|
|
Joined: Feb 2015
Posts: 160 Likes: 6
Senior Member
|
Senior Member
Joined: Feb 2015
Posts: 160 Likes: 6 |
looks like I got M58846 dumping now. The bit order isn't 100% sure but it does look rather good. The initialization code appears to be 100% correct. I found that the code uses 4 undefined opcodes- 008h, 009h, 018h, and 019h. There's plenty of others but only those show up. I found that the M58845 uses them for the ADC so I added them for that but they don't really make much sense. After tracing through the VFD update code, I'm 99% sure 018h is a left rotate or acc=acc+acc. (which is the same thing) The code here illustrates that:
01-00 005 EI ;external interrupt vector
01-01 046 RTI
01-02 041 LCPS 1 ;timer 1 interrupt vector
01-03 01A TEAB ;move AB into E
01-04 0CC LXY C ;point to RAM 0ch
01-05 064 TAM 0 ;get memory in 0Ch (grid #)
01-06 00C TYA ;old grid
01-07 014 RD ;turn off old grid
01-08 002 INY ;next grid #
01-09 03C SEY #C ;is it 12? (there's 12 grids)
01-0A 1A5 B 25 ;no
01-0B 0EC LXY C ;address 0ch
01-0C 021 SZB 1 ;do we read buttons?
01-0D 1A0 B 20 ;do not read buttons
01-0E 0B1 LA #1 ;check left+down buttons
01-0F 081 OFA ;acc to port F
01-10 04D SB 1 ;we read buttons
;buttons are on bits 0 and 1 of K port which is loaded into A
;via the IAK instruction. bit 2 isn't used and bit 3 is skill.
01-11 0CD LXY D ;L+D buttons go into 0dh
01-12 057 IAK ;read button register
01-13 060 XAM 0 ;store in RAM
01-14 0B2 LA #2 ;check up+right buttons
01-15 081 OFA ;acc to port F
01-16 05F RB 3 ;clear bits 2/3 of 0dh
01-17 05E RB 2
01-18 048 RC ;clear carry
01-19 057 IAK ;read button register
01-1A 018 *XAL ;shift left I think
01-1B 048 RC ;clear carry
01-1C 018 *XAL ;shift left I think
01-1D 00A AM ;add DL00 to 00RU in RAM 0dh
01-1E 060 XAM 0 ;store into 0dh (DLRU buttons)
01-1F 1A4 B 24 ;done
01-20 0E8 LXY 8 ;if we do not read buttons
01-21 000 NOP ;waste time instead
01-22 002 INY
01-23 1A2 B 22 ;loop
01-24 0C0 LXY 0 ;fall thru (if grid = 12 sets to 0)
01-25 065 TAM 1 ;get data at addr 0Y
01-26 01C TBA ;put it into B
01-27 067 TAM 3 ;get data at addr 1Y
01-28 01B OSAB ;put it into A then output to port S
01-29 065 TAM 1 ;get data at addr 2Y
01-2A 084 OGA ;output it to port G
01-2B 064 TAM 0 ;get data at addr 3Y
01-2C 081 OFA ;output it to port F
01-2D 015 SD ;turn on grid Y (new grid)
01-2E 01D TAY ;grid # into Y
01-2F 0CC LXY C ;point to 0ch
01-30 060 XAM 0 ;store grid # into 0ch
The full disassembly is here: http://blog.kevtris.org/blogfiles/Handhelds/m58dxx.txtand ROM is here (you only need 2K words, I dumped it a lot of times to make sure it dumped OK) http://blog.kevtris.org/blogfiles/Handhelds/m58d.binthese links will probably go dead when I finalize the ROM and put it into the proper /Coleco Frogger/ dir.
|
|
|
|
|
Joined: Mar 2002
Posts: 1,368 Likes: 120
Very Senior Member
|
|
Very Senior Member
Joined: Mar 2002
Posts: 1,368 Likes: 120 |
I don't know if this belongs here, per se...but I figured I'd ask since I just came across it the other day and have been following this thread with some interest. Is there any interest in a Dungeons & Dragons Electronic Labyrinth game? I actually have no idea what's inside of it, though since it's presumably fairly primitive. I can probably pop it open and look at chips if someone wants.
They don't seem to be terribly sought after and mine's in less than pristine condition, and I'm going through another wave of trying to shed random crap I've over-accumulated, so... Since kevtris already guessed on TMS1xxx, my bet is on a Rockwell MCU cause it's a Mattel game. Open her up and tell us who won the imaginary bet?
|
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I'll put 5 MESScoins on National Semiconductor.
|
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I got lucky with the Lightfight COP421L - it was easy to dump by just giving it power, a resistor and cap for the oscillator, 3V on SO, and grounding SI. I had to let it run normally for a bit so that the code set up the L port as output, then 3V on SO put it in ROM dump mode. Since SK is used as an output it doesn't indicate when the ROM bits are valid, but they are wide enough that I could find the centers easily. There were 32 zeroes at the end of the dump that helped ID the start, and I confirmed it by disassembling the code and checking JSR addresses. I posted the ROM dump and hardware info: http://www.seanriddle.com/cop421l.htmlI couldn't measure the clock rate from the oscillator pin; the capacitance of my 'scope probe slowed it down. Maybe the same thing was happening with the Entex BB3 TMS1100. When you turn on power, it continually displays a dot, then a small square, then a large square, and it beeps each cycle. I counted 30 cycles in 23.3 seconds. The resistor and cap used are listed in the datasheet as giving a 19uS instruction time, +/- 15%.
|
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I picked up a couple of Dark Tower PCBs. I contacted an ebay seller who offers a repair service and asked him if he had any broken PCBs, and he sold me one. Right after that, a tower came up for buy-it-now at a (somewhat) reasonable price, so I got that, too. The bare PCB has some battery acid damage, but the chip looks OK. I decapped it and I'll Whink it tomorrow to make transcribing the bits easier. The bare PCB is Rev C, while the PCB in the tower is Rev B. The Rev B board has a DIP TMS-1400; the Rev C board has an SDIP. They are wired the same except that Rev C runs an additional output to the chip enable of a hex driver that controls the speaker and lamps. I'm not sure why; maybe to make it easier to blink all the lamps at once, or maybe to shut them off to save power? The Rev B board also has another transistor hacked onto it for motor control. I guess the original design wasn't robust enough. The motor rotates an inner plastic shell with 21 different different images that the lamps can illuminate. An LED and phototransistor are positioned to detect notches in the shell for indexing. I haven't figured out how to remove the inner shell to get pictures of the images, and I'm not sure how to get good scans since it is curved. The tower was listed as not working, but after I put it back together it seems to be fine. I put the wiring info up, and I'll add the ROM dump when I finish that. www.seanriddle.com/tms1400.html
|
|
|
|
|
Joined: Mar 2002
Posts: 1,368 Likes: 120
Very Senior Member
|
|
Very Senior Member
Joined: Mar 2002
Posts: 1,368 Likes: 120 |
That's great! =) Could you also make photos of both PCBs and of the cardreel mechanics? Scans of the cards are on this site too: http://www.bigfloridacountry.com/darktower.htm
|
|
|
|
|
Joined: Aug 2011
Posts: 48
Member
|
|
Member
Joined: Aug 2011
Posts: 48 |
Heh. I thought I knew where the D&D game was, but it seems I might have left it at the storage unit. I'll let you guys know in a few days who the winning bet is.
|
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
I uploaded the Little Professor 1978 ROM array pic and ROM dump. When I run the code in an emulator, it gets stuck in a loop. This is likely because opcodes are slightly different from the TMS1000, since the TMS1990 has separate keyboard strobe outputs. I compared the ROM word address decoder and the ROM page address decoder circuits, and they appear to be the same, so I think the ROM dump is correct. Unfortunately, there is a glob of plastic covering part of the instruction decoder. I just ordered some stronger Nitric acid to help clean dice. www.seanriddle.com/tms1990.html
|
|
|
|
|
Joined: Mar 2002
Posts: 1,368 Likes: 120
Very Senior Member
|
|
Very Senior Member
Joined: Mar 2002
Posts: 1,368 Likes: 120 |
lilprof78 ROM looks good, and the instructions PLA looks the same as Wiz-A-Tron (ignoring what's under the smudge). I see no indication on extra opcodes such as an Power-OFF opcode.
I'll add it to MESS now and post an update soon.
*edit* hmm I'm going to cleanup the driver a bit 1st. Also:
6 row 1
7 N/C
8 col 1
9 row 2
10 col 2
11 row 3
12 col 3
13 row 4
14 col 4
15 row 5
rows are write-R pins, cols are read-K pins?
Last edited by hap; 03/14/15 11:02 PM.
|
|
|
|
|
Joined: May 2010
Posts: 1,051
Very Senior Member
|
|
OP
Very Senior Member
Joined: May 2010
Posts: 1,051 |
Yeah, I assume that there are 4 K inputs. I mostly matched up the pads on the die shot to the pins, but there are actually 29 pads. The top right pad is segment B, with +9v below it.
I can't see an obvious difference between the row and column pads, but if the outputs are just used for the keypad, they don't need much drive, unlike the O output pads at the top of the die.
|
|
|
|
3 members (Dorando, Praxis, 1 invisible),
526
guests, and
1
robot. |
|
Key:
Admin,
Global Mod,
Mod
|
|
|
Forums9
Topics9,320
Posts121,930
Members5,074
| |
Most Online1,283
Dec 21st, 2022
|
|
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!
|
|
|
|
