It is currently Wed Feb 20, 2019 8:13 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 11 posts ] 
Author Message
PostPosted: Thu Jun 28, 2018 8:33 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
There are 2 chips which are used for generating extra audio (WR550400 and WR550402). How they work is in progress. This is NOT the same as `Moe Pro! - Saikyou Hen (J) [hM23][p1]`.
This cartridge uses mapper VRC4 with wiring
VRC_A0 <- CPU A2
VRC A1 <- CPU A3
which is #23
Audio registers sit at $E001/$E002/$E003 (mask is $E003). Game uses mirrors of those regs at $f001/$f002/$f003. Unfortunatelly, writing to any of those regs will also be treaten by VRC4 as write to $f000 (IRQ Latch, low 4 bits). Maybe that's the reason why IRQ split graphics in FCEUx doesn't work correctly (it works on real hardware without problems)

Audio chip pinout:
Code:
        .--v---.
   D7 ->|01  18|<- D0
   D1 ->|02  17|-----------+
   D6 ->|03  16|---------+ R=150k
   D2 ->|04  15|- GND    +-+
   D5 ->|05  14|       
   D3 ->|06  13|
   D4 ->|07  12|
  +5V - |08  11|
AUDIO <-|09  10|
        `------`




Image Image Image Image Image

---

R should be 750k, not 150k and it is used to set speed of internal RC generator which clocks the circuit (I mistakenly read it at 150k and replicated the whole circuit on PCB and all sounds were just too fast).

Also, one of the D0-D7 seems to control the play/stop or even VCC of the circuit, because the clock (which is pin 16) is clocking only when sound is playing.


Attachments:
Moe Pro! - Saikyou Hen (bootleg) [apply over Moe Pro! - Saikyou Hen (J)].ips [923 Bytes]
Downloaded 139 times
Top
 Profile  
 
PostPosted: Thu Jun 28, 2018 11:14 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8142
Location: Seattle
krzysiobal wrote:
Audio registers sit at $E001/$E002/$E003 (mask is $E003). Game uses mirrors of those regs at $f001/$f002/$f003. Unfortunatelly, writing to any of those regs will also be treaten by VRC4 as write to $f000 (IRQ Latch, low 4 bits). Maybe that's the reason why IRQ split graphics in FCEUx doesn't work correctly (it works on real hardware without problems)
Er, how could that work on hardware? That's exactly how a VRC4 should behave.


Top
 Profile  
 
PostPosted: Thu Jun 28, 2018 3:48 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 430
thank you


Top
 Profile  
 
PostPosted: Fri Jun 29, 2018 6:07 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
I analyzed the chips. Each of them have pre-programmed different set of 8 PCM sounds.

Rising edge on D0..D7 starts playing one of 8 sounds. If two or more inputs rise exactly at the same time, no song is played. When edge occurs during playing, previously played song is stopped and new one is played back.

Clock (pin 16) seems to be running only when song is played, otherwise it is low. With R=750k, f=80kHz. Maybe it can be used as some kind of notification when chip is busy, but it needs to be buffered and filtered.

Audio output (pin 9) seems to be rather current-output than voltage, without load is it just high, but it produces analog output.

More interesting are pins 10/11/12. They seem to output some kind of digital signal during playback (binary value of PCM sound sample?).

I add dumps for analysing each of the chip, *.logicdata is Saleae file format (for use with Saleae Logic analyzer software) + wav files

I attached RAR because it produced 3MB file in comparision to 7MB ZIP (and maximum attachment size for this board is 4MB)


Attachments:
audiochip-analyze.rar [2.95 MiB]
Downloaded 113 times
waveform.PNG
waveform.PNG [ 63.6 KiB | Viewed 5260 times ]
Top
 Profile  
 
PostPosted: Fri Jun 29, 2018 6:26 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 430
krzysiobal wrote:
I analyzed the chips. Each of them have pre-programmed different set of 8 PCM sounds.

Rising edge on D0..D7 starts playing one of 8 sounds. If two or more inputs rise exactly at the same time, no song is played. When edge occurs during playing, previously played song is stopped and new one is played back.

Clock (pin 16) seems to be running only when song is played, otherwise it is low. With R=750k, f=80kHz. Maybe it can be used as some kind of notification when chip is busy, but it needs to be buffered and filtered.

Audio output (pin 9) seems to be rather current-output than voltage, without load is it just high, but it produces analog output.

More interesting are pins 10/11/12. They seem to output some kind of digital signal during playback (binary value of PCM sound sample?).

I add dumps for analysing each of the chip, *.logicdata is Saleae file format (for use with Saleae Logic analyzer software) + wav files

I attached RAR because it produced 3MB file in comparision to 7MB ZIP (and maximum attachment size for this board is 4MB)

this game using sample wav play sound.
this cart too?


Top
 Profile  
 
PostPosted: Fri Jun 29, 2018 10:25 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8142
Location: Seattle
krzysiobal wrote:
More interesting are pins 10/11/12. They seem to output some kind of digital signal during playback (binary value of PCM sound sample?).
If I treat pin 10 12 as data and pin 12 10 as clock on a rising edge, there's a series of 20-bit ... somethings? as playback continues. Possibly ROM offsets?
Looking through WR550400.logicdata, the following numbers show up during the playback of the first sample:
0x0008C 0x00618 0x006E0 0x00640 0x8A860
0x00668 0x808E0 0x80690 0xF0000
0x006B8 0x8000C

When pin 11 looks like a clock, pin 12 instead seems to be either "not pin 11" or high, rather than just sitting still for an entire bit time.

If I treat pin 11 as data clock and pin 12 as clock data on a falling edge, there's ... a thing ? might be ADPCM? Four bits are emitted every 5kHz. ... which actually seems to be quite accurate; if you look at the spectrum of the audio recording there's a clear aliasing line at 5,10,15 kHz and reflections about 2.5,7.5,12.5,17.5,22.5 kHz – all consistent with a zero-order-hold "interpolator".

edit: If I take that stream of nybbles, treat each one as little-endian, and parse it as IMA ADPCM, I end up with this:
Attachment:
File comment: I've only verified it plays back using sox
wr550400-recording-number-1.7z [1.27 KiB]
Downloaded 112 times
It's similar, but not particularly close.


Last edited by lidnariq on Tue Jul 03, 2018 11:41 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Fri Jun 29, 2018 11:38 pm 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 430
VRC4+sound?


Attachments:
20180630143816.png
20180630143816.png [ 81.73 KiB | Viewed 5161 times ]
Top
 Profile  
 
PostPosted: Sun Jul 01, 2018 4:53 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
First, the IRQ problem. What the game does every frame is:
Code:
F000 <- 9 ;during NMI (scanline 290)
F004 <- 5 ;during NMI (scanline 290)
F008 <- 2 ;during NMI (scanline 290)
F008 <- 2 ;during NMI (scanline 290)
F001 <- 0 ;at scanline 14 (resets Audio chip, accidentally sets VRC4 IRQ latch D3..D0 to 0
F003 <- 0 ;at scanline 14 (resets Audio chip, accidentally sets VRC4 IRQ latch D3..D0 to 0
...
IRQ should be triggered at scanline 148 but it does not
...
goes back to the beginning of loop


I checked what might be the source of problems with no IRQ triggering and the problem is FCEUX itself - those lines bellow. Maybe because #23 aggregates VRC2 and VRC4 with different address lines, they did this way:
Code:
static DECLFW(M23Write) {
   A |= ((A >> 2) & 0x3) | ((A >> 4) & 0x3) | ((A >> 6) & 0x3);// actually there is many-in-one mapper source, some pirate or
                                                // licensed games use various address bits for registers
   VRC24Write(A, V);
}

But this causes write to F003 to be treaten as write to IRQ Acknowledge register which moves
A bit to E, but because A was 0, now E is 0 and IRQs are disabled;

If I replace it with
Code:
static DECLFW(M23Write) {
   VRC24Write((A & 0xF000) | ((A >> 2) & 3), V);
}
,

this (and other #23 games which are VRC4 will work, but #23 which are VRC2 will not.
So probably this game need INES2.0 header.

---

Now the audio - thank you lidnariq for pointing that that pin 11 and pin 10 might be clokcks. At first I thought like you that pin12/pin11/pin10 are just bits0/1/2 of the audio sample and when I merged it into WAV file, I got somethink like your WAV. Even connecting speaker to pin 12 produces quite similar (but not very exact) sound like on the analog output - it is more metalic. Applying RC lowpass filter qives better results but it is still not the same as on analog output.

Definitelly pin 12 is DATA, pin11 is CLK1, pin 10 is CLK2. Looks like CLK2 clockes some control bit stream and CLK1 clockes data (but it does not seem to be just plain wave, maybe some kind of compression)

I rememeber I found similar chip in one of famiclone's zapper, which emited sound after pressing trigger - there it was called HT2880
Image

It has quite similar beaviour (but different pinout). But what's more interesting is that it has TEST1, TEST2 and TEST3 signals (just like those 3 weird pins here), which unfortunatelly datasheet does not explains.

What I am also curious is pin14/13 - they seem to be some indicator of sound being played, but they only apply to the SONG3.


Attachments:
HT2880.pdf [3.16 MiB]
Downloaded 79 times
Top
 Profile  
 
PostPosted: Sun Jul 01, 2018 5:12 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8142
Location: Seattle
krzysiobal wrote:
I checked what might be the source of problems with no IRQ triggering and the problem is FCEUX itself - those lines bellow. Maybe because #23 aggregates VRC2 and VRC4 with different address lines
Assuredly true.

Quote:
So probably this game need INES2.0 header.
It needs its own mapper to emulate the audio, I think, anyway.


Top
 Profile  
 
PostPosted: Sat Dec 22, 2018 5:16 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
Finally I got into posession of digital scope so I could return to analysis of this chip.

2 = main clock (pin 16),
3 = digital audio clock (pin 11),
4= digital audio data (pin 12),
1 = analog audio (pin 9)

Image Image Image Image Image Image

It looks like analog audio is some kind of DAC and every note lasts 16 cycles of main clock (every 4 cycles of main clock one digital audio bit is clocked and every 4 bits of digital audio one analog level is changed). Not sure how many levels there are (32?)

Not sure what's the delay between analog and digital data, but here is some part of the digital audio analyzed. No matter on which bit we consider start of the four-bit chunk pack, there is a sequence of the same 3 same chunks, but there are not 3 same analog audio levels in sequence, so the digital code is rather not DAC value, maybe it is relative value to the previous sample?
Code:
                                     *     *    *
1100 1010 0000 0001 1011 1101 0000 1000 1000 1000 0100 0000 0011 01
1 1001 0100 0000 0011 0111 1010 0001 0001 0001 0000 1000 0000 0110 1
11  0010 1000 0000 0110 1111 0100 0010 0010 0010 0001 0000 0000 1101

Image


Top
 Profile  
 
PostPosted: Sat Dec 22, 2018 11:52 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8142
Location: Seattle
I'd strongly suspect that's some kind of ADCPM, not just multi-bit DPCM.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: Google Adsense [Bot] and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group