TV-NET MC-1200

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
Posts: 264
Joined: Sat Nov 18, 2017 9:15 pm

TV-NET MC-1200

Post by Fiskbit » Thu Mar 26, 2020 4:37 am

I just picked up a TV-NET modem and figured I'd post some pictures of its PCB, since I don't think there are any online yet. This is the MC-1200 version; I have an MC-1200B coming later for comparison, and there's also an MC-1200A and a TV-NET Rank 2 MC-4800.

The TV-NET carts have a footprint exactly the size of a credit card and are about 0.1" thick. For the connector, rather than one long slot containing an edge connector, it has one hole per pin. The cart I have on-hand is SanrainF-III (Sun-Line F-III?). Video of the F-II in actual use can be seen in this commercial. I don't know how the F-II and F-III differ. The top of my cart has a lockable slot that presumably contains a removable battery, but I've not removed it in case there is still data saved on the cart.

A bunch of pictures of the exterior and some information can be found on this blog post: ... -f3a6.html.

Posts: 10422
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: TV-NET MC-1200

Post by lidnariq » Thu Mar 26, 2020 11:34 am

Quickly enumerating the ICs I see:
* Sony CXK5816SP-12L ( 2048x8 SRAM )
* Hitachi S256KP-12 ( unknown. maybe an EEPROM? )
* NEC D23C1000C-1 ( 131072x8 Mask ROM )
* NEC D65013GF503 ( uncommitted gate array )
* Sharp PC814 ( optoisolator )
* Sierra Semiconductor SC11007CV ( baud rate generator )
* Sierra Semiconductor SC11014CV ( 300/1200 baud modem )
* NEC C251C ( op amp )
* TDK RZCO5N50 ( boost converter )
* Mitsubishi M74ALS02P ( quad NOR gate )
* ?? TV-NET MC/BS.P256-01 ( mask ROM )
* 3x Samsung KS74HCTLS157N ( quad 1-of-2 multiplexer - "HCTLS", really??? )

Posts: 264
Joined: Sat Nov 18, 2017 9:15 pm

Re: TV-NET MC-1200

Post by Fiskbit » Sat Apr 04, 2020 7:03 pm

I received a MC-1200B, TV-NET controller, and TV-NET JRA-PAT cart. Pictures of the MC-1200B PCB are attached. The chip in the first picture that isn't very readable says: NEC JAPAN, D65013GF503, 8840KK001.

Posts: 264
Joined: Sat Nov 18, 2017 9:15 pm

Re: TV-NET MC-1200

Post by Fiskbit » Sat Apr 04, 2020 7:05 pm

The TV-NET controller is a pad with 21 buttons and a switch on the back that is recessed enough that it can't be flipped by hand. I've included a picture below from this Twitter post showing 4 different kinds of this controller; mine is the basic TV-NET version on the left. My guess is that they're all functionally the same and just have different labeling. Unfortunately, while the controller has screws, it's also held together by interior plastic tabs that I've been unable to release. If I figure out how to open it nondestructively, I'll add pictures of the PCB.

Using lidnariq's raw.nes input test (which does a strobe on $4016.0), I've found that the controller has a 24-bit report on $4017.1 and returns 1's for any additional reads. Each button's report appears to be independent; there doesn't seem to be a limit or any ghosting. The bits come in the following read order (using the labeling on the standard TV-NET variant):

0: P/T switch (1 if T)
1: 終了 (Shuuryou / End)
2: F3
3: (Always 1)
4: F1
5: F2
6: F4
7: F5
8: 1
9: 4
10: 7
11: (Always 1)
12: 2
13: 3
14: 5
15: 6
16: *
17: Left
18: 実行 (Jikkou / Run)
19: Right
20: 8
21: 9
22: 0
23: .
TV-NET Controllers.jpg

Posts: 832
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: TV-NET MC-1200

Post by krzysiobal » Thu Sep 24, 2020 2:05 am

Thanks to Ben Boldt I was able to obtain TV-NET too, so prepare soon for rev-en. Unfortunatelly my unit does not came with the credit cart, so after I figure out how it is accessed by the console, I'd ask for help to dumping its content.

To open the controller, you have to squeeze (using clamp) the top part in the middle and lever it up using some plastic lever.

Image Image Image Image Image Image Image Image Image

Posts: 264
Joined: Sat Nov 18, 2017 9:15 pm

Re: TV-NET MC-1200

Post by Fiskbit » Fri Mar 26, 2021 1:02 am

A friend and I took apart a TV-NET JRA-PAT (94-02) cartridge and reverse engineered the contents. TV-NET carts are very hard to take apart. The front and back labels are both thoroughly glued in place to both the plastic frame and PCB, and the PCB is glued to the frame and attached with what looked like 3 plastic rivets. The PCB is also exceptionally thin. The glue is extremely dry and has a paper-like consistency, and warming with a heat gun does not help much. Removing the battery tray, soaking in isopropyl alcohol, and then using a spudger seems so far to be the best approach, though will probably still cause significant damage to the metal labels. Applying heat while soaking might help, and then floss instead of a spudger may be enough to separate them without significant damage.

Inside, we found a board labeled MD0011102-0. The board is inserted into the TV-NET parts-side down. I've attached pictures, though they're in zips because the forum gives me an error every time I try to attach the JPGs ("It was not possible to determine the dimensions of the image."). The board has the following chips:

IC1: LH532000BT ((C)MICRO CORE 9430 D)
IC2: PST531 (T531A Mitsumi 424)
IC3: M5M5255BFP-10LL (433100 M5M5255BFP-10LL)
IC4: HC157 (HC157 9428V7)

Pinouts are as follows:

1: GND
2: N/C
3: VCC
4: IC4.2, IC4.6 (/CS)
5: IC4.1 (RAM/ROM)
6: IC3.27 (R/W)
7: IC1.27 (IC1.OE)
8: IC1.28, IC3.11 (D0)
9: IC1.30, IC3.12 (D1)
10: IC1.32, IC3.13 (D2)
11: IC1.34, IC3.15 (D3)
12: IC1.39, IC3.16 (D4)
13: IC1.41, IC3.17 (D5)
14: IC1.43, IC3.18 (D6)
15: IC1.45, IC3.19 (D7)
16: IC1.46, IC3.10 (A0)
17: IC1.23, IC3.9 (A1)
18: IC1.22, IC3.8 (A2)
19: IC1.21, IC3.7 (A3)
20: IC1.20, IC3.6 (A4)
21: IC1.19, IC3.5 (A5)
22: IC1.18, IC3.4 (A6)
23: IC1.17, IC3.3 (A7)
24: IC1.16, IC3.25 (A8)
25: IC1.10, IC3.24 (A9)
26: IC1.9, IC3.21 (A10)
27: IC1.8, IC3.23 (A11)
28: IC1.7, IC3.2 (A12)
29: IC1.6, IC3.26 (A13)
30: IC1.5, IC3.1 (A14)
31: IC1.4 (A15)
32: IC1.3 (A16)
33: IC1.2 (A17)
34: N/C
35: IC4.5 (/RAMSEL)
36: VCC
37: GND
38: GND

IC1: LH532000BT 256 KB ROM (datasheet)
(NOTE: In the datasheet, pins A0-A16 select 16-bit words and A-1 selects bytes within the word. These are referred to here as A0-A17.)
1: GND (IC1./BYTE)
2: Connector.33 (A17)
3: Connector.32 (A16)
4: Connector.31 (A15)
5: Connector.30 (A14)
6: Connector.29 (A13)
7: Connector.28 (A12)
8: Connector.27 (A11)
9: Connector.26 (A10)
10: Connector.25 (A9)
11: N/C? (N/C)
12: GND (GND)
13: N/C? (N/C)
14: N/C? (N/C)
15: GND (IC1.OE1)
16: Connector.24 (A8)
17: Connector.23 (A7)
18: Connector.22 (A6)
19: Connector.21 (A5)
20: Connector.20 (A4)
21: Connector.19 (A3)
22: Connector.18 (A2)
23: Connector.17 (A1)
24: IC4.4 (IC1./CE)
25: GND (GND)
26: GND (GND)
27: Connector.7 (IC1.OE)
28: Connector.8 (D0)
29: N/C? (IC1.D8)
30: Connector.9 (D1)
31: N/C? (IC1.D9)
32: Connector.10 (D2)
33: N/C? (IC1.D10)
34: Connector.11 (D3)
35: N/C? (IC1.D11)
36: GND (GND)
37: VCC (VCC)
38: VCC (VCC)
39: Connector.12 (D4)
40: N/C? (IC1.D12)
41: Connector.13 (D5)
42: N/C? (IC1.D13)
43: Connector.14 (D6)
44: N/C? (IC1.D14)
45: Connector.15 (D7)
46: Connector.16 (A0)
47: GND (GND)
48: GND (GND)

IC2: PST531 SRAM power management (datasheet)
1: IC3.22 (IC3.S2)
4: GND (GND)
6: VCC (VCC)

IC3: M5M5255BFP-10LL 32 KB RAM (datasheet)
1: Connector.30 (A14)
2: Connector.28 (A12)
3: Connector.23 (A7)
4: Connector.22 (A6)
5: Connector.21 (A5)
6: Connector.20 (A4)
7: Connector.19 (A3)
8: Connector.18 (A2)
9: Connector.17 (A1)
10: Connector.16 (A0)
11: Connector.8 (D0)
12: Connector.9 (D1)
13: Connector.10 (D2)
14: GND (GND)
15: Connector.11 (D3)
16: Connector.12 (D4)
17: Connector.13 (D5)
18: Connector.14 (D6)
19: Connector.15 (D7)
20: IC4.7 (IC3./S1)
21: Connector.26 (A10)
22: IC2.1 (S2) (IC3.S2)
23: Connector.27 (A11)
24: Connector.25 (A9)
25: Connector.24 (A8)
26: Connector.29 (A13)
27: Connector.6 (R/W)
28: VCC (VCC)

IC4: HC157 Mutiplexer (datasheet)
1: Connector.5 (RAM/ROM)
2: Connector.4 (/CS)
3: VCC (IC4.1B)
4: IC1.24 (IC1./CE)
5: Connector.35 (/RAMSEL)
6: Connector.4 (/CS)
7: IC3.20 (IC3./S1)
8: GND (GND)
9: N/C? (IC4.3Y)
10: GND (IC4.3B)
11: GND (IC4.3A)
12: N/C? (IC4.4Y)
13: GND (IC4.4B)
14: GND (IC4.4A)
16: VCC (VCC)

/CS, RAM/ROM, and /RAMSEL go through the muxer. RAM/ROM selects whether /CS is sent to the RAM or ROM. If it is sent to the ROM, then /RAMSEL is sent to the RAM.

I've also done some very basic dumping and reverse engineering of the TV-NET MC-1200B modem. The address space appears to be laid out like this:

$5000-57FF: Dual-port CPU/PPU RAM
$6000-6007: Registers (possibly mirrored through $6FFF)
$7000-7FFF: Cartridge PRG-RAM
$8000-FFFF: Modem ROM

$6002 may be readable (dumping $6000-6FFF returns 00 in $6xx2/$6xxA and FF everywhere else). It is not clear where the cartridge ROM is mapped to.
(2.66 MiB) Downloaded 9 times
(3.04 MiB) Downloaded 9 times

Post Reply