Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

I've also checked one I had in the backlog: cd2708. To freshen your memory: it was the arduous-to-transcribe Speak & Math decap from Siliconpr0n.

cd2708raw.bin:
One error: offset $3A8, change $A0 to $AF.
Also, from reading the disasm, I conclude there's one under the smudge too: offset $108, change $14 to $15.

It looks like it works in MESS now. I'll update the driver in a bit. Did you have more decaps planned for TI Speak stuff?

Thanks for checking those again. Do you feel like we can be reasonably confident in the accuracy of the dumps at this point?

Yes. Even without the error I found(ignorance is bliss?), we could be reasonably confident. You can't get much better with optical method dumping.

That's good news on the Microvision carts. I think part of the reason that there weren't many wrong bits found is that I play-tested the games in Paul's emulator, which uncovered many of the errors. But some of the games are pretty difficult to figure out, and some of them seem to have odd quirks even playing on an original unit, so it's good to have another pair of eyes checking them out.

As for Speak and Spell stuff, I don't think I've got anything else that's undumped. Let me know if there's anything in particular you're looking for.

I tried for a couple of Dark Towers on Sunday. One game with a broken tower went for something like $70 shipped, which is more than I'm willing to pay. Another auction was just for a broken tower, so I figured I could get that, but it went for over $50 shipped.

I dumped the ROM from Entex Space Invaders. After I type up the wiring diagram, I'll post the link.

I bought one unit a few months ago and decapped the COP444, but the die stuck to the plastic and I had to really torch it to get it off. That toasted the passivation layer, so I couldn't get pics of the top metal layer. I Whinked the die and the results were good, but I couldn't see the ROM bits, so I bought another game to try again. In the meantime, Lord Nightmare posted the app notes on dumping the chip electronically, so I tried that.

I actually took a much simpler route than the app note describes- I put the chip on a breadboard with power and a cap and resistor for the oscillator, used a couple of AA batteries and a couple of resistors to enter ROM dump test mode, then clipped on a Saleae Logic 16 to capture the bytes.

Since the game uses the L pins to drive LEDs, they are set up as outputs, but it also uses the SK pin as an output, so that didn't output the byte valid signal that you get if you follow the app note. But it was very easy to track the bytes outputted and sample them in the middle of the bit times.

The entire 2K gets dumped every 40mS or so, but there's no indication of the beginning of the dump- it just rolls from 7FF to 000 and keeps going. Since I had to enter test mode while the game was running to make sure the L pins were outputs, I had no idea at what address the dump started. I captured for about 2 minutes and verified that all of the 2K sections (about 3000 of them) were identical. The game uses 6 AA batteries, but the datasheet says Vcc is 5V, so I dumped at both voltages and got the same results.

Because the chip breaks ROM up into 32 pages of 64 bytes, it turned out to be pretty easily to figure out the 64-byte boundaries; many of the pages are padded out with zeroes. And the chip has a quirk that requires the first instruction executed after reset (at address $000) to be a CLRA ($00), so I looked for a zero at 64-byte offsets. There were only 5 possibilities, so I used unidasm to figure out which one was most logical for a reset routine (looking for RAM initialization, setting the L pins as output, etc).

That's where I got confused- there were lots of "Invalid" messages in the disassembly. After a bit of investigation, I figured out that the COP444 disassembler imposes the same 1K ROM limits as for the other COP chips, although the COP444 has 2K of ROM. That was causing various instructions like JP, JSR, LDD, XAD and LBI to say the operand was invalid. I patched that up and figured out which 0 was the start of the ROM and shifted the bytes to bring it to the front.

We only have Speak & Math US newest release (CD2708) so far: http://www.datamath.org/Speech/SpeaknMath_86.htm

The other Speak & Math and the Speak & Spell rom code was typed in from the patents. The Speak & Math one is definitely pre-release. The Speak & Spell one, might be the same as the 1978 commercial release. We still need to verify TMC0271(hmm, didn't you buy two?). Then there's the Language Tutor rom, also typed in from the patent, but doesn't work in MESS yet.

So yeah, anything except CD2708. IMHO CD2705: Speak & Read would be at the top of the list.

We have a COP400 series emulator in MESS, let's hope Entex Space Invaders gets running with ease =)

After looking at youtube (I never heard of the game..), it looks like this is another candidate for external artwork. Can you make a scan of the.. erm.. plastic screen/mask/thing?:P

I posted the Space Invader info: www.seanriddle.com/cop444l.html I'm trying to get a good scan of the mask without destroying it.

Handheld Museum says that the grey version has the COP chip and the black version has the TI chip (MP1211, probably a TMS1100), so I bought a black one.

Here's a scan of the Space Invader mask: www.seanriddle.com/entexsi.jpg I peeled it off, cleaned it, and stuck it to a piece of paper to scan. It looks pretty good, but there are some scuffs. There is a reddish/purplish bezel that goes over this and hides the unlit enemies.

Thanks, it looks fine.
Does it say anywhere why they changed MCU supplier? It'd mean they reprogrammed it, like when MB went from Intel to TI on Microvision games.