Home Page Forums MAME MAME TMS-09xx/1xxx thread (was New Dumps)

It's too bad Rockwell was so closed-mouthed about the PPS-4 internals (not even publishing the opcodes in the datasheets!) I assume that the code in the patent is real, which sure implies an LFSR PC, at least for the MM77. Maybe the test pin enables circuitry to increment the bank register?

OK, I'll decap the 2705 from the SnR. LN, how do I dump the 2801 electronically?

Hmm. I'm not sure, you might be better off lending it to plgdavid for that, unless you can make an 'vsm-emulator' device to do it.

LN

Here's the complete schematic for the marx 300 bowling board I have:

http://blog.kevtris.org/blogfiles/Handhelds/Marx%20300%20Bowling/marx300.PDF

Enjoy!

with the help of sarayan that did most of the work, we figured out most of the MM78 stuff now. Including bit order, and that it looks like my dumps are good. All of the opcodes except a couple have been figured out now and the code looks pretty decent.

It looks like I was correct in that the CPU starts dumping at the reset vector, after 4 "junk" bytes. Address 0004h in my dumps is address 03c0h in the CPU space. The init code happened to be the same on both chips which helped a bit. Having more than 1 example is very useful in determining how close you are.

The tentative disassemblies are here:

http://dspnet.fr/~galibert/c6.txt
http://dspnet.fr/~galibert/c7.txt

Thanks a bunch to sarayan for the help!

I still am mystified how I got all 2K of data out of the chip, seeing how it has a polynomial program counter (verified) and a bank latch. Apparently the bank latch is really a counter, and every time the polynomial PC wraps it increments it. The other 4 bitters sure don't do this.

There's hundreds of examples in the disassembly of this not being a fluke. I particularly liked the jmp slide which appears at 0522h of c6.txt. They used jumps (they call them "transfers", or T) because each one takes 2 cycles instead of 1 cycle like a NOP, and the possibility of them properly pointing to each other like that by chance is impossible because it's in polynomial order.

Each usage of the TAB instruction is also "proper". the jump itself doesn't occur until 2 cycles later, so they nop them out or have another instruction or so before the jump table itself.

Also, every time the skisl instruction is used, there's a NOP before it because it takes a cycle to read the port bit in question, selected by B.

016 [017] 1b lb #b
017 [00b] 00 nop
018 [005] 01 skisl

On other micros, I finished dumping all my HD38820's. I had 8 of these surface mount chips to dump and finished doing that finally. So I think we got 14 or 15 games backed up waiting to be emulated, only being held up by lack of documentation.

I uploaded the ROM dump and hardware info for Entex Baseball 3:
http://www.seanriddle.com/tms1100.html

Scan of the bezel: www.seanriddle.com/entexbb3bezel.jpg

Scan of PCB showing LED placement: www.seanriddle.com/entexbb3pcb.jpg

Cool =) I'll let you know when it's emulated.

Ah, on ebball3 where's the Speaker connected to?

It's connected to pins 3 and 4 (R10 and VDD). I updated my doc. Thanks.

Well I finished up a few more vector + dumps. There's 2 new D553C games and one HD38820 game. I have 2 more to finish (another D553C and HD38800) and then I'm through all my games, except dumping the COP411 on turtles.

This one game I have, tandy kingman, has an HD38800B on it. This is the first time I have come across the B revision of this chip- it appears to be a die revision and is most likely a die shrink. It does not dump properly, and upon inspection the first 10-15 words are OK then it just sort of falls apart.

I am guessing it's because I am clocking it too slowly, so I will adjust my clocking doodad see if it behaves then. This would lend credence to a die shrink since the gate capacitance will go down making clock speed more critical. I am running it at something like 20-50KHz which is way below datasheet spec.

These chips needed a special circuit to clock them because it only uses an RC oscillator, so you have to "simulate" an RC circuit for it to work properly. You cannot just stuff a clock in because the oscillator pin is both input AND output. (it lets the resistor charge the cap up to a certain voltage, then it turns a transistor on to dump the capacitor to a lower voltage, then the cycle repeats).

New games:

http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Laser%20Fight/
http://blog.kevtris.org/blogfiles/Handhelds/Bambino%20Superstar%20Football/
http://blog.kevtris.org/blogfiles/Handhelds/Entex%20Galaxian%202/

Tomorrow I will try to get the last two done (kingman and astro command which is the D553C game).

Looks like I am up to 19 games done!