Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

I got 3 of the calcs:TI Business Analyst-II and 2x TI-55-II. The TI-55-IIs appear identical externally.

I was also able to dump the output PLAs from Ranger's Microvision carts that I've got: Blockbuster and Mindbuster output 0 8 4 C 2 A 6 E 1 9 5 D 3 B 7 F, which is 0-F bit-reversed, and Vegas Slots output 0 1 2 3 4 5 6 7 8 9 A B C D E F. But those PLAs don't use the status bit. I tried to set and clear the status bit while dumping other chips, but I always got the same 16 bytes twice, although with 2 chips, I got a different set of 16 bytes depending on the code and voltage that I used. To force in the address to execute opcodes from, I have to assert INIT, and I'm not sure what that does to the status bit.

The other chips I dumped were Coleco Electronic Quarterback, Coleco Zodiac and Capsela. One set of 16 bytes I got from the 2 Coleco chips include 7-segment data, so I know that those are correct, but I also got a different set of 16 bytes from them. Electronic QB gave me 0 1 8 9 2 3 A B 4 5 C D 6 7 E F, and Zodiac gave me 01 08 A0 A8 40 48 E0 E8 06 10 A6 B0 46 50 E6 F0. Since both of those games also have keyboard and LED matrices, it's possible that those other bytes are with status set. I'll decap Electronic QB and see for sure.

Capsela only gave me 01 02 04 08 10 20 40 80.

I wasn't able to get any E revision chips to dump the output PLAs, but I'm not sure why.

I pulled the MM4799 die off the Mattel Basketball PCB and took pics of it. This is the game that someone had wired the 9v battery clip backwards, and that vaporized some of the metal on the die and some of the bond wires, which sputtered onto the die, obscuring some stuff. But most of the die is clear, and I'm hopeful that using some Whink on it will clean it up.

It has the same amount of ROM and RAM and it looks like the same pinout as the MM5799 described in the NSC 1977 MOS LSI databook on bitsavers.org. The ROM array is laid out oddly- it's 1.5K, so 24 pages of 64 bytes. But instead of having a column for each of the 24 pages, it has just 16 columns per bit, and instead of 64 rows, it has 96. So the 8 other pages are in the extra 32 rows. I'd like to figure out the bit arrangement and see if disassembling the ROM contents as MM5799 opcodes results in good code.

I don't think it's similar enough to the COP400 to be included in that driver, but I could be wrong.

OPLA: Ah, I didn't expect it to be possible in practice Let's hope the Coleco QB data matches.

Here's the Coleco QB OPLA

I electronically dumped 3F 06 5B 4F 66 6D 7D 07 7F 6F 80 1C 5E FF 00 00 and 0 1 8 9 2 3 A B 4 5 C D 6 7 E F.

I need to tweak the code a bit to get the dump working better. For Electronic QB, I had to change the voltage and/or the method to get either the entries with the status bit set, or the entries with the status bit clear. For Zodiac, I had to change the voltage. I should be able to dump all the entries at the same voltage, at least.

I got the TI-35 and opened all the calcs. It looks just like the TI Business Analyst-II. The 2 TI-55-IIs look identical, other than markings on the chips.

TI-35:
28 SDIP
CD4557NL P
M 8227
PHILIPPINES

TI Business Analyst-II:
28 SDIP
TP0322-4NL
IS 8109
PHILIPPINES

TI-55-II #1:
28 SDIP
TP0456NL
CD4555
M^8340

40 SDIP
TP0456N2L
CD4556
M^8310

TI-55-II #2:
28 SDIP
CD4555NL P
M 8231
PHILIPPINES

40 SDIP
CD4556N2L
M 8231
PHILIPPINES

Edit: I couldn't dump MP7324 so I decapped it, and it turns out it's a TMS-1400. When it warms up a bit here I'll Whink it.

You can predict most MPxxxx MCUs by comparing it with this table at the start of this MAME driver: http://git.redump.net/mame/tree/src/mame/drivers/hh_tms1k.cpp

Do you know the TSI Speech+? It's a talking calculator for the blind, it has the same speech chip as in Berzerk(arcade game).
see: http://www.vintagecalculators.com/html/speech-.html
*TMC1007 TMS1000 1976, TSI Speech+ (S14002-A)
*MP0057 TMS1000 1978, APH Student Speech+ (same ROM contents as TSI Speech+?)

I've been told the speech ROM is already dumped. The calculator is very expensive on eBay and it would be a shame to decap the MCU on it. Maybe someone that owns one can send it to you or kevtris to try to dump it electronically?

I haven't tried to dump a TMS1000 yet, but if I recall correctly, Kevin only got the low 7 bits when he did it. His idea to dump those and the Rev E TMS1100s is to execute each instruction and then shift out the program counter to see if it is the next value from the LFSR (which means not a call/branch, so the high bit was not set) or if it is the low 6 bits from the opcode (which means the high bit was set). That would likely get most opcodes, leaving only the oddball instances where the code jumps to the next byte in the LFSR sequence, in the same page or another page. Jumping to the next byte in the same page is unlikely (maybe a NOP?), but jumping to the next byte in another page seems fairly likely (there are only 64 bytes in a page), so we'd have to sort those out via emulation.

Coleco QB real output PLA, it matches:
3F 06 5B 4F 66 6D 7D 07 7F 6F 80 1C 5E FF 00 00 00 01 08 09 02 03 0A 0B 04 05 0C 0D 06 07 0E 0F
http://pastebin.com/vxAhK8sy

So status=0, data=14 is not defined, and when I did a TDO with the accumulator=14, it output 00000000. All the other TDOs I did were defined.

I got a few new chips to dump, and did that tonight. also I put up the melody madness PIC dump and disassembly. The fun is here:

http://blog.kevtris.org/blogfiles/Handhelds/LCD%20Games/Mattel%20Computer%20Gin/

http://blog.kevtris.org/blogfiles/Handhelds/LED%20and%20Sound%20Only%20Games/GAF%20Melody%20Madness/

http://blog.kevtris.org/blogfiles/Handhelds/Random%20Dumps/UPD650C-128%20Roland%20TR-606.bin

http://blog.kevtris.org/blogfiles/Handhelds/Random%20Dumps/UPD650C-128%20Roland%20TR-606.txt

I own two of these talking calculators. unfortunately I only got 7/8 bits of data from them. I have dumped the speech ROM as well, that works; I tested it. I own one of the brown version and one of the blue version. both have the same guts inside. Both of the CPUs will only divulge 7 of their data bits however.