Famicom Network System (aka Famicom Modem) Investigations

[krzysiobal]

I am brand new to Eagle and have not used it before. Your program is very easy to use so far. I have had success creating a new project and importing the front and back images of the modem module. I have drawn some thru-hole vias and wires connecting them. It seems to be a very efficient interface, much easier and less steps than what I was doing in Photoshop.

I am a little bit stuck on assigning a device. I don't know what device to assign to for the main edge connector (P3) or for the MC14LC5436P chip (IC7). There are tons and tons to choose from. What devices do you normally choose for generic chip or connector purposes like this?

Eagle contains a lot of built-in libraries with a lot of components already defined (like 74xx chips, 40xx chips, memories, microcontrollers, even some FPGAs). But I bet all the chips/connectors you have there are some niche devices that are not available in eagle so there are a few suggestions:
* you can always create your own components (the best way is to create your own library and then fill it with your own trusted components). If you put your library with others (c:\Program Files\EAGLE-x.x.x\lbr\ directory), KrzysioPCB will be able to use it aswell. That way you control how the symbol of such component looks like, but for new Eagle users this might be hell, so there are few more options:
* you can use generic components, for example:
connectors -> PINH-1X30 (use one component for the left and one for the right row of pins)
* DIP chips -> DIL14

If there is no existing device, but there are datasheets available in the web for it, I prefer creating component for it. If there is no datasheet available, I am using generic package components.

[Ben Boldt]

Okay, thanks for the advice. I am making progress using it and it is super cool. I can imagine using it for a lot more than Nintendo actually! I will figure out how to create new devices and save them at the correct location as you suggest.

[Ben Boldt]

Another question krzysiobal:

I have some traces that are packed in pretty tight and when I use 'W' to add points, if they are close to existing points, they make a connection. Is there a way to tell it to add a 'W' wire point and telling it not to connect to nearby stuff? I tried shift+W, alt+W, and those didn't do it.

I have still not created any custom parts in Eagle but I am thinking that won't be too hard. I will probably google it and find a walkthrough when the time comes.

Edit:
I noticed I can change my wire width and pad size; that seems to solve the problem. I have also created my first library part for the PC725V optocoupler and successfully hooked it up to the PCB. I am definitely making progress learning this.

[Ben Boldt]

I taped over PPU A10 and A11 tonight and found that register writes were still possible. I also verified the tape was still okay after removing the Famicom modem from the Famicom (I.e. didn’t bunch up.)

I also made a nifty gizmo. You enter a register address on the dip switches and it will give a high signal any time that address is on the address bus. I can run some commercial software and measure time intervals that specific registers are read/written.

[Ben Boldt]

I found today that having PPU A10,A11 taped did not allow Super Mario Club to run properly. No register reads or writes occurred except that first check of $40C0. Though I did prove that register writes do work with these lines taped, something in Super Mario Club won't proceed like that. I did reseat the famicom modem into the famicom a few times and it stayed like that, and started working as expected when removing the tape. I can't say for certain that removing the tape didn't fix a bad connection somehow. But in case it is more than a coincidence, I thought I better mention it.

I didn't find anything interesting with my fancy address detector thing, but I did verify a couple things in $40C0 and $40AE and updated the wiki.

[Fiskbit]

If I'm understanding the wiki page properly, $40AE.0 high enables modem WRAM, and $40C0.0 high enables cartridge RAM. As far as I'm aware, though, software will set both $40AE and $40C0.0 to the same value (0 or 1), which means both are either enabled or disabled at the same time, which doesn't sound right to me. Are you sure you didn't invert the meaning of $40AE.0?

The typical code for this looks like:

Code: Select all

LDA #$00
STA $40AE

LDA $18
AND #$FE
STA $18
STA $40C0

Code: Select all

LDA $18
ORA #$01
STA $18
STA $40C0

LDA #$01
STA $40AE

[Ben Boldt]

If I'm understanding the wiki page properly, $40AE.0 high enables modem WRAM, and $40C0.0 high enables cartridge RAM. As far as I'm aware, though, software will set both $40AE and $40C0.0 to the same value (0 or 1), which means both are either enabled or disabled at the same time, which doesn't sound right to me. Are you sure you didn't invert the meaning of $40AE.0?

I just did a test code specifically to check this for you. This code does toggle built-in RAM /CE:

Code: Select all

testRamEnable:
    lda #$01
    sta $40AE
    ldx $6000
    jmp testRamEnable

And this code does not (always high):

Code: Select all

testRamEnable:
    lda #$00
    sta $40AE
    ldx $6000
    jmp testRamEnable

The RAM +CE signal does go to the card connector but JRA-PAT does not use RAM +CE. So I think that is what is preventing a conflict. I have also run Super Mario Club on my JRA-PAT card with no problems, so I am thinking it does not use RAM +CE in the card either.



I did some additional testing tonight with my address catcher and found the sequences of register reads/writes that Super Mario Club uses when connecting and disconnecting. Not sure it matters for this but when it asked me for a number, I filled it will all 1's for this example.

When opening the connection:

Code: Select all

Reads $40D3 continuously.  Normally has value $E0.
When $40D3 value changes to $60, proceed.
Write $00 to $40D0
Write $13 to $40D1
Write $00 to $40D2
Write $BF to $40D3
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $E0.
Write $42 to $40D0
Write $31 to $40D1
Write $20 to $40D2
Write $3F to $40D3
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $60.
Write $36 to $40D0
Write $33 to $40D1
Write $57 to $40D2
Write $BF to $40D3
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $E0.
Write $30 to $40D0
Write $36 to $40D1
Write $30 to $40D2
Write $3F to $40D3
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $60.
Write $37 to $40D0
Write $38 to $40D1
Write $31 to $40D2
Write $BF to $40D3
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $E0.
Write $34 to $40D0
Write $34 to $40D1
Write $31 to $40D2
Write $3F to $40D3
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $60.
Write $33 to $40D0
Write $25 to $40D1
Write $67 to $40D2
Write $BF to $40D3
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $60.
Read $40D3 -> value is $E0.
Write $25 to $40D0
Write $A2 to $40D1
Write $01 to $40D2
Write $3F to $40D3
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $E0.
Read $40D3 -> value is $60.
Write $FF to $40D3
Read $40D3 -> value is $60.
Read $40D3 -> value is $E0.
Write $FF to $40D3

When closing the connection:

Code: Select all

Read $40C0 -> value is $CC.
Read $40AC -> value is $40.
Read $40D3 -> value is $20.

Write $7F to $40D3
Read $40D3 -> value is $20
Read $40D3 -> value is $20
Read $40D3 -> value is $20
Read $40D3 -> value is $A0

Read $40D0 -> value is $80
Read $40D1 -> value is $01
Read $40D2 -> value is $00

Write $FF to $40D3
Read $40D3 -> value is $A0
Read $40D3 -> value is $A0
Read $40D3 -> value is $A0
Read $40D3 -> value is $20

Read $40A2 -> value is $21
Write $05 to $40C0
Read $40D0 -> value is $01

Write $7F to $40D3
Read $40D3 -> value is $E0

Write $FF to $40D3

I also found that there is no register write coinciding with the green LED turning on. (The Green LED is controlled by the 5A18 chip, which uses $4xDx address space.)

[Fiskbit]

Thanks for doing that test. I've looked through all the software I currently have access to and see this same access pattern in all of them, so I'm unfortunately still a bit confused. Maybe all of the carts are ignoring RAM +CE?

PiT's code seems the most unique of everything and is a bit of an exception. Of most interest is its init code, which sets $40AE to 0 and $40C0 to 1, while all the others set both to 0. The other functions are the same as in the other software, except it writes to $40AE first in both cases (and uses $78 instead of $18 for the $40C0 variable). PiT's init configuration is what I'd expect given your findings, but nothing else matches up, so I wonder if there's something we're missing here.

This is something I should play with with my dumper, though. I wasn't able to get any SRAM from Famicom ANSER, Sumitomo Homeline, nor Super Mario Club. Perhaps I need to write 1 to $40C0.0 to enable it, assuming any of my writes are being honored. Everything else dumped SRAM with 0 written to both.

[Ben Boldt]

Thanks for doing that test. I've looked through all the software I currently have access to and see this same access pattern in all of them, so I'm unfortunately still a bit confused. Maybe all of the carts are ignoring RAM +CE?

It might have been intended to hook to a RAM /CE in the card.

PiT's code seems the most unique of everything and is a bit of an exception. Of most interest is its init code, which sets $40AE to 0 and $40C0 to 1, while all the others set both to 0. The other functions are the same as in the other software, except it writes to $40AE first in both cases (and uses $78 instead of $18 for the $40C0 variable). PiT's init configuration is what I'd expect given your findings, but nothing else matches up, so I wonder if there's something we're missing here.

Bear in mind that PiT does run in a JRA-PAT card. Whether it is talking to both RAMs at the same time when I do that, I guess I don't know.

This is something I should play with with my dumper, though. I wasn't able to get any SRAM from Famicom ANSER, Sumitomo Homeline, nor Super Mario Club. Perhaps I need to write 1 to $40C0.0 to enable it, assuming any of my writes are being honored. Everything else dumped SRAM with 0 written to both.

I am still wondering, have you had any successful register writes other than to the MMC1 chip in the card? It seemed we were both maybe stuck not able to write any registers unless we run the Famicom modem in a real Famicom. All of the register writing I have been able to do has always been with test code put into a flash ROM and run in the Famicom.

[Ben Boldt]

I took some more data from Super Mario Club opening a phone connection. I took this in both the normal mode where you don't enter any numbers and also in the 2nd mode where you do enter some numbers. I don't have any idea what they do, but I attached the register write sequences from different numbers and different length numbers. You can see the numbers you entered clearly being sent as ASCII text.

Sending messages to the 5A18 happens in groups of 3 bytes, plus acknowledge:

1. Write 1st byte to $40D0
2. Write 2nd byte to $40D1
3. Write 3rd byte to $40D2
4. Write an acknowledge request to $40D3
5. Repeatedly read back from $40D3 until acknowledge is received, then proceed to next group of 3 bytes to send.

To end the stream of data, an $FF is written to $40D3, usually twice. I attached the data, which includes some things pointed out such as the byte count and how it backfills the end of the message if there was not a multiple of 3 bytes sent. I don't know what a lot of it does though. Some of those bytes could be commands to send to the MSM6827L integrated modem chip.

Even when running a test ROM, the 5A18 is constantly accessing its RAM chip. The /CE is doing stuff all the time on its own, similar in a way to the PPU. Maybe it has its own CPU in there and you can send it a program to run, who knows at this point. Very strange interface with this 3-byte-at-a-time thing.

[Ben Boldt]

Does anyone know much about dial tones? I would like to simulate a Japanese dial tone and put it into my Famicom modem and see what that does. Without a phone line hooked up, right away the software detects this and aborts, before ever attempting to dial any numbers. If I could trick it to think there is a dial tone, it might get farther and tell us more about it.

Based on Japanese wikipedia page for dial tone:
https://translate.google.com/translate? ... %259F%25B3

It says that they have a 400Hz single frequency dial tone, as opposed to our 350Hz + 440Hz in USA. I went and updated that into the English wikipedia. Easy enough, I could just use a function generator to make a 400Hz sine wave, no problem. What I don't know is what voltage to use. I have seen mention of 1V peak to peak, and also 48V. Maybe 48V is just to signal a ring? I have no idea with this stuff.

Please let me know if anyone has info/experience what voltage of 400Hz would be correct for Japan, I will see what I can do generating that and see if I can figure out how the Famicom modem detects a dial tone, and how it starts dialing numbers.

[lidnariq]

At least in the US - I don't know anything about Japan - modems seem to be looking for the 24-48Vdc "idle" voltage instead.

[Ben Boldt]

I actually have an isolated electronic AC source that can generate 400Hz at those voltages. I am a little scared though, unfortunately it isn't easy to find a confirmation of that voltage in Japan anywhere.

[lidnariq]

My recollection is that the dial tone is much lower voltage AC-coupled to the idle voltage. Only the ringer should be high voltage AC.

[Ben Boldt]

Do you know, is the idle voltage a DC voltage? And then the 400Hz tone is a small signal added on top of that?

Edit:
I found this with some more googling:

Off-Hook: -7 to -12 Volts DC.
Ringing: -48 Volts DC, plus 100 Volts RMS @ 20 Hz
On Hook: -48 Volts DC

I guess I didn't realize that telephone signals had a specific polarity like this either.