Famicom Network System (aka Famicom Modem) Investigations

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Tue Nov 24, 2020 2:20 pm

I spent the last few days tracing out the expansion audio circuitry in the modem module. I am more of a digital/firmware guy; any analog wizards out there care to have a look and speculate as to what the 5A18 pins 61, 62, 63 do? Could these be mute and the 2 tones generated for dialing? Definitely keep in mind I was careful but probably still have mistakes in this schematic. Especially the transistor pinouts. Q4 source/drain markings on the PCB silkscreen are different than the BS170 datasheet's pinout, so I used the datasheet.

I did this in PSpice. In theory it could simulate the circuit but I have long since completely forgotten how to do that.

fns_sch.png
fns_back.jpg
fns_front.jpg


Edit:
I fixed an error with one of the NPNs:

fns_sch_2.png


Edit 2:
I was able to track down the datasheet for IC1:
Oki MSM6827L:
https://www.datasheetarchive.com/pdf/do ... rm=MSM6826

It seems this chip is responsible for generating the DTMF tones and PSK/FSK modulation. Basically it's a 1200 baud modem. I think I can use that datasheet to figure out slightly more of the RF5A18 and RF5C66 pinouts though!

krzysiobal
Posts: 827
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by krzysiobal » Fri Nov 27, 2020 1:26 pm

Man, I appreciate the enourmous amount of work you did. Sorry I did not mention this earlier, but few years ago I made a program that helps such things (KrzysioPCB). All you need to do do is load PCB images, mark all the pins, redraw all tracks, assign PADS to devices and it generates eagle schematic for that.

https://translate.google.com/translate? ... 47421.html

Image
Attachments
KrzysioPCB v1.4.zip
(57.55 KiB) Downloaded 61 times

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Fri Nov 27, 2020 6:23 pm

Wow thanks, I will try that. It sounds awesome. I used Photoshop with lots of layers and the file was too large to upload here and very prone to mistakes when manually translating to schematic.

I plan to eventually put my Famicom Modem back together (hopefully it will work again) and then sniff the busses with it running to try to figure out what the registers do. I had no luck getting any of the chips to do hardly anything on their own way back when I started this thread.

I think it should be possible to connect 2 modems directly together if a game is designed to work that way; it could be interesting. I still don't know what the 8-pin modular jack is for. Definitely not Ethernet. I might find more clues as I continue tracing the board.

Also, this system has its own CIC, and if I remember right the CIC chip in the system and in the card are different chips. I may eventually try dumping the CIC's according to that other thread we have here. But that is a later project.

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Fri Dec 04, 2020 7:55 pm

I now have what may be the first flashable Famicom Modem card:
IMG_0051.jpg
IMG_0052.jpg
IMG_0053.jpg

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Sun Dec 06, 2020 7:56 pm

Test ROM that I plan to run on the flashable card:

Code: Select all

.INESPRG 1 ; 1 * 16k = 16k
.INESCHR 0
.INESMAP 1 ; MMC1

org $C000  ; Last page of ROM, static 16k page range $C000-FFFF

main_init:
    ; Load pointer to $4000 into RAM $01:00
    ; This will point to FNS register.
    lda #$00
    sta $0000
    lda #$40
    sta $0001

main_loop:
    ldy #$20  ; Y is register offset.
write_reg:
    lda #$00
    sec
write_bit:
    rol
    sta ($0000),Y ; Write to the register $4000 + Y.
    ;ldx ($0000),Y ; Read from register $4000 + Y.
    bne write_bit
    iny
    bne write_reg
    lda $5000
    lda $5000
    lda $5000
    bit $40B0  ; Test resetting the Kanji ROM pointer.
    lda $5000
    lda $5000
    jmp main_loop



VBLANK_NMI:
    rti


IRQ:
    rti


; Copied from JRA-PAT:
org $FFD9
RESET_JRA_PAT:
    sei
    cld
    ldx #$00
ppu_status_wait:
    stx $2000
    stx $2001
    bit $2002
    bpl ppu_status_wait
ppu_status_wait_2:
    bit $2002
    bpl ppu_status_wait_2
fns_status_wait:
    bit $40C0
    bpl fns_status_wait
mmc1_inc:
    inc mmc1_inc
    jmp main_init


; Fill unused PRG-ROM space with 00s:
fillvalue $00
pad $FFFA

VECTOR_TABLE:
DW VBLANK_NMI
DW RESET_JRA_PAT ;RESET
DW IRQ

I will then probe various pins to find toggling and see if I can correlate toggles with register bits. Not sure physically how hard it will be to get to the signals with the thing running but will figure that out one way or another. I have 16-bit digital + 4 bit analog mixed signal logic analyzer I will be using for this like I did a long time ago with MMC5 stuff.

Fiskbit
Posts: 240
Joined: Sat Nov 18, 2017 9:15 pm

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Fiskbit » Sun Dec 06, 2020 8:27 pm

The test looks good to me. Another thing I'm interested in seeing is whether $40C0.7 starts as 0 and becomes 1, which this test may not show because of the long wait for PPU init before the register read loop. If $40C0.7 is a CIC input, the lock CIC may wait for the key CIC to do something before outputting 1.

I'd also like to see if any results change if the tray switch is in its unpressed state while the cart is still properly seated.

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Sun Dec 06, 2020 10:12 pm

I could make a ROM that just all it does it read $40C0 right away and forever. I can try that with and without tape on the CIC pins of the card to see the difference. Maybe the CIC also plays a role in enabling the connection between the CPU data bus and the card data bus?? Might be worth poking at that too.

I should be able to control the switch independent of the lid and see what happens. This test so far only writes registers but I definitely can make it read instead of write and check it that way.

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Wed Dec 09, 2020 9:57 am

Just a note for this thread:

I discovered with Fiskbit last night that the microwire EEPROM in JRA-PAT is a 93LC46B, even though the PCB has printed on it BR93C46AF. The difference between A/B/C revisions is memory organization 8-bit/16-bit/selectible with ORG pin (respectively). I dumped mine as an A using my EEPROM programmer, then proceeded with experiment erasing and reprogramming, only to realize it was a B and had effectively lost its data... Not too smart on my part but just wanted to make everyone aware to expect it is the 16-bit version EEPROM.

We are not quite clear how to dump this EEPROM yet using the MMC1 CHR banking/mirroring registers but Fiskbit is hard at work on that. Nobody knows what this 128-byte EEPROM is used for yet. I have a new famicom modem coming today (hopefully) and will see if it can still boot up JRA-PAT without this EEPROM.

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Wed Dec 09, 2020 11:57 am

I got my new modem and I flashed JRA-PAT onto a flash ROM and put it into my card. It runs but I only get this screen now (can't proceed past it like I could when I erased my SRAM):
IMG_0055.jpg
Probably because my EEPROM is removed from the card. This won't hopefully prevent me from running custom test code.

Google Translate tells me the top part says "A failure has occurred." Can any Japanese speaking folks tell me what the text in orange says?

lidnariq
Posts: 10118
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by lidnariq » Wed Dec 09, 2020 12:08 pm

If I displace the bottom three characters down so that they don't blur with the top line, Google says it translates to "Connect the communication controller (コントローラ) please"

Pokun
Posts: 1696
Joined: Tue May 28, 2013 5:49 am
Location: Hokkaido, Japan

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Pokun » Wed Dec 09, 2020 1:50 pm

Yes that's correct.

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Wed Dec 09, 2020 9:00 pm

That is interesting, I wonder what "communication controller" means?? I do have the large numberpad controller plugged into the famicom.

I flashed Super Mario Club onto my card, and it similarly prompts me with a message, roughly translated as:

Register your membership number and connection method. User Manual: Please see "Start of use".
IMG_0056.jpg
When I press a button on the numberpad controller, it proceeds with all the normal stuff, pink Mario head bouncing around, title screen, then after a few prompts I see Mario and Luigi on the pogo sticks, LED turns green, etc. So I think this verifies my setup is good, sans the EEPROM I screwed up.

Pokun
Posts: 1696
Joined: Tue May 28, 2013 5:49 am
Location: Hokkaido, Japan

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Pokun » Thu Dec 10, 2020 11:01 am

Tsuushin controller is kind of vague as it could be communication controller, transmission controller, link controller or something to that effect. What else do you have that can be connected besides the joypad? Maybe the EEPROM card is the tsuushin controller. You could try looking for things that says "通信コントローラ" on it.

User avatar
Ben Boldt
Posts: 718
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by Ben Boldt » Thu Dec 10, 2020 7:33 pm

It might actually be referring to the numberpad controller and just reporting a wrong error, who knows.

I added a header where I can plug in and unplug the EEPROM chip, which make it possible to swap back and forth with my EEPROM burner easily.

IMG_0058.jpg

When I attach just the blank EEPROM chip (i.e. all FF's), JRA-PAT actually proceeds just like it did before with an erased SRAM:

IMG_0057.jpg

I am able to press a button to proceed from this screen and it asks me to enter information. It then even attempts to dial and plays its familiar music. I tried the EEPROM filled with $55's as well and acted the same as FF's. I am not sure what about the EEPROM being disconnected causes it to ask for the controller. But anyway, seems I didn't blow it away quite as much as I thought.

lidnariq
Posts: 10118
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: Famicom Network System (aka Famicom Modem) Investigations

Post by lidnariq » Thu Dec 10, 2020 8:26 pm

I've been recently working on making a clone of a mapper IC in the Wonderswan, and have been learning subtle things about the version of microwire as used by the 93cX6 EEPROMs.

Notably, if the host has a weak pull-up on the DO pin, the hardware can not only nondestructively detect the EEPROM's absence, but can also automatically detect the size (in terms of number of address bits) of the attached EEPROM. The EEPROM always sends a 0 bit before it sends its reply in response to a READ command.

All the host has to do is send b'110' (the prefix that means READ) and then clock in more bits until it receives the 0. The zero starts at half a bit after the last address bit starts. All widespread EEPROMs have somewhere between 6 (93c46 or 93c06 in word mode) and 11 (93c76 or 93c86 in byte mode) address bits. (Larger EEPROMs exist – e.g. 93c95a and 93c10a – but they're rare)

Post Reply