Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

BTW I combined the misc. dedicated 1-game drivers into one, per MCU family. This got rid of a lot of code duplication.

http://git.redump.net/mame/tree/src/mess/drivers/hh_tms1k.c
http://git.redump.net/mame/tree/src/mess/drivers/hh_ucom4.c

And you created the handheld version of cave.c/metro.c in the process. Wait 5 years and it'll be an imperative to split it back up so it's readable (actually, I believe that's true *now*, but there's always a lag time with MAMEdev).

Oops, should be

http://www.seanriddle.com/bankshotacid.xcf

http://www.seanriddle.com/tc4_acid.xcf

Here's the Maniac wiring:

http://www.seanriddle.com/maniac.txt

Well I started playing around with the MM78. I got it doing something but doesn't seem to be terribly useful yet. I have it in test mode and am feeding a binary counter into the 8 inputs which causes some of the bits to flow through to the RIO1-8 pins. Not all do, just a few do. Might need a decap to get more information on how the test pin works- it might need to be set to an odd voltage like on the 3850's.

Hmm I verified that all 8 bits that go into PIx comes out RIOx. Though, interestingly, the bits are swapped around a bit.

I am guessing this is going to work similar to the F8 microcontrollers where you get access to the internal CPU's data bus. So theoretically you feed instructions into the chip using the PI pins and then make it do load or store instructions or whatever, and then turn the ROM enable on at the right time to snag the ROM data. If there's some way to run the ROM code and get access to the bus it'd be easy to slurp the ROM contents this way and make it execute jumps to get into new banks to read the entire ROM.

I've decapped an MM75 that I can get pictures of, if that would help. I've also got an MM76EL that I haven't decapped yet.

The 3870 has one test pin that you apply two different voltages to: one disables ROM and forces in an opcode to be executed, and the other enables ROM and outputs the databus to a port. I dumped them by forcing in the instruction to reset the data counter to 0, then continually forcing in a load memory instruction, which put the ROM byte on the bus and incremented the data counter. When dumping the ROM, the signals on the port are inverted and ORed with the ROM data, so you have to put $FF on the port when reading or else you corrupt the ROM data read.

The COP444L is similar- you force signals on the SPI data in and data out lines to get into 2 different test modes. One lets you force opcodes, the other dumps ROM continuously to a port. I didn't force any opcodes, just read in the ROM dump and figured out where the start was.

yeah I remember that because we talked about it and I got F8 dumping working. I tried setting the MM78's test pin to different voltages but it only seems to put it in or out of test mode. I tried 0 to -10V (normal range) and then all the way to -20V via a resistor.. no change. the IOs are good to -30V so claims the sheet so this was safe.

I tried poking data into the other pins but didn't get any different behaviour; this chip has a serial port on it too so I applied a clock to the clock pin for it and could shift data through the chip's serial port but I don't think this was doing anything useful internally.

The MM76 chip dieshot would probably help a bit, since this 78 is very similar I think, so both will most likely dump the same way.

I think I might have something! I was running the chip at 10V, which was wrong. This chip runs on 15V (checked the output of the converter on the game's PCB... 14.8V). I bumped it up to 15V and now the test mode appears to be dumping the ROM! I have a whack of data coming out the RIOx pins, about 20.8ms long with a bit time of approximately 10.2us. This divides out to around 2040ish bits!

The chip has 2K of data so this is pretty close, well within the measurement error of my scope.

The voltage range for data dumping is fairly critical and I thought I saw something earlier while it was running at 10V. At around 12V on test, the chip dumps its data it looks. 11.6V to around 12.4V. Below 11.6V it just relays data from the input ports. (possibly throwing data into the bus to execute). Above 12.4V it runs the code in the ROM.

Going by PMOS standards, this would be -2.6V to -3.4V.

Looks like I will have to make yet another dumping rig for these- I will make it a three play. MM78, COP411, and the mitsubishi CPUs maybe. Will be good to get my allpro 88 going. I got a replacement PCB for it about half done.

Good progress there on the MM78!

RB Yeah I understand why you could think that, but I don't think it's *that* bad. A better comparison to MAME is 8080bw.c

Sean: Maniac has 2 piezo speakers?