Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

I haven't looked at the disassembly, but maybe that's the M0 rising edge for the next byte? The timing diagram from the data sheet shows that the data isn't valid until after the falling edge, but it also shows the next rising edge while the old data is valid.

Yes, it baffles me that the datasheets conflict with Mr.Challenger.

Anyway, after staring for a while at the TMS6100 diagrams in the Speak&Spell patents, I'm starting to think the latch timing is different for nibble mode and serial mode. See fig 20a,b,c. patent US4189779.

Nibble mode is latched on _LOW and _HIGH on fig20c. This sounds very generic but it's obvious these signals are coming from the counter PLA on fig20a.

Here's a Logic capture of me dumping the first 6 bytes from CD2601. It starts off with a dummy address load and dummy read, then I load an address of 00000 (I tried both 4 and 5 nibbles, and got the same results), then another dummy read. Then I clock M0 and read the bytes, LSN first: 8 C 3 0 E C 3 0 3 D 3 0 = C8 03 CE 03 D3 03, which are pointers to the first 3 words at addresses 3C8 (ABSENT), 3CE (ALERT), and 3D3 (ALIKE).

This is with pins 1-4 as DATA/ADDR 1,2,4,8, pin 5 as CLK, pin 8 as M0, pin 10 as M1, pin 11 CS tied to VSS, pins 6, 7, and 13-16 NC.

Note that CLK is just held high, and the PIC that I used to toggle M0 and M1 also created the "flag" signal that indicates when data is valid (based on waiting a few clocks after the falling edge of M0).

You can see that the new byte is not yet valid on the rising edge of M0, although the old byte is still valid. Neither the old nor new byte is valid immediately after the falling edge of M0. This seems compatible with the timing diagram in the data sheet.

If you still have everything set up. Can you do the same thing but with M0 held high longer? I see d0-d3 change on several places during M0 high.

Yeah- here are captures with M0 held hi 2 clocks, 3 clocks and 4 clocks. I'm measuring up to 13.8 uS from M0 rising edge until last data bit settles. So I guess that is different from the data sheet, which shows the data bits transitioning while M0 is low.

I have some 28SDIP TMS6100 VSMs that I could dump and compare captures with, if that would be useful. CD2307A, CD2354A, CD2394A, CD2395A.

Cool =) and now I wonder if it's the same on 1-bit mode.

2 other cases you can test:
- after setting the complete address, then reading a byte, then setting an incomplete address, what is the address? ... what a stupidly worded question :P lemme redo it like this

LA=$F, LA=$F, LA=0, LA=0, LA=0
READ = dummy
LA=$A
READ = dummy
READ = from where? $FA? or did the address get zeroed and it reads from $0A?

The other thing: The datasheet says that READ BRANCH can only be used on single-chip configurations. Is this true? This implies that the upper bits of the address are zeroed after setting indirect address. It's testable by trying this on one of the Speak&Spell cartridges, which has a CS(upper 4 bits of address) of not-0. So, first set direct-address to a valid one, then set indirect address.

I'll do a capture while dumping one of those 28DIP VSMs; they use 1-bit mode.

I can do an incomplete address test, but since I'm just tying DATA/ADDR to GND to force in the 0000 address, I'll have to do it a bit differently. I can start off like my normal dumps, read some nibbles, then load in 1-3 0s and see where the next read comes from.

OK, I started up like normal and set address 0000, but only read 23 bytes, then set address 0. That reset the address to $0010. Then I read 275 more bytes, then set address 00. That reset the address to $0100. So it looks like incomplete addressing works.

CD2307A, a 28 SDIP 1-bit VSM, also transitions data when M0 is high, up to 6.4 uS after the rising edge.

ok