City Figher 4 with ext audio (Mapper 266)

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
krzysiobal
Posts: 843
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

City Figher 4 with ext audio (Mapper 266)

Post by krzysiobal » Sat Dec 19, 2020 5:41 pm

The whole story started when trying to make repro of City Fighter 4 (mapper 266)
Image Image

Thanks to wiki, I was able to get how the registers works. It does not say however how the DAC is realized so I made a resistor ladder:
Image Image Image

https://www.youtube.com/watch?v=Dcj0r5pjIVc

Then, somebody shown me how the original PCB looks like so I made a schematic:
Image Image Image Image Image

There are some interesting facts:
* PRG ROM D3 and D5 are reversed (copy protection?)
* The resistor ladder is different than mine.
* Wiki says about using pin /WR900C of VRC4 to decode $900C/$980C, which sounds logical, because together with VRC4's OR gate and CPU-A11 it would work indeed:

Code: Select all

CPU-A11 - |VRC4 OR A     VRC4 OR Y | - WR9800C
       +- |VRC4 OR B               |
       |  |                        |
       |  |                 /WR900C| -+
       |                              |
       +------------------------------+
but instead, PAL is used to perform the decoding and latch six bits (four for AUDIO DAC and two for PRG data)
* Despite using 32kB PRG banks (which would suggest that VRC4 is not involved in PRG banking at all), VRC4 drives PRG-A13 and PRG-A14. To make 32KB banks works as expected:

Code: Select all

$8000 $a000 $c000 $e000
  0      1    2     3 
game should initialize:
* PRG REG0 at $8000 to 0
* PRG REG1 at $a000 to 1 (which is accessed at $c000 because of mixed CPU-A13 and CPU-A14)
and it does it!

Code: Select all

 01:FE96: A9 00     LDA #$00
 01:FE98: 8D 98 93  STA $9398 
 01:FE9B: 8D A0 86  STA $86A0 !
...
 01:FE9E: A9 01     LDA #$01
 01:FEA0: 8D 30 CD  STA $CD30 !
NewRisingSun - you made the wiki description of Mapper 266. Do you have different revision of this cartridge?

NewRisingSun
Posts: 1294
Joined: Thu May 19, 2005 11:30 am

Re: City Figher 4 with ext audio (Mapper 266)

Post by NewRisingSun » Sat Dec 19, 2020 5:51 pm

No, I only debugged the game's code and tried to draw plausible conclusions. 8-)

User avatar
Ben Boldt
Posts: 785
Joined: Tue Mar 22, 2016 8:27 pm
Location: Minnesota, USA

Re: City Figher 4 with ext audio (Mapper 266)

Post by Ben Boldt » Sat Dec 19, 2020 6:05 pm

Why do you suppose they added a 4-bit DAC instead of just using the built-in DPCM in the Famicom? Are they already using the DPCM at the same time for a different purpose?

NewRisingSun
Posts: 1294
Joined: Thu May 19, 2005 11:30 am

Re: City Figher 4 with ext audio (Mapper 266)

Post by NewRisingSun » Sat Dec 19, 2020 6:09 pm

I speculated on the wiki that doing so would allow them to add a low-pass filter to make the grungy PCM sound less objectionable.

User avatar
aquasnake
Posts: 224
Joined: Fri Sep 13, 2019 11:22 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by aquasnake » Sun Dec 20, 2020 6:54 am

Your resistor ladder of DAC is better than the original circuit. The output level of the original circuit is not strictly an 8421 code function.(I'm not sure. Maybe the original design made some sense)

q5911
Posts: 6
Joined: Sun Mar 07, 2021 10:36 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by q5911 » Fri Mar 19, 2021 9:14 pm

Hello, can you write this PAL program? Why not use the PRG address of vrc4 this card?

krzysiobal
Posts: 843
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: City Figher 4 with ext audio (Mapper 266)

Post by krzysiobal » Thu Apr 08, 2021 11:45 am

I was requested to create a JEDEC file to burn into GAL chip to make clone of the subjected chip. I don't have access to the original cartridge's PAL so here are my efforts (if I'm wrong, feel free to correct me)

1. The most basic GAL (or PAL) chips are the "L" ones, whose outputs can be combinatorial or latched (SET/RESET latch, using internal feedback path).
To define an output (Q) as latched one, that is set to 1 when S=0 and set to 0 when R=0, we can just write it like:

Code: Select all

Q = /nS + nR * Q

2. More advanced ones are the V chips, whose outputs can be combinatorial, latched or registered (clocked latch).
To define an output (Q) as registered one:

Code: Select all

Q := D
Q.C = some_clock_signal
Q.OE = /some_output_enable_signal
The advantage of registered latch is that it uses less resources than latched one, but the disadvantages are:
* each registered output share the same clock and output enable input
* clock input must come from pin 1 (if more advanced logic function is needed, one of output pins need to be used for such equation and then connected externally to in 1)
* otpuput enable must come from pin 11 (if all regsitered outputs need to be always enabled, pin 11 must be connected externally to GND)

3. This PLD chip is not configured in registered mode, because
a) that would force common clock for all output pins, but audio pins ($9800) and PRG-A pins ($9000) use different address and so need different logic formulas for clock inputs
b) pin 11 is not GND

2. So the PAL need to be configured in latched mode. But because pin19 (=PRG_A16) and pin 12 (=AUD3) are latched outputs, it can't be realised in the most popular 16V8 chip (it has 16 inputs, but out of all I/O pins, only 13..18 can be inputs) and so it needs 18V8 chips (18 inputs = all pins can be used as inputs).

But GAL18V8 are much less common.
* I can't find them on aliexpress,
* the good-old program EQN2JED.EXE does not support them,
* MiniPro, the popular USB programmer does not support them either


So if yout want to stick to GAL16V8, you should reorder the output pins (AUD3=pin12 and CLK_OUT=pin17) to get extra one output but still there would be no place for PRG-A16.
Image

The CLK_IN / CLK_OUT external loop is neccessary because there is not enough logic terms for feedback output of all the inputs to be calculated internally (CPU_R_nW, CPU_ROMSEL, CPU_A14, CPU_A13, CPU_A12)
Image

The only working idea is to:
* forget about all the five inputs (CPU_R_nW, CPU_ROMSEL, CPU_A14, CPU_A13, CPU_A12) and route VRC4_900C instead (to pin 1), because VRC4 computes it in exact the same way.
* route CPU_A11 to pin 2
* move PRG_A16 to pin 17
* move AUD3 to pin 16

As a final result, I burned GAL16V8 with the above file:
Image Image

and then read-it back using my tester:
Image Image

and et voila - I got a working logic:

Code: Select all

AUD2 <= 
 '0' when (!CPU_D2 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D2 & CPU_A11 & !nVRC4_900C);
 
AUD1 <= 
 '0' when (!CPU_D1 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D1 & CPU_A11 & !nVRC4_900C);
 
AUD0 <= 
 '0' when (!CPU_D0 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D0 & CPU_A11 & !nVRC4_900C);
 
AUD3 <= 
 '0' when (!CPU_D3 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D3 & CPU_A11 & !nVRC4_900C);
 
PRG_A16 <= 
 '0' when (!CPU_D3 & !CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D3 & !CPU_A11 & !nVRC4_900C);
 
PRG_A15 <= 
 '0' when (!CPU_D2 & !CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D2 & !CPU_A11 & !nVRC4_900C);
q5911 wrote:
Fri Mar 19, 2021 9:14 pm
Hello, can you write this PAL program? Why not use the PRG address of vrc4 this card?
Maybe because this game expects 32kB banks (and also expects PRG bank writes at $900C instead of $9000?)
Attachments
proj_eqn+jed+log.zip
(1.9 KiB) Downloaded 14 times

q5911
Posts: 6
Joined: Sun Mar 07, 2021 10:36 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by q5911 » Sat Apr 10, 2021 4:35 pm

krzysiobal wrote:
Thu Apr 08, 2021 11:45 am
I was requested to create a JEDEC file to burn into GAL chip to make clone of the subjected chip. I don't have access to the original cartridge's PAL so here are my efforts (if I'm wrong, feel free to correct me)

1. The most basic GAL (or PAL) chips are the "L" ones, whose outputs can be combinatorial or latched (SET/RESET latch, using internal feedback path).
To define an output (Q) as latched one, that is set to 1 when S=0 and set to 0 when R=0, we can just write it like:

Code: Select all

Q = /nS + nR * Q

2. More advanced ones are the V chips, whose outputs can be combinatorial, latched or registered (clocked latch).
To define an output (Q) as registered one:

Code: Select all

Q := D
Q.C = some_clock_signal
Q.OE = /some_output_enable_signal
The advantage of registered latch is that it uses less resources than latched one, but the disadvantages are:
* each registered output share the same clock and output enable input
* clock input must come from pin 1 (if more advanced logic function is needed, one of output pins need to be used for such equation and then connected externally to in 1)
* otpuput enable must come from pin 11 (if all regsitered outputs need to be always enabled, pin 11 must be connected externally to GND)

3. This PLD chip is not configured in registered mode, because
a) that would force common clock for all output pins, but audio pins ($9800) and PRG-A pins ($9000) use different address and so need different logic formulas for clock inputs
b) pin 11 is not GND

2. So the PAL need to be configured in latched mode. But because pin19 (=PRG_A16) and pin 12 (=AUD3) are latched outputs, it can't be realised in the most popular 16V8 chip (it has 16 inputs, but out of all I/O pins, only 13..18 can be inputs) and so it needs 18V8 chips (18 inputs = all pins can be used as inputs).

But GAL18V8 are much less common.
* I can't find them on aliexpress,
* the good-old program EQN2JED.EXE does not support them,
* MiniPro, the popular USB programmer does not support them either


So if yout want to stick to GAL16V8, you should reorder the output pins (AUD3=pin12 and CLK_OUT=pin17) to get extra one output but still there would be no place for PRG-A16.
Image

The CLK_IN / CLK_OUT external loop is neccessary because there is not enough logic terms for feedback output of all the inputs to be calculated internally (CPU_R_nW, CPU_ROMSEL, CPU_A14, CPU_A13, CPU_A12)
Image

The only working idea is to:
* forget about all the five inputs (CPU_R_nW, CPU_ROMSEL, CPU_A14, CPU_A13, CPU_A12) and route VRC4_900C instead (to pin 1), because VRC4 computes it in exact the same way.
* route CPU_A11 to pin 2
* move PRG_A16 to pin 17
* move AUD3 to pin 16

As a final result, I burned GAL16V8 with the above file:
Image Image

and then read-it back using my tester:
Image Image

and et voila - I got a working logic:

Code: Select all

AUD2 <= 
 '0' when (!CPU_D2 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D2 & CPU_A11 & !nVRC4_900C);
 
AUD1 <= 
 '0' when (!CPU_D1 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D1 & CPU_A11 & !nVRC4_900C);
 
AUD0 <= 
 '0' when (!CPU_D0 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D0 & CPU_A11 & !nVRC4_900C);
 
AUD3 <= 
 '0' when (!CPU_D3 & CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D3 & CPU_A11 & !nVRC4_900C);
 
PRG_A16 <= 
 '0' when (!CPU_D3 & !CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D3 & !CPU_A11 & !nVRC4_900C);
 
PRG_A15 <= 
 '0' when (!CPU_D2 & !CPU_A11 & !nVRC4_900C) else
 '1' when (CPU_D2 & !CPU_A11 & !nVRC4_900C);
q5911 wrote:
Fri Mar 19, 2021 9:14 pm
Hello, can you write this PAL program? Why not use the PRG address of vrc4 this card?
Maybe because this game expects 32kB banks (and also expects PRG bank writes at $900C instead of $9000?)

I modified the connection of these pins according to your tips.
But the game can't run, white screen.
I analyzed the logic of the program, and I think it is correct.
I think there are several possibilities:
1. My NES ROM is not right, it comes from the Internet.
2. I don't have a vrc4 chip. I use a vrc4 chip cloned from ax5208p.Its 18th pin may have no signal output to PLD1 pin. I don't have an oscilloscope to verify it.

Finally, your homemade tester looks great. Can it read encrypted content?

krzysiobal
Posts: 843
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: City Figher 4 with ext audio (Mapper 266)

Post by krzysiobal » Sun Apr 11, 2021 2:06 am

This rom is probably UNIF, not iNES so be sure you correctly extracted the PRG part out of it.
Finally, your homemade tester looks great. Can it read encrypted content?
it does **not** read the content, it provides inputs vectors in different orders to find which pins are:
* combinatorial,
* feedback latches basing on inputs and,
* which are combinatorial based on inputs and feedback outputs.
For those with feedback, by providing input vectors in proper order (gray code) it analyzes which ones latches 0, latches 1 or does not change their output value and then basing on it, then constucts equations.
Works fine for L chips, for V never needed it so don't support them bus as I see, they're even more straightforward.
So no matter if the chip is protected or not.

q5911
Posts: 6
Joined: Sun Mar 07, 2021 10:36 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by q5911 » Mon Apr 12, 2021 2:40 am

krzysiobal wrote:
Sun Apr 11, 2021 2:06 am
This rom is probably UNIF, not iNES so be sure you correctly extracted the PRG part out of it.
Finally, your homemade tester looks great. Can it read encrypted content?
it does **not** read the content, it provides inputs vectors in different orders to find which pins are:
* combinatorial,
* feedback latches basing on inputs and,
* which are combinatorial based on inputs and feedback outputs.
For those with feedback, by providing input vectors in proper order (gray code) it analyzes which ones latches 0, latches 1 or does not change their output value and then basing on it, then constucts equations.
Works fine for L chips, for V never needed it so don't support them bus as I see, they're even more straightforward.
So no matter if the chip is protected or not.
Great!It is a very practical instrument.
Yes, it really is in UNIF format.But I am sure that ROM is extracted correctly, I correctly removed the bytes before PRG and CHR.

krzysiobal
Posts: 843
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: City Figher 4 with ext audio (Mapper 266)

Post by krzysiobal » Mon Apr 12, 2021 2:45 am

I will make the cartridge in free time to verify. Honestly I would prefer the AX5202P (MMC3) as this chip is more common and all Street Fighter versions I have encountered so far used it, but that would require modifying the ROM.

q5911
Posts: 6
Joined: Sun Mar 07, 2021 10:36 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by q5911 » Mon Apr 12, 2021 8:25 pm

krzysiobal wrote:
Mon Apr 12, 2021 2:45 am
I will make the cartridge in free time to verify. Honestly I would prefer the AX5202P (MMC3) as this chip is more common and all Street Fighter versions I have encountered so far used it, but that would require modifying the ROM.
I took a quick look at the GAL16V8 data sheet and found that all of its pins were available as input.Why do you say it only has 16 input pins?Or is there a special case when the chip is configured to latch?
GAL16V8 Pinout
GAL16V8 Pinout
GAL16V8.png (13.89 KiB) Viewed 466 times
Can you reprogram the PLD in the original pin order?Because I seriously suspect that the AX5208 has no output signal to the PLD1 pin, and I cannot verify it for the time being.
I hope you can refactor the program because not only do I have GAL16V8, I can even buy ami18CV8 in the original cartridge's .

lidnariq
Posts: 10435
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Re: City Figher 4 with ext audio (Mapper 266)

Post by lidnariq » Mon Apr 12, 2021 8:38 pm

q5911 wrote:
Mon Apr 12, 2021 8:25 pm
I took a quick look at the GAL16V8 data sheet and found that all of its pins were available as input.Why do you say it only has 16 input pins?Or is there a special case when the chip is configured to latch?
16V8 can operate in three (four) different modes. Not all modes can make use of all pins as inputs.

The four modes are:
"Registered" (-SYN, +AC0), where the /OE and ↑clock pins are dedicated and can't be used in the matrix: only 16 inputs and that if you have no outputs at all
"Complex/Medium" (+SYN, +AC0), where pins 12 and 19 are dedicated outputs
"Simple/Small" (+SYN, -AC0), where pins 15 and 16 are dedicated outputs
"Stupid" (-SYN, -AC0), which is a useless subset of "Registered" where /OE is ignored.

q5911
Posts: 6
Joined: Sun Mar 07, 2021 10:36 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by q5911 » Mon Apr 12, 2021 8:46 pm

lidnariq wrote:
Mon Apr 12, 2021 8:38 pm
q5911 wrote:
Mon Apr 12, 2021 8:25 pm
I took a quick look at the GAL16V8 data sheet and found that all of its pins were available as input.Why do you say it only has 16 input pins?Or is there a special case when the chip is configured to latch?
16V8 can operate in three (four) different modes. Not all modes can make use of all pins as inputs.

The four modes are:
"Registered" (-SYN, +AC0), where the /OE and ↑clock pins are dedicated and can't be used in the matrix: only 16 inputs and that if you have no outputs at all
"Complex" (+SYN, +AC0), where pins 12 and 19 are dedicated outputs
"Simple" (+SYN, -AC0), where pins 15 and 16 are dedicated outputs
"Stupid" (-SYN, -AC0), which is a useless subset of "Registered" where /OE is ignored.
I see what you mean. I need to read the data sheet carefully.

q5911
Posts: 6
Joined: Sun Mar 07, 2021 10:36 pm

Re: City Figher 4 with ext audio (Mapper 266)

Post by q5911 » Mon Apr 12, 2021 10:02 pm

Wow, it occurred to me that we could use the newer GAL20V8 chip, which has plenty of pins.It's probably the best option. :D

Post Reply