|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I got 3 of the calcs:TI Business Analyst-II and 2x TI-55-II. The TI-55-IIs appear identical externally. I was also able to dump the output PLAs from Ranger's Microvision carts that I've got: Blockbuster and Mindbuster output 0 8 4 C 2 A 6 E 1 9 5 D 3 B 7 F, which is 0-F bit-reversed, and Vegas Slots output 0 1 2 3 4 5 6 7 8 9 A B C D E F. But those PLAs don't use the status bit. I tried to set and clear the status bit while dumping other chips, but I always got the same 16 bytes twice, although with 2 chips, I got a different set of 16 bytes depending on the code and voltage that I used. To force in the address to execute opcodes from, I have to assert INIT, and I'm not sure what that does to the status bit. The other chips I dumped were Coleco Electronic Quarterback, Coleco Zodiac and Capsela. One set of 16 bytes I got from the 2 Coleco chips include 7-segment data, so I know that those are correct, but I also got a different set of 16 bytes from them. Electronic QB gave me 0 1 8 9 2 3 A B 4 5 C D 6 7 E F, and Zodiac gave me 01 08 A0 A8 40 48 E0 E8 06 10 A6 B0 46 50 E6 F0. Since both of those games also have keyboard and LED matrices, it's possible that those other bytes are with status set. I'll decap Electronic QB and see for sure. Capsela only gave me 01 02 04 08 10 20 40 80. I wasn't able to get any E revision chips to dump the output PLAs, but I'm not sure why.
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I'm pretty confident that a MM47 emulation core is possible. But it'll have to go to the endless virtual TODO list for now. If it's similar enough to the COP400, it can be added after someone(can be me) refactors our cop400 core. I pulled the MM4799 die off the Mattel Basketball PCB and took pics of it. This is the game that someone had wired the 9v battery clip backwards, and that vaporized some of the metal on the die and some of the bond wires, which sputtered onto the die, obscuring some stuff. But most of the die is clear, and I'm hopeful that using some Whink on it will clean it up. It has the same amount of ROM and RAM and it looks like the same pinout as the MM5799 described in the NSC 1977 MOS LSI databook on bitsavers.org. The ROM array is laid out oddly- it's 1.5K, so 24 pages of 64 bytes. But instead of having a column for each of the 24 pages, it has just 16 columns per bit, and instead of 64 rows, it has 96. So the 8 other pages are in the extra 32 rows. I'd like to figure out the bit arrangement and see if disassembling the ROM contents as MM5799 opcodes results in good code. I don't think it's similar enough to the COP400 to be included in that driver, but I could be wrong.
|
|
|
|
Joined: Mar 2002
Posts: 1,368 Likes: 120
Very Senior Member
|
Very Senior Member
Joined: Mar 2002
Posts: 1,368 Likes: 120 |
OPLA: Ah, I didn't expect it to be possible in practice Let's hope the Coleco QB data matches.
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
Here's the Coleco QB OPLA I electronically dumped 3F 06 5B 4F 66 6D 7D 07 7F 6F 80 1C 5E FF 00 00 and 0 1 8 9 2 3 A B 4 5 C D 6 7 E F. I need to tweak the code a bit to get the dump working better. For Electronic QB, I had to change the voltage and/or the method to get either the entries with the status bit set, or the entries with the status bit clear. For Zodiac, I had to change the voltage. I should be able to dump all the entries at the same voltage, at least. I got the TI-35 and opened all the calcs. It looks just like the TI Business Analyst-II. The 2 TI-55-IIs look identical, other than markings on the chips. TI-35: 28 SDIP CD4557NL P M 8227 PHILIPPINES TI Business Analyst-II: 28 SDIP TP0322-4NL IS 8109 PHILIPPINES TI-55-II #1: 28 SDIP TP0456NL CD4555 M^8340 40 SDIP TP0456N2L CD4556 M^8310 TI-55-II #2: 28 SDIP CD4555NL P M 8231 PHILIPPINES 40 SDIP CD4556N2L M 8231 PHILIPPINES Edit: I couldn't dump MP7324 so I decapped it, and it turns out it's a TMS-1400. When it warms up a bit here I'll Whink it.
Last edited by seanriddle; 01/19/16 05:51 PM.
|
|
|
|
Joined: Mar 2002
Posts: 1,368 Likes: 120
Very Senior Member
|
Very Senior Member
Joined: Mar 2002
Posts: 1,368 Likes: 120 |
You can predict most MPxxxx MCUs by comparing it with this table at the start of this MAME driver: http://git.redump.net/mame/tree/src/mame/drivers/hh_tms1k.cppDo you know the TSI Speech+? It's a talking calculator for the blind, it has the same speech chip as in Berzerk(arcade game). see: http://www.vintagecalculators.com/html/speech-.html *TMC1007 TMS1000 1976, TSI Speech+ (S14002-A) *MP0057 TMS1000 1978, APH Student Speech+ (same ROM contents as TSI Speech+?) I've been told the speech ROM is already dumped. The calculator is very expensive on eBay and it would be a shame to decap the MCU on it. Maybe someone that owns one can send it to you or kevtris to try to dump it electronically?
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I haven't tried to dump a TMS1000 yet, but if I recall correctly, Kevin only got the low 7 bits when he did it. His idea to dump those and the Rev E TMS1100s is to execute each instruction and then shift out the program counter to see if it is the next value from the LFSR (which means not a call/branch, so the high bit was not set) or if it is the low 6 bits from the opcode (which means the high bit was set). That would likely get most opcodes, leaving only the oddball instances where the code jumps to the next byte in the LFSR sequence, in the same page or another page. Jumping to the next byte in the same page is unlikely (maybe a NOP?), but jumping to the next byte in another page seems fairly likely (there are only 64 bytes in a page), so we'd have to sort those out via emulation.
|
|
|
|
Joined: Mar 2002
Posts: 1,368 Likes: 120
Very Senior Member
|
Very Senior Member
Joined: Mar 2002
Posts: 1,368 Likes: 120 |
Coleco QB real output PLA, it matches: 3F 06 5B 4F 66 6D 7D 07 7F 6F 80 1C 5E FF 00 00 00 01 08 09 02 03 0A 0B 04 05 0C 0D 06 07 0E 0F http://pastebin.com/vxAhK8sy
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
So status=0, data=14 is not defined, and when I did a TDO with the accumulator=14, it output 00000000. All the other TDOs I did were defined.
|
|
|
|
Joined: Feb 2015
Posts: 160 Likes: 6
Senior Member
|
Senior Member
Joined: Feb 2015
Posts: 160 Likes: 6 |
|
|
|
|
Joined: Feb 2015
Posts: 160 Likes: 6
Senior Member
|
Senior Member
Joined: Feb 2015
Posts: 160 Likes: 6 |
You can predict most MPxxxx MCUs by comparing it with this table at the start of this MAME driver: http://git.redump.net/mame/tree/src/mame/drivers/hh_tms1k.cppDo you know the TSI Speech+? It's a talking calculator for the blind, it has the same speech chip as in Berzerk(arcade game). see: http://www.vintagecalculators.com/html/speech-.html *TMC1007 TMS1000 1976, TSI Speech+ (S14002-A) *MP0057 TMS1000 1978, APH Student Speech+ (same ROM contents as TSI Speech+?) I've been told the speech ROM is already dumped. The calculator is very expensive on eBay and it would be a shame to decap the MCU on it. Maybe someone that owns one can send it to you or kevtris to try to dump it electronically? I own two of these talking calculators. unfortunately I only got 7/8 bits of data from them. I have dumped the speech ROM as well, that works; I tested it. I own one of the brown version and one of the blue version. both have the same guts inside. Both of the CPUs will only divulge 7 of their data bits however.
|
|
|
1 members (1 invisible),
292
guests, and
2
robots. |
Key:
Admin,
Global Mod,
Mod
|
|
Forums9
Topics9,320
Posts121,930
Members5,074
|
Most Online1,283 Dec 21st, 2022
|
|
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!
|
|
|
|