tracked down the traces on the PCB and dumped it electronically.


Yeah, Funtronics Tag must be the same way, there's a piece of plastic protecting the LEDs, so the chip must be under that... I can send you Tag and Red Light/Green Light if you want to look into those. The forth 'game' (Hot Wheels Drag Race) is the same as Red Light. So we can get the entire 'Funtronics' line checked off...

Originally Posted By seanriddle
Basketball actually has 3 chip dies on the PCB. I haven't looked too closely at it yet.

I've heard about the round blips vs dashes, but I don't think the chips would be different. I've decapped one Football and I have another; I'll check the markings. It might just be that they standardized on the -nn style labeling.


Hmm, I'm going to have to look at a Basketball now... smile What other Mattel games have not been looked into? I have them all so I can check them out for you.

I didn't think Football would be different just because of the LEDs, but was surprised to find them so many years apart. I figured they would have stopped making Football when Football 2 came out...

Originally Posted By seanriddle
I didn't realize that there was a clone of BSG.

Actually, it's the other way around. Mattel Missile Attack was one of the first games Mattel ever made (3rd game, after Auto Race and Football). Story has it that some companies (NBC, not wanting to air the commercials) didn't like the idea that if you lost the game, New York basically got nuked... smile (This was the 70's remember) So they licensed Battlestar Galactica and made it a space game instead. Later the BSG license ended, and it was sold just as 'Space Alert'

Originally Posted By seanriddle
I got a Unisonic 21 blackjack/calculator (AKA Jimmy the Greek model D3).


I just found mine over the weekend, D2 model I think, top picture here:
http://www.handheldmuseum.com/Misc/UnisonicJtG.htm
I also have one of the little calculator versions... Didn't get into yet though.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/05/15 11:10 PM

Oh, my bad, I see I wrote Bandai Missile Attack originally. smile Meant Mattel Missile Attack, the first version. Just confirming nothing was changed internally with the name change. Hehe...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 12:00 AM

Ah- got it. I was confused about that.

I've got a Red Light Green Light coming. It would be nice to dump Tag and have them all. If I can't find a cheap one, you could send it to me or Kevin to dump.

I've looked at Armor Battle, Auto Race, Baseball, Basketball, BSG, Brain Baffler, Football, Football 2, and Sub Chase.

I assume the 3 Blackjacks have the same chip, but I've only looked at the D3. You may not be able to get into the handheld one easily- I had to bend the Radio Shack blackjack calculator's case to get it open.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 05:25 AM

http://www.ebay.com/itm/VINTAGE-1978-SCRABBLE-SENSOR-ELECTRONIC-WORD-GAME-IN-BOX/121524520482

... Well, that's a new one to me. Never heard of that at all. Guessing tms1000 based but god knows.

The game looks fantastically boring, it is basically 2 player mastermind, with the computer managing the 7 letter word the master player entered, and reporting whether the guessing player's letter and position are correct or just letter and not position.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 06:42 AM

Sensor is one of the Rockwell chips that I sent to Kevin to try to dump before I decap it.

It looks like Lexor is more interesting; when I find a cheap enough one I'll pick one up.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 09:25 AM

Originally Posted By Lord Nightmare
http://www.ebay.com/itm/VINTAGE-1978-SCRABBLE-SENSOR-ELECTRONIC-WORD-GAME-IN-BOX/121524520482

... Well, that's a new one to me. Never heard of that at all. Guessing tms1000 based but god knows.

That's made by Selchow & Righter, same ones that made this:
http://www.handheldmuseum.com/Misc/SelchowReadersDigest.htm

I think I still have a Readers Digest, I'll see if I can find it...
That also reminds me of Monty Plays Scrabble:
http://www.handheldmuseum.com/Misc/RitamMontyPlaysScrabble.htm
Don't think that's in MESS... It's actually Z80 based with normal PROM/EPROMS. I've dumped the ROMs (links on my page), I can send one to someone if they need the harsware to emulate it...
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 09:54 AM

I would, but my plate is full =(

Could you post high res photos of the pcbs(front & back) making the labels readable?
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 11:32 AM

No worries, don't think anyone is in a hurry to play it... smile

Here's the original pics:
http://www.handheldmuseum.com/Z_Imgs/MESS/Ritam-MontyCirc.jpg
http://www.handheldmuseum.com/Z_Imgs/MESS/Ritam-MontyCircBack.jpg

And there's also a Master Monty Plays Scrabble:
http://www.handheldmuseum.com/Misc/RitamMasterMontyPlaysScrabbleBlue.htm
That appears to have been made possible by hand-modifying the original circuit boards... More complex Scrabble logic, and larger built-in memory.
Board close-ups:
http://www.handheldmuseum.com/Z_Imgs/MESS/Ritam-MasterMontyBlueCirc.jpg
http://www.handheldmuseum.com/Z_Imgs/MESS/Ritam-MasterMontyBlueCircBack.jpg
The extra logic chip is actually just glued, upside-down, to the circuit board... I'd have to pop that off to see what it is...
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 01:38 PM

A normal Z80 with ROMs sounds like something many people here could pick up if they're sufficiently bored smile
Posted By: drewcifer

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 01:58 PM

Yeah, even I'm tempted. Its LCD controller, the SED1503, isn't in MAME exactly, but a newer model is (the SED1520 src/emu/video/sed1520.c).

Docs for the SED1503, used on this board, are here:
http://lcdhype.condense.de/index.php?showtopic=2382

/Andrew
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 09:38 PM

Originally Posted By seanriddle
I assume the 3 Blackjacks have the same chip, but I've only looked at the D3. You may not be able to get into the handheld one easily- I had to bend the Radio Shack blackjack calculator's case to get it open.


Found my D-2... This thing is very well made, metal screw thread (instead of just screwing into plastic), well made buttons like ones from an old calculator (which it doubles as)... This thing was meant to be _used_...

The chip in mine is Rockwell, labelled: A4821CA (date code 7721).
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 09:46 PM

I got melody madness today. It contains a PIC1655A-094 which I already dumped and checked. code looks OK. Need to trace out the PCB yet. The HW is very similar to le boom.
Posted By: Tafoid

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 09:56 PM

Originally Posted By kevtris
I got melody madness today. It contains a PIC1655A-094 which I already dumped and checked. code looks OK. Need to trace out the PCB yet. The HW is very similar to le boom.


/me does happy dance!!! Thanks for that smile

Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/06/15 10:35 PM

Bowzer approves! smile
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/07/15 06:29 AM

More stuff...
Mattel Hockey and Soccer have the 3 chips on the circuit board like Basketball...

Mattel Competition Football (small LCD game) :
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel-CompetitionFootball_MB.jpg
Toshiba T6819S
Whole game seems to be licensed from Toshiba

Mattel Long Bomb Football (slightly larger LCD game) :
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel-LongBombFootball_MB.jpg
Toshiba T6840S (I'm assuming Toshiba...)

Mattel Mind Boggler (VFD puzzle solving game) :
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel-MindBoggler_MB.jpg
Rockwell MM75 A7505-12

Mattel Computer Gin:
http://www.handheldmuseum.com/Z_Imgs/MESS/Mattel-ComputerGin_MB.jpg
NEC 650C 060
With Hughes HLCD 0530 driver chip

A random one I found:
Fonas Baseball
http://www.handheldmuseum.com/Misc/FonasBB.htm
Motherboard:
http://www.handheldmuseum.com/Z_Imgs/MESS/Fonas-Baseball_CPU.jpg
TI TMS1000NL 3232

And just for reference:
Actronics Challenge Racer (VFD game)- HD38750-A58
There's two Twinvader games listed here:
http://www.handheldmuseum.com/Actronics/Twinvader.htm
And they are also sold as Twinvader III (and say that on the back usually), but the large and small versions seem to have different chips.
Twinvader (large white one)- HD38800-A51
Twinvader (smaller brown one)- HD38750-A56

Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/07/15 06:37 PM

Originally Posted By hap
Unrelated, this has been nagging me :P Anyone know what chips are in Milton Bradley Dream Phone?
Originally Posted By Lord Nightmare
I'd guess just a tsp50c10, given when it came out, and how it works.

LN

I think that's it- the 1991 version has a 16-pin DIP labeled
5507 JKT
DREAM PHONE2
CSM11120AN

The 1989 Electronic talking Battleship TSP50C10 was labeled
85AX02T
B-SHIP 1998
CSM10287AN

And Dream Phone has the same 4-transistor amplifier as in the data sheet.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 12:20 AM

Ah, you purchased one?
I believe Lord Nightmare is interested getting this chip emulated.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 01:31 AM

Yeah, someone in the city had just the phone for sale, and it got here really fast.

The "Design Manual" says there is test code at the top of memory, but doesn't go into detail. Maybe some combination of inputs during reset jumps there? There is a bunch of info on how to program/verify the OTP version; maybe some piece of that can also be used on the ROM version?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 04:02 AM

So far we know of the following tsp50cxx chips:
1. Keynote speech synthesizer module that Kevtris has ("2472JXT // CSM10075AN")
2. MB Electronic Talking Battleship(1989) ("2234673 // BATTLESHIP // CSM10017AN")
3. MB Electronic Talking Battleship(1998?) ("85AX02T // B-SHIP 1998 // CSM10287AN")
4. MB Dream Phone(1991) ("5507 JKT // DREAM PHONE2 // CSM11120AN")
5. Echo II Speech Synthesizer Card for Apple2 (1989) ("ECHO-2 SEC // LU 9020 // 25954 PHILIPPINES") [note this uses a different, earlier tsp50c01 or 02 or other part with a slightly different pinout to tsp50c10]
6. MB Omega Virus(1992) ("3253ACT // OMEGA VIRUS // CSM11161AN")
7. Mystery Vtech unit from Dumping Union ("84C91HT // VIDEO TECH // CSM10150AN")
we suspect that MB Mall Madness also uses a tsp50cxx but don't have the chip label yet.
Also from Boardgamegeek forums we know a German voice version of Omega Virus exists as well.

I believe the number even tells you what type of tsp50cxx it is, its the first 2 digits after CSM, next 3 digits are die number, letter is die rev and N means plastic
so CSM11120AN = TSP50C11A die # 120, plastic package

Let's try to figure out that test mode, it should be possible to dump these things without any decap at all.

LN
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 04:06 AM

I picked up just the voice unit from an omega virus board off ebay, so we will have one of those to play with.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 08:53 AM

Cool. I bet it has more interesting phrases than Dream Phone! Although Dream Phone could probably be hacked into a phreaking tool smile I need to read the instructions- so far all I get is "Sorry, wrong number. Dial again."

I picked up another Battleship, too. It's the same as the other one; the box, the bottom of the board and the code book all say copyright 1989. But the first PCB has a date code of 8105 and the 2nd has 8223??? The top line of the new chip is different; instead of 85AX02T, this one has 88AR7HT.

The resonator on Battleship is 8MHz; the one on Dream Phone is 9.6MHz

I finally used a frequency counter on the 2 different Microvision Pinball carts; the one with the E rev chip runs 6.7% faster on the 3 pins that I measured than the B rev.

I cleaned the Plus One die again and was setting it up under the microscope when it disappeared. I've "tiddly-winked" other dies before, but I've always found them eventually. This one's so tiny, I didn't even hear it hit wherever it landed. I used a bright LED flashlight to try to see it glint, but never found it. Hopefully I've got enough pics of the ROM to figure out all the bits.

I dumped the COP410L in Red Light Green Light visually; I'll trace the wiring and dump it electronically, too.

I haven't had any luck dumping the COP421 in Einstein. All the other COP chips I've dumped are "L" versions- 444L, 421L and 410L, so maybe that's part of the issue. What's odd is that I can't even see the keyboard matrix scan with a frequency counter or oscilloscope. I know it's working because I can play, so I should see it strobe the rows.

I picked up an Entex Basketball 2.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 01:46 PM

Originally Posted By Lord Nightmare
Also from Boardgamegeek forums we know a German voice version of Omega Virus exists as well.
There's also a Spanish version: http://www.segundamano.es/toledo/virus-omega-de-mb/a65452532/

EDIT: And of Dream Phone, too: https://www.youtube.com/watch?v=nAcaOZKl-Jo

We also got localizations of most if not all the Battleship editions, in Spain.

As "Hundir la flota":
http://blog.kelkoo.es/tendencias/la-historia-de-hundir-la-flota-2012-04
https://beatrizromo.wordpress.com/2012/07/16/juegos-para-ensenar-espanol/

Or as "Batalla Naval":
http://www.cinemania.co.cr/content/pages/Concurso-Juego-de-Mesa-de-Batalla-Naval.html
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/08/15 08:59 PM

Originally Posted By seanriddle
I cleaned the Plus One die again and was setting it up under the microscope when it disappeared. I've "tiddly-winked" other dies before, but I've always found them eventually.


Oh man, this had me laughing so hard... Using 'tiddly-wink' as a verb just caught me completely off guard. smile smile

BTW, what model and power is your microscope?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/09/15 07:56 AM

I can smile now, but I wasn't very happy last night at 2AM crawling around the floor of my basement looking for it!

I bought one of the cheapest trinocular metallurgical microscopes that I could find, an Omano OMM200 from microscope.com. It came with 10x and 16x eyepieces and 4x, 10x, 40x and 63x objectives. I swapped out the 63x with a more useful 20x. I generally use the 10x for full die shots and sometimes the 20x for a close up of the ROM array. I also bought a camera adapter, but I've since switched to using a 50mm lens digiscoping the 10x eyepiece. I 3d-printed a threaded cone to hold the camera in alignment with the eyepiece.

I built a simple XY table using a couple of linear slides and 2 linear actuator stepper motors. I put another stepper motor on the focus knob, but I recently added a kinematic mount to level the die manually. That helps with focus, since the die is parallel with the film plane.

The latest die I'm working on, from Entex Color Football,is a TMS1400 that measures 5.85mm x 4.82mm. I shot 208 pics of the full die (16x13) using the 10x objective, which resulted in a 19700x16200 pixel image, about 3.4 pixels per micron. To make it easier to work with, I scaled it down about 2.5 times.

I still haven't had luck running any automated panorama scripts, so I manually align the pics using a program I wrote, then use Microsoft ICE to create the composite, which I clean up in GIMP. I've got another program that reads the ROM array to a binary file, then I manually verify the bits by drawing them over a picture of the ROM array.

Blowtorch to ROM file is a couple of hours per chip at best.
Posted By: midget35

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/09/15 04:08 PM

Apologies - I haven't had time to read through all of this thread, but I may have some useful stuff. Haze pointed me in this direction via his blog. I have almost all of the round corner Tiger LCD games (over 100 unique games). I would be happy for you guys to try to preserve them in MESS. Is this possible?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/10/15 06:41 PM

TSP50c1x MB games test modes found so far (All games programmed by Michael Gray, I believe; I need to verify what games he programmed at some point, he has an account on BoardGameGeek):
The test modes are all accesed by holding down a key and pressing the 'on' button:

Electronic Talking Battleship(1989):
Key Test:
Hold the Player 1 A1 key (or Player 2 J10 key which maps to same matrix position), then press the green 'On' button to enter key test mode.
When in key test mode, you are expected to press player 1 keys A1, B2, C3, D4, E5, F6, G7, H8, I9, J10 in that order, the system will beep after each key is pressed. Then press Player 1 Fire, the system will say 'two'. Now press Player 2 A1, B2, C3, D4, E5, F6, G7, H8, I9, J10 in that order, the system will beep after each key is tested. Finally, press Player 2 Fire, the game will say 'Battleship' and play the explosion sound while flashing the ship explosion LED, then turn off.

Sound Test:
Hold the Player 1 B2 key (or Player 2 I9 key which maps to same matrix position), then press the green 'On' button to enter sound test mode.
The game will play the beep, all of the speech samples, the firing arc and music jingles in order, followed by the explosion sound and the flashing ship explosion LED, and then turn off.


Omega Virus(1992):
Key test:
Hold the '0' key, then press the 'On' button to enter key test mode.
The game will say 'zero', 'one', 'two' when pressing the 3 number keys, and will say <monotone>'we are running out of time' when pressing the 'Repeat' key, and then turn off.

Sound test:
Hold the '1' key, the press the 'On' button to enter sound test mode.
The game will play the explosion sound followed by all of the speech sounds and sound effects, followed by the glitch samples, and then turn off.


I am assuming the international (german, spanish, italian, french, etc) versions of these games have the same test modes. (I also assume the test modes are the same on the 1998 ?re-release? of electronic talking battleship. It is quite unclear what changed between the 1989 and 1998 releases, but they use different mask tsp50cxx chips, so there must be some changes. Would be worth checking if the C3 key plus 'On' activates some new test mode that didn't exist in the older MCU)


Given the way these test modes work, I suspect dream phone and other games of this era probably have a similar set of tests if you hold the '0' or '1' keys on the phone or other entry pads while turning on the game.


Also note Omega Virus has a hidden game mode: After you press 'On', and the game asks you to enter skill, press 'repeat' 3 times and the virus will laugh once then taunt the players. This enables an extra difficult mode where the virus will start to move between rooms once any player gathers all 3 of the items needed to kill it! This makes the endgame MUCH harder!


P.S. If anyone has one of the international versions of these games, please open them up and send a picture or text of what is written on the tsp50cxx 16-pin mcu! The CSMxxxxx number will be different from the english ones. I'm curious if there is a British/UK voice version of some of these games as well.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 01:44 AM

Originally Posted By midget35
Apologies - I haven't had time to read through all of this thread, but I may have some useful stuff. Haze pointed me in this direction via his blog. I have almost all of the round corner Tiger LCD games (over 100 unique games). I would be happy for you guys to try to preserve them in MESS. Is this possible?

I don't think it is likely that the ROMs can be dumped non-destructively, but I could be wrong. These games generally have the chip bonded directly to the PCB and then globbed with epoxy. I've only looked at some RZone games and a few Konami games, so I'm not sure what chip the Tiger games use. Could you list a few titles? I can do some research.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 01:48 AM

LN- OK, I'll bite- how did you figure out the test sequences? I'll try a few things on Dream Phone and see what happens, and I'll try your Battleship sequence on mine.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 02:05 AM

Sean: Random button mashing!
Actually I figured it out by accident, since I read that Michael Gray had a secret mode in omega virus (which I later read the exact sequence to activate elsewhere) I wondered if there was some sort of hidden secret game in battleship if you held down a pair of buttons; so I held down both a1 and b2 when powering on the game, and it activated the key test mode (which is very weird behavior compared to the way the game normally starts). Immediately I tried holding just b2, and got the sound test, then just a1 and got the key test again (so the game must read the keys starting from a1 toward j10 in sequence; this turns out to be true for omega virus as well).

Omega Virus arrived yesterday and I wondered if it had similar tests, and sure enough first try holding 0 down did the key test, and second try holding 1 down did the sound test.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 04:59 AM

I think Dream Phone really likes me:

push On+1
"ring"
push 1 2 3 4 5 6 7 8 9 * 0 #
"You're right; I really like you."

On+2
<guy's voice>
Hello.
Hello.
Hello.
Hell-o.
I just told you.
One more time.
You again!
What... weren't you listening?
I know where he hangs out.
He likes most sports.
He'll eat almost anything.
He looks cool in whatever he wears.
I know who it is, but I'm not telling. HA HA
Sorry, wrong number. Dial again.
Nice try, but it's not me.
You're right; I really like you.
<girl's voice>
Hi! I just heard
it's not
George
Tyler
Gary
Steve
Tony
Bob
<back to guy's voice>
Hello.
He's not
I'm not
except
He's not wearing
the mall
the snack shop
the movies
the park
the beach
the gym
baseball
volleyball
basketball
tennis
surfing
skateboarding
pizza
ice cream
popcorn
hot dogs
candy
cookies
bluejeans
a jacket
glasses
a tie
a hat
anything yellow

I also verified that the DTMF is accurate- I held Dream Phone up to my landline and dialed the local time and temperature number, and it went through. The "Design Manual" has sample DTMF code.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 05:05 AM

And my Battleship seems to act the same as yours. Same results for On+A1, and On+B2 says:
Prepare for battle!
Select Game.
Select Skill.
Select Players.
1
2
3
4
task force
enter
patrol boat
destroyer
submarine
battleship
carrier
letter
number
direction
fire
armed
Man your battlestations!
hit
sunk
<anchors away>
<whoop>
<whistle>
<explosion/LED flash>
<taps>
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 05:08 AM

Originally Posted By seanriddle
Originally Posted By midget35
Apologies - I haven't had time to read through all of this thread, but I may have some useful stuff. Haze pointed me in this direction via his blog. I have almost all of the round corner Tiger LCD games (over 100 unique games). I would be happy for you guys to try to preserve them in MESS. Is this possible?

I don't think it is likely that the ROMs can be dumped non-destructively, but I could be wrong. These games generally have the chip bonded directly to the PCB and then globbed with epoxy. I've only looked at some RZone games and a few Konami games, so I'm not sure what chip the Tiger games use. Could you list a few titles? I can do some research.

I actually had 4 Tiger LCD games here that were part of a bulk buy: X-Men Project X, Space Jam, Sonic and Batman the Animated Series. They are all very similar inside. The globs have 50-60 traces coming from them, depending on the game. I'll try to de-glob one and see what it is. It's likely that different games have different chips.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 06:13 AM

Found another chip (or two) that I'm not sure has been mentioned.

These are in Kingsford's Match Me game
http://www.handheldmuseum.com/Misc/KingsfordMatchMe.htm

Sort of like Simon with twice the buttons.
It has a General Instruments chip, labeled 8018 (with a 123 above it). There's a Mini Match-Me, and it has a GI 8002 (also with the 123). I can get some pics up later, just curious if these chips were familiar or not...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 06:52 AM

Since those could be date codes, maybe they are PICs with ROM ID 123? Kevin has dumped 1650s and 1655s with IDs 036, 192 and 255. How many pins?
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 08:34 AM

Originally Posted By seanriddle
Since those could be date codes, maybe they are PICs with ROM ID 123? Kevin has dumped 1650s and 1655s with IDs 036, 192 and 255. How many pins?


Hah, didn't even think of date codes... smile I'm just used to a little more writing on these things.

It's a 'normal' sized 28-pin chip.
Posted By: midget35

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/11/15 04:09 PM

There are something like 103 'round corner' Tiger games. I think I'm missing about 5. If you want a full list, by all means PM me. I would like to preserve these games in MESS, even if there is a small chance they won't work afterwards. Sample games:

* Addams Family, the
* After Burner
* Altered Beast
* American Gladiators
* Back to the Future [aka Ritorno al futuro?]
* Baseball Super Stars
* Basketball, Magic Johnson's
* Batman
* Batman Forever
* Batman Returns [aka Batman Il Ritorno]
* Battletoads
* Captain Planet
* Castlevania II: Simon's Quest
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/12/15 10:56 PM

I torched the epoxy glob on the Tiger X-Men LCD game but didn't have great results. I'll try to put it in some acid in the next couple of days. I can see the perimeter of the die, and it looks to be the same chip used in the RZone game Indy 500. I think that's one of the Sharp SM5 MCUs.

I also got Sears Auto Race, and it doesn't use the same Rockwell chip as in Mattel Auto Race; the Sears game has a glob with 28 traces coming out. I'll see if I can get it cleaned up and figure out what it is.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/13/15 10:53 AM

Next batch of games on their way to Kevin... (Should arrive Thursday...)
Been too quiet around here... smile

Bandai Burgertime (VFD) (HD38820A65)
Bandai Pair Match (HD38820A88 & A89) (Two processor chips in this one)
Bandai Pengo (VFD) (HD38820A63)
Bandai Ultraman
Bandai Zaxxon (VFD)
Gakken Amidar
Gakken Jungler

Tried to pick a batch of interesting, and rare, games... Not a lot of people have played the handheld version of most of these, but they are definitely cool (Burgertime, Pengo, Jungler... smile )

Rik
Posted By: midget35

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/13/15 12:17 PM

I just think you guys are doing a fantastic job. Obviously - I am willing and able to make a huge contribution here as and when you feel ready to dump the games in my collection. Please keep in touch, and I will keep checking back.

Good luck guys.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/13/15 12:18 PM

Didn't know there *was* a handheld Burgertime. Nice!
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/13/15 01:47 PM

Originally Posted By Rik
Next batch of games on their way to Kevin... (Should arrive Thursday...)
Been too quiet around here... smile


Great =)

I've been working on Tamagotchi(the very 1st). It's taking me longer than I expected.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/14/15 02:08 AM

Actually, that's really cool too... I think I saw the skeleton driver show up in the source and it reminded me that I still have one of those somewhere. That'll be fun to play with again. smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 01:18 AM

I got the new batch of games today. On first impressions, there's some weird stuff in here.

Amidar uses an M81503-702SP which is similar to the chip on frogger, but is in a shrink dip package- a 56 pin sdip. This is an odd package size. I'm sure it probably dumps the same way so I most likely can extract it's programming goodness.

The other issue with this game is the VFD has the white "grid" pattern of amidar printed onto the filter. This is going to make vectoring it difficult because the lines obscure the VFD glyphs head-on.

Jungler has the same chip frogger does, an M58846-702P. (frogger's 701P and I think 700P). Again I can dump this so no big deal.

Bandai pair match has TWO HD38820's in it. One runs the game/VFD and the other does nothing except make sounds. Almost all of its IOs are NC. There's a 4 bit bus and 2 or so control signals between the two.

Bandai zaxxon has a mirror above the VFD so that the two halves of the VFD are "overlapping" each other for a 3D effect. Half the VFD glyphs are reversed because of the mirror.


Bandai ultraman has a very difficult to vector VFD, I might have to let that one go, at least for now (or someone else is welcome to do it :-)

Other than that, should be easy work. I got the two select a game carts apart without damage to the labels except for a tiny bit that shouldn't be very visible once it's back together.


Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 03:32 AM

Originally Posted By kevtris
I got the new batch of games today. On first impressions, there's some weird stuff in here.

Amidar uses an M81503-702SP which is similar to the chip on frogger, but is in a shrink dip package- a 56 pin sdip. This is an odd package size. I'm sure it probably dumps the same way so I most likely can extract it's programming goodness.

The other issue with this game is the VFD has the white "grid" pattern of amidar printed onto the filter. This is going to make vectoring it difficult because the lines obscure the VFD glyphs head-on.


I didn't even open Amidar or Jungler, but surprised they used different chips than Dig Dug...
What is the grid printed on? Directly on the glass, or on the color overlay? If it can be peeled off, you can go ahead and do that...

Originally Posted By kevtris
Bandai pair match has TWO HD38820's in it. One runs the game/VFD and the other does nothing except make sounds. Almost all of its IOs are NC. There's a 4 bit bus and 2 or so control signals between the two.


Yeah, that one surprised me when I opened it... But hey, at least the VFD is REALLY easy to vector. smile

Originally Posted By kevtris
Bandai zaxxon has a mirror above the VFD so that the two halves of the VFD are "overlapping" each other for a 3D effect. Half the VFD glyphs are reversed because of the mirror.


Yeah, that's done to create the illusion of 3D, half the glyphs are overlayed on the other half. Maybe for emulation that will have to be treated as two VFDs on top of each other?

Coleco Zaxxon is similar, but it really does have two VFDs. Using a mirror, your ship (all on one VFD) is super-imposed on everything else. These might be interesting to emulate... Not sure if that makes it harder, or just 'different'.

Originally Posted By kevtris
Bandai ultraman has a very difficult to vector VFD, I might have to let that one go, at least for now (or someone else is welcome to do it :-)


Haha, I warned you about that one! There's one more in that series too which is probably just as annoying... We can at least get it dumped, photographed and emulated... Figure out the graphics later, there's plenty more in the mean time.

I'll send some 'less interesting' ones next time around. smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 03:41 AM

I got Mattel Sub Chase and Tomytronics Break Up. Sub Chase uses the same chip that was in Mattel Armor Battle that I sent to Kevin.

Break Up has a 28 SDIP labeled MP2726 and a TMS1025 40 SDIP. I decapped the MP2726 and the die is marked 1040B. That makes it the first TMS1040 I've seen. The only info I've found is on Datamath.org. The only pinout I have of the TMS1025 is on the one-page "Texas Instruments Microprocessor and Memory Products TMS 1000 Family Pinouts" sheet, but they swapped the pinouts for it and the TMS1200.

I also de-globbed Sears Auto Race. It looks like instead of an MCU that it has a custom VLSI, like Simon.

I'll put together some pictures.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 05:17 AM

Dumped most of the micros from this lot; having trouble with the HD38820A88/89 though; the data is coming out off by 1 somewhat randomly; guessing I am not clocking it fast enough or too fast, so I might have to dork with it.

Both amadar and jungler have the konami logo on the CPU, and the konami name/logo is on the PCB also; both use an itron VFD like on coleco frogger, too. Fairly interesting.

I wonder if konami designed these for coleco, but then coleco stopped selling them so they got CGL/gakken to distribute/make them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 01:21 PM

Mattel Auto Race should have a Rockwell MCU, is the Sears one a newer release?

Yeah, TMS1025 is an I/O expander like the 1024. Did you trace it to understand how the chip works? If not, I'm sure we can find out with trial & error. A pinout would be awesome though: which pin goes to which LED, which TMS1040 pin goes to which TMS1025, etc.

TMS1040: can you see differences on the die when compared to the standard TMS1000?

kevtris: with more of those Konami (Mitsubishi, was it?) MCU dumps now, I'm confident enough to start a new mcu emu core =) - the more 'test cases' the better
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 05:32 PM

Mattel Auto Race has a Rockwell B6000, which looks like the same B6001 that's in Battlestar Galactica, except for the ROM. There are no identifying marks on the Sears die except RMR-0012. So I'm not sure if this is a licensed Mattel cost-reduced game or if it's a knockoff.

I will trace the pinout of Break Up and post it with the other info.

I haven't composited the TMS1040 pics yet, but visually it looked similar enough to a TMS1000- ROM, RAM and PLAs in the same places. Datamath's comparison table shows all the same info as for the 1070.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 08:54 PM

Which Sears Auto Race do you have? (There's two, one where the track is horizontal, and the other one has a vertical track like Mattel)
http://www.handheldmuseum.com/Sears/AutoRace.htm

I don't think Sears ever licensed from Mattel. I know the horizontal one is a licensed game from Tiger (Tiger Raceway, their clone of Mattel's game).

The vertical one appears to be licensed from Dynamic Toys (I think they are the maker)-
http://www.handheldmuseum.com/Misc/DynamicToysDynamicRace.htm

There's a couple knock-off versions of the vertical format that got licensed all over the world it seems...

I have both of the Sears games, if I can find them I'll take a peek inside and see if they are the same chips or not.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/15/15 09:57 PM

I have the vertical one that looks like Dynamic Race. The PCB has a logo that looks like TCL : www.seanriddle.com/searsautoracepcb.jpg

The die just says RMR-0012.

I guess those traces that have been drilled out are for testing that the PCB was made correctly? I see that all the time.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/17/15 01:39 AM

usually those holes are there to break all the circuits apart after gold plating. the routes are all joined so that they can be plated, then they are punched/drilled to break the circuits apart.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/18/15 07:34 PM

I uploaded info on Castle Toy Co Einstein and Mattel Funtronics Red Light Green Light. Both use Nat Semi COP MCUs; RLGL has a COP410L die bonded directly to the PCB, and Einstein has a COP421 (not L). I had to lower the voltage on SI to 1.5v to get the COP421 to go into ROM dump mode. I dumped RLGL both visually and electronically. There's one bit under some dirt, but it's difficult to clean because I don't want to damage the bond wires. I did wind up breaking the bond wire to the green LED; I've been careful with the board, but something must have touched it. Maybe it happened when I removed the plastic that covers the LEDs.
www.seanriddle.com/cop410l.html
www.seanriddle.com/cop421l.html

There are a couple of crappy videos of Einstein to help with the timing:
www.seanriddle.com/einstein1.mov
www.seanriddle.com/einstein2.mov
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/18/15 09:56 PM

Your Einstein dump is incomplete? COP42x is 1KB.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/18/15 11:41 PM

I forgot to mention that- it dumped 512 bytes of 0s as well. So I guess they only needed 1/2 the space? I disassembled the code and didn't notice anything obviously wrong (like calls to the other half of the address space), but if there are issues, I can decap the chip and check it out.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/19/15 09:44 AM

I uploaded Entex Color Electronic Football 4 info: www.seanriddle.com/tms1400.html

Here's a timing video: www.seanriddle.com/colorfootball.mov

I'll scan the plastic overlay and post that, too.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/19/15 01:39 PM

Cool, another TMS1670 smile
And looks like it didn't use the extra 4 input pins either.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/19/15 05:32 PM

I added Funtronics RLGL, but unfortunately it doesn't do much: it plays the start jingle and locks up. I'll check Einstein another time.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/19/15 08:50 PM

Interesting. I'm confident of the RLGL ROM dump, since I got the same results visually and electronically. From the COP4xx User's Guide, it doesn't look like there are any differences in the instruction set as compared to the other COP4xx chips, other than removal of some opcodes and interrupts.

I assume with Einstein that they programmed the game with a COP410 in mind but for some reason wound up using the COP421. I guess it's theoretically possible that they wanted some functionality that the '421 has that the '410 doesn't, but I can't think of what that would be for such a simple game.

At some point we'll probably run across a TMS-14xx/-16xx that uses the latched inputs, and maybe even the frequency divider.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/19/15 10:54 PM

I uploaded the info for Entex Basketball 2: www.seanriddle.com/tms1100.html

I also uploaded a fuzzy timing video: www.seanriddle.com/entexbasketball2.avi

And I uploaded the overlay and bezel for Color Football: www.seanriddle.com/tms1400.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/20/15 01:43 AM

Do you have the top-metal die pic for Football 4? There are some evil smudges.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/20/15 04:57 AM

They aren't evil; they're just misunderstood smile I posted the ROM array top metal pic.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/20/15 05:24 AM

I uploaded die shots of the TMS1025; top metal and below in one GIMP XCF: www.seanriddle.com/tms1025.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/20/15 06:25 PM

I found a service manual for a radio that has a TMS1024. I think the basic operation of the chip (and the '1025) can be figured out from it. www.seanriddle.com/tms1025.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/20/15 08:04 PM

Ok, that should be straightforward to emulate =)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/20/15 08:41 PM

I'm tracing out the Tomy Break Up game now; that will probably fill in some gaps. That radio service manual had the MS pin tied high, but Break Up has it tied low.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/21/15 06:27 PM

I started on a Mitsubishi MELPS 4 microcontroller family emulation core. Known games using it are AFAIK:
- Coleco Frogger
- Gakken Frogger (or is this the same rom as coleco version?)
- Gakken Amidar
- Gakken Jungler

Rik: do you know any other games using this MCU?

Also, this thing has an output-PLA similar to TMS1x series. I've read about someone(nickname: blanka) that decapped a Frogger MCU. Is the die picture online somewhere? And if so: more than just the ROM.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/22/15 01:04 AM

I uploaded the Tomy Break Up info: www.seanriddle.com/tms1040.html

And a blurry video to help with timing: www.seanriddle.com/tomybreakup.MOV
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/22/15 01:06 AM

Originally Posted By seanriddle
I'm tracing out the Tomy Break Up game now; that will probably fill in some gaps. That radio service manual had the MS pin tied high, but Break Up has it tied low.

My bad- they both have it tied to positive voltage, which on the game is labeled GND.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/22/15 07:20 AM

Originally Posted By hap
I started on a Mitsubishi MELPS 4 microcontroller family emulation core. Known games using it are AFAIK:
- Coleco Frogger
- Gakken Frogger (or is this the same rom as coleco version?)
- Gakken Amidar
- Gakken Jungler

Rik: do you know any other games using this MCU?

Also, this thing has an output-PLA similar to TMS1x series. I've read about someone(nickname: blanka) that decapped a Frogger MCU. Is the die picture online somewhere? And if so: more than just the ROM.


Gakken and Coleco Frogger are different. Probably not by much, but the VFD is slightly different, and it's a different ROM code.

I'm not sure (off the top of my head) if any other games use that MCU or not... I'm sure we'll find at least 1 or 2 more...

I sent an Email to Blanka to see if he has a pic of the Frogger die handy... I'll also look around and see if I saved the chip from a dead Frogger I scavenged for parts. Not sure if I kept it or not...
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/22/15 10:08 AM

Originally Posted By seanriddle
I have the vertical one that looks like Dynamic Race. The PCB has a logo that looks like TCL : www.seanriddle.com/searsautoracepcb.jpg

The die just says RMR-0012.

I guess those traces that have been drilled out are for testing that the PCB was made correctly? I see that all the time.


Here's a 58 MP GIMP XCF of the Sears Auto Race die; there are 2 layers- one with and one without the top metal layer: www.seanriddle.com/searsautorace.xcf
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/22/15 03:49 PM

corrections:
tomybreakupraw.bin: change offset $034: $CD to $DF
entexbasketball2raw.bin: change offset $713: $7F to $3F
football4: looks ok

Do you have a pcb photo of Football 4? I'd like to know the LEDs positions. If the game ever turns on green+red, it could mean either a 2-colored icon, or orange.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/22/15 07:50 PM

Sean by the way, with all the MAME license updating, I have to officially ask you if you're ok with the license in the source files I credited you in. smile

I tagged them as BSD3. More specifically, lemme just copy-paste it directly:
// license:BSD-3-Clause
// copyright-holders:hap, Sean Riddle, Kevin Horton
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/23/15 01:02 AM

Thanks for the corrections. I updated my files.

The LEDs are surface mounted, with the green and red ones only about 1 mm apart, behind opaque plastic. So I bet if both LEDs were on, the colors would mix. Here's a pic:
http://www.seanriddle.com/entexcolorfbleds.jpg

It's interesting that there is an unused row at the 50 yard line.

The BSD-3-Clause license is fine, thanks!
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/23/15 06:31 AM

Originally Posted By hap
Also, this thing has an output-PLA similar to TMS1x series. I've read about someone(nickname: blanka) that decapped a Frogger MCU. Is the die picture online somewhere? And if so: more than just the ROM.


Here's what he has:
http://www.handheldmuseum.com/Z_Imgs/MESS/froggerchip.zip

A couple of shots of different parts of the chip with an inexpensive microscope... I don't think he has the chip anymore, so we'd have to sacrifice another one to get better pics... But maybe this covers what you need (assuming they are clear enough)?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/23/15 08:50 AM

The pics are good enough, that's no problem =) but!
It looks like the output PLA is hiding from us, it's probably in the upper-right section of the die then.

Before deciding to sacrifice a chip(s), I think I should try getting the games work by faking their PLA (same with what we do on some TMS1x games)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/24/15 02:42 PM

If all goes to plan, a new MAME release is due in 3 days. Here's a summary of what we added.

working,playable:
- Bandai Tamagotchi
- Entex Turtles
- Entex Stargate
- Milton Bradley Lightfight

added but not working yet:
- Castle Toy Einstein (COP400)
- Coleco Frogger (WIP)
- Entex Color Football 4 (WIP)
- Entex Basketball 2 (WIP)
- Mattel Funtronics Jacks (COP400)
- Mattel Funtronics Red Light Green Light (COP400)
- Milton Bradley Plus One (COP400)
- Ritam Monty Plays Scrabble (WIP)
- Ritam Master Monty (WIP)

(WIP) = work in progress, no big problems expected.
(COP400) = assumed CPU core emulation bugs

Tomy Breakup and the batch of Rik's games that kevtris dumped/will dump, will be added later.
Posted By: Shideravan

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/24/15 05:07 PM

Originally Posted By hap
If all goes to plan, a new MAME release is due in 3 days. Here's a summary of what we added.

working,playable:
- Bandai Tamagotchi
- Entex Turtles
- Entex Stargate
- Milton Bradley Lightfight

added but not working yet:
- Castle Toy Einstein (COP400)
- Coleco Frogger (WIP)
- Entex Color Football 4 (WIP)
- Entex Basketball 2 (WIP)
- Mattel Funtronics Jacks (COP400)
- Mattel Funtronics Red Light Green Light (COP400)
- Milton Bradley Plus One (COP400)
- Ritam Monty Plays Scrabble (WIP)
- Ritam Master Monty (WIP)

(WIP) = work in progress, no big problems expected.
(COP400) = assumed CPU core emulation bugs

Tomy Breakup and the batch of Rik's games that kevtris dumped/will dump, will be added later.


Thank you very much hap, Sean Riddle and Rik smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/25/15 12:39 AM

Originally Posted By kevtris
Originally Posted By seanriddle
Tandy Baseball has a PIC1650A- maybe I can dump this one; I know Kevin can.
I can dump the 1650 right now, btw.

Help me, Obi ROM Kenobi- I just spent a couple of hours trying to dump the PIC1650A from Tandy Baseball. I put it on a breadboard and wired pin 1 to ground, pins 39 and 40 to +6V, pin 37 (/MCLR) to +6V via a resistor, pin 36 (OSC) via a 22K resistor to +6v and via a 47pF cap to ground, and pin 38 (/RTCC) to pin 35 (CKOUT). With pin 5 (TEST) low, the chip runs normally. But like the PIC1655A from Maniac, when I tie that pin high, the chip just locks up.

The resistor and cap on the OSC pin are the same as on the game, but I also fed it an external clock at 100, 200, 400 and 500 kHz, and verified CKOUT was 1/4 the rate. I also tried VCC at 5V and 6V, and TEST at 1.5V, 3V, 4.5V, 6V and 7V.

I put a socket on the game's PCB and plugged the chip in and everything still works fine.

I got a Milton; I know you dumped its speech ROMs before. I decapped the M6805, and I'll see if I can dump the ROM visually. If so, we might be able to figure out how to dump the ROM electronically using the test code.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/29/15 09:38 AM

Anyone heard from Kevin lately? He seems to have disappeared... smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/29/15 10:14 AM

(since he didn't reply to sean either, let me..)
In short he's very busy with a work project at the moment, patience. =)
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/29/15 11:50 AM

That's cool, no rush... Just wanted to be sure all was well. smile
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/30/15 11:06 PM

Sorry, haven't disappeared. I have been hard at work getting the HDMI NES project done. It's crunch time and I have to get it done to get it into testing.

I haven't forgotten those games. hehe. actually I have dumped the CPUs on several of them.

Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 12:19 AM

sean: my dumper is at work, but I will try and write something up about how it works. in the mean time, the secret seems to be RA3 it looks. I think it controls if the ROM will dump or not.

you hook power up, an RC, and then reset will return the PC back to the start (I think it actually starts at the very last location in ROM), and I used the clkout pin next to the RC pin to time the dump.

RA4-7 and RB0-7 is where the data comes out. you have to pull test high, also. I just have it wired to 5V by the looks of it when I gave it a quickie look-see friday.

you can just wire it up on a breadboard for testing. that's how I figured it out the first time.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 04:00 AM

Thanks! I just got back from a business trip so I haven't messed with it recently. I'll try to carve out some time tomorrow to play with RA3.

I've got a raw bit dump of the 6805 from Milton; I'll try to figure out the logical bit arrangement, and see if the test ROM has the ability to dump the ROM.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 06:17 AM

ah nice. I wanted to try and dump my milton without frying the chip open. I thought it was a 6804 instead of a 6805 going by the pinout. this is a similar chip but is bit-serial so the die is smaller (but runs slower). I think I figured that out via the pinout, but I could be wrong on that. it was a couple years ago.

Guess if it's a 6805 I can try the usual "secret" dumping method on it.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 06:19 PM

At least one variant of the 6805 has the same pinout as the 6804. The Milton chip and die don't have the part number, but one of the 6804 manuals compares the 6804 die with the 6805 die (to show that it's smaller, like you said) and the Milton die is identical to the 6805 die in that pic. I also found a book that went along with a 6805 seminar that has some parts of the 6805 die annotated. And the ROM array on the Milton die has the same weird number of bytes as the 6805 data sheet shows - 1216 (128 bytes of zero-page ROM, 964 bytes of user ROM, 116 bytes of self-test ROM and 8 bytes of vectors).

I searched for info on dumping the 6805, but it remained secret to me!
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 08:32 PM

ok so it IS a 6805. Good to know. LN and balrog hooked up a logic analyzer to their device programmer and traced what it did to dump the ROM out, so I did the same thing on the allpro and it seemed to work. I dumped a number of 68705's anyways and it worked. I believe I dumped a few 6805's as well, but all 40 pinners (except the 68705's which there were some 40 and 28 pin variations).

it's been a couple years so I forgot how it all works though.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 09:10 PM

IIRC it involves pulling one pin (one of the port C pins? pins 7,8,9,10,or 11?) to +12v on /RESET to kick the chip into test/debug mode.

In that mode, assuming the chip is not a 68705p5 with the secondary security bit set, you can synchronously feed bytes to port A and the chip will execute them as opcodes (I think it may immediately execute the words meaning you need to manually 'make up' immediate-value-only code to move your real program into the 0x0000-area ram, then jump to that to run it). This is used to put a small program into the 68705's memory, which spits the rom contents out port B sequentially, using port A or part of C for timing?

This works even on "protected" 68705P3 chips, where the protection bit on the very last eprom byte (actually a sort of flag/mode byte) before the mask rom is in memory is set. (if this bit is clear, I forget what the difference is)
The 68705P5 version added a second security bit which when set I think prevents port A from being read by the mcu (at least in test mode), effectively locking out the test/debug mode.

There is the 'other' more well known 68705 flaw however which still works on the P5, the one involving the built in rom's verify mode taking a different number of cycles to toggle the 'increment external address' line when in verify mode depending on a byte match or mismatch, which allows a 256 passes of one of each byte attack to dump the internal rom contents.

The 68705P5 attempted to prevent that by making the test/verify mode vector point to 3 bytes before the end of the eprom (which is immediately before the start of the mask rom/test code) with the intent that you would put a jump to the normal reset vector there to disable the test mode completely as protection, but this can be bypassed with voltage glitching to make the eprom bytes read as 0x00 (NOP).

We have yet to demonstrate this attack against a protected 68705P5 (from taito games etc), but according to what appears to be testimony from people in the security industry who dealt with these mcus before, that trick does work for dumping protected P5 chips.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 11:49 PM

Originally Posted By kevtris
sean: my dumper is at work, but I will try and write something up about how it works. in the mean time, the secret seems to be RA3 it looks. I think it controls if the ROM will dump or not.

you hook power up, an RC, and then reset will return the PC back to the start (I think it actually starts at the very last location in ROM), and I used the clkout pin next to the RC pin to time the dump.

RA4-7 and RB0-7 is where the data comes out. you have to pull test high, also. I just have it wired to 5V by the looks of it when I gave it a quickie look-see friday.

you can just wire it up on a breadboard for testing. that's how I figured it out the first time.

Woo-hoo, I've got bits. Thanks! I was just missing grounding RA3.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 05/31/15 11:56 PM

Ah- I had seen some of the 68705 stuff (like verifying the ROM 256 times!) But I didn't think any of that would be applicable to the 6805 with its mask ROM.

Plastic stuck to the die, and I wound up torching it a bit too much. Most of the bits are readable, but I'm worried there might be a few ambiguous ones- the ROM bits are more subtle (like the 3853, not easy like the TMS1000). And I couldn't get a top metal shot because of the stuck plastic.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/01/15 09:24 AM

I'm not sure if the 68705 stuff DOES apply to 6805, but given both the 6805 and 68705 appear to have that internal 'fixed' rom of 81 or 116 or whatever bytes or so, then it may apply to both. the internal fixed rom contents may be different though.
The EPROM-based chips (68705p3 and p5, and u3/u5 which are 40 pins I think) fixed mask ROMs are dumped, so having the MASK-rom-based chips (6805px/ux) fixed mask ROM could be very useful.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/04/15 09:18 AM

I uploaded the Tandy Baseball info: http://www.seanriddle.com/pic1650a.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/08/15 06:43 PM

I dumped the 6805 visually, then disassembled the code and found one obvious bit error in the self-test code. After I fixed that I ran the self-test code and the ROM checksum didn't match. It just does an XOR of every byte and only one bit was wrong, so I checked that column in the ROM array and found a bit I had missed. Now the checksum is correct, but since it's just an XOR, it's possible that I still have other errors that cancel out.

Putting 9V on the timer pin for self-test mode moves the vectors up 8 bytes in memory, so you get new reset and interrupt addresses. The self-test code checks the ports then does a RAM test- it fills RAM with the pattern 00 80 40 20 10 08 04 02 01 then verifies it, then shifts the pattern to 80 40 20 10 08 04 02 01 00 and verifies it, etc.

Then it does the ROM test, XORing all the bytes from $080 to $7FF (including unused bytes, which must all read the same and therefore don't change the checksum). The ROM test is done with self-modifying code, using some of the residue from the RAM test! I guess they were trying to cram as many tests as possible into the smallest amount of ROM as possible.

I noticed that the old sim6805 program coded the CLRA opcode incorrectly by also clearing the carry bit (which messed up the RAM test code), so I checked the MAME/MESS code. CLRA and CLR direct are OK, but CLRX and the 2 CLR indexed opcodes clear the carry bit. The data sheets I have say that carry is unaffected.

I don't see a way to dump ROM using the test mode (normally or "creatively"), so I guess we'll have to figure out non-user mode. Unfortunately, my 6805 die got pretty cooked and I don't have a top-metal shot, so it's probably not too useful.

www.seanriddle.com/mc6805p2.html


Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/09/15 08:07 AM

I found a few more incorrect bits and updated the files. I think it's about as good as I can do it visually with this die. The test code runs and passes the ROM checksum, and the disassembly looks good. Next time I use acid on a chip, I'll see if I can clean this one up a little more and see if anything looks different.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/09/15 05:03 PM

RB If you're reading, maybe you are interested in the 6805 Milton one?

I finally finished adding these to MAME (reminder: MAME and MESS are now MAME)
- Coleco Head 2 Head Baseball
- Entex Basketball 2
- Entex Color Football 4
- Tomy Breakup

Tomy Break Up has some glitches where LEDs flicker in-game. I doublechecked the ROM and PLAs so those are fine. I don't think it can be the TMS1025.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/15/15 04:14 AM

I was able to dump the Milton MC6805P2 electronically using non-user mode. But oddly enough, I wasn't able to get it
to go into self-test, even though that's well documented.

I put the chip on a breadboard and gave it power, put a 1MHz clock on EXTAL, grounded XTAL, tied /RESET, /INT and TIMER high
and connected NUM to +5. I checked each port with an LA and noted that all PORT A bits were high, PORT B bits were toggling
(apparently) randomly, PORT C<3> was high and C<2:0> were toggling.

So I assumed PORT A and C<3> were inputs and the others were outputs. I figured opcodes would be fed into PORT A, so
I used 8 1K resistors to +5 and ground to set it to $9D, the opcode for NOP. I also tied C<3> high for the first test. I
captured PORT B and C<2:0> and was surprised to see an obviously repeated pattern every 16384 uS. Looking closer, there were
8 clocks between bytes being output, and 16384/8 = 2048, which corresponds to the 11-bit address space. Port C<2:0> outputs
bits 8-6 of the address bus, so it counts from 000 to 111 four times during a complete dump.

After searching for a while, I found the bytes that I had visually transcribed from the Milton die shot. I verified that all
the electronic dumps I made were identical, then compared the electronic dumps to the visual dump, and found 4 more bit errors
in my visual dump.

I was confused about where the dump was starting; each time it re-started at the same byte after reset, 1437 bytes in.
Then I realized that it was fetching the reset vector from $7FE, but was getting $9D9D from the resistors, which translated
to $59D in the 11-bit address space. So it dumped from there to the end before wrapping around to $000.

I was expecting to have to feed the chip opcodes to dump the ROM contents, so I was surprised but happy that it turned out
there was a simpler way. It looks like in non-user mode that the chip fetches the byte from memory and puts in on PORT B,
then executes the opcode on PORT A. Since I had made it a NOP, it just kept fetching the next byte. I'm not sure if any
of the other 6805 varieties will do the same, but maybe this will help.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/19/15 01:28 AM

Progress is a bit slow on my side.
I finished the MELPS 4 MCU core emulation, the only dumped game using it at the moment is Coleco Frogger.

What to do next? hmm, there's the COP400 MCU core that needs to be looked at, the PIC core too. And mayhaps the Sharp MCU core for Nintendo Game & Watch (Sarayan is very busy with other things).

Again: any dev wanna look at Milton MC6805P2?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/19/15 03:14 AM

Busy with work here, but I've done some stuff.

I dumped the Milton GROMs; it took longer than I thought because they weren't behaving like I thought they would.

I'll get the keypad matrix documented tonight, then all the info should be on my site.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/27/15 06:15 PM

About Sharp SM510 series: I think I'll start with Konami Top Gun that you purchased a while ago.
http://www.seanriddle.com/topgun.html
http://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=91613&page=2

Game&Watch Mickey & Donald has the same MCU as that.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/29/15 04:23 AM

Cool! You need anything from me? This could also lead into R-Zone!
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/29/15 05:26 PM

Do you have enough stronger acid left to finish TMNT and R-Zone? smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/29/15 08:24 PM

I think I've already got TMNT transcribed; I guess I just didn't post it. I'll take a look. The TMNT patent also has code, and I'm pretty sure I typed it in. The patent says is uses an SM-510, but it's really a -511, with the melody ROM.

Ranger Lennier sent me lots of R-Zone carts. I've experimented with de-globbing several of them. A couple used Sharp SM-5's, but I'm not sure what others use. I should have more experience (and acid!) to clean them up better now. I probably also ought to send scans to Kevin to see if he thinks it might be possible to electronically dump them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/29/15 09:11 PM

I think(and hope) there's a good chance these can be dumped electronically, they have a TEST pin afterall. I'm certain Kevtris would love to check it out when he finished his NES HDMI project.

There's a high res die photo of Mickey & Donald done by digshadow: http://siliconpr0n.org/map/nintendo/dm-53/
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/29/15 09:32 PM

You'd have to partially de-glob Top Gun and TMNT to get to the test pin. And I'm not sure where the ROM contents are output, but not all the strobe outputs are bonded out. I need to look at the R-Zone carts again to see if they are the same way, or if they are more amenable to testing/dumping.

The Top Gun patent doesn't seem to have the correct button wiring. I'm sure you could figure it out easily in emulation, but here's what I see:

Code:
    S1     S2     S3
K1  Sel   Left    On
K2  Snd    Up     --
K3  Off   Down    --
K4  Fire  Right   --


I vectorized some of the PCB: www.seanriddle.com/topgun.svg

Pin 1 is lower right.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/29/15 09:58 PM

Is it possible to do that without killing the MCU?
That is, to make handheld lend-outs possible.

Fortunately with Game&Watch, the PCB pics I've seen have the MCU chip and not an epoxy blob.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/30/15 12:13 PM

That's the question. From my experience, I don't think I could.

It doesn't look like I transcribed the TMNT ROM from the die, so I'll work on that. I did type in the patent ROM, but it's scanned, photo-copied, dot-matrix printer output, so there are likely some errors. I can cross-check it with the die dump after I finish that.

I also typed in Contra from the patent, but I don't have that game.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/30/15 12:24 PM

topgun.svg link is broken btw

*edit* What is the number of the contra patent?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/30/15 12:33 PM

Erg- probably don't have SVG's whitelisted. I made a ZIP: www.seanriddle.com/topgunsvg.zip

Contra is US5120057
Posted By: Shideravan

Re: TMS-09xx/1xxx thread (was New Dumps) - 06/30/15 02:39 PM

Originally Posted By seanriddle
Cool! You need anything from me? This could also lead into R-Zone!

Would be awesome to see R-Zone emulated.
Some people claims that's a crap system, but have a inestimable historical value smile

*edit* some information can be retrieved in this website: http://www.consoledatabase.com/faq/rzonefaq-sylvaindechantal/
It seems that had 27 games released.
Some merchandising scans also can be senn in this link: http://www.vintagecomputing.com/index.ph...ow-to-look-dumb

Interesting fact:
In Brazil, Tec Toy distributed R-Zone, but from reports from users, it seems that only the cartridges which came in R-Zone itself was compatible with the system (cartridges which came with other consoles doesn't work), and it's unknown if cartridges was available to buy locally.
https://www.youtube.com/watch?v=bxsbGvqOXIo (in Portuguese)
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/01/15 12:19 PM

Another interesting TMS MCU to dump/decap might be in the Capsella CRC 2000 (https://en.wikipedia.org/wiki/Capsela)

My audio dev friend Chris Randall has posted a photo of his acquisition here:
https://instagram.com/p/4f0PQPn6eX
https://instagram.com/p/4h84nCH6bd

Asked him to open it to know what sort of MCU it had, and from the photo, I'm pretty sure its a TMS1400 or similar (same pinout and markings as my Coleco Talking Teacher)

Photo credits: Chris Randall
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/01/15 05:56 PM

looks like a fun creative/learning toy, I didn't hear about it until now.
MP1359: our serial numbers list suggests 13xx is for the TMS1100
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/01/15 08:13 PM

My *guess* btw as to the MPxxxx markings with the MSl△xyyzz style datecodes (with 5 digits; the old ones use 4 digit YYWW year + week datecodes) is:
MS - ?
l = location of manufacture?
x = last digit of year (first digits are 198)
yy = week during year
zz = day during week (first digit is always 0)

LN
Posted By: Just Desserts

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/01/15 09:14 PM

Originally Posted By plgDavid
Another interesting TMS MCU to dump/decap might be in the Capsella CRC 2000 (https://en.wikipedia.org/wiki/Capsela)


Fuck, Capsela! That's one part of my childhood I'd completely forgotten. Capsela was the shit when I was growing up, second only to LEGO. Thank you for the nostalgia trip! laugh
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/05/15 08:54 AM

I uploaded the TMNT ROM dump transcribed from the die shot. As expected, the one typed in from the patent had a bunch of errors, but comparing the two, I'm confident of the file. The only differences between the dumped file and the patent file are the 64th byte of each page. I guess they didn't license TI's method of detecting all 1s and forcing 0s to get all 64 counts.

I also posted the melody ROM. It's the same except that the patent ends with 5 $FFs, but the die has $00s.

www.seanriddle.com/tmnt.html

I don't have a Contra to decap, but the printout in the patent is pretty sharp. I'll double-check what I typed in previously.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/05/15 11:02 PM

Originally Posted By hap
I think(and hope) there's a good chance these can be dumped electronically, they have a TEST pin afterall. I'm certain Kevtris would love to check it out when he finished his NES HDMI project.

There's a high res die photo of Mickey & Donald done by digshadow: http://siliconpr0n.org/map/nintendo/dm-53/

I transcribed this ROM, too:
www.seanriddle.com/nintendo_dm-53-raw.bin
www.seanriddle.com/nintendo_dm-53.bin
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 12:03 AM

Oh! I'm sorry I didn't mention it before, dm-53 was already transcribed by Segher and O.Galibert.

*edit* I don't know if it's OK to publicize the link to segher's stuff, hold on a sec and I'll compare the 2 to see if there's differences.
I verified Top Gun with my usual doublecheck method btw =)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 12:47 AM

ok, for www.seanriddle.com/nintendo_dm-53.bin please doublecheck these bits smile
48b: c5 or e5
539: 77 or 73
c69: 80 or 90
c7d: 1c or 9c
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 12:54 AM

Originally Posted By seanriddle
The only differences between the dumped file and the patent file are the 64th byte of each page. I guess they didn't license TI's method of detecting all 1s and forcing 0s to get all 64 counts.


Yeah, it supports 63 steps per page, program will get stuck at $3f unless it has a jump instruction.

int feed = ((m_pc >> 1 ^ m_pc) & 1) ? 0 : 0x20;
m_pc = feed | (m_pc >> 1 & 0x1f) | (m_pc & ~0x3f);
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 03:48 AM

Originally Posted By hap
ok, for www.seanriddle.com/nintendo_dm-53.bin please doublecheck these bits smile
48b: c5 or e5
539: 77 or 73
c69: 80 or 90
c7d: 1c or 9c

Looks like 2 of mine were wrong and 2 were right:
48B: E5
539: 73
C69: 80
C7d: 1C
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 01:39 PM

Thanks, I'll add it to the driver.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 03:59 PM

incog if you're here, do you still have your broken G&W Mario Bros? https://imgur.com/BgsYbgc,eir6NPb,WRFOkxH,VEddGjp,sYcT9xe,9EBYvqI,JnyuDme,RMH0aJr#5
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 07:17 PM

I posted the Contra ROM dump from the patent:
http://www.seanriddle.com/contra.html

The scan is much better than the other 2 Konami patents, but there are still a few ambiguous bytes.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/06/15 09:21 PM

Thanks, I will doublecheck smile
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 04:09 PM

Regarding the current vectorized VFD Artwork, I've noticed that, compared side-to-side, they sometimes are not very accurate to their source.

This is specially noticeable when looking at certain cartoony figures, which sometimes look like they've been drawn by using tracing paper over the original art (kind of how other artwork in MAME would look if it was replicated by hand, I guess).

I ignore how these are being made, but perhaps there may be some alternative way of creating more accurate vector files out of the originals?


I fear that this could be a problem that will be carried over to all future supported handhelds, and will be specially noticeable in those with more elaborate graphics, licensed characters, etc, so now that the ball is just starting to roll, it may be a good time to look into it...
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 04:56 PM

I think using open standard SVG vectorized artwork is the best method. The ones we have were created by kevtris, this is the best he can do in his free time. It's great quality IMHO, I've played around a bit with Inkscape myself and can't get even near to what he created.

The svg files are available and if you or anyone volunteers to improve them, that would be awesome.
*edit* be glad to even have these svgs smile I can't assure every emulated vfd/lcd game will have artwork done by any of us.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 05:01 PM

Anyone know when Nintendo started producing their LCD games with MCUs? The patent of their 1st game "Ball" suggests it's on dedicated hardware: http://www.google.com/patents/US4438926
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 05:07 PM

The plan is that once we have a BGFX renderer, BGFX includes a module that can hardware-rasterize SVGs. So we'd go to fully scalable artwork, which should look great on e.g. 4K and 5K monitors.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 05:33 PM

Originally Posted By hap
I think using open standard SVG vectorized artwork is the best method.
I wasn't implying the opposite, actually.

Quote:
be glad to even have these svgs smile
I also wasn't implying that I'm not glad we have these, but... well, what I said.

Quote:
The svg files are available and if you or anyone volunteers to improve them
Maybe a solution could be having a repository where people could check the original scans, have a try at vectorizing them and submit their results? They'd be still "hand-made" but people would be able to keep improving on each iteration, until they look just like the originals.

I don't think that anybody not reading this topic even knows that they can contribute to those, or how to do it.

Originally Posted By R. Belmont
once we have a BGFX renderer, BGFX includes a module that can hardware-rasterize SVGs. So we'd go to fully scalable artwork
I'm... not quite sure I understand what that would mean, sorry. frown
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 05:44 PM

MAME Artwork has always relied on external contributions, and we've seen lots of great stuff from it. Maybe it's not been very popular on the MESS side, but it is exactly the same thing.

If you think an external repository is needed. By all means, please organize/make it. I for one have my hands full.
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 06:32 PM

ICEknight: it means you'd give MAME an SVG file for artwork instead of converting it to a PNG first (which de-vectorizes it and fixes the maximum resolution). MAME would then use your video card to draw it quickly.
Posted By: Just Desserts

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 10:33 PM

Originally Posted By ICEknight
I'm... not quite sure I understand what that would mean, sorry. frown


MAME artwork shiny. MAME code not so shiny. When make shiny, pretty shinies become all shiny. Until, less shiny. Pretty thing. Fire bad.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/07/15 10:51 PM

yup, exactly that, maybe a tad shinier

------
on-topic

I'm starting to hear some blips and bloops with Konami Top Gun, but it's jumping to an undefined area pretty soon. It's hard to fix due to MAME's lack of LFSR programcounter support in the debugger, but I'm sure I'll get it right eventually.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/08/15 12:44 PM

Originally Posted By R. Belmont
ICEknight: it means you'd give MAME an SVG file for artwork instead of converting it to a PNG first (which de-vectorizes it and fixes the maximum resolution). MAME would then use your video card to draw it quickly.
Ah, so that's it. Thanks for the explanation.

Originally Posted By Just Desserts
MAME artwork shiny. MAME code not so shiny. When make shiny, pretty shinies become all shiny. Until, less shiny. Pretty thing. Fire bad.
Uh... Really? sick
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/08/15 01:02 PM

JD's answer is actually a pretty good deconstruction of the truth, if a bit unorthodox smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/09/15 11:00 PM

Sean is your Top Gun LCD panel still working? If so, is it possible to light up a single icon by probing a column pin + a segment pin?

In other words, I want to know which LCD matrix position is wired to which game gfx.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/09/15 11:30 PM

I bought a PIC16LF1907 that has an LCD driver that can do 3V, 1/4 duty, 1/3 bias panels like the SM510 does. The hassle is connecting the 41 pins! The game uses an elastomeric connector between the panel and the PCB, and the pads are 1.2mm pitch.

I should have bought one of these:
http://www.aliexpress.com/item/2pcs-Scre...2251428401.html

but instead I cut off the Top Gun PCB and I'm in the process of soldering wires to the traces. When that's done, I'll be able to drive each of the 33 segments on the 4 commons. Then I can map the pins to the segments, and I can drive the segments to get pictures of them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/09/15 11:40 PM

Great smile looking forward to it!

Top Gun is responsive and seems playable, you can 'move around' and shoot, and hear the sound effects.
G&W Mickey & Donald is using SM510 opcodes I don't fully understand and are documented differently across different SM510 series datasheets. It can mean either a mistake in the datasheet, or they differ between SM510 and SM511. (opcodes are: LB x and SBM)
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/10/15 04:54 AM

Originally Posted By hap
Great smile looking forward to it!

Top Gun is responsive and seems playable, you can 'move around' and shoot, and hear the sound effects.
G&W Mickey & Donald is using SM510 opcodes I don't fully understand and are documented differently across different SM510 series datasheets. It can mean either a mistake in the datasheet, or they differ between SM510 and SM511. (opcodes are: LB x and SBM)


Top Gun and M&D use the same cpu, and I suspect it's called a SM54C.

OG.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/10/15 07:07 AM

Hap-

Have you looked at any of Paul Robson's stuff? He was going to do a retrochallenge on the Watchman a couple of years ago, and he's got 20 blog posts, some info and some code:

http://watchdev.blogspot.com/


OG-

I figured that SM510 was the name marketing used and CMS54C was what the designers used. Top Gun's top metal says CMS54C (actually, the first C looks more like a [, and the S is under the CM) and underneath it looks like it says KMS598.



Likewise, TMNT (assumed SM511 from ROM and RAM sizes and melody ROM) says
KMS 73B and KMS 774.



The G&W die shot says CMS54C over CMS565. I'm guessing the numbers 598 and 565 are the ROM IDs; they are repeated in a different location on the 2 dies.
Posted By: Tauwasser

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/10/15 05:54 PM

Originally Posted By hap
G&W Mickey & Donald is using SM510 opcodes I don't fully understand and are documented differently across different SM510 series datasheets. It can mean either a mistake in the datasheet, or they differ between SM510 and SM511. (opcodes are: LB x and SBM)


The 1990 Sharp Microcomputer Data Book lists both MCUs and LB does indeed differ between SM510 and SM511.

cYa,

Tauwasser
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/10/15 06:24 PM

Paul's Watchman: yeah, the blog posts showing the development process was a fun read. The source code is not that useful to me, looks like he didn't finish the project? Also, I removed Java a long time ago and won't reinstall it. =p

SBM opcode I assume I have right. I think I will get the LB x one right eventually too, after some trial & error.
Posted By: Tauwasser

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/10/15 08:33 PM

Shouldn't it literally just be

Code:
void sm510_base_device::op_lb()
{
	// LB x: load BM/BL with 4-bit immediate value (partial)
	m_bm = (m_bm & 0x04) | (m_param & 0x03);
	
	m_bl = ((m_param >> 3) ^ (m_param >> 2)) & 0x01;
	m_bl = (m_bl << 1) | m_bl;
	m_bl <<= 2;
	m_bl |= (m_param >> 2) & 0x03);
}

void sm511_device::op_lb()
{
	// LB xy: load BL with y, BM with x; 2-bit immediate value each
	// B_M1 <= I_2 in 1990 Sharp Microcontroller Data Book p.170 is a typo I think
	m_bm = (m_bm & 0x04) | (m_param & 0x03);
	m_bl = (m_bl & 0x0C) | ((m_param >> 2) & 0x03);
}


Did you try this naïve implementation already and saw that it failed, or what seems to be the issue? I think p170 in the data book must be a typo when it assigns B_M2 <= I2 instead of B_M2 <= I1...

EDIT: I think op_incb and op_decb also need attention. They currently skip the next instruction when they overflow. However, I think what the datasheet means is that B_L cannot overflow using these ops.

INCB 64 Skip if B_L=F_H; B_L <= B_L + 1

I read that as:

Code:
if (m_bl != 0xF)
    m_bl = (m_bl + 1) & 0xF;


cYa,

Tauwasser
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/11/15 01:42 AM

incb/decb are correct. The skip means it skips the next instruction on that condition, for example:

loop:
...
incb
jump to loop

Yeah, I tried implementing LB x literally, but it doesn't work. The most I got from it was setting BL only (so: m_bl=m_op&0xf, don't alter BM). Mickey&Donald is playable for a few seconds that way.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/11/15 06:15 PM

Sean could you post your SM511 raw2good conversion script? TMNT die looks good, but there are 2 obscured parts(smudge).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/12/15 03:01 AM

The '510 has a 128x176 ROM array, and I figured the '511 ROM layout would be the same but with the full 64 pages instead of just 44. And the '511 ROM *is* 128x256, but the rows and columns are transposed, so it's really 256x128. It turns out that they put two 128x128 arrays side by side, and switch sides every 8 pages.

Here's pseudocode:
Code:
	blockorder[]={4,5,7,6,3,2,0,1,11,10,8,9,12,13,15,14};
	numpages=64;
	bytesperpage=64;
	bytesperrow=32;
	bitsperrow=bytesperrow*8;
	rowsperpage=bytesperpage/bytesperrow;

	FOR(pg2=0;pg2<(numpages/16);pg++) {
		FOR(pg1=0;pg1<2;pg1++) { // every eight pages, change ROM array halves
			FOR(Pg0=0;pg0<8;pg++) {
				FOR(i=0;i<(bytesperrow/2);i++) {
					FOR(j=0; j<(rowsperpage*2);j++) {
						rom[rx]=0;
						FOR(b=0;b<8;b++) {	// bits
							ix=((pg0*4+pg2)*4+j)*bitsperrow+b*bytesperrow+blockorder[i]+16*pg1;
							rom[rx]=rom[rx]*2+rawbits[ix];
						}
						rx++;
					}
				}
			}
		}
	}


I also uploaded a top metal pic with smudges in different areas: www.seanriddle.com/tmntrom.jpg
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/12/15 07:15 AM

Ok, TMNT verified =)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/13/15 06:49 AM

The Smithsonian has a TMS1000 chip with code MP0002A:

http://smithsonianchips.si.edu/texas/t_400-1.htm
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/13/15 12:21 PM

Quote:
The algorithm is for a Magic Chef microwave oven.


We've *got* to get our hands on one of those chips smile
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/13/15 02:06 PM

Originally Posted By R. Belmont
Quote:
The algorithm is for a Magic Chef microwave oven.


We've *got* to get our hands on one of those chips smile


Amazingly, here's a possible coder for the code on that chip:
https://www.linkedin.com/pulse/20141031154854-10753040-college-education-in-america-is-out-of-reach
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/13/15 02:14 PM

I really shouldn't underestimate Stiletto, but that result still surprised me smile Doubt that guy has the code though - is there a patent like there is for the game-oriented TMS1xxx chips?
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/13/15 05:40 PM

Originally Posted By R. Belmont
I really shouldn't underestimate Stiletto, but that result still surprised me smile


Heh, search "TMS 1000" + "Magic Chef" on Google and it's like the first result. smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 12:26 AM

Sharp is pranking me, SM511 opcode documentation is incomplete (missing some opcodes), and the melody controller doc is very sparse.

Contra patent ROM code: I agree some bytes are ambigious, especially B and 8 look similar. The chance of getting an errorfree ROM from it is small.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 12:27 AM

Rik if you're reading, could you provide PCB photos of your Game&watch games?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 02:24 AM

I started using the character widths- 0 is skinniest, then 8, then B.

I've got a Contra on the way, and just got a Star Trek 25th Anniversary. G&W Boxing is also coming.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 11:14 AM

TMNT is playing jingles now =)

Will you try finding out how the test pin works? G&W games are very expensive, would be great to find out that they can be dumped without decapping/breaking one.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 05:02 PM

Cool! I will see what I can figure out on the G&W's test pin. ST25 has 2 globs- one looks like it has 60 pins, so I'm guessing SM511/512. The other has 16 pins- I assume it's for the speech/sound effects.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 05:57 PM

Ah, found a good deal, it's the sequel to the G&W game i had when i was a kid, Donkey Kong 2:

http://www.ebay.nl/itm/Carte-mere-origin...=item2803028dd7
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/14/15 09:38 PM

Interesting. No panel though, huh? I counted 50 pads for the LCD, so some of them must be interconnected, since the chip only has 60 pins; SM510/511 has 60 pins, but only 37 are used to drive the LCD panel.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/15/15 02:24 AM

Originally Posted By hap
Rik if you're reading, could you provide PCB photos of your Game&watch games?


When you guys say 'G&W', are you specifically talking about the Nintendo brand? (People frequently use G&W to indicate any small LCD handheld... smile )

I think I only have a couple of them, since they can be pricey I never really got into collecting that series (more of a VFD guy myself anyway. smile ) But I'll check out what I have.
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/15/15 05:35 AM

I wonder what those Nelsonic Game Watches run...
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/15/15 06:39 AM

Yeah, I mean the Nintendo mono LCD ones. I want to know approximately from when until when they used a Sharp SM510.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/15/15 10:36 PM

Originally Posted By hap
Ah, found a good deal, it's the sequel to the G&W game i had when i was a kid, Donkey Kong 2:

http://www.ebay.nl/itm/Carte-mere-origin...=item2803028dd7

I asked if he'd ship to US, but he didn't reply.
Posted By: A. Viloria

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/15/15 10:54 PM

I'm in Europe... If its needed I can act as intermediate, and send it to you... Just my 2 cents
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/15/15 10:58 PM

Not needed, I already purchased it wink
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/17/15 11:20 PM

I finally typed in the Touch & Tell / Vocaid patent listing, I will see to adding it to the tispeak.c driver.

http://pastebin.com/wgyshMuL
http://www.google.com.bd/patents/US4403965?cl=en (missing some lines! but this one is easier to read)
http://www.google.com.bd/patents/EP0048835A2?cl=en
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/18/15 05:39 AM

I double-checked the first half - 100%!

I've received several handhelds the past few days:
Konami Star Trek 25, Konami Contra, Nintendo G&W Boxing, Mattel Football 2, Mattel Classic Football 2, Mattel Classic Baseball, Mattel Bowling. Konami Gradius is on the way.

From the pinout, the Boxing CPU is likely an SM510 or SM511. I'm going to play around with the test pin this weekend. It must draw very little power; while I was tracing out the connections with my Fluke, it powered up and played a little tune, no batteries installed.

Unsurprisingly, Contra looks very similar to Top Gun and TMNT. Star Trek looks pretty similar, but has a 2nd glob that I'm thinking is a DAC for the speech. If I figure out the test pin on Boxing, I'll see if I can de-glob the Konamis enough to get to the necessary pins without trashing them. I assume we won't be able to dump the melody ROM, but I can probably capture the output with an LA and reconstruct it.

The Mattel classic games have globs; stenciling on the Classic Football 2 PCB includes RA0-RA3, RB0-RB3, RC0-RC3, RD0, and RE1, which makes me think it's a PIC.

The classic games use a regular Phillips screwdriver, but I found the perfect tool for the triangular screws used on the originals; I took a Torx T10 screwdriver and ground off every other ridge using a Dremel cutoff wheel.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/18/15 01:19 PM

Check out line 1897 of the Touch & Tell patent listing, which is line 1493 of the pastebin, 2 bytes after the only B7 in the file. Everything else matched, although I was fooled by several 8s that looked like 3s.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/18/15 03:58 PM

Got it, thanks.
The output PLA is in the patent, as you probably saw. But the microinstr. PLA is not and judging from the disasm it is not the default one either. See for example line 0499, the comment "Y is also incremented by RSTR"
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/18/15 04:45 PM

Hmm, I didn't catch that. Didn't we run into that somewhere before? Or am I thinking of the TMS0980? I know the SR16 calculator removed one instruction and used that spot in the PLA to modify one of the built-in opcodes.

I'm pretty sure the Mattel Classic Football 2 CPU is a Winbond 4-bitter, in the same family as the W541E260. The pinouts line up perfectly, but it looks like there are a lot of members in the family, so I'm not sure which exact one it is. Interestingly, it's EEPROM. I haven't found enough info on the chip to see if it can be read.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/18/15 07:09 PM

Yes, modifications to the microinstructions PLA are more common on TMS1000(SR16) and TMS0970. Touch & Tell looks like it changed much more. Here's some just from the 1st page of the patent, I think it's a bit too much to be able to construct a correct PLA. Maybe you can decap one if you find a one cheap?

default 1100 -> touch n tell

03: XMA -> TAM
3E: IMAC -> XMA
3C: SAMAN -> DCY
01: ALEM -> YNEA

Winbond? I don't think we emulate any of them in MAME.
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/19/15 07:38 AM

Originally Posted By hap
Anyone know when Nintendo started producing their LCD games with MCUs? The patent of their 1st game "Ball" suggests it's on dedicated hardware: http://www.google.com/patents/US4438926


This interview mentions how they switched to MCUs. I don't believe it says exactly when it happened, though.

http://www.plasticpals.com/?p=23596

Yamamoto: Mr. Izushi and I were rookies until the fourth title, “Fire,” but I do remember that at the beginning, the games weren’t programmed as much as they were built in hardware.

Iwata: You mean the games weren’t made by being programmed like they are now, but by building the actual hardware circuits.

Izushi: That’s right. Actually, it was the same as it was for “Racing 112″ and “Block Breaker.” Keeping the gameplay in mind, you would put together a circuit schematic in your head, and pick up a soldering iron. That’s how I made the prototype for “Fire.”

Iwata: So you used a soldering iron instead of a keyboard. (laughs)

Izushi: I always thought it was faster that way. It was faster then, actually.

Yamamoto: It was, wasn’t it?

Iwata: But at some point, you changed over to conventional programming.

Izushi. Yes. When I learned to use programming languages and started to make games that way, I thought “this is so much easier!” (laughs)

Iwata: It was easer and definitely faster. (laughs)

Izushi: It was faster, and I didn’t have to get my hands dirty. (laughs)

All: (laugh)
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/19/15 08:03 AM

Originally Posted By Shideravan

*edit* some information can be retrieved in this website: http://www.consoledatabase.com/faq/rzonefaq-sylvaindechantal/
It seems that had 27 games released.


That game list is incomplete. I have Nights Into Dreams, Zorro, and Football/Soccer, which aren't listed. I've never seen Nascar Racing, Judge Dredd, Star Trek, and Waterworld, so I don't know if those are real or not.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/19/15 08:35 AM

"The chip we used to make “Ball” could control a total of 72 segments."
That is much less than SM510, maybe it's SM530/31(same MCU family) or something. Or it is SM510 and they were mistaken on the exact number :P

*edit* or a more primitive 'calculator chip' of course
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/20/15 10:01 PM

Originally Posted By seanriddle
The classic games use a regular Phillips screwdriver, but I found the perfect tool for the triangular screws used on the originals; I took a Torx T10 screwdriver and ground off every other ridge using a Dremel cutoff wheel.


Anyone that opens these on a regular basis I recommend to just buy the bits for them:
http://www.ebay.com/itm/231507477051

You only need two (TA20 and TA23), but it never hurts to have extra security bits, never know when they'll come in handy.

Mattel used two different sizes of these, one the triangle is almost the exact size as the head of the screw (TA23), the other is obviously smaller (TA20). You can make one bit that will work in both, but one small enough for the small size can actually strip the head of the larger size if it happens to be stuck for some reason (rare in plastic, but you never know). The small size I think I've only seen in the earliest games (Missile Attack, Auto Race, etc), the TA23 size is the most common. Works in most of those disposable games/toys too, like the McDonald's Happy Meal games.

There's also an exact replacement screw you can get with a normal phillips head... I have a box of them at home (I can check the screw specs tonight), the head is the same size, and the threads are exactly the same, so you won't damage the hole putting them in. Handy if it's a game you think you will be opening a lot for some reason (or if you just hate those damn screws... smile )
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/20/15 10:35 PM

I've got about a jillion security bits, but none are triangular.

I can usually unscrew the triangles by using two jeweler's screwdrivers- 1 that's just shorter than the edge of the triangle, and another smaller one in the middle to keep the first one in place. But I've run across a few screws that I couldn't get out that way.

I'm ashamed to say that I have used a Dremel cutoff wheel to cut slots on screws so I can use a flat-blade (cutting partially through the case, if need be).

Somehow, I've wound up with half-a-dozen of those Torx T10s, so no big loss. I used the ground-down one on Auto Race and Football 2 and it worked well on those two, but I'm sure the actual bits are best.

Speaking of opening games, I've been surprised at how many repaired games I've gotten off ebay. A few times it's been battery damaged traces that were repaired with wire jumpers, and there have been several that had broken plastic support pieces that were fixed to various degrees. Then again, I got a Mattel Basketball where the 9v battery clip had been pulled off and the wires were just twisted together- red to black and black to red! That game has 3 bare dies on the PCB, and one of them had melted all of its bond wires. But the ROM bits are still visible!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/21/15 07:23 PM

Coleco Electronic Quarterback has a TMS1100NLL MP3415 BSP 7823. I'm going to try dumping electronically again. It might take me a while, unless I get frustrated and torch it. Then again, I'm not sure die rev BSP is dumpable.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/22/15 12:51 AM

Touch and Tell is on the way.

I had some luck with G&W Boxing- I can dump 1 page of 63 bytes. Just 43 more pages to go! (Or maybe 63 if it's an SM511). If I fiddle with some of the inputs right after reset, I can switch pages, but I haven't figured out the exact steps yet.

Gradius is pretty much just like Top Gun, TMNT and Contra. Tiger Marble Madness looks like it's an SM512 because there are a lot more segments.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/22/15 09:24 AM

Sounds promising smile
You got Contra too, right? That would be a good case to see what data you're actually dumping, since we can assume we have the dump already via the patent(with some wrong/obscured bits)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/22/15 12:10 PM

My worry is that all the lines required to dump blobbed ROMs aren't bonded out. The ROM data comes out S1-S8, but after a quick look at Contra, I only see 5-6 traces for those signals coming out from under the blob. I'm guessing the other 2-3 aren't bonded, which means you'd have to remove the blob and use probes on the die pads to access that data.

Other LCD games might bond out all the signals and even have test pads to verify the ROM data, but I bet that by this time, yields and confidence were up, and full ROM verification was no longer done.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/24/15 11:00 AM

I received G&W Donkey Kong II pcb yesterday, it looks in good condition, it's on its way to you now.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/24/15 05:47 PM

It is 'guess the MCU' tiem!

1: Lego Technic Control Center, used in
set 8094 from 1990 http://technicopedia.com/8094.html
set 8485 from 1995 http://technicopedia.com/8485.html
I assume both are the same. I remember the 1st one from toy magazines, the 2nd one looks much better tho! =)

2: Nintendo R.O.B, a silly NES peripheral, MCU is 16-pin DIP labeled Nintendo. I assume it's an old Sharp MCU like the 10NES CIC(lockout chip).

*edit* laugh https://www.youtube.com/watch?v=9CRVd3jk0q4
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/24/15 06:15 PM

Guess the mcu/cpu as well for the Lego DACTA Control Lab '2954' block:
http://www.bricklink.com/PL/2954.gif
http://lgauge.com/technic/LEGOInterfaceB/9751.htm for more information

Given that brick actually accepts rs232 and has an unlock compare string, its probably a z80 or 6809 or a similar 'true' cpu in there, with an eprom or mask rom. (Unlock: send the brick "p<NUL>###Do you byte, when I knock?$$$" and it responds "###Just a bit off the block!$$$" and unlocks itself. The much later Lego RCX 1.0/2.0 brick, which is Hitachi H8 based (and dumped), uses a nearly identical unlock phrase.)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/24/15 07:33 PM

Lego Dacta? Never heard of that until today =)
I googled around a bit to learn about it, interesting educational 'branch' of Lego smile

The one you linked is interface B. Interface A info is over here:
http://lukazi.blogspot.nl/2014/07/lego-legos-first-programmable-product.html

*edit* The interface brick connects to a PC(software control happens there), so I assume the interface only has a serial controller and no CPU on it.

also, pcb pics of the Control Center here http://freggelweb.de/technic-controlCenter.html
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 04:29 AM

I'm baaack. I finished the HDMI adapter and it's in production right now, so I am back on game duty for awhile.

The Allpro 88 adapter is almost done, I finished the PCB so now I have to check it and then get it made. This board plugs inside the Allpro 88, after removing the three existing power boards. It adds USB and 12V only power and basically turns it into a super powered chip dumping rig while removing most of the original bad hardware design.

This will allow dumping new chips without constantly making up hardware to do it like before. I can "import" the existing dumping stuff into the allpro relatively easily too.

As for dumps, I dumped most of the micros I could on the last round of games, and will take VFD pics and RE the pinout soon. I will let others vector them from now on I think, since it takes a huge amount of time to do this that I could spend REing and dumping stuff, and some people were complaining about the quality. Let's see if they can do better :-)

So the new protocol will be to dump the chip, photo the VFD, and trace it out like before except I will put the plate numbering on an actual picture instead of the vector version.

I will have to make some socket adapters to dump some of the chips because they are in different packages from what I natively support, but shouldn't be too difficult.

Re the last dumps, The two CPUs out of the Bandai Pair Match won't dump. It's odd, like the dumping stuff was slightly changed or something. I haven't poked around with it too much but they are some of the very last chips made going by date/mask number.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 07:56 AM

I dumped the Gakken Jungler ROM tonight (Mitsubishi M58846-702P) and was looking at dumping the CPU that's in Amidar, but the problem is it's an M58103-702SP.

This is a 52 pin shrink dip chip which is very odd. It should theoretically be similar to the '46 but I cannot find a data sheet with the pinout of it. Does anyone have that or know where to get it?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 10:51 AM

I've searched for it before, but couldn't find anything. M58846 official documentation is sparse as well, as I said on IRC I had to guess some of the opcodes.

I got an interesting link from MetalliC yesterday =)
http://sfrolov.livejournal.com/175067.html
http://www.leningrad.su/files/nupogodi.zip

It's a 80s USSR clone of Nintendo G&W Egg. The MCU is a КБ1013ВК1-2, probably a clone of a Sharp MCU. There's a 2KB ROM in the .exe resources, the data looks similar to Sharp MCU code.
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 11:49 AM

http://puu.sh/jdp0n/f4d4f5cbb3.7z
Extracted files.
From the .exe info:
(C) 2015 Igor Rychenkov
Full KB1013 emulator "Game & Watch"
Game&Watch "Wolf&Hare"

From the about info:
Quote:

Гаджет для рабочего стола
"Игра с часами-будильником"

Приложение "Ну,погоди!" является полным функциональным аналогом одноимённого микропроцессорного устройства, выпускавшегося в СССР в 80-90х годах.

Может использоваться как игра и как часы-будильник на рабочем столе.
Для запуска программы при включении компьютера, создайте ярлык программы в папке "Автозагрузка", указав ключ "/watch". (пример: C:\NuPogodi.exe /watch ) Приложение запустится в правом нижнем углу экрана в режиме часов.

Чтобы увидеть часы, когда запущены другие программы, нажмите на значок в системном трее.
Для вызова окна помощи, когда оно свёрнуто, дважды нажмите на ярлык в трее.

Все функции оригинала сохранены. Можно установить будильник: он сработает, если программа запущена.
Дополнительная функция: для синхронизации часов с системным временем Windows, в режиме "индикация времени" нажмите клавишу F3.

Функции "Сброс","Установка системного времени" доступны только когда активно окно с подсказкой клавиш управления. Когда активно окно с часами-игрой, доступны функции запуска и управления игрой, установка будильника.

С вопросами и пожеланиями обращайтесь на e-mail: emulator2015@ya.ru
Posted By: abelenki

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 02:38 PM

Originally Posted By hap
It's a 80s USSR clone of Nintendo G&W Egg. The MCU is a КБ1013ВК1-2, probably a clone of a Sharp MCU. There's a 2KB ROM in the .exe resources, the data looks similar to Sharp MCU code.

there is big article on Elektronika handheld games on Russian Wikipedia:

https://ru.wikipedia.org/wiki/%D0%AD%D0%...%D1%80%D1%8B%29
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 03:39 PM

Ah, found a good thread with KB1013 tech info, with scans of official doc. Looks like enough to emulate it.
http://www.nedopc.org/forum/viewtopic.php?t=9662
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 05:50 PM

hap, if you want to collect the KB1013 info into something that can be stashed in our collection of docs, that would be great. smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/26/15 08:28 PM

Ok, uploaded the manual scans to the docs.

Sean: A surprise TI Spelling B* and Mr Challenger are on the way shocked
*1978 or 1980 version? I don't know, that's a surprise too I guess?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 02:43 AM

New dumps are ready. I have the dumps + pinouts + high rez pictures of the VFDs. the same kind I used to make the vector files. There's dim and bright versions to help with the blooming on the cyan and such.

Bandai Ultraman
Bandai Zaxxon
CGL Amidar
Gakken Jungler


http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Ultra%20Man/
http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Zaxxon/
http://blog.kevtris.org/blogfiles/Handhelds/CGL%20Amidar/
http://blog.kevtris.org/blogfiles/Handhelds/Gakken%20Jungler/

Enjoy!

oh yeah, forgot. Amidar has no dump because I need to find the datasheet for the CPU.



Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 04:04 AM

Oh, come on, you _know_ you want to vector Ultraman! smile

What's the tool you used for making the vectors?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 04:41 AM

I used inkscape and got very good at bezier curves. I almost have the rest of your games "processed", they are all dumped except for Amidar.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 05:32 AM

Almost forgot, I dumped the other two Select a Game Machine games, and uploaded them. I also changed the pinout file to reflect that it's used for all three HD38800 games. So only one game uses the TMS1xxx which is interesting.

The two new ones are Baseball 4 and Pinball.

I know someone wanted to make this into a 'Cart based' system on MESS but why not just emulate them as separate games that happen to share resources? It'd probably be a lot easier, seeing how different games have different CPUs.

http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Select%20a%20Game/
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 06:55 AM

Originally Posted By kevtris
Almost forgot, I dumped the other two Select a Game Machine games, and uploaded them. I also changed the pinout file to reflect that it's used for all three HD38800 games. So only one game uses the TMS1xxx which is interesting.

The two new ones are Baseball 4 and Pinball.

I know someone wanted to make this into a 'Cart based' system on MESS but why not just emulate them as separate games that happen to share resources? It'd probably be a lot easier, seeing how different games have different CPUs.

http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Select%20a%20Game/


Cool! Do you have access to any other carts?

There's a similar situation with the Microvision, which mostly used a TMS1100, but also had some games released on an Intel 8021.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 07:23 AM

There's three dumps in that directory right now. The TMS cart I can't dump I don't think. It's shrink dip and probably protected. I think there were 6 total games so half of them are dumped now.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 09:20 AM

Originally Posted By kevtris
I used inkscape and got very good at bezier curves. I almost have the rest of your games "processed", they are all dumped except for Amidar.


Pair Match too, or are you still having problems with that one?
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 09:25 AM

Originally Posted By ranger_lennier
Cool! Do you have access to any other carts?


I have all of them, so I'll send the remaining two (Pac Man and Basketball) with the next batch of games I send him.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 05:59 PM

kevtris is the Zaxxon pinout correct?
You've described that 2 pins control plate 3, if so, is it an OR or an AND? I also don't see plate 18 and 19 mentioned.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/27/15 09:53 PM

rik: yeah I got three games left: Pair Match (dumped both CPUs, need to pin/photo VFD), pengo (same) and burgertime. All three of those are dumped.

I *think* pair match dumped OK. I thought it didn't but it looks like it did. I will keep the CPUs on the carrier boards until we confirm if it's good or not. I might vector it too since it's so simple.

Re: zaxxon, I will check into it and update the files to fix it. That VFD is really loooong and it had multiple grid points so it was kinda tricky.

Also one of the plates is "missing" on amidar (though I guess it doesn't matter if we can't find CPU info). this is because there's two connected together. 1/31 and 12/13 I think it was are both tied together (i.e. 1 and 31, then 12 and 13) which is why it's missing. Not sure why the same signal comes out two pins but it does. you can see it on the bottom.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/28/15 02:36 AM

Originally Posted By hap
Ok, uploaded the manual scans to the docs.

Sean: A surprise TI Spelling B* and Mr Challenger are on the way shocked
*1978 or 1980 version? I don't know, that's a surprise too I guess?

Cool! I got G&W Blackjack and Bomb Sweeper, as well as Touch & Tell. I decapped T&T, but need to Whink it to make it easier to see.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/28/15 02:38 AM

There. I fixed the zaxxon pinout. one of the plates is always on and I screwed up the numbering so now that should be fixed.

here's pair match. It's got dual HD38820's. should be fun. one wrinkle is one of the chips can reset the other, so keep that in mind. I put both pinouts on one spreadsheet. The one CPU literally only has a single output to the feeper not counting the "feedback" between it to the main CPU.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Pair%20Match/

I updated the file in the zaxxon directory so redownload it to get the fixed version.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/28/15 05:30 AM

Woot, got the last 2 games done. Pengo and Burgertime.

http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Burgertime/
http://blog.kevtris.org/blogfiles/Handhelds/Bandai%20Pengo/

Enjoy!
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/28/15 03:41 PM

Added to MAME:
- Konami Top Gun [hap, Sean Riddle]
- Konami TMNT [hap, Sean Riddle]
- Game & Watch: Mickey & Donald [hap, Sean Riddle, segher, O. Galibert]
- Gakken Jungler [hap, Kevin Horton, Rik]
- Bandai Zaxxon [hap, Kevin Horton, Rik]
- Bandai Ultra Man [hap, Kevin Horton, Rik]
- Bandai Pengo [hap, Kevin Horton, Rik]
- Bandai Burger Time [hap, Kevin Horton, Rik]

The SM510 ones(top 3 on the list) are still WIP. I've set the 'not working' warning flag on the others as well, until they're confirmed playable with external artwork.

When I get Pair Match emulated, I can make internal artwork for it. It only supports rectangles, circles, and text but that's good enough for this game. See for example the internal artwork for efball: http://imgur.com/WzLkIrJ
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/29/15 12:18 AM

hap: looks great! do those 5 games I dumped run in any fashion? i.e. bleeps/bloops, or are they just "added"? I am not 100% what it means that they are added I guess :-)
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/29/15 12:39 AM

yup, the games do their little jingles and become active when pressing the start button.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/29/15 04:54 AM

Originally Posted By hap
Added to MAME:
- Konami Top Gun [hap, Sean Riddle]
- Konami TMNT [hap, Sean Riddle]
- Gakken Jungler [hap, Kevin Horton, Rik]
There's three games that I loved when I was little, thank you so much for preserving them in a proper way and emulating them.

For those who have never played them, once the next version is ready I recommend trying TMNT and, very specially, Jungler.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/29/15 07:54 AM

Pair Match A88 has been fixed. Dropping the voltage down to 8V or 9V worked and I got what I think is a good dump. You could see repeated bytes in the old dump, and now that's gone. I dumped it 6 times and got the same CRC so I am gonna say it's probably OK now.

I replaced the files in the pair match directory.

I also redumped vtech invaders- it looks a lot better now. I lowered the voltage a little bit on this one too and got consistent data then.

It is sitting in its respective directory too.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/29/15 09:44 PM

VTech Invaders is playable now. I added Pair Match too, and that one is also working fine. =)
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/30/15 02:41 AM

hap: great to hear! I can put some back together.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/30/15 08:21 AM

Originally Posted By hap
Sean: A surprise TI Spelling B* and Mr Challenger are on the way shocked
*1978 or 1980 version? I don't know, that's a surprise too I guess?

Spelling B showed up today. No serial # on the back, but the date code is 0479 and the copyright date is 1978. There are 2 chips: 40 DIP TMC0272NL DAS 7901 SINGAPORE and 28 SDIP TMC1984NL DAS 7849 SINGAPORE. 5 caps, 5 diodes, 2 resistors and a transistor. VFD is 8 digit, 14-segment plus decimal point and apostrophe.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/30/15 11:35 AM

The difference is that the 1978 version is dual-mcu as you described, and the 1980 version hw is like Mr.Challenger: TMS0270 + VSM ROM.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 07/31/15 11:27 PM

I hope you don't mind these gifts :P
- Little Professor 1982 version, assumed it uses a CMOS version of TMS1000 series MCU. Since we already emulate 2 of them, figuring out the details hopefully won't be difficult.
- TI DataMan (1977)
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/01/15 06:42 AM

It's like Christmas in July (and August)! I got Mr. Challenger: 40-pin SDIP, TMC0273N2L P GAS 8031 SINGAPORE and 16 DIP TMC0355BNL P CD2601 DCU 8035 SINGAPORE
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/02/15 10:37 PM

I redid my handhelds directory to categorize things better. So no, it didn't disappear, it just got rearranged a bit.

I also dumped the UPD557LC from "tactix" that sean sent me. So that's now sitting here:

He will be along shortly to post the text file on pinout I suspect.

http://blog.kevtris.org/blogfiles/Handhelds/LED%20and%20Sound%20Only%20Games/Castle%20Tactix/
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/02/15 11:20 PM

Btw another probably-TSP50C1x game from MB:
https://en.wikipedia.org/wiki/Enchanted_Palace
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/03/15 12:23 AM

Tactix pinout: My browser cache reminded me it's already online:
http://www.seanriddle.com/tactix.txt

kevtris: uPD557 has 2KB internal ROM, your file is 1KB. Was the 2nd half filled with 00s?
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/03/15 04:02 AM

Here's the Tactix pinout: www.seanriddle.com/tactix.txt

Thanks, Kevin!

Edit: beaten to it!
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/03/15 07:00 AM

Originally Posted By hap
Yes, modifications to the microinstructions PLA are more common on TMS1000(SR16) and TMS0970. Touch & Tell looks like it changed much more. Here's some just from the 1st page of the patent, I think it's a bit too much to be able to construct a correct PLA. Maybe you can decap one if you find a one cheap?

default 1100 -> touch n tell

03: XMA -> TAM
3E: IMAC -> XMA
3C: SAMAN -> DCY
01: ALEM -> YNEA

Winbond? I don't think we emulate any of them in MAME.

I decapped the CD8012 chip from Touch & Tell. I don't have the full die shots yet, but here are the instruction and output PLAs:
www.seanriddle.com/cd8012instpla.jpg
www.seanriddle.com/cd8012opla.jpg
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/03/15 08:08 PM

The microinstructions differ a lot from default indeed, I think it's the same one as the one in patent.
see: http://pastebin.com/9UH9QhEM
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/04/15 09:17 AM

blah, I must've uploaded the wrong file. I did dump it as 2K and confirmed the code looked good in it. I dumped it as both because originally I didn't know how big it was.

The bin is updated and should now be 2K.

I put almost all of my games back together now over the last 2 days and so far all of them work. Had to fix a few that had corroded battery contacts and such but all of them seem to have lived through it so far.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/04/15 09:44 AM

Hey guys, the saturn SMPC (peripheral controller) is a hitachi unidentified 4-bit cpu with a test pin. Think you can give it your love?

http://www.db-elec.com/home/technical-info/saturn/schematics has the schematics showing the pinout, the fact that it's a 4-bitter is in the saturn docs (and we all know that sega docs are always perfectly correct).

OG.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/04/15 02:37 PM

kevtris, yeah I noticed that the disasm was from a 2KB file, and then converted that one to a rom file wink
Could you measure the MCU OSCs now that the games are working again?

OG: it doesn't match any HMCS40 pinout. Maybe a HMCS400 one, or did Hitachi make more 4-bit MCUs? (I only know the ones from the 1980s)
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/04/15 10:21 PM

a bit late now. I put them all back together. d'oh. I could probably take video of them running though and then it'd be easy to match the pitch up of the sfx/tunes with the video.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/05/15 05:12 AM

Hmm should I put rik's games back together that have been added to MESS?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/05/15 05:17 AM

I'd do recordings of the video/sound of the assembled games so we can work out the r/c clock stuff.

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/05/15 11:00 AM

Lemme check Youtube first for recordings.

The dumps you did of Rik's games look fine, but as I said, we can't be 100% certain they're ok until it can be confirmed with ext. artwork.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/05/15 03:02 PM

Sean do you have a pcb photo of Tactix? I'd like to know if the on/off button is on the button matrix, and the yellow buttons connection to port A.

Is the tuning cap knob external?(accessible by the end-user) If internal, and assuming you didn't touch the tuning capacitor, can you measure the frequency of the R/C circuit? I couldn't find any vid on Youtube to use as reference for soundpitch. For now, I'm just assuming 400khz.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/06/15 03:33 AM

Hap- no I didn't scan it, and it doesn't look like I shot video. I've got the case here, but I sent the PCB to Kevin. The on/off button was not on the matrix, and the tuning cap was internal. It looks like I left button matrix column 5 (PE0) off my text file, and I don't see in my notes which port A pins those other 2 buttons are connected to.

I got Little Professor '82 today. Looks just like the pics on Datamath.

I'm going to be tied up with work for a couple of weeks. I've decapped, photographed, whinked, and re-photographed a bunch of chips that I need to composite and dump the ROMs/PLAs from. I've also started electronically dumping SM510/511s, and built a circuit to energize one LCD segment at a time.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/07/15 03:49 AM

Originally Posted By ICEknight
Regarding the current vectorized VFD Artwork, I've noticed that, compared side-to-side, they sometimes are not very accurate to their source.

This is specially noticeable when looking at certain cartoony figures, which sometimes look like they've been drawn by using tracing paper over the original art (kind of how other artwork in MAME would look if it was replicated by hand, I guess).

I ignore how these are being made, but perhaps there may be some alternative way of creating more accurate vector files out of the originals?


I fear that this could be a problem that will be carried over to all future supported handhelds, and will be specially noticeable in those with more elaborate graphics, licensed characters, etc, so now that the ball is just starting to roll, it may be a good time to look into it...


If you think you can do anything better, please, PLEASE go ahead! The original vfd images (bright and dim versions of each) are all available at http://blog.kevtris.org/blogfiles/Handhelds/VFD%20Games/

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/07/15 03:50 AM

Dataman arrived today!
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/07/15 12:53 PM

Donkey Kong II must be doing laps around the planet :P

Touch & Tell is added to MAME, it doesn't work like it's supposed to and Vocaid doesn't work at all. For now I assume the patent code has typos/bugs or is incompatible.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/08/15 08:48 PM

DKII showed up today!

After I get the T&T pics composited, I'll transcribe the ROM and we can see if it matches the patent.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/09/15 12:09 AM

ok =)

kevtris will help me out with the tntell pinout when I get stuck, there's no need for a detailed description for it then. Most of it is already documented here: http://www.burnkit2600.com/touch-and-tell/
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/09/15 10:19 AM

Originally Posted By hap
Touch & Tell is added to MAME, it doesn't work like it's supposed to and Vocaid doesn't work at all. For now I assume the patent code has typos/bugs or is incompatible.

The code in the T&T TMS1100 labelled CD8012 is completely different from the patent code. I'll double-check the bits some more then upload the dump.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/09/15 08:48 PM

Here are the CD8012 files:
www.seanriddle.com/tnt8012acid.jpg
www.seanriddle.com/tnt8012acidrom1280.jpg
www.seanriddle.com/tnt8012raw.bin
www.seanriddle.com/tnt8012.bin
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/09/15 09:47 PM

Thanks! I'll doublecheck and add it.
Looks like the die was affected by king Midas's touch (but not tell) - badum tssh :|
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/09/15 10:47 PM

smile I cleaned the die in hot nitric acid a couple of times but the giant glob didn't come off. When I whinked the chip, enough came off to see the ROM array, but I guess it had protected the passivation layer enough so the metal didn't get dissolved. I'll whink it again when I'm doing other chips and make sure those bits are correct.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/09/15 11:20 PM

Hmmm, I missed bit 65; should be a 1.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/10/15 12:56 AM

Confirmed, and one more fix, so:
raw file, offset $08, change $2E to $6E
and offset $698, change $22 to $23.

I don't think I saw any ambigious bits in the midas section.

Oh: I nearly forgot, are you interested in the Nintendo ROB? It has an old Sharp MCU that needs decapping. The toy is super expensive on ebay, so our best bet is someone willing to donate the pcb.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/10/15 02:29 AM

Got it, thanks.

Yeah, if it's similar to the SM51x, and I can figure out how to dump all the pages of those, we could dump it electronically. Otherwise, if we can get a dead PCB, I can decap the chip.

This one seems reasonably priced:
http://www.ebay.com/itm/NINTENDO-DELUXE-...9-/371262843039
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/10/15 02:46 AM

Externally, it's the same pinout as the NES lockout chips, no testpin unfortunately.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/10/15 09:50 PM

tntell is emulated and playable =)
That also includes the UK and French versions, Vocaid, and 6 external modules.

http://www.datamath.org/ has scans of the overlays, though with a visible watermark.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/11/15 03:13 AM

Cool! It would be interesting to see what the differences are between the patent code and the CD8012 dump.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/11/15 12:39 PM

It's hard to say, since overall the patent description and source code comments match how the game works.
tntell patent: http://pastebin.com/bnsskGpt
tntell cd8012: http://pastebin.com/ZmEfMzPB
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/11/15 10:36 PM

Nintendo Mini Classics: Donkey Kong Jr. and Super Mario Bros are on the way!
Not working, price was only $5. If it's the same MCU as the Game & Watch ones, it's a bargain. We'll see..

https://en.wikipedia.org/wiki/Nintendo_Mini_Classics
"The companies that help distribute them are also responsible of the programming for their versions of the titles, which is why some might sound and behave differently."
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 08:21 AM

Originally Posted By hap
https://en.wikipedia.org/wiki/Nintendo_Mini_Classics
"The companies that help distribute them are also responsible of the programming for their versions of the titles, which is why some might sound and behave differently."

Also, there may be different revisions or at least releases with different artwork.

The Donkey Kong Jr. pictured in this site seems to have a more colorful background than usual.

EDIT: Oh, I see Wikipedia also mentions that. =|
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 02:18 PM

Do you think the Mini Classics also use Sharp MCUs, or did they recreate the games, like the Mattel Classic games?
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 02:19 PM

Almost certainly recreated given the quote hap cites. They're basically MADrigal simulators in hardware.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 04:59 PM

Yeah, you can put their decap on low priority, espcially if the MCU isn't emulated yet. They're just a curiousity since it's official Nintendo licensed.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 05:32 PM

I remember noticing a few small differences in Zelda, so they're definately recreated.
Posted By: Haze

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 06:48 PM

Originally Posted By ICEknight
I remember noticing a few small differences in Zelda, so they're definately recreated.


will be interesting to see if they're actually something we know how to emulate, or just programmed into FGPA devices at that point..

entirely possible later re-releases are hilariously hi-tech inside using older cellphone type tech too ;-)
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 07:00 PM

Yeah, might be an ARM7 or something. They've sold probably billions of those things by now.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 07:18 PM

This makes me wonder if Nintendo actually went all the way with the "faithful reproduction" in this one, including its innards.
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/12/15 10:28 PM

http://iwataasks.nintendo.com/interviews/#/clubn/game-and-watch-ball-reward/0/4
It seems to be quite faithful, considering they got some of the original team that made the original to work on the reproduction.
Posted By: midget35

Re: TMS-09xx/1xxx thread (was New Dumps) - 08/17/15 02:36 PM

I'm pretty sure the super mario bros mini classic has a bug on the later level (spinning fire barriers) that can crash the game. Certainly don't recall that in the original.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 09/08/15 05:56 PM

I've been busier than I thought, and it's likely to continue through the end of the month. But then it looks like I'm pretty open through the end of the year.

I've decapped, photographed, whinked, and photographed all the chips from the stuff I've bought and Hap sent me, but I need to composite the pics, transcribe the bits, and document the hardware. Incog sent me a big package of PCBs with blobs, too.

The only one I've finished up so far is DataMan: www.seanriddle.com/tms1980.html I did all the work on that then looked at the patent- it's got the schematic, VFD connections, and source and object code! Oh, well, I verified that the unit Hap sent matched the patent.

Kevin- Incog sent me a couple of NEC chips- a 42-DIP D774C Cassette Vision board marked with what Google Translate tells me is "TV Vader & Yosaku", and an 80-QFP D75316GF from Barcode Blitter. Let me know if you want me to send those to you to dump electronically.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 09/08/15 09:08 PM

Originally Posted By seanriddle
Kevin- Incog sent me a couple of NEC chips- a 42-DIP D774C Cassette Vision board marked with what Google Translate tells me is "TV Vader & Yosaku"... Let me know if you want me to send those to you to dump electronically.


Oh, do we finally know what the D774C is and how to dump it electronically? Guru had me looking for a while...
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 09/08/15 10:23 PM

hap and I speculated that the D774C is a special ucom4 mcu plus built in simple video display ASIC thing. Possibly a 128x128 3bpp framebuffer and a composite ntsc driver?

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 09/08/15 10:26 PM

Great smile having the patent with commented src code for the Dataman will be very useful when I add it to MAME.

I'm not spending much time coding these days: got a new PC recently and am catching up on some games I wasn't able to run smoothly before. I completed Arkham Asylum today. Up next is Arkham City and if I'm not fed up with the batham by then, Arkham Knight :P
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 09/28/15 08:47 PM

Arkham Knight was great, I'm all bathammed out.

I added support for TMS1980 to the TMS1xxx core. TI DataMan is emulated and works.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 10:09 AM

Anyone know how to get ahold of Kevin these days? He's not responding to PMs and I _really_ need to get my games back from him soon...
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 05:32 PM

I do have 4 or so cassette vision carts ready to dump if you find a way smile
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 05:34 PM

Kevtris tried to dump a upd774-based chip from a CV cart and it isn't looking good so far. We may need to decap one to see if there's a test mode accessible on die.
I know some CV carts use upd774 and some use upd777 (I assume both use the same core and the 777 has more rom? ram?)

LN
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 06:16 PM

Originally Posted By Rik
Anyone know how to get ahold of Kevin these days? He's not responding to PMs and I _really_ need to get my games back from him soon...

Yes. He is available on IRC server Efnet, channel #messdev.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 09:32 PM

sorry, I haven't checked the forum much lately; looked like interest pretty much evaporated on the micro dumping front when no one else wanted to vector the VFDs.

that and I had to get the HDMI NES adapter finished up so I did like 2 months of crunch on that getting it finished.

sean: I would've liked it if you warned me you were going to send those boards- I can't do anything with either. The D774 is some kind of ASIC so even if I do dump it, I am not sure it will be useful, and I am in the dark and don't even know how to power it up because I don't have the base unit.

What's the other board? some kind of 80 pin micro on that and it does not have a test pin at all according to the datasheet so I dunno if I can do anything with it. And being 80 pin SMD that makes it all the more tougher.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 10:11 PM

Yeah, the 'job opening' for vectoring VFDs is still unanswered. That shouldn't stop us from dumping/emulating handhelds though! smile
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 11:43 PM

kevtris: I (not realizing that they didn't have any obvious test mode nor that we did not know the pinout) asked Sean to send you those chips (well, I asked him to send the upd774), so don't blame him, please.

LN
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/13/15 11:59 PM

s'ok. not blaming anyone... just would've liked a little warning :-)

I can continue to dump/pin/photog the VFDs for the games.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 07:52 AM

Originally Posted By kevtris
I can continue to dump/pin/photog the VFDs for the games.


I didn't realize there were vfds that needed to be vectorized. I can have a look, I'm kinda used to vectorizing stuff by now, where are they?

OG.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 01:26 PM

About the Cassette Vision stuff. I do have a base device and did quite a few recordings (from JAP RF OUT). Started the pinout, but the video output from the uPD77X itself is not simple RGB or composite, its something else that needs to be figured out.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 03:02 PM

PCB pics of the cassette vision main unit pcb and the cart pcbs are very much wanted, at this point.

LN
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 03:12 PM

Already scanned. I'll try to make a blog post with everything in it.
Including videos.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 03:33 PM

OG They are on kevtris's open directory, here: http://blog.kevtris.org/blogfiles/Handhelds/

If you want more specific info (which games, which MAME shortnames), ask.
Posted By: Olivier Galibert

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 06:50 PM

Originally Posted By hap
OG They are on kevtris's open directory, here: http://blog.kevtris.org/blogfiles/Handhelds/

If you want more specific info (which games, which MAME shortnames), ask.


Asked ;-)

OG.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 10/14/15 07:06 PM

Right, let's see... =)

I'm only listing the ones we currently have good photos for and are candidates for vectoring.
- einvader/einvaderc (sorry, have no hyperlink here)
- bzaxxon http://blog.kevtris.org/blogfiles/Handhelds/VFD%20Games/Bandai%20Zaxxon/
- bpengo http://blog.kevtris.org/blogfiles/Handhelds/VFD%20Games/Bandai%20Pengo/
- bbtime http://blog.kevtris.org/blogfiles/Handhelds/VFD%20Games/Bandai%20Burgertime/
- bultrman http://blog.kevtris.org/blogfiles/Handhelds/VFD%20Games/Bandai%20Ultra%20Man/
- gjungler http://blog.kevtris.org/blogfiles/Handhelds/VFD%20Games/Gakken%20Jungler/
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/02/15 06:59 AM

Originally Posted By plgDavid
Already scanned. I'll try to make a blog post with everything in it.
Including videos.


Are the Cassette Vision scans on-line yet? I have some carts here. Would it help to see some more, or is the technology all basically the same?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/02/15 07:14 AM

more cart scans are better; not sure if the pinout is the same on the upd774 and the upd777?

LN
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/02/15 07:49 PM

Sly DC already scanned everything for CV including PCBs. He is only missing PCB scans for Monster Block and Elevator Panic since he doesn't own the games. I think you own these so PCB scans for both of them would be nice I guess.

He has everything online on his blog:
http://discreteconsoles.blogspot.com

He also started to post scans for HMG-7900/SD-200 which is a similar system. I was actually going to send all my HMG-7900/SD-200 stuff for kevtris to have a look at it, but don't seem to be able to contact him lately.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/03/15 12:27 AM

I'd love to have a go dumping the HMG-7900/SD-200 stuff. Not sure if SlyDC has all carts or if you have something unique, but I could borrow him some (he lives an hour from me).

ssj: you have a list of your carts?

Note SlyDC tried to register on this board without success., is registration broken?
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/03/15 12:54 AM

Did he use the bannister.org contact form after registering like it says to?
Posted By: R. Belmont

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/03/15 03:13 AM

Yeah, everyone who claims no success means they didn't read the giant farging red message stating to email Richard through the contact form smile
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/03/15 08:04 AM

Originally Posted By plgDavid
I'd love to have a go dumping the HMG-7900/SD-200 stuff. Not sure if SlyDC has all carts or if you have something unique, but I could borrow him some (he lives an hour from me).

ssj: you have a list of your carts?

I have all released carts (English versions) except SD-204 for which I only have the French one. Also have the French/Hanimex releases of others not exactly sure which ones from memory, but I'm guessing there won't be a difference between them.

I think SlyDC also has a full set so would probably be easier for you to get them from him since you live so close to each other. If he is willing to lend them of course. If not let me know.
Posted By: Sly DC

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/05/15 06:30 AM

Hi Folks!

R.Belmont was right, i didn't read the message that indicated to contact Richard, but now it is done. smile

I don't have all the cartridges for the HMG-7900, i just have Chaser (SD-201), Gobeur (French version of Chaser), Meteorites (SD-202), Envahisseurs (SD-203) and Mur de Briques (SD-205). I'm still waiting for Raging Turtle to arrive (from a trade) so that's leaves only 4 missing games.

I have an Hanimex HMG-7900 and also a Soundic Programmable Color Video Game SD-290, i could lend one of the game system with all the carts i have to plgDavid but that still leaves a few games short to dump.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/05/15 07:48 AM

Originally Posted By Sly DC
Hi Folks!


Welcome! smile
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/05/15 08:43 AM

Originally Posted By Sly DC
Hi Folks!

R.Belmont was right, i didn't read the message that indicated to contact Richard, but now it is done. smile

I don't have all the cartridges for the HMG-7900, i just have Chaser (SD-201), Gobeur (French version of Chaser), Meteorites (SD-202), Envahisseurs (SD-203) and Mur de Briques (SD-205). I'm still waiting for Raging Turtle to arrive (from a trade) so that's leaves only 4 missing games.

I have an Hanimex HMG-7900 and also a Soundic Programmable Color Video Game SD-290, i could lend one of the game system with all the carts i have to plgDavid but that still leaves a few games short to dump.


Hi!

If you could lend them those that would be great, if he is able to do any progress I'm happy to send him the remaining carts since I have them all.

SD-204 has already been dumped by Gilles Fetis a while back btw, he seems confident the dump is good, but having someone else redumping it would be nice to verify it. It's a microcontroller tagged as D8049 which seems to be some sort of uPD8049.

SD-201 doesn't have anything else other than the PCB.

The console is a NEC microcontroler (D779C-300).
Posted By: Shideravan

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/05/15 03:11 PM

Welcome, Sly DC!
smile

Great thing you came onboard!
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/05/15 03:16 PM

I want to see scans of those SD-2XX carts a lot now...
Posted By: Sly DC

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/05/15 07:02 PM

Thanks for the welcome Stiletto & Shideravan. smile

Check out my new post on http://discreteconsoles.blogspot.ca/

I have put scans of the four cartridges i have. If any of you needs the pictures bigger, e-mail me and i'll send you a RAR/ZIP file.

ssj: so the SD-204 (Raging Turtle) has been dumped ? Great! So that leaves only SD-206, SD-207, SD-208 and SD-210 and maybe SD-204 to be redumped for comparation. SD-201 game is incorporated in the D779C-300 BTW wink
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/06/15 01:36 AM

Very interesting. Hum yeah weird roms. What surprises me is the amount of diodes and resistors on there. JEDEC style roms do not need those. could they be micros?

EDIT2: Can't be JEDEC since A5+A6 would be tied, A3 would be floating.

EDIT1: And looks like bad hand soldered job, just like the other AY-3-85XX pong carts.
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/06/15 02:53 AM

Fun lol.

Was scourging old Motorola 81/82 era catalogs for MC6800 MCU's that could come in 28 pin packages, one was MC6805P2
Googled that and found this very own thread's Sean Riddle

http://www.seanriddle.com/milton.txt
Who saw one SC87XXX in this device, and found it was indeed an MC6805P2

http://www.seanriddle.com/mc6805p2.html
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/06/15 06:47 AM

I spoke with Sean back then and he was interested on trying to dump the Motorolla rom. The SC94806P at least as that was the one I asked him about since I only owned 2 or 3 games back then. Since I was working on acquiring the rest of the games and then send everything to kevtris we decided to wait and I ended up not sending him anything as I'd send the whole pack to kevtris instead then if needed he could forward it to sean since they are both in the US.

I managed to dig out his message from back then:
"That Moto part # is very similar to a 3870 that I dumped from the Boris Diplomat chess computer; it was SC80265P. I don't think there are any 28-pin 3870 variants, but it is likely some other micro, possibly not originally from Moto."

Console PCB pictures if anyone needs them:
http://i.imgur.com/OfpE0xp.jpg
http://i.imgur.com/Jg2jhyz.jpg
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/06/15 06:49 AM

This is probably calling for a new thread by the way, this one is getting completely hijacked now smile
Posted By: plgDavid

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/06/15 09:30 PM

And you have a PM regarding a VERY RARE CART smile
Posted By: Sly DC

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 05:38 AM

That would be a good idea to make a new thread for the Hanimex HMG-7900/Soundic SD-200.

So i'll unhijacked it by giving this link: http://project-megs.blogspot.ca/

It's a new blog about the Electronic Handheld Games in MESS (err...MAME!) that i would make simulators about games that have no micro processors (aka 4-bit CPU's) like those Electro-Mechanical handheld games (example: Marx TV Tennis) and also put information, scans and artworks for upcoming or already emulated games.

Go take a peak! =)
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 07:15 AM

Nice one, looking great I always thought bezels would help a lot on these. Getting yourself into more projects eh? smile

By the way I was thinking on adding a section for Electronic Handhelds to the wiki. Basically everything that's being worked on the basis of this thread, this way we could gather all info (dumped games, artwork, undumped games, missing info, etc.) in one place for easier reference.
Links can be added to relevant sites such as kevtris or sean's website.

Is this a good idea? If so I would need some help in order to get a list of everything that has been dumped/emulated so far. I know hap posted a list a few months back, but I see a lot of progress has been done since then.
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 12:09 PM

Originally Posted By ssj
Nice one, looking great I always thought bezels would help a lot on these. Getting yourself into more projects eh? smile

By the way I was thinking on adding a section for Electronic Handhelds to the wiki. Basically everything that's being worked on the basis of this thread, this way we could gather all info (dumped games, artwork, undumped games, missing info, etc.) in one place for easier reference.
Links can be added to relevant sites such as kevtris or sean's website.

Is this a good idea? If so I would need some help in order to get a list of everything that has been dumped/emulated so far. I know hap posted a list a few months back, but I see a lot of progress has been done since then.


Yes, yes - please do this. Headers from:
https://github.com/mamedev/mame/blob/master/src/mame/drivers/hh_melps4.c
https://github.com/mamedev/mame/blob/master/src/mame/drivers/hh_tms1k.c
https://github.com/mamedev/mame/blob/master/src/mame/drivers/hh_hmcs40.c
https://github.com/mamedev/mame/blob/master/src/mame/drivers/hh_ucom4.c
(others?)
would be a good place to start. smile
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 12:16 PM

Originally Posted By Sly DC
That would be a good idea to make a new thread for the Hanimex HMG-7900/Soundic SD-200.

So i'll unhijacked it by giving this link: http://project-megs.blogspot.ca/

It's a new blog about the Electronic Handheld Games in MESS (err...MAME!) that i would make simulators about games that have no micro processors (aka 4-bit CPU's) like those Electro-Mechanical handheld games (example: Marx TV Tennis) and also put information, scans and artworks for upcoming or already emulated games.

Go take a peak! =)


If these artworks are accurate to the handhelds (?) then I'll happily add them to the MESS Artwork page smile
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 12:42 PM

Wow, I've just found out about the Takeshi's Castle LCD game and I really wonder how would it be possible to make it work in MAME:
https://youtu.be/B6Tgxs3Afgg?t=1m4s
Its display must be manipulated whenever the character enters an underground passageway, which somehow makes the colors get inverted to make it look like a dark room.

Pretty original stuff for an LCD.
Posted By: LoganB

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 01:31 PM

Looks like it's just increasing the contrast, but is an interesting use of that.
Posted By: Sly DC

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 02:34 PM

Indeed! That is a great idea doing a wiki for electronic handheld games, this way we'll known which games are dumped (or not), working status, extra artwork and the whole shibang!

Oh and they should also be place by category of display (LED, LIGHT, VFD, LCD and Color LCD).

­­@Stiletto: The ones i have done are accurate, these were scanned from the original handhelds and vectorized.

@ICEknight: Inverting the display is very easy in fact, you need to rotate 90 degrees the polarizing sheet (the tinted sheet) and you invert the display. This is how it's done with Color LCD games, they rotate the polarizing sheet and put a light source behind the LCD display (like the Panoramic Game & Watch) or they uses white LED's or light bulbs as a light source.

Check this video: https://www.youtube.com/watch?v=H6mKiImQLdQ

This is how it's done for the Takeshi's Castle game, the person rotates 90 degrees the polarise film sheet. =)
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 05:03 PM

Alright I'll get it started soon then, yeah having the display category was something I was going to add.
I was actually thinking on using that to categorize them so we don't have different display types mixed together.

I'll start with the driver info Stiletto posted and the list posted by hap a few months back, then we can add others that will probably be missing.
Posted By: ICEknight

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/07/15 05:34 PM

Originally Posted By Sly DC
@ICEknight: Inverting the display is very easy in fact, you need to rotate 90 degrees the polarizing sheet (the tinted sheet) and you invert the display. This is how it's done with Color LCD games, they rotate the polarizing sheet and put a light source behind the LCD display (like the Panoramic Game & Watch) or they uses white LED's or light bulbs as a light source.

Check this video: https://www.youtube.com/watch?v=H6mKiImQLdQ

This is how it's done for the Takeshi's Castle game, the person rotates 90 degrees the polarise film sheet. =)
That's some really interesting info that I completely ignored, so thanks a bunch.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/16/15 11:16 PM

Is there active interest in trying to decap and either dump, or 'manually dump', a lot of the Tiger LCD games? I was in a conversation with someone that apparently has a _lot_ of these, and he wants to preserve the games, originally by simulation, but he seems interesting in donating them for the cause if someone is up to the task of working on them.

I'm going to point him to Sean's site, so you may hear from him anyway... smile

BTW, has anyone tried X-raying chips to see if the ROM code can be read that way? I've seen X-rays of microchips, but never in high enough resolution to even attempt to identify anything on them, but I'm not sure it's even possible to get a 'readable' image that way...
Posted By: ranger_lennier

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/18/15 01:54 AM

Sean Riddle has looked at the Tiger R-Zone some. I think that work is still in progress.

http://www.seanriddle.com/rzone.html

The older Tiger LCD games might use some similar technology.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/18/15 02:21 AM

Yeah, this might be a slow process, especially since there's literally 100s of Tiger games (not to mention all the other manufacturers)... But at the very least, get the LCD photographed, and the chip decapped and photographed so when it's convenient for anyone that wants to help, ROM code can be 'dumped' and possible emulation worked on... smile

I'm curious how easy it is to remove the epoxy blobs with Decap? That would be something I'd be all for playing with myself... smile
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/18/15 04:47 AM

Anyone owns a ColorVision? Just got one game for it and seems something interesting to try to dump and emulate.
The cart seems to basically consist of the LCD to plug into the console.
Posted By: Vas Crabb

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/18/15 06:18 AM

ColorVision seems to be one of those systems where the cart connector wiring selects between games programmed into the main unit. The blob in the main unit would need to be decapped and analysed. Carts are needed to image LCDs, obviously.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/19/15 05:05 AM

Yeah, the ColorVision carts are just an LCD screen and a pinout to trigger the game to play. You can see the inside of a cart and the system here:
http://www.handheldmuseum.com/Romtec/Colorvision.htm

It's that blob near the cartridge part we are interested in... I think I have a couple of them, I may be able to sacrifice one to the cause...
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/19/15 06:01 AM

Yeah that's pretty much it. Carts aren't an issue it's just a matter of tracing the connections and convert the LCD images, that blob will definitely need a decap. Do you have any idea of what's hiding behind the blob?

If you are willing to sacrifice one that would be great Rik, all I have is 1 cart (Submarine). How many of the games do you own? Beasts Planet seems to be kinda rare.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/19/15 09:32 PM

Originally Posted By ssj
If you are willing to sacrifice one that would be great Rik, all I have is 1 cart (Submarine). How many of the games do you own? Beasts Planet seems to be kinda rare.


I have these 3 for sure:
Horror House
Jungle Boy
Monster Chase

I might have another loose one with one of the consoles, but I think it's just a duplicate of Monster Chase...
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/20/15 12:03 AM

That would leave only Beasts Planet missing then as I own Submarine. Never saw that one for sale, although truth to be told never really looked carefully into these until very recently.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/21/15 06:20 AM

I'm finally back! I've done nothing hobby-related for the past couple of months, so I'm trying to figure out where I'm at with everything. I was working on dumping the Sharp SM series electronically and driving LCDs for digitizing, Hap sent me a G&W, Mr Challenger, Spelling Bee and Little Professor LCD, Lord Nightmare sent me Compact Speak and Spell, and incog sent a bunch of boards, including a G&W. I did continue buying stuff off ebay, so I've also got G&W Cement Factory, Blackjack, Bomb Sweeper and Boxing, Mattel Dungeons and Dragons board game and LCD game, Computron notebook, Coleco Zodiac, Mattel Gin Rummy, Tomy Electronic Pinball, Tandy Basketball, Tandy Electronic Golf, VTech Mini Wizard, Mattel Mind Boggler, Mattel Gravity, Mattel Horoscope Computer, Scrabble Lexor, a bunch of Konami games (Blades of Steel, Gradius, Marble Madness, Contra, Star Trek 25th), several Tiger handhelds, many newer LCDs, and a ton of calculators. Whew!
Posted By: Stiletto

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/21/15 08:30 AM

Originally Posted By seanriddle
I'm finally back! I've done nothing hobby-related for the past couple of months, so I'm trying to figure out where I'm at with everything. I was working on dumping the Sharp SM series electronically and driving LCDs for digitizing, Hap sent me a G&W, Mr Challenger, Spelling Bee and Little Professor LCD, Lord Nightmare sent me Compact Speak and Spell, and incog sent a bunch of boards, including a G&W. I did continue buying stuff off ebay, so I've also got G&W Cement Factory, Blackjack, Bomb Sweeper and Boxing, Mattel Dungeons and Dragons board game and LCD game, Computron notebook, Coleco Zodiac, Mattel Gin Rummy, Tomy Electronic Pinball, Tandy Basketball, Tandy Electronic Golf, VTech Mini Wizard, Mattel Mind Boggler, Mattel Gravity, Mattel Horoscope Computer, Scrabble Lexor, a bunch of Konami games (Blades of Steel, Gradius, Marble Madness, Contra, Star Trek 25th), several Tiger handhelds, many newer LCDs, and a ton of calculators. Whew!


Christmas come early laugh
Posted By: ssj

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/21/15 09:45 AM

Indeed!

Welcome back Sean, seems you have a ton of work ahead of you smile
Posted By: Shideravan

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/21/15 04:57 PM

Welcome back Sean smile
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/22/15 07:53 AM

Tomy Pinball and Mattel Dungeons and Dragons board game are both TMS1100, so they should be pretty easy. VTech Mini Wizard looks like a 4-bit MCU, but I don't recognize it. There's no name or logo on the die other than a V, so maybe it's their own custom. Anyway, I can't distinguish any ROM bits in the array, so it's moot.

Is anyone working on Rockwell PPS-4/1 in MESS? I remember Kevin having some chip, and we found the patent with MM77 assembly code, but I'm not sure if any coding has been done. Patent US4339134 for a blackjack calculator has assembly code for the Rockwell A48xx calculator chip, (I have a blackjack calculator and a regular calculator with that chip) and it looks very PPS-4/1-ish. The mnemonics are different, but the opcodes are mostly the same, and the patent has a pretty good explanation of each instruction and I was able to map them to PPS-4/1 fairly well.

Patent 4322074 for the game Gravity mentions that an object code listing was submitted with the patent application, but nothing is on the USPTO site or Google. So I called the USPTO and asked, and they said I could order the "patent wrapper", which includes the application and correspondence between the patent examiner and applicant. But the older ones are only available on paper, and cost $225 to copy! I bit the bullet, and several weeks later I got a bound folder with several hundred pages of application and correspondence. It's pretty interesting to read; the examiner rejected or objected to all the claims in the application, so they had to make a lot of changes, some of which were rejected again. I was disappointed that the object code listing was just that, a 4-page binary dump of the ROM.

Gravity uses the same chip as Mattel Football and Baseball (B61xx), and I had decapped both of those, but didn't have Gravity. After watching ebay for several months, one finally came up for a somewhat reasonable price. I decapped the chip on Friday, took pics and composited them, and transcribed the ROM bits. A count of 1s versus 0s showed I had swapped them, so I fixed that and then wrote some programs to figure out how to map the bits on the die to the bits in the patent. The layout on the die is 64 rows by 112 columns- the 112 columns are made of 8 groups of 14 columns for the 14 pages of 8 bit bytes. First I figured out how the 8 groups of columns mapped to bits in each byte, then how the 14 columns mapped to banks, then how the 64 rows mapped to the sequence in each bank. Eventually I got an exact match to the patent, so I should be able to use the same mapping on Football and Baseball.

The older games (Auto Race, Battlestar Galactica) use the B60xx chip which has less RAM and ROM, but it looks like they use the same opcodes. I've decapped those, so they should also be dumpable. And there are newer Rockwell chips in the same family (that have more RAM and ROM, and some with better sound circuitry) that probably also use the same opcodes.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/22/15 08:56 AM

$225 for the rom dump? Wow, talk about dedication!
Also, you should (maybe, if you feel like it) bug the USPTO to attach the rom binary pages to the patent hosted on patft.uspto.gov since they're clearly meant to be part of the public record as the patent mentions them...
(there's probably some stupid form that has to be attached to it too, explaining that the pages were initially omitted, though, and its probably too much hassle to generate/make said form, since it probably has to be done via the same lawyer/firm as generated the patent in the first place. and its useless since the patent is expired anyway.)

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 02:15 AM

I don't know how long it would have taken me to figure out the ROM bit mapping, so $225 might be very cheap! But I was hoping for more 'inside' information in the wrapper. The patent wrapper is public information, but I guess the USPTO isn't going to go back and digitize all those patents that were submitted on paper.

I confirmed that the "ROM word address decoder" (to use the TMS1000 terminology) is the same on Football, Baseball, Gravity and Battlestar Galactica. Bit decoding is the same on Football, Baseball and Gravity, but BSG only has 8 banks instead of 14, so I'll have to figure it out from the decoding circuitry.

Tandy Basketball is PIC1655A and Coleco Electronic Quarterback is TMS1100, so those will be easy. Scrabble Lexor is Panasonic MN1405, like the MN1400 in Computer Perfection, so I'll try to dump it.

Tandy Golf is HD38135S, which I don't know, and Mattel Gin is NEC D650C, which I don't know (it also has a version of the LCD controller like in Microvision). Dungeons and Dragons LCD is Toshiba T6818S, which I don't know.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 05:39 AM

NEC upd650c aka 'D650C' is dumpable electronically with no decap; send to kevtris.

HD38135S I don't know, it may be similar to some of the other Hitachi NMOS parts, which are also dumpable electronically. Do we have a datasheet for it?

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 06:46 AM

I looked through my notes for info about the HD38135, and a couple of Mattel games have similar chips: Sub Chase has HD38132 and Armor Battle has HD38133. I sent Armor Battle to Kevin, but we couldn't find a data sheet and he didn't have high hopes.
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 08:19 AM

sean: I think the MN14xx can be dumped electronically, I saw something about it in the data sheet I think, it's been awhile. I remember looking into it when you did the computer perfection.

I can dump the D650C with the D55x rig I already have. I dumped one I found cheap on ebay to test.

I don't know much about the toshiba part- there's an LCD driving toshiba MCU in that vtech learning window as well (and SP0256 speech chips and ROMs that I have dumped).
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 09:33 PM

Kevin- I've found a few datasheets, but they don't really have any info about the test pin. I'll try some simple stuff and see if I get lucky.

You want me to send you the Mattel Gin game that has a D650?
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 10:58 PM

sure, send. I will poke around on the MN stuff tonight
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 11:15 PM

Just looked. the 40 pin version of the MN14xx parts definitely have a test pin... the 28 pin version, I don't know. I can't find a datasheet with the pinout for the 28 pin version, just the 40 pin one. the MN1405 is 40 pins, while the 1400 can be 28 or 40.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/23/15 11:39 PM

http://www.semicon.panasonic.co.jp/ds4/MN1400_series__J_discon.pdf shows the 28-pin version of the 1400 (slightly different pinout from the 1402). The 1400 in Perfection has 28-pins; my die shot shows 12 un-bonded pads, so it's easy to figure out the numbering.

Even the 16-pin MN1404 has a TST pin! And it only has 6 outputs (CO0-CO5, which I think are strobes, so normally only one active at a time).
Posted By: kevtris

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/24/15 09:12 AM

ah nice datasheet. the ones I found had the instruction set and bit mappings so once the ROM is extracted getting it to run should be pretty simple. Not sure how the test pin works, but I wouldn't be too surprised if it's similar to how the 55x/650/HD388xx work.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/25/15 07:42 AM

I uploaded info on the TI Little Professor 1982 that Hap sent:
http://www.seanriddle.com/tp0456.html
I need to scan the LCD.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/26/15 05:04 AM

Update on known tsp50cxx chips:
1. Keynote speech synthesizer module that Kevtris has ("2472JXT // CSM10075AN")
2. MB Electronic Talking Battleship(1989)[Oct 92] ("2234673 // BATTLESHIP // CSM10017AN")
3. MB Electronic Talking Battleship(1989)[Apr 96] ("5BATX6T // BATTLESHIP-2 // CSM10259AN")
4. MB Electronic Talking Battleship(1989)[? 98 or 99] ("85AX02T // B-SHIP 1998 // CSM10287AN")
5. MB Dream Phone(1991) ("5507 JKT // DREAM PHONE2 // CSM11120AN")
6. Echo II Speech Synthesizer Card for Apple2 (1989) ("ECHO-2 SEC // LU 9020 // 25954 PHILIPPINES") [note this uses a different, earlier tsp50c01 or 02 or other part(probably 02 given the '25954' number starts with 2) with a slightly different pinout to tsp50c10]
7. MB Omega Virus(1992) ("3253ACT // OMEGA VIRUS // CSM11161AN")
8. Mystery Vtech unit from Dumping Union ("84C91HT // VIDEO TECH // CSM10150AN")
we suspect that MB Mall Madness also uses a tsp50cxx but don't have the chip label yet.
Also from Boardgamegeek forums we know a German voice version of Omega Virus exists as well.

What we know about the tsp50cxx marking numbers:
First line:
First digit is almost certainly the last digit of the manufacturing year. Unclear what the rest is.
Second line: Product name, if present.
Third Line: "CSM", then "10" for tsp50c10 or "11" for tsp50c11, then 3-digit mask code, then 'as a whole series' silicon stepping revision (usually "A") and "N" for plastic package.

Unclear what changed between the 3 revisions of Talking battleship. LN owns one of the '10 92' made boards, Zorix owns a '4 96' made one. Sean owns a 1998 one but the MCU has been decapped already and didn't seem readable optically, so we could use another 1998 one if possible.

There is almost certainly a way to digitally dump these chips, the databook may hold some clues: http://www.ti.com/lit/ml/spss011d/spss011d.pdf

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/15 09:54 AM

I uploaded info on Tomy Pinball and Mattel Dungeons and Dragons Computer Labyrinth Game: http://www.seanriddle.com/tms1100.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/15 05:53 PM

For lprof82, do you have higher resolution photos of the PLAs? I see the output PLA on the left, with a bit of LCD RAM(?), and main instruction line select + microinstructions on the middle and right.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/15 08:42 PM

I'll post some more pics of the lprof82 die.

I corrected a couple of bits on both Tomy Pinball and Mattel D&D, so get the new binary files!

<edit>
There's so much different on the CD4570 die that I uploaded giant pics of the full die before and after removing the top metal layer:

www.seanriddle.com/lprof82_acid_big.jpg
www.seanriddle.com/lprof82metal_big.jpg

They are both about 26 MB. It's icy here, so my internet connection is slow today, so it might take a while to download them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/15 10:38 PM

Got them, thanks. I'll do the TMS1100 ones first.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/28/15 11:32 PM

Cool! I uploaded a scan of the D&D playfield. The printed part is glued onto a folded plastic piece with conductive traces, like a lot of games. I tried to remove it, but it's stuck on so well that it was pulling off the paint, so I scanned it as-is. That means you can see some of the traces through the printing, but that's how it really is. The case covers up a lot of it anyway- just the centers of each square are visible.

D&D is interesting; just 72 buttons and a speaker. But it's another one of those electronic games with pieces, which makes it more difficult to emulate in MESS.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 11/30/15 06:38 AM

I uploaded pics of the Little Professor 1982 LCD. One pic has all the segments on, and 3 others are the different segments that make up the Professor's face.

http://www.seanriddle.com/tp0456.html
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/03/15 08:55 PM

I posted info on Texas Instruments Spelling B that Hap sent: www.seanriddle.com/tmc0270.html
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/05/15 03:32 PM

Great! =) looking forward to emulate it.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/05/15 09:52 PM

I finally got a good dump from the TMC0355 in MrChallenger, so I posted that info, too: www.seanriddle.com/tmc0270.html

I've dumped TMS6100s and TMC0430s before, so I figured the TMC0355 wouldn't be too hard, but it gave me some trouble. It outputs 4 bits at a time instead of 1 bit like the other chips I've dumped, but that was easy to fix. But it looks like it is using an internal oscillator that I couldn't figure out how to disable, which gave my PIC-based dump hardware issues.

If I tried to clock it with the PIC, it mixed its clock with mine and bytes were skipped. If I left its clock disconnected or tied low, no data came out. If I tied it high, then data came out, but because I wasn't clocking it, the M0/M1 signals I sent to load addresses and read nibbles weren't synced. For large stretches of bytes, everything was OK, but occasionally nibbles were missed.

I was going to have the PIC sync to the ROM's clock, but the datasheet says that the M0/M1 edges need to be within 1 uS of the clock, which is pretty tight. So first I checked 144 of the dumps that I had made with the clock tied high, and found that 27 of them matched. I examined that data and figured out it was a simple dictionary of the words the game uses; top of ROM has 2-byte pointers to the words, which are stored 0=A, 1=B, ..., 25=Z, with the high bit set on the last letter. I wrote a program to make sure the data was consistent, so I'm sure the dump is good. I can decap the chip and visually compare if needed.
Posted By: Tauwasser

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/07/15 12:13 AM

Originally Posted By hap
Ah, found a good thread with KB1013 tech info, with scans of official doc. Looks like enough to emulate it.
http://www.nedopc.org/forum/viewtopic.php?t=9662


Originally Posted By hap
I got an interesting link from MetalliC yesterday =)
http://sfrolov.livejournal.com/175067.html
http://www.leningrad.su/files/nupogodi.zip

It's a 80s USSR clone of Nintendo G&W Egg. The MCU is a КБ1013ВК1-2, probably a clone of a Sharp MCU. There's a 2KB ROM in the .exe resources, the data looks similar to Sharp MCU code.


Is there any news on emulation? Can these games can be dumped using software? Has somebody already dumped these?

I have the Nu Pogodi IM-2 here, but apparently some (battery?) fluid got inside the LCD, rendering the left side semi-useless. Maybe someone more knowledgeable can salvage it?
PCB is in a rough shape, I suspect it met water at some point, but the game works nonetheless. IC is unmarked, but pinout seems to match КБ1013ВК1-2 from Russian thread.



cYa,

Tauwasser
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/07/15 12:44 AM

Yes, last time I chatted with MetalliC he let me know that Sergei has dumped(decapped) a couple more of these.

In MAME, I will add them when the parent CPU emulation is mature enough. For this, we need more test data first(aka Nintendo and Konami LCD game dumps).
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/07/15 06:52 AM

Originally Posted By Tauwasser

I have the Nu Pogodi IM-2 here, but apparently some (battery?) fluid got inside the LCD, rendering the left side semi-useless. Maybe someone more knowledgeable can salvage it?


The type of damage shown indicates the lcd glass itself is cracked, and the black stuff is the lcd material itself leaking or oxidizing due to air or moisture getting in through the crack, or some similar process. It is not fixable.

LN
Posted By: Tauwasser

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/07/15 06:46 PM

Well, maybe I should have mentioned it earlier, but whatever. The black color is only visible through the polarizing film. When I took it apart, I could see the intended shapes on the LCD as well as this liquid, no obvious crack, so I doubt it's oxidation, but still probably not fixable.

However, maybe someone more knowledgeable than me could still use the LCD to take pictures of the shapes using some kind of polarizing filter? How are the shapes dumped (for a lack of a better term) anyway?

Anyway, any takers for this game let me know, I'll ship it. Willing to get this thing dumped even if it's only for confirmation of the ROM that's floating around.

cYa,

Tauwasser
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/07/15 07:38 PM

I've had a little luck taking pics of an LCD through my microscope like a chip die, but for many of them, I can't get enough contrast to be useful, even with polarizing filters.

I bought some PIC microcontrollers with LCD outputs, but haven't had a lot of luck driving panels with them. For the TI Little Professor with an LCD panel, I used a signal generator to create a 100Hz or so sine wave and varied the amplitude around 2V until I got good contrast. Then I applied that signal to the different inputs to map them, and then connected it to all the inputs to get a picture of all the segments.

I need to work on a better way to get pictures. The panels have conductive traces instead of wires, and it's tough to connect to them. Usually there's a little rubber piece that has conductive material in it that is sandwiched between the LCD panel and the PCB, but it has to be squeezed pretty hard to get all the connections to conduct. So the best bet would be to modify the existing game case to get access to the connectors. I didn't have that option with Little Professor because there is no PCB- it uses a sheet of plastic with traces on it, which is difficult to solder to because the plastic melts. So I built a little jig to connect a PCB to the panel, but it's not flat on the front to fit on my scanner, which means I had to take pics, and it was hard to get straight-on shots without glare.

And even the simple Little Professor panel has 72 segments, which is a lot to map out. It has 7 7-segment digits, and those formed a logic pattern, which helped. A game like Top Gun has over 100 segments- see patent US5137277. It would be very time-consuming to describe each segment, so it seems like the best bet would be to take one picture per segment. That means an automated system would be helpful.

I'll finish mapping Top Gun's LCD segments so Hap can work on the driver some more.

If no one else responds about the Nu Pogodi you can ship it to me. I can try a different polarizer to see if that helps the blob issue. I'll be working on dumping Sharp SM5xx MCUs again in a week or so, so I might be able to dump it electronically. Worst case, I could decap it and read the ROM visually, but that would destroy the MCU.
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/08/15 12:09 AM

Originally Posted By Tauwasser
Well, maybe I should have mentioned it earlier, but whatever. The black color is only visible through the polarizing film. When I took it apart, I could see the intended shapes on the LCD as well as this liquid, no obvious crack, so I doubt it's oxidation, but still probably not fixable.


It may not be cracked, it might just be the two pieces of glass separating slightly along the side exposing the liquid crystal (likely not visible to the naked eye). But either way, it's unfixable without the equipment used to actually manufacture LCD screens. The liquid crystal is never visible without the polarizing filters. I suspect it was damaged in some way by being dropped, and the black 'cloud' will likely get larger over time.

In theory, you could actually separate the glass layers, clean out the crystal completely and still be able to see the sprites (barely), but they'd be damn hard to photograph like that. They are sort of etched into the glass (I assumed it's a conductive material bonded to the glass, never really looked into who these are manufactured...) Not the easiest solution, but usable if there's no other option.

The circuit board looks fine though, the weird stippling you see on it is just how the green 'paint' layer was applied (or dried) when it was manufactured.

Did you remove the speaker to see if there's markings on the chip on that side?
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/11/15 04:25 PM

update: I verified Mattel dnd and Tomy Pinball, and prepared the PLAs. Adding them to MAME should go fine...

I'm happility addicted to Fallout 4, coding time gets 2nd place. ;(
Posted By: Tauwasser

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/11/15 08:12 PM

Originally Posted By Rik
The circuit board looks fine though, the weird stippling you see on it is just how the green 'paint' layer was applied (or dried) when it was manufactured.


I know a thing or two about PCBs and it's definitely some kind of damage, salt water probably. The actual texture doesn't come out very good in the pictures.

Originally Posted By Rik
Did you remove the speaker to see if there's markings on the chip on that side?


I did not, but looking under it sideways just reveals a convex epoxy shape with no visible markings.

If there aren't any other takers, I'll ship it off to Sean.

cYa,

Tauwasser
Posted By: Rik

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/12/15 02:16 AM

Originally Posted By Tauwasser
Originally Posted By Rik
The circuit board looks fine though, the weird stippling you see on it is just how the green 'paint' layer was applied (or dried) when it was manufactured.


I know a thing or two about PCBs and it's definitely some kind of damage, salt water probably. The actual texture doesn't come out very good in the pictures.


I have (and have had) several of these Russian games before, and have seen the same thing on more than one of them... It's just whatever the green coating is being poorly made. Is it flaking off? If it is, and you remove it, the board looks fine underneath.
It might be something different on yours, but I've never seen liquid damage on a circuit board that didn't leave behind other evidence (corrosion, rust, residue from the liquid, etc...) I just made that comment as yours looks exactly like a couple of these 'Elektronika' games I've had in the past...

I'd say Sean's the best option though, send 'em his way. smile
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/17/15 05:57 PM

Tomy Pinball and Mattel D&D are added to MAME and working. We'll need a volunteer for external artwork for the pinball game. The D&D boardgame however will be hard to play with or without external artwork. The artwork system would need to be more versatile. A developer could use the emulation to make an accurate simulator app though.

I'm working on MR Challenger and Spelling B now, some bit fixes here for the raw files:
mrchallenger273raw_fix1.bin:
- offset $0CF change $3A to $2A
- offset $105 change $F2 to $B2
spellingb1984raw_fix1.bin:
- offset $532 change $00 to $04
spellingb272raw_fix1.bin:
- offset $656 change $9D to $9C
- offset $8B0 change $9F to $9E
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/18/15 03:58 AM

Thanks- I updated the files on my site. I've got a couple of PIC1655As dumped as well as some of the bare chips incog sent me. I'll get those uploaded over the next couple of days.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/20/15 10:08 PM

Originally Posted By seanriddle
I'm finally back! (...) and a ton of calculators. Whew!

By the way Sean, I'm getting curious :P which calculators did you get? IMHO TMS0952 and 0972 are worth getting. Especially as the 0972 was licensed to multiple manufacturers. For a weird example of it, see http://www.datamath.org/Related/Concept2000/Barbie.htm
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/15 05:02 AM

I bought a couple of lots off ebay, and wound up with: TI57, TI55, The MBA, SR 51A, TI57 LCD, TI1025 and TI5025. I've also got Canon Palmtronic 8 and Palmtronic LD-8M 2, Lloyd's Accumatic 200, Corvus 312, Radio Shack EC-281, Sharp EL-218, Sears Pocket PD12, APF Mark 31, Novus 850, Montgomery Ward P50 and Commodore MM2SR.

I just bought a TI1200 and TI1250 (maybe I'll get lucky and one will have the 0952 and the other the 0972), but I only found the Barbie in a lot of 4, for too much $$$$.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/15 02:42 PM

I'm certain TMS0972 is same in each, so decapping/dumping one from a cheap calc and we can practically emulate all of them. Including the Barbie ;P
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/15 08:35 PM

Did the Spelling B I bought for you include the booklet? I think the manual for the one on datamath is for the 2nd revision hw. Speaking of the 3.9MB one here http://www.datamath.org/Edu/SpellingB.htm

If you have it, is it equal? On MAME, I'm getting mismatched numbers, for example:
26 = nurse
85 = broom
64 = chain

It also locks up on me sometimes, I'll look into that. The Hangman game mode works fine.

*edit*
WIP driver: http://git.redump.net/mame/tree/src/mame/drivers/tispellb.cpp
also, datamath includes Math Marvel in the same list. but you see I didn't put it in the driver comments. It actually is the same hardware as DataMan: 1 MCU only, no TMS0355 ROM.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/21/15 09:33 PM

Spelling B did come with a book. It looks a little different from that pdf, but the pics look like they are the same: 26 is a bed, 64 is a dog, and 85 is a kite. Must be another bad bit, huh? I'll check again.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/15 12:22 AM

spellingb1984raw.bin byte 2B1: 8D should be 8F
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/15 10:50 PM

There's as much chance of bad emulation too. Unfortunately it's still broken after correcting that bit.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/15 10:54 PM

Bummer. I wrote a new algorithm for detecting bits in the die shots, and then compared its results to the old ones and found that 1 bit in the 1984 dump, and none in the 0272 dump.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/15 11:05 PM

Does it find any in mrchallenger 0273? That game almost works. I can see it going to the correct address in the word ROM for MYSTERY, then read the letters. And then it shows junk on the screen instead :p
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/22/15 11:40 PM

I had scanned that one with the new algorithm already, so I just now rescanned it looking for bits where the average value of the red component of the color in the middle 4x4 of each bit was > 180. After fixing up some bits that it missed, that dump is identical to the first one. So that gives me pretty good confidence that the dump is good.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/15 02:47 AM

I think I found the problem for Mr. Challenger, the game expects reads to be valid after setting indirect address on the VSM.
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/23/15 05:47 AM

Cool. I read about that in the data sheet, but didn't know anything used it. I've got some VSMs; I can write some PIC test code and capture waveforms if it turns out that you need them.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/28/15 10:50 AM

After fixing a stupid bug, Spelling B emulation is playable, I didn't get any lockups. There's still a bug where the game gives the wrong word sometimes, maybe mcu<->mcu comms emulation timing problem.

Also FWIW Mr.Challenger patent with source code: 4421487
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/15 04:16 AM

Hmm, since the Mr Challenger patent has binary object code, it might not be too hard to OCR to compare to my file.

I got the TI calcs- a TI-1200 with an 0952 and a TI-1250 with an 0972. I got a good pic of the 0952 top metal, but I damaged the 0972 die. The ROM array is OK, though.

The 1250 has memory functions and CS (change sign, or +/-) that the 1200 doesn't have. They are in the same case, with just those 5 buttons covered up on the 1200. I pressed the button where CS is, and it worked as it should. The memory buttons were actually missing the metal domes that make contact with the wires, but I used a clip to connect the wires, and all the memory functions work as well!

I haven't removed the top metal layers yet, so I haven't transcribed the ROM bits, but I visually compared the first few bytes and they are different.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/15 05:07 PM

The PLAs look ok on the 0972?
- microinstructions to the left of the ROM
- main opcode redirectionm at mid-top of die
- output pla at left of die

The Mr.Challenger VSM, what was the pinout like?
Is a newer TMS6125 you have (for example Touch n Tell) the same pinout?
Code:
(1) as in TMS6125 datasheet
                 +---------+
       DATA/ADD1 | 1    16 |  NC
       DATA/ADD2 | 2    15 |  NC
       DATA/ADD4 | 3    14 |  NC
       RCK       | 4    13 |  NC
       CLK       | 5    12 |  VDD
       DATA/ADD8 | 6    11 |  CS
       NC        | 7    10 |  M1
       M0        | 8     9 |  VSS
                 +---------+


(2)
                 +---------+
       DATA/ADD1 | 1    16 |  NC
       DATA/ADD2 | 2    15 |  NC
       DATA/ADD4 | 3    14 |  NC
       DATA/ADD8 | 4    13 |  NC
       CLK       | 5    12 |  VDD
       NC        | 6    11 |  /CS
       NC        | 7    10 |  M1
       M0        | 8     9 |  VSS
                 +---------+

I want to make MAME TMS6100 emulation more accurate. The current one is from 2010. That was before we added Speak & Spell driver.

*edit* RCK I think is a gate/mask to CLK, maybe this was the thing you were having trouble with when reading it out.
Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/15 05:23 PM

Another VSM question. On Mrchal. the game reads from VSM when M0 is high. This implies the DATA lines are ready for reading after rising edge of READ command. Our current emulation model assumes DATA can be read after _falling_ edge of READ cmd.

Are you able to confirm this? And is it the same way on other VSMs?
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/15 07:59 PM

Checked touch and tell pcb with meter, conclusion is the tms6125 datasheet (1) is right, despite what I've been told by others.
See https://www.dropbox.com/s/e9rrrq9h8t75zcx/2015-12-29%2014.42.43.jpg?dl=0
You can see the tms6100 footprint with the flashlight shining thru the pcb and the tms6125 above that. Pin 1 of both footprints is at the bottom left of each one. note the /CS and VSS of the tms6100 footprint are tied together by a trace.

Also note the 'top row' (pins 15-28) of the tms6100 are n/c inside the package, so ti used that whole row of vias as convenient tie points, they don't actually do anything to the 6100.

BUT. one new thing jumped out at me:
Pin 2 of the tms6100 has a trace connected to it. The tms6100.cpp lists this pin as N/C, and the other end of the trace connects to CD2802 pin 2, the PDC pin. Maybe some early tms6100s required a PDC pulse on pin 2 to accept m0/m1 commands? Or perhaps it was a routing error at TI where someone mixed up pin 2 of cd2802 and pin 2 (which is supposed to be N/C?) on the tms6100 when laying out the board.

LN

Posted By: hap

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/29/15 10:48 PM

Simply cut pin 2 and see if it still works?
I wouldn't be surprised if pin 2 is the optional RCK pin.
Posted By: Lord Nightmare

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/30/15 12:43 AM

Well, the touch and tell is dismantled (i only have the board for it) so i can't cut it. Also the touch and tell doesn't use tms6100 roms except in cartridges. The rare Vocaid does use a tms6100, though.

LN
Posted By: seanriddle

Re: TMS-09xx/1xxx thread (was New Dumps) - 12/30/15 04:44 AM

Unfortunately, the 0972 PLAs are gone. Well, they are embedded in plastic, torn off the die. I might be able to get them out when it gets warmer. The 0952 die is laid out like the TMS1000: www.seanriddle.com/0952_metal.jpg

I am sure that the Mr Challenger CD2601 pinout is #2 that you listed above. The PCB connects pins 4 to 6, and 7 to 10. But I dumped it using pin 4 for data/addr 8 and pin 10 for M1. I tried using 6 for data/addr