Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

RB If you're reading, maybe you are interested in the 6805 Milton one?

I finally finished adding these to MAME (reminder: MAME and MESS are now MAME)
- Coleco Head 2 Head Baseball
- Entex Basketball 2
- Entex Color Football 4
- Tomy Breakup

Tomy Break Up has some glitches where LEDs flicker in-game. I doublechecked the ROM and PLAs so those are fine. I don't think it can be the TMS1025.

I was able to dump the Milton MC6805P2 electronically using non-user mode. But oddly enough, I wasn't able to get it
to go into self-test, even though that's well documented.

I put the chip on a breadboard and gave it power, put a 1MHz clock on EXTAL, grounded XTAL, tied /RESET, /INT and TIMER high
and connected NUM to +5. I checked each port with an LA and noted that all PORT A bits were high, PORT B bits were toggling
(apparently) randomly, PORT C<3> was high and C<2:0> were toggling.

So I assumed PORT A and C<3> were inputs and the others were outputs. I figured opcodes would be fed into PORT A, so
I used 8 1K resistors to +5 and ground to set it to $9D, the opcode for NOP. I also tied C<3> high for the first test. I
captured PORT B and C<2:0> and was surprised to see an obviously repeated pattern every 16384 uS. Looking closer, there were
8 clocks between bytes being output, and 16384/8 = 2048, which corresponds to the 11-bit address space. Port C<2:0> outputs
bits 8-6 of the address bus, so it counts from 000 to 111 four times during a complete dump.

After searching for a while, I found the bytes that I had visually transcribed from the Milton die shot. I verified that all
the electronic dumps I made were identical, then compared the electronic dumps to the visual dump, and found 4 more bit errors
in my visual dump.

I was confused about where the dump was starting; each time it re-started at the same byte after reset, 1437 bytes in.
Then I realized that it was fetching the reset vector from $7FE, but was getting $9D9D from the resistors, which translated
to $59D in the 11-bit address space. So it dumped from there to the end before wrapping around to $000.

I was expecting to have to feed the chip opcodes to dump the ROM contents, so I was surprised but happy that it turned out
there was a simpler way. It looks like in non-user mode that the chip fetches the byte from memory and puts in on PORT B,
then executes the opcode on PORT A. Since I had made it a NOP, it just kept fetching the next byte. I'm not sure if any
of the other 6805 varieties will do the same, but maybe this will help.

Progress is a bit slow on my side.
I finished the MELPS 4 MCU core emulation, the only dumped game using it at the moment is Coleco Frogger.

What to do next? hmm, there's the COP400 MCU core that needs to be looked at, the PIC core too. And mayhaps the Sharp MCU core for Nintendo Game & Watch (Sarayan is very busy with other things).

Again: any dev wanna look at Milton MC6805P2?

Busy with work here, but I've done some stuff.

I dumped the Milton GROMs; it took longer than I thought because they weren't behaving like I thought they would.

I'll get the keypad matrix documented tonight, then all the info should be on my site.

About Sharp SM510 series: I think I'll start with Konami Top Gun that you purchased a while ago.
http://www.seanriddle.com/topgun.html
http://forums.bannister.org/ubbthreads.php?ubb=showflat&Number=91613&page=2

Game&Watch Mickey & Donald has the same MCU as that.

Cool! You need anything from me? This could also lead into R-Zone!

Do you have enough stronger acid left to finish TMNT and R-Zone?

I think I've already got TMNT transcribed; I guess I just didn't post it. I'll take a look. The TMNT patent also has code, and I'm pretty sure I typed it in. The patent says is uses an SM-510, but it's really a -511, with the melody ROM.

Ranger Lennier sent me lots of R-Zone carts. I've experimented with de-globbing several of them. A couple used Sharp SM-5's, but I'm not sure what others use. I should have more experience (and acid!) to clean them up better now. I probably also ought to send scans to Kevin to see if he thinks it might be possible to electronically dump them.

I think(and hope) there's a good chance these can be dumped electronically, they have a TEST pin afterall. I'm certain Kevtris would love to check it out when he finished his NES HDMI project.

There's a high res die photo of Mickey & Donald done by digshadow: http://siliconpr0n.org/map/nintendo/dm-53/

You'd have to partially de-glob Top Gun and TMNT to get to the test pin. And I'm not sure where the ROM contents are output, but not all the strobe outputs are bonded out. I need to look at the R-Zone carts again to see if they are the same way, or if they are more amenable to testing/dumping.

The Top Gun patent doesn't seem to have the correct button wiring. I'm sure you could figure it out easily in emulation, but here's what I see:


I vectorized some of the PCB: www.seanriddle.com/topgun.svg

Pin 1 is lower right.