Previous Thread
Next Thread
Print Thread
Page 120 of 398 1 2 118 119 120 121 122 397 398
Joined: May 2010
Posts: 1,051
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,051
Originally Posted By hap
surprise calcs en route to hmm, Arcadia :p

1) http://datamath.org/Sci/Slimline/Business-Analyst-II.htm - should be TP0320 series MCU, for emulation testing
2) http://datamath.org/Sci/Slimline/TI-35.htm - can be either TP0320, 0455, or 0456
3) two of these(single auction) http://datamath.org/Sci/Slanted/TI-55-II.htm interesting calc, dual-mcu. On the ebay photo, one was larger than the other, we'll see if the insides is the same or not.

I got 3 of the calcs:TI Business Analyst-II and 2x TI-55-II. The TI-55-IIs appear identical externally.

I was also able to dump the output PLAs from Ranger's Microvision carts that I've got: Blockbuster and Mindbuster output 0 8 4 C 2 A 6 E 1 9 5 D 3 B 7 F, which is 0-F bit-reversed, and Vegas Slots output 0 1 2 3 4 5 6 7 8 9 A B C D E F. But those PLAs don't use the status bit. I tried to set and clear the status bit while dumping other chips, but I always got the same 16 bytes twice, although with 2 chips, I got a different set of 16 bytes depending on the code and voltage that I used. To force in the address to execute opcodes from, I have to assert INIT, and I'm not sure what that does to the status bit.

The other chips I dumped were Coleco Electronic Quarterback, Coleco Zodiac and Capsela. One set of 16 bytes I got from the 2 Coleco chips include 7-segment data, so I know that those are correct, but I also got a different set of 16 bytes from them. Electronic QB gave me 0 1 8 9 2 3 A B 4 5 C D 6 7 E F, and Zodiac gave me 01 08 A0 A8 40 48 E0 E8 06 10 A6 B0 46 50 E6 F0. Since both of those games also have keyboard and LED matrices, it's possible that those other bytes are with status set. I'll decap Electronic QB and see for sure.

Capsela only gave me 01 02 04 08 10 20 40 80.

I wasn't able to get any E revision chips to dump the output PLAs, but I'm not sure why.

Joined: May 2010
Posts: 1,051
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,051
Originally Posted By hap
I'm pretty confident that a MM47 emulation core is possible. But it'll have to go to the endless virtual TODO list for now. If it's similar enough to the COP400, it can be added after someone(can be me) refactors our cop400 core.

I pulled the MM4799 die off the Mattel Basketball PCB and took pics of it. This is the game that someone had wired the 9v battery clip backwards, and that vaporized some of the metal on the die and some of the bond wires, which sputtered onto the die, obscuring some stuff. But most of the die is clear, and I'm hopeful that using some Whink on it will clean it up.

It has the same amount of ROM and RAM and it looks like the same pinout as the MM5799 described in the NSC 1977 MOS LSI databook on bitsavers.org. The ROM array is laid out oddly- it's 1.5K, so 24 pages of 64 bytes. But instead of having a column for each of the 24 pages, it has just 16 columns per bit, and instead of 64 rows, it has 96. So the 8 other pages are in the extra 32 rows. I'd like to figure out the bit arrangement and see if disassembling the ROM contents as MM5799 opcodes results in good code.

I don't think it's similar enough to the COP400 to be included in that driver, but I could be wrong.

Joined: Mar 2002
Posts: 1,262
Likes: 48
H
hap Offline
Very Senior Member
Offline
Very Senior Member
H
Joined: Mar 2002
Posts: 1,262
Likes: 48
OPLA: Ah, I didn't expect it to be possible in practice smile Let's hope the Coleco QB data matches.

Joined: May 2010
Posts: 1,051
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,051
Here's the Coleco QB OPLA

I electronically dumped 3F 06 5B 4F 66 6D 7D 07 7F 6F 80 1C 5E FF 00 00 and 0 1 8 9 2 3 A B 4 5 C D 6 7 E F.

I need to tweak the code a bit to get the dump working better. For Electronic QB, I had to change the voltage and/or the method to get either the entries with the status bit set, or the entries with the status bit clear. For Zodiac, I had to change the voltage. I should be able to dump all the entries at the same voltage, at least.

I got the TI-35 and opened all the calcs. It looks just like the TI Business Analyst-II. The 2 TI-55-IIs look identical, other than markings on the chips.

TI-35:
28 SDIP
CD4557NL P
M 8227
PHILIPPINES

TI Business Analyst-II:
28 SDIP
TP0322-4NL
IS 8109
PHILIPPINES

TI-55-II #1:
28 SDIP
TP0456NL
CD4555
M^8340

40 SDIP
TP0456N2L
CD4556
M^8310

TI-55-II #2:
28 SDIP
CD4555NL P
M 8231
PHILIPPINES

40 SDIP
CD4556N2L
M 8231
PHILIPPINES

Edit: I couldn't dump MP7324 so I decapped it, and it turns out it's a TMS-1400. When it warms up a bit here I'll Whink it.

Last edited by seanriddle; 01/19/16 05:51 PM.
Joined: Mar 2002
Posts: 1,262
Likes: 48
H
hap Offline
Very Senior Member
Offline
Very Senior Member
H
Joined: Mar 2002
Posts: 1,262
Likes: 48
You can predict most MPxxxx MCUs by comparing it with this table at the start of this MAME driver: http://git.redump.net/mame/tree/src/mame/drivers/hh_tms1k.cpp

Do you know the TSI Speech+? It's a talking calculator for the blind, it has the same speech chip as in Berzerk(arcade game).
see: http://www.vintagecalculators.com/html/speech-.html
*TMC1007 TMS1000 1976, TSI Speech+ (S14002-A)
*MP0057 TMS1000 1978, APH Student Speech+ (same ROM contents as TSI Speech+?)

I've been told the speech ROM is already dumped. The calculator is very expensive on eBay and it would be a shame to decap the MCU on it. Maybe someone that owns one can send it to you or kevtris to try to dump it electronically?

Joined: May 2010
Posts: 1,051
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,051
I haven't tried to dump a TMS1000 yet, but if I recall correctly, Kevin only got the low 7 bits when he did it. His idea to dump those and the Rev E TMS1100s is to execute each instruction and then shift out the program counter to see if it is the next value from the LFSR (which means not a call/branch, so the high bit was not set) or if it is the low 6 bits from the opcode (which means the high bit was set). That would likely get most opcodes, leaving only the oddball instances where the code jumps to the next byte in the LFSR sequence, in the same page or another page. Jumping to the next byte in the same page is unlikely (maybe a NOP?), but jumping to the next byte in another page seems fairly likely (there are only 64 bytes in a page), so we'd have to sort those out via emulation.

Joined: Mar 2002
Posts: 1,262
Likes: 48
H
hap Offline
Very Senior Member
Offline
Very Senior Member
H
Joined: Mar 2002
Posts: 1,262
Likes: 48
Coleco QB real output PLA, it matches:
3F 06 5B 4F 66 6D 7D 07 7F 6F 80 1C 5E FF 00 00 00 01 08 09 02 03 0A 0B 04 05 0C 0D 06 07 0E 0F
http://pastebin.com/vxAhK8sy

Joined: May 2010
Posts: 1,051
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,051
So status=0, data=14 is not defined, and when I did a TDO with the accumulator=14, it output 00000000. All the other TDOs I did were defined.

Joined: Feb 2015
Posts: 160
Likes: 6
K
Senior Member
Offline
Senior Member
K
Joined: Feb 2015
Posts: 160
Likes: 6

Joined: Feb 2015
Posts: 160
Likes: 6
K
Senior Member
Offline
Senior Member
K
Joined: Feb 2015
Posts: 160
Likes: 6
Originally Posted By hap
You can predict most MPxxxx MCUs by comparing it with this table at the start of this MAME driver: http://git.redump.net/mame/tree/src/mame/drivers/hh_tms1k.cpp

Do you know the TSI Speech+? It's a talking calculator for the blind, it has the same speech chip as in Berzerk(arcade game).
see: http://www.vintagecalculators.com/html/speech-.html
*TMC1007 TMS1000 1976, TSI Speech+ (S14002-A)
*MP0057 TMS1000 1978, APH Student Speech+ (same ROM contents as TSI Speech+?)

I've been told the speech ROM is already dumped. The calculator is very expensive on eBay and it would be a shame to decap the MCU on it. Maybe someone that owns one can send it to you or kevtris to try to dump it electronically?



I own two of these talking calculators. unfortunately I only got 7/8 bits of data from them. I have dumped the speech ROM as well, that works; I tested it. I own one of the brown version and one of the blue version. both have the same guts inside. Both of the CPUs will only divulge 7 of their data bits however.

Page 120 of 398 1 2 118 119 120 121 122 397 398

Link Copied to Clipboard
Who's Online Now
1 members (1 invisible), 20 guests, and 5 robots.
Key: Admin, Global Mod, Mod
ShoutChat
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Forum Statistics
Forums9
Topics9,103
Posts119,274
Members5,019
Most Online890
Jan 17th, 2020
Our Sponsor
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!

Superior Solitaire
Forum hosted by www.retrogamesformac.com