It is currently Mon Feb 18, 2019 1:17 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 14 posts ] 
Author Message
PostPosted: Fri Jan 04, 2019 7:27 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
I got into possesion of this interesting keyboard-like console called SUBOR SB97.
Image Image Image Image

But it's not like other cheap keyboard-famiclones (GLK-2004). It's the first famiclone that doesn't make you want to throw the keyboard out of window after pressing few keys. But primarily the most interesting fact is presence of standard 3.5" floppy disk (!) and printer port, so I thought of making extensive reverse-engineer.
Also it was kind-of broken (internal cartridge showed no graphics like you would remove SRAM chip from CHR-RAM game) - as it turned out later, the resistor that pulled-up to VCC the line used to detect presence of external cartridge has too much resistance causing too big voltage drop.

This is probably either first-release or low quantity product:
* there are few patches applied to the PCB (cut traces + wires) - I marked them on schematics to see what they changed, they even cutted one track in two places
Image
* overal designs looks weird - mixed glob + DIP chips and goldpin add-on boards with another addon boards.
Image

--
Reverse engineering
The entire console consists of primary PCB (with cartridge slots) and secondary one (with DC A/V jacks), connected by a 22 pin ribbon cable (whose pinouts is different than any one I ever saw before). They even put two 7805's (one for powering floppy and the other for rest of chips). Both red & yellow wires of floppy are powered from 5V (maybe early floppy drives needed +12/+5V, but this one seems to be normal HD floppy, reads standard FAT12 1.44MB disks). Most hard part was to desolder those goldpins cause they're extremely fited to the holes, but it was succes.

Primary PCB:
Image Image Image Image Image

Primary PCB - addon board:
Image Image Image

Secondary PCB:
Image Image Image

Keyboard layout:
Image Image Image Image

--

Overal design:
There are tons of chips:
*NES-on-chip blob (with exact same pinout as UM6561)

*40 pin Mapper blob:
Code:
              +--------+
!ENABLE     ->| MAPPER | -> PRG_A14..A19
              | BLOB   | -> ROM_!CE
CPU_D0..D7  ->|        | -> RAM1_!CE
CPU_A14..A8 ->|        | -> RAM2_!CE
!ROMSEL     ->|        | -> CIRAM_A10
M2          ->|        |
R/W         ->|        | -> !LPT_REG
              |        | -> !LPTSTRB_REG
PPU_A13..A10->|        | -> !FDD_REG
              |        | -> !AUDIO_REG
              |        | -> AUDIO_LATCH
              +--------+


*SRAM which acts as CHR-RAM for internal cartridge

*GM82C765B which is floppy controler

*74273/74139/7308/7404/74161 for glue logic & interfacing with LPT port

*128 kB PRG-RAM1

*addon-board with 1MB PRG-ROM, 8kB PRG-RAM2 and some mysterious audio (?) blob-chip
Code:
               +--v--|
        CPU-D3 |01 16| CPU-D4
        CPU-D2 |02 15| CPU-D5
        CPU-D1 |03 14| CPU-D6
        CPU-D0 |04 13| CPU-D7
           GND |05 12| Audio output2
   AUDIO_LATCH |06 11| Audio output1
           GND |07 10| +5V
    !AUDIO_REG |08 09| CPU-R/!W
               +-----+

Audio coming from this chip is used at least in the calculator-program which talks all digits and operations.

*SB02 for driving columns of keyboard-matrix
Code:
         +--v--|
    OUT2 |01 20| +5V     
!EXT/INT |02 19| OUT0   
   !KBEN |03 18| OUT1   
    ROW6 |04 17| ROW11 
   ROW12 |05 16| ROW10 
COL1-|>- |06 15| ROW4   
    ROW8 |07 14| ROW1   
    ROW7 |08 13| ROW9
    ROW2 |09 12| ROW3
    GND  |10 11| ROW5
         +-----+
      
Falling edge of OUT0 causes next ROWn line to become low (others are high) in the following order:
ROW11, ROW2, ROW3, ROW8, ROW6, ROW1, ROW9, ROW7, ROW10, ROW4, ROW5, ROW12


*74158 for multiplexing lines of keboard rows

*Chip called SUBOR.
Image
This is a small glob pcb whose purpose is to play a one second welcome text (?) after console is started, no matter if the external cartridge is present or not.
Image Image
Code:
+------------+
|1 +5V       |
|2 NC        |
|3 PLAY      |
|4 NC        |
|5 RESET     |
|6 NC        |
|7 AUDIO_OUT |
|8 GND       |
+------------+

- Rising edge on pin 3 cause restart of currently played sample.
- When pin 5 is held low, voice become muted (but after releasing it, it starts playing where it stopped)

Dumping the PRG-ROM.
I created a small adapter which converts the add-on board to standard 27801 pinout and thus allow read using EPROM programmer.
Image

Firstly I got very incosistent reads. Later it turned out that the blob chip placed with the ROM is causing bus-conflicts. I disabled it.

--
Analyzing the mapper chip
It's hard to analyze chip built-in console. I did it by creating a special cartridge UNROM-like cartridge which controls pin 31 (used for detection of external cartridge).
Image

Code:
$08xx-0fxx = !LPT_STRBREG (during read/write cycle, this pin is held down)

$48xx-$4fxx = !LPT_REG (during read/write cycle, this pin is driven low)

$50xx = [MMpppppp] $8000 bank + configuration register1
         ||||||||
         ||++++++- select 16 kB ROM/RAM1 bank at $8000-$bfff
         ++------- mode

$52xx = [pppppp.V] $c000 bank + configuration register2 + AUDIO_LATCH latch
         |||||| |
         |||||| +- mode
         ++++++--- select 16 kB ROM/RAM1 bank at $c000-$ffff
              +--- value latched on AUDIO_LATCH pin

$53xx      = !AUDIO_REG (during read/write cycle, this pin is held down)

$54xx-57xx = !FDD_REG (during read/write cycle, this pin is held down)

       CPU memory map                     PPU memory map
V MM | $6000 | $8000 | $c000 |            $0000 | $1000
x 00 |  RAM2 |  ROM  |  ROM  |              c       c
0 01 |  RAM2 |   -   |  ROM  |
0 1x |  RAM2 |  RAM1 |  ROM  |
1 01 |  RAM2 |   -   |   -   |
1 1x |  RAM2 |  RAM1 |  RAM1 |

ROM is enabled even during write cycles;
"-" is open bus




What is left to do:
* PPU banking & mirroring: internal CHR-RAM's A0-A11 are wired to PPU. A12 is wired to CIRAM-A10 (which is controlled by mapper), but mapper blob has access to PPU_A13..A10 (so theoreticaly it can do V/H/0/1 mirroring and use 4kB/8kB ROM bank granurality).
Which I found extremely weird is that on powerup CIRAM-A10 follows PPU-A10 and there does not seem to be any register which changes that. However, when I looked at the behaviour of CIRAM-A10 for internal cartridge, it is strange. Looks like not CPU controls mirrorig/banking of CHR-RAM, but rather it is done by PPU-itself (like in MMC2, by looking at specific tiles) or it changes automatically after certain rises of PPU-A10/A11/A12/A13. I need to find that out.


I attach the ROM + modified FCEUx that supports it.

---

The built-in semi operating system called SB DOS Version 1.0 for managing flopppy drive has very limited set of commands. It can't even enter folders, but is able to execute COM/EXE (they need to be in subor format, whatever that means).
Note that in attached ROM, DOS (which is the center choice) cannot be run - probably communication with floppy-controler chip need to be implemented in emulator for that to work, but on real hardware the floppy disk can ever be disconnected and it still lets DOS to be executed.

Image Image Image Image Image Image Image Image Image Image Image Image


Attachments:
rom.zip [2.01 MiB]
Downloaded 47 times


Last edited by krzysiobal on Sat Jan 05, 2019 3:41 pm, edited 2 times in total.
Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 4:03 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 852
Eh, that ROM has already been dumped as Subor V, Mapper 518, which displays the graphics without any glitches in NintendulatorNRS. Of course, the audio, floppy disk controller and printer functions still need to be described. Furthermore, the $5200 register on the wiki does not incorporate the more elaborate PRG banking, while your description is missing the CHR banking bit.

Yes, the DOS will only be displayed if the (NEC µPD765-compatible) floppy disk controller raises an IRQ when it is reset.


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 7:07 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
I've just wrote a test ROM that after writing to $5200 each value ($00..$FF), which happens after OUT0 pulse, reads from whole PPU address space (using PPUDATA).
As a result - CIRAM-A10/CHR-A12 always follows PPU-A10.
Image

Mapper does not have PPU-/RD nor PPU-/WR routed so it can't distinguish between PPU read/writes. So either it somehow can distinguish when PPU is rendering/not or there is more logic underneath.


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 7:29 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 852
That is correct, because clearly, the introduction screen with the falling Subor logo must have that CHR-A12 follow mode off to not look garbled.

But I got floppy disk reading working in NintendulatorNRS! I had no actual disk image with files suitable for the SB97, so I just used a PC game disk for testing:
Attachment:
SuborV-disk1.PNG
SuborV-disk1.PNG [ 1.75 KiB | Viewed 1486 times ]
Do you have Subor format files to try?


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 7:44 am 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
My mistake, my test cartridge had solder jumper set to V mode (CIRAM-A10 permanently soldered to ppu-a10), that's why no mirroring changes were observed :oops:

Unfortunately not, I got it without any floppies. But take look at it, it is yet different Subor version (probably also with different DOS with more commands):
https://webcache.googleusercontent.com/ ... clnk&gl=pl


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 8:33 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 852
Television commercial for this particular model. Not terribly enlightening, but amusing nonetheless.

Twenty minute video of this model in action. Apparently, the speech chip is not just used in the calculator, but the text editor can read the characters of a text as well. Also, the middle icon changes from DOS to something else if a cartridge is inserted! I presume that the PRG modes that are listed as mapping "open bus" actually map to the cartridge slot.


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 4:01 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
I wonder if the EXE/COM are just pure 6502 asm files that are executed by CPU or rather they contain calls to the SB DOS routines and are interpreted.

The "audio chip" looks more like a two channel digital pulse generator rather than audio chip. Here are waveforms after pressing each of the digit on calculator (1, 2, ..., 0).
AUDIO_LATCH goes high after pressing first digit and stays high until exit of the calculator program (chip enable for the "audio chip" ?)
Image

I don't know chinese (or japanese) but "2" sounds like an "ahh". It consists of sending 17 "packets" of data to the chip, with delay of around 19.5ms (once per frame?)
Image

Each packet consist also of some amount of read/writes to the chip (read is used to get the READY state of chip?)
Image

The actual pulse channels output by the chip are variable-duty pulses (with period of 50us)
Image

Here is how look those pulses with comparision of how they look at the bases of transistors (they're in fact all 5V amplitude, just my scope makes them look like they not fall to 0V for the shorter ones)
Image Image Image
Image


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 4:11 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 8136
Location: Seattle
A few years ago we had someone show up to talk about writing programs for one of these famiclones with a floppy disk drive... had a blog about it too. Can't remember his username, unfortunately, nor any other identifying details that would let me search for it :/

But what he was demonstrating was native code that used jumps to the bios at a fixed address as a syscall interface, to replace the x86 DOS "interrupt" syscalls.


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 4:41 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 21097
Location: NE Indiana, USA (NTSC)
krzysiobal wrote:
I don't know chinese (or japanese) but "2" sounds like an "ahh".

If 1, 2, 3 sound like "ee, ah, san" then it's probably Mandarin (yī, èr, sān).


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 5:57 pm 
Offline

Joined: Sun Mar 19, 2006 9:44 pm
Posts: 977
Location: Japan
This design looks VERY similar to the Dr. PC Jr. Famiclone, as that had a floppy disk, AT keyboard port, "DOS" clone, and a speech chip on board:

http://www.chrismcovell.com/drpcjr/

_________________
http://www.chrismcovell.com


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 6:08 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 852
The heck you say. That reminds me of an unanswered request I had made about a month ago...

The design and focus are different - The Bung Dr. PC Jr. uses the PS/2 keyboard interface, while the SB97 uses a proprietary (Subor) keyboard interface, and no mouse. (Later Subor models did support a mouse, again with a proprietary interface.) The Dr. PC Jr. had better capabilities for running pirated games, however; its custom mappers basically replicate Bung's late-1980s (Super) Game Doctor RAM cartridges, so that mapper hacks made for them can be reused, requiring only the addition of the custom file header. Clearly, Subor was serious about making an educational computer, while Bung repackaged their game piracy devices as a make-pretend educational computer.

Edit: The pinout of the audio chip resembles that of the TSP50C10/11 speech chip (N package), at least in the data pins. If it is that chip, then the design manual has a mere 400 pages.


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 7:35 pm 
Offline

Joined: Sun Mar 19, 2006 9:44 pm
Posts: 977
Location: Japan
NewRisingSun wrote:
The heck you say. That reminds me of an unanswered request I had made about a month ago...


Was it a month ago? Feels like I had read it only 1 week ago. I'll look for the other PCJr files, but I doubt that I have them backed up anywhere. I lost all my PC contents pre-2004 due to a hard drive crash at that time.

_________________
http://www.chrismcovell.com


Top
 Profile  
 
PostPosted: Sat Jan 05, 2019 8:11 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 468
Location: Poland
NewRisingSun wrote:
Edit: The pinout of the audio chip resembles that of the TSP50C10/11 speech chip (N package), at least in the data pins. If it is that chip, then the design manual has a mere 400 pages.


It might be true, this chip also uses D7 for signalling BUSY/IDLE state
Image


Top
 Profile  
 
PostPosted: Sun Jan 06, 2019 5:32 am 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 99
Slightly unrelated but it just occured me that the add-on PCBs (specifically, the one that has two story) has the same Bert (?) signature as a series of multicarts found in Mainland China in the early 90s, like that one.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group