Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

I finally built a rig to dump the Sharp SM5s in the G&Ws that I have. It's a little messier than the TMS1000 dumper because along with level-shifting (this time down to 3V instead of up to 9V), you have to force opcodes into the same port that you get the dump out of. I found a neat hack using the IDT QS3861, and I also had to use a CD4049 for the OSC. The PIC monitors one of the S lines to sync the 4x OSC input to the internal instruction clock. I capture everything with a Logic 16, then process the exported file to get the dump.

There are a couple of things that are a little different from what Igor told me about the Russian chip, but overall it worked like he said. I had figured out that making the T input high would output the current bank of 63 bytes (usually the reset page 55) to the S bus, but I didn't know that when you made K1 high, you could input opcodes over the S bus. Igor said that you had to invert the opcodes (like you have to do for the 3870), but I found that I had to leave them alone. He didn't tell me a specific opcode to use; I chose TL. When I send those 2 bytes then drop K1, the ROM dump starts 8 bytes into the page for some reason. I clock 55 more bytes through to get back to the beginning, then capture the next 63 bytes. Then I compare the next 63 bytes to the previous, then increment the page and loop back to force the new TL opcode.

Page 55 of the resulting dump matches what I see when I do a simple capture without forcing in opcodes, so I'm pretty confident of it. I used unidasm on the output, but I don't know SM5 well enough to tell if it makes sense.

I've only dumped Boxing (BX301) so far, since I already had it apart from when I experimented on it before. I've got the PCB for Donkey Kong II (JR55) that hap sent me, but it will only dump the lsb; the others remain high all the time. I guess I'll decap it and visually read the bits. I've also got just the PCB for Mario Bros (MW56) from Incog, and I bought the complete games Cement Factory (M102), Blackjack (BJ60), and Bombsweeper (BD62). Hap recently sent me DK JR (DJ101). I also have the Nu, Pogodi that Tauwasser sent me, and just the LCDs for Mickey and Donald that Lord Nightmare sent. Blackjack and Bombsweeper have 80 pins, so I assume they are SM512s.

Now I need to build a rig to get pics of the LCDs. Here's the Boxing dump: www.seanriddle.com/bx301.bin

Heck yeah Game&Watch dumping! I simply cannot wait until I can blog a MAME WIP post about this on social media

Great progress
Boxing is a SM510? The page layout in your dump is strange and there are many duplicate pages. Counting unique pages, I come up with 31 total.

Found this VTech Kiddies' Laptop in the trash today:



The base is just the keyboard, touchpad and ports, all the "real" electronics is in the detachable "screen" portion.



The mainboard has some of the dreaded blobs ...



If someone wants to have a go at dumping it, I can send the mainboard/LCD assembly.

Wow, that looks like it would be a b*tch to dump.... all those epoxy blobs with no hints on what's underneath them and how it's wired up... good luck

Hap- I decapped JR55 and it is an SM510; the die looks just like Top Gun's. SM510 has 44 banks of ROM instead of 64, so if Boxing also uses it, there would be duplicate banks in my ROM dump, and it's possible (although it seems unlikely) that they only needed 31 banks for the code.

I might need to tweak the timing; using the same rig on Cement Factory, I'm not getting the same bytes in bank 55 as I get straight out of reset.

There are no part numbers on the chips, and SM510 and SM511 have almost identical pinouts. I guess I need to come up with a set of instructions that I can send the chips that will distinguish between them.

Regarding the TMS1270, only the PMOS version has 10 O outputs, which would all be addressed through the PLA anyway. I have no idea if that means more gates are available.

All CMOS devices in the TMS1000 family have the Vdd and Vss pins interchanged relative to their PMOS counterparts, probably because Vdd is supposed to be -15V for PMOS but +5V for CMOS.

Yeah, I expect simply a larger PLA for the TMS1270. As for the CMOS devices, another difference is that unlike the Motorola CMOS chips they have a 3-level stack, similar to TMS1400.

@Sean: Could you upload the partial electronic dump of JR55? To check if the layout is the same(31 unique banks).

I originally worked with BX301, and didn't notice that JR55's dump was different; BX301 outputs a byte for 4 clocks, while JR55 outputs a byte for 2 clocks. The SM510 datasheet says "the system clock has a frequency of one second that of the oscillator frequency". I think that's a mis-translation of one half, which matches what JR55 was doing. The SM511 has a selectable 8.192/16.385 kHz system clock which defaults to 8.192 after ACL. That matches what I see with BX301.

I dumped JR55 with 4 clocks per byte, so I was sending doubled-up opcodes and then missing half the data. That doesn't explain why S2-S8 weren't working, though. I assume that was due to some kind of damage.

ML102 also outputs a byte for 2 clocks, so I expect it is also an SM510.

Do you know the process of choosing the 16kHz clock? The datasheet just says it "can be selected by instructions", but I didn't see anything obvious in the instruction set.

I looked through the other SM5 chips in the 1990 and 1996 databooks, and there's only one other with the same pinout; SM3903. It looks like that's identical to the SM510, but using the R outputs for a remote control signal instead of a buzzer. I'm not sure anything's different about the chip itself. The datasheet is a copy of the SM510 datasheet with "buzzer" replaced with "remote", even keeping the same typos. So checking the number of clocks per byte should tell me if a game has an SM510 or SM511.

I will check over everything some more and post the dump of ML102.

I don't know what controls the SM511 instruction clock divider (or maybe I forgot, it's been a while).