BF9096 (camerica mapper 232) - invalid pinout description

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
krzysiobal
Posts: 649
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

BF9096 (camerica mapper 232) - invalid pinout description

Post by krzysiobal » Sun Dec 25, 2016 9:13 am

I think there is something wrong with description of this chip that is published on the internet OR i have other version of this chip.
This chip is from some famiclone game (probably some kind of Quattro - Arcade/Adventure or so). I did complete PCB rev-en of this cardridge:
Image Image

So, what are my observations:
1. CPU_!ROMSEL and CPU_R/!W lines are reversed
2. PRG_A16 and PRG_A17 are reversed.

More over, in all Quattro NES roms player on emulator (FCEUX): Adventure, Sports, Arcade when you choose second game from the menu, in facts third game is launched and when you chose third - second is launched. This might be the cause that author of emulator implemented mapper 232 according to the bad specification that is over internet.

Another more technical aspect that I have discovered is that the BF9096 chip is clocked by all of these three lines: CPU-!ROMSEL, CPU-R/!W, CPU-A14 (or rather internally by signal generated by oring all of them?) - so if all of these lines are at 0 and any of them goes to 1, the mapper latches to PRG-A16/PRG-A17 the vaue of D4/D3.

lidnariq
Posts: 9027
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: BF9096 (camerica mapper 232) - invalid pinout descriptio

Post by lidnariq » Sun Dec 25, 2016 11:23 am

krzysiobal wrote:2. PRG_A16 and PRG_A17 are reversed.
[...]
More over, in all Quattro NES roms player on emulator (FCEUX): Adventure, Sports, Arcade when you choose second game from the menu, in facts third game is launched and when you chose third - second is launched.
Does it seem more likely that the dump is wrong, or that the bits in the register are out of order?
e.g. on the wiki we say

Code: Select all

  $8000-BFFF:   [...B B...]   PRG Block Select
but if those two bits are actually D4→A16 and D3→A17 then this is a documentation issue, rather than a dump issue.
Another more technical aspect that I have discovered is that the BF9096 chip is clocked by all of these three lines: CPU-!ROMSEL, CPU-R/!W, CPU-A14 (or rather internally by signal generated by oring all of them?)
That feels like the simplest way to do that, and safe given the timing of the 2A03

krzysiobal
Posts: 649
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: BF9096 (camerica mapper 232) - invalid pinout descriptio

Post by krzysiobal » Mon Dec 26, 2016 6:09 am

Here is proof of the latching timings:
Image

Next interesting thing in this chip is pin 16. According to documentation it is GND, but after desoldering and measuring resistance on diode test there is about 600 mV drop between pin 10 (GND1) and pin16 (GND2), so this might be some kind of controlling or testing pin. Unfortunatelly according to my observation, this chip behaves the same if pin 16 is pulled to GND or VCC>

And the CIC output pin is de facto M2 divided by 2 (M2 is not used for anything else).
Image

lidnariq
Posts: 9027
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: BF9096 (camerica mapper 232) - invalid pinout descriptio

Post by lidnariq » Tue Dec 27, 2016 4:37 pm

What software did you find/buy/write to explore the state machine of the BF9096?

krzysiobal
Posts: 649
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: BF9096 (camerica mapper 232) - invalid pinout descriptio

Post by krzysiobal » Tue Dec 27, 2016 5:05 pm

It is a device + program made by my hands.
Image Image Image

The device consists of DIL ZIF socket and Atmega 8 which communicate with PC through USB. 30 out of 32 pins (except bottom left and top right) are connected with Atmega pins (with serial resistors). Atemga can read/write signals on any of those pins. Serial resistors protect pins from overcurrent if there is different logic level on both sides.

The PC part is a control program written in C#. It basically allows doing following things:
* reading ROMs/EPROM/Flash
* programming flash
* automatic testing IC circuits (74xx, SRAMs, asics, pals, etc). The logic function of such device is hardcoded in PC application, so adding new device is just matter of minutes - add new class defining logic of outputs with respect to inputs.
* dumping PALs.

I succesfully restored PALS of 168-in-1 famiclone multicart, golden 5 (5-in-1) famiclone multicart.

Few days ago I aded useful function for manipulating the logic levels of pins just by clicking on them so it can be used for fast testing behaviour of some new chips.

Image Image Image

krzysiobal
Posts: 649
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: BF9096 (camerica mapper 232) - invalid pinout description

Post by krzysiobal » Mon Feb 10, 2020 4:51 pm

I come back to analysis of this chip.
*First, pin 10 seems to be the only true GND and pin 16 seems to be some unknown input. Why? Diode test between any pin and pin 10 shows ~0.7V drop (due to protection of clamp diodes), while testing between any and pin 16 shows ~1.4V

*Second, the above test shows that all pins (even CPU D2) has internal connection inside.

*Third - I was interested what is the point of using CPU_A13 and CPU_A0 if the mapper description does not take care of them. They are indeed used for the lockout. While writing to E000-FFFF, the inverse of A0 is latched internally and available on pin 13 (which then drives the charge pump)

I tested few codemasters' ROMs and at the very beginning, they make 10 alternating FFF0/FFF1 writes with delay of 5ms between them, so that would correspond make 10 0/1 pulses of the pin 13.

But what I find out is that the pin 15 (R/W) is not taken into acount while latching the value for pin 13. As a result, not only writes but also reads cause latching aswell. And because A0 toggles every CPU cycle, that would correspond to around 1.7MHZ toggling (only when reading from ROM)

But in the above PCB, where R/!W and /ROMSEL are exchanged, it changes the behaviour - here only writes trigger the latch, but additionally the range is not only $e000-$fff but also $6000-7fff (because of not taking pin15=/ROMSEL). This seems to be more rational, because $e000-$ffff overlays also the $c000-$ffff range used bankin, so the game would prefer to use $6000-$7fff.

* Fourth - M2 does not have any influence on the banking/CIC functionality (it can be all the time low or high and it still works the same).

* Fifht - also value od D2 does not seem to alter anything.

Because those pins seems to be still connected internally, it makes me thing that this BF9096 chip is some kind of programmable IC that was just programmed to ignore pins 5(M2) and 16.

aquasnake
Posts: 85
Joined: Fri Sep 13, 2019 11:22 pm

Re: BF9096 (camerica mapper 232) - invalid pinout description

Post by aquasnake » Wed Feb 19, 2020 5:43 am

mapper71 & 232

$9xxx.bit[4]: 1-s mirroring
$8xxx.bit[4:3]: outer prg address
$C000-$FFFF.bit[3:0] : inner prg address


cpu_addr_out[17:13] = {{outer[3], outer[4]}, inner[3:0]};


for mapper 71: cpu_addr_out[17:13] = {{cpu_addr_in[14] ? prg_bank_cdef[3:0] : inner[3:0]} , cpu_addr_in[13]} & prg_mask[17:13];

for mapper 232: cpu_addr_out[17:13] = {{outer[3], outer[4]}, {{cpu_addr_in[14] ? prg_bank_cdef[1:0] : inner[1:0]}, cpu_addr_in[13]} & prg_mask[15:13]};

mostly do not access $8000, somtimes init $8000 with 0 at the very beginning, when prg rom >=128K <=64K every invidual rom in mapper232 then need to set the outer prg address register

Post Reply