It is currently Thu Jun 27, 2019 5:11 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 30 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sun Feb 24, 2019 8:06 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
I got my very own Famicom Network Adapter this weekend, which included the JRA-PAT game card and gigantic controller with numberpad. I verified everything works except obviously not able to dial into a Japanese horse racing dialup server. That still just cracks me up this was legitimately used for that.

Anyway, I have probed and prodded and found lots of curiosities. It is a big unknown what this thing is capable of, but here is what I have found so far.

Pinouts here for now:
https://wiki.nesdev.com/w/index.php/User:Ben_Boldt

The RF5C66 chip (U9):
  • This seems to be a memory mapper chip.
  • It can generate IRQs.
  • It is connected to CPU address bits 0-7, 12-14, /ROMSEL, CPU R/W.
  • It is connected to CPU data bus 0-7.
  • The card has its own data bus. RF5C66 also connects to this data bus.
  • (The card's address bus is directly connected to the CPU address bus however.)
  • So it seems the RF5C66 must multiplex the CPU and Card data busses together.
  • It controls what appears to be an 8kbyte PRG-RAM chip (U5) which is on the card data bus.
  • It is connected to PPU A10 and A11 (and no other PPU address bits, no A12), so it isn't doing any fancy PPU stuff like MMC5.
  • The presence of PPU A10 & A11 makes me think MMC3 scanline detection, but no A12 though.
  • It is able to control or monitor the onboard CHR-RAM's /CE, not sure why. It does not receive PPU /RD or /WR.
  • This chip has no means of writing to the onboard CHR-RAM and no access to PPU data bus.
  • Has a 21.47727MHz crystal.

The RF5A18 Chip (U10):
  • This appears to be a modem controller chip.
  • It has its own private 8kbyte RAM chip (U6), presumably for buffering network data.
  • It has CPU address bits A0, A1, and A2. No others.
  • It is on the card data bus and not on the CPU data bus.
  • It controls the LEDs.
  • It reads the switch on the bottom of the network adapter.
  • Has a 19.6608MHz crystal.

The JRA-PAT card:
  • No CHR/PPU connections. The user program has to manually load data into CHR-RAM.
  • The JRA-PAT card is not potted. I was reading somewhere earlier someone thought it was potted due to its weight. If you carefully peel the back metal piece off, it can be opened and accessed.
  • The card is very reminiscent of a GameBoy cartridge. It is longer, but slightly thinner and skinnier.
  • Contains an MMC1B2F mapper chip, SOIC-24 package.
  • Contains a BR93C46AF, SOIC-8 package, which appears to be a 1kbit microwire EEPROM?? Not sure.
  • It has a CIC chip scheme, using "8633AN" as the host CIC chip and "8634A" as the guest CIC chip inside the card. Great. :?
  • The card itself is labeled with part# FCN-027, which matches the label on the ROM chip inside, so that makes me think it is a mask ROM and not an auto-destruct style RAM chip holding the program.
  • The card has a battery in it. My battery is still 3V, so I don't actually know what happens when the battery dies.


Attachments:
IMG_1637[1].JPG
IMG_1637[1].JPG [ 2.39 MiB | Viewed 11323 times ]
IMG_1635[1].JPG
IMG_1635[1].JPG [ 2.19 MiB | Viewed 11323 times ]
Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 11:11 am 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
I am planning to dump the ROM chip tonight. If anyone is interested in poking at the code, send me a PM.


Attachments:
IMG_1639.JPG
IMG_1639.JPG [ 2.05 MiB | Viewed 11275 times ]
Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 11:29 am 
Offline

Joined: Fri Feb 24, 2012 12:09 pm
Posts: 918
Last year somebody was taking the SNES version apart, https://www.raphnet.net/divers/retro_ch ... /index.php (it's in french, and I don't know if it's containing anything interesting in regards to NES version).
Where are those 100pin chips shown on the pin-out page? Is that on something expansion port, not shown in the photos? The SNES version has the modem on controller port, so that appears to be different. The modem/horsebetting protocol may be similar though.


Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 4:26 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
All of the pinouts that I have are from the inside the famicom network adapter. The photos I have above are from the card that goes into the network adapter.

Here is what the network adapter looks like:


Attachments:
pcb.jpg
pcb.jpg [ 250.43 KiB | Viewed 11241 times ]
1024px-Nintendo-Famicom-Modem-Network-System-Attached.jpg
1024px-Nintendo-Famicom-Modem-Network-System-Attached.jpg [ 88.41 KiB | Viewed 11241 times ]
Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 5:49 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
Here is the MMC1 pinout, RAM is connected differently than seen elsewhere:

Code:
MMC1B2F
             _____ _____
    PRG A14 -| 1  V 24 |- +5Vcc
    PRG A15 -| 2    23 |- M2
    PRG A16 -| 3    22 |- CPU A13
    PRG A17 -| 4    21 |- CPU A14
    PRG /CE -| 5    20 |- /ROMSEL
PRG RAM +CE -| 6    19 |- CPU D7
          ? -| 7    18 |- CPU D0
          ? -| 8    17 |- Card RAM /WR
PRG RAM A13 -| 9    16 |- ?
PRG RAM A14 -| 10   15 |- GND
PRG RAM /CE -| 11   14 |- GND
        GND -| 12   13 |- GND
             |_________|


The ROM is 128kbytes. I have fashioned up a ROM dumper with A0-A15, D0-D7, and I had manually grounded the chip selects and hooked switches to A16 and A17. I dumped 4 times with each combo of switches, merged the 4 files, and found that the first half matched the last half, so A17 doesn't do anything for this ROM, thus 128k and not 256k. When looking at the end of the ROM, the vectors make sense, so I believe it to be a good dump. I added an iNES mapper set to 128k PRG-ROM, 0 CHR-ROM (=CHR RAM present) and mapper #1, ran it in FCEUX, and it doesn't do much, it initialized the stack and some PPU stuff, then it sits forever waiting for something to happen with register $40C0. Something magic must happen because if something ever did happen with $40C0, it would then escape that loop and manually jump back to the reset vector. Maybe it waits for an IRQ. The IRQ and NMI vectors don't seem to make much sense though.

Attachment:
front.jpg
front.jpg [ 572.66 KiB | Viewed 11229 times ]

Attachment:
front2.jpg
front2.jpg [ 952.91 KiB | Viewed 11227 times ]


Attachment:
back.jpg
back.jpg [ 408.52 KiB | Viewed 11229 times ]

Attachment:
back2.jpg
back2.jpg [ 759.52 KiB | Viewed 11227 times ]


Last edited by Ben Boldt on Mon Feb 25, 2019 6:16 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 6:11 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 4118
Location: A world gone mad
Random fly-by post: if someone (ex. nocash) wants one a Famicom Network/Modem Adapter, let me know -- I own one and would be happy to donate it for whatever cause. I do not have the keypad or any game cards, however.


Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 6:22 pm 
Offline
Site Admin
User avatar

Joined: Mon Sep 20, 2004 6:04 am
Posts: 3694
Location: Indianapolis
Thanks for the info, that's very interesting.. surface-mount MMC1.. cart board was designed in 1992.. that cartridge was made in 1995..! I knew almost nothing about this thing so I guess anything would be a surprise, but I didn't know it was in use for that long. Seeing "OTP" on there makes me wonder too if any carts used that, if so we'll want to get those dumped before bit-rot sets in. That specimen clearly is a mask ROM though. I'd be surprised if any of them were OTP, but who knows.

Do the FC audio pins go anywhere, or just passed through?


Top
 Profile  
 
PostPosted: Mon Feb 25, 2019 9:47 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
Memblers wrote:
Thanks for the info, that's very interesting.. surface-mount MMC1.. cart board was designed in 1992.. that cartridge was made in 1995..! I knew almost nothing about this thing so I guess anything would be a surprise, but I didn't know it was in use for that long. Seeing "OTP" on there makes me wonder too if any carts used that, if so we'll want to get those dumped before bit-rot sets in. That specimen clearly is a mask ROM though. I'd be surprised if any of them were OTP, but who knows.

Do the FC audio pins go anywhere, or just passed through?

I think it is very interesting too. The main board inside network adapter itself is at least 4 layers, though most stuff is on the top and bottom. I plan to remove some components from the main board in the future so I can at least visually verify some N/C pins on those 100-pin chips.

The FC audio pins do run across the main board, and out the edge connector to the modem. It is probably just for modem sounds, but if it does contain additional audio channels, it wouldn't be unreasonable for everything to be mixed together inside the modem. I started working my way through what the audio signals do inside the modem and it is pretty complex. For sure the adapter must be able to make dialing sounds somehow. I don't want to get my hopes up too high beyond that yet though.


Top
 Profile  
 
PostPosted: Tue Feb 26, 2019 5:24 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
Happy to report -- the card still works after I reassembled it. It gave a different screen when I first ran it after having the battery out, it was probably some gambling disclaimer or something. After I pressed A, it was back to normal.


Top
 Profile  
 
PostPosted: Tue Feb 26, 2019 5:30 pm 
Offline
User avatar

Joined: Sun Sep 19, 2004 9:28 pm
Posts: 4118
Location: A world gone mad
Ben Boldt wrote:
Happy to report -- the card still works after I reassembled it. It gave a different screen when I first ran it after having the battery out, it was probably some gambling disclaimer or something. After I pressed A, it was back to normal.

If you ever want to find out what the screens say in Japanese, just post a photo/screenshot/link to such and many of us can take care of the translation/telling you what's said. :-)


Top
 Profile  
 
PostPosted: Tue Feb 26, 2019 9:20 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
koitsu wrote:
Ben Boldt wrote:
Happy to report -- the card still works after I reassembled it. It gave a different screen when I first ran it after having the battery out, it was probably some gambling disclaimer or something. After I pressed A, it was back to normal.

If you ever want to find out what the screens say in Japanese, just post a photo/screenshot/link to such and many of us can take care of the translation/telling you what's said. :-)

Okay! I took the battery out again:
Attachment:
IMG_1642.JPG
IMG_1642.JPG [ 1.58 MiB | Viewed 11109 times ]

It seemed to have data stored before -- when it failed to connect it had a menu system that let you view charts, etc. No graphics, only text. Now after I have removed the battery, it is no longer possible to proceed past the connect screen.


Top
 Profile  
 
PostPosted: Tue Feb 26, 2019 10:00 pm 
Offline

Joined: Sun Feb 07, 2016 6:16 pm
Posts: 675
Code:
The battery needs to be replaced.

If you've already replaced it, please press the "Execute/Launch" key.
  Code 399010009999
The battery has run out.
                         Please press the "Execute/Launch" key.

Edit: Specifically, it calls it the "実行" key, in case a key is labelled that way on the modem itself.


Top
 Profile  
 
PostPosted: Wed Feb 27, 2019 1:59 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
Thanks! That is pretty cool.

I did some very nerve-racking working today removing parts from the main board. I am not able to remove the 4 SRAMs, not sure why. They may be glued. I actually burned and bubbled the board slightly beneath U5 trying, hopefully it didn't break anything. I did not tear out any barrels when removing parts. Whew. Here are some pictures.


Attachments:
IMG_1650.JPG
IMG_1650.JPG [ 1.69 MiB | Viewed 11046 times ]
IMG_1649.JPG
IMG_1649.JPG [ 1.97 MiB | Viewed 11046 times ]
IMG_1645.JPG
IMG_1645.JPG [ 2.98 MiB | Viewed 11046 times ]
IMG_1644.JPG
IMG_1644.JPG [ 2.98 MiB | Viewed 11046 times ]
IMG_1643.JPG
IMG_1643.JPG [ 2.28 MiB | Viewed 11046 times ]
Top
 Profile  
 
PostPosted: Wed Feb 27, 2019 3:32 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
Hi-res PCB pictures from scanner attached.


Attachments:
FNA-top.jpg
FNA-top.jpg [ 2.92 MiB | Viewed 11035 times ]
FNA-bottom.jpg
FNA-bottom.jpg [ 3.21 MiB | Viewed 11035 times ]
Top
 Profile  
 
PostPosted: Thu Feb 28, 2019 2:52 pm 
Offline
User avatar

Joined: Tue Mar 22, 2016 8:27 pm
Posts: 332
Location: Minnesota, USA
Interesting tidbit:

Labeled pin 1 of the mysterious LH5323 chip does not correspond to the clipped/indexed corner of the chip! It had me confused for a little while. Will have to update the pinout to reflect this.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 30 posts ]  Go to page 1, 2  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: Majestic-12 [Bot] and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group