Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

Cool!

I got a NSC Quiz Kid Speller. It's got a little NSC 4-bit MCU bonded directly to the PCB (along with what looks like a driver IC die, 2 transistors and a diode). The MCU is marked MM47 and does not look like a COP4. In fact, it looks a lot like a TMS1100. I also got a Play Bridge Computer that has a Hitachi HD44801.

I've also got a couple of things coming: Coleco Lil Genius and Milton Bradley Ask Zandar.

I finally got TMS1100 electronic dumping working! I dumped Coleco Electronic Quarterback and Coleco Zodiac, but of course I can't electronically dump the PLAs. The instruction PLAs are most likely standard, but the output PLAs could be problematic.

I also dumped all of Ranger Lennier's Microvision carts for practice. The ones with B revision dies dumped fine, but I got several different results for the E revision dies: some dumped with the high bit set like Kevin saw, some dumped all zeros, and some didn't output anything. Then I tried dumping the Capsela chip- it doesn't have the die revision printed on it, but it is an SDIP, so I figured it was an E revision. It dumped all zeros.

Then I played with the voltage used to power the chips; I originally dumped at 9V, so I tried 8.5V and 7.5V. I wound up getting all the chips to dump at one or more of the voltages, but not every chip at the same voltage. I did get all 8 bits of the Capsela dump, so it must be a rev B die.

I also dumped Ranger's Super Blockbuster chip, which is a rev G, and it dumped all 8 bits, which is confusing. Since that's later than rev E, I assumed it would also only dump the lower 7 bits.

I compared the bottom 7 bits of the rev E dies to my visual dumps, and several of them had byte 0 incorrect. So it looks like I need to adjust my code to get that right; maybe I need an additional delay on the first byte. One other dump has another byte different: Sea Duel. I'm going to load up my ROM pic and see if that needs to be corrected.

Yeah, we'd still need the PLAs. But that's a lot less time spent than picturing the whole die.

MAME microvision seaduel crc32 is 77a8f71b

Aha- my bad on Sea Duel- I hadn't corrected the bit you found about a year ago. Still nice to confirm the lower 7 bits of 6 rev E games.

It would be nice not to have to destroy every TMS1100, but definitely a lot more work! I probably wouldn't even need to use any acid on the die just to extract the PLAs.

I was talking to Kevin about the possibility of loading in addresses of opcodes to execute that would output the different O PLA patterns, but I haven't worked on it. It's similar to his idea about how to figure out the 8th bit by executing the instruction and seeing if the new program counter indicates that a jump was taken.

Or, since the O PLA is limited to 20 patterns, I could just do an LA capture of the port while exercising the game to try to grab them all. For games with 7-segment LEDs, half of them would be pretty easy to figure out. But I couldn't be sure that I got them all, and I wouldn't know what accumulator value each one was associated with. I guess comparing the capture to a run through MESS could answer the questions.

It would be good to have a method in case we had access to a TMS1100 that the owner didn't want to destroy. In fact, Rik has Black Knight Pinball. That one's probably a simpler case because it likely has the same PLAs that Raise the Devil had, so the (8-bit) ROM dump would be enough.

For rare games that should remain intact: yes definitely

If you need any custom code done in MAME (OPLA logging etc), let me know.

I knew MM47 sounded familiar- that's also on the die that's bonded directly to the PCB of Mattel Basketball. That one has the 3 letters NCX, whereas Quiz Kid Speller has NDF. I'll visually dump them and see if I can figure out what they are.

The Mattel Electronics Synsonics toy drum machine uses a Sanyo 4-bit MCU marked "LM6402" on the schematics. So that might turn up in some of their other stuff.

Lil Genius and Ask Zandar got here. The non-working Coleco Lil Genius has a 28 DIP marked GI CF-583 7616; I'm not sure if it's an MCU. There's a 2nd PCB, about 2"x1", that looks like a power supply- a potted box, 10 resistors, 3 electrolytic caps and 4 transistors! Since the unit just has a calculator keypad, 2 LEDs and a speaker, I'm guessing the chip requires weird voltages.

Milton Bradley Ask Zandar (1992) has another tsp50cxx: 16 DIP "98047C7KOT // ASK ZANDAR // CSM14026DN"). The phrases listed in the Ask Zandar Patent don't match the actual game, though. It only has one button, a "game/fortune" switch, and a light sensor. I haven't been able to get into a test mode that speaks all the phrases, just "yes" and "no".

GI CF-583 is a calculator chip
http://www.rskey.org/~mwsebastian/calcwebpg/gen_inst.htm

Ah, OK. The full data sheet is in a GI book, too.

I remember reading a patent about an educational calculator that used a regular calculator chip, and had external circuitry to decide if an entered equation was correct. I bet that's what the 2nd PCB is for. I wonder if I can find it again.

Edit- it was actually Coleco Quiz Wiz's patent US4303398. One implementation was to use a calculator chip and have the inputs set up so that when you punched in a question #, you were entering an equation. When you put in your answer, that was subtracted from the answer the calculator chip got from the equation. Then that difference was used as a divisor, so if it was 0 (correct), a divide-by-zero error lit the green LED. Whew! Fig. 9 in that patent shows PLS, CHK and CLR keys, which are on the Lil Genius. The Quiz Wiz that I got used the other implementation, which was much more user-friendly.

And while I was searching for that, I hit patent US4051605 for an educational calculator from National Semiconductor using the MM57 chip. Quiz Kid Speller and Mattel Basketball use the NSC MM47. The patent has an instruction list and source code. It calls the chip a "Calculator Oriented Processor" or COP. I haven't found anything on the MM47, but there's quite a bit on the MM57: http://www.cpushack.com/2014/09/27/national-semiconductor-the-cop-before-the-cops/ Hopefully the MM47 is similar enough that this is enough info to figure it out.

I'm pretty confident that a MM47 emulation core is possible. But it'll have to go to the endless virtual TODO list for now. If it's similar enough to the COP400, it can be added after someone(can be me) refactors our cop400 core.