Racermate Challenge 2

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderators: B00daW, Moderators

Post Reply
Posts: 9774
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Racermate Challenge 2

Post by lidnariq » Mon Jul 30, 2012 3:05 pm

So I started REing this board a couple days ago (as part of my "get everything in NesCartDB in the wiki" project), and ran into trouble because enough traces are hidden under ICs and there's no complete functional description of what exactly is going on.

CaH4e3, in his implementation in fceumm, says there's a 6 bit register laid out as [PP.. CCCC] at $b000. There is; on the board it's the 74ls174 labeled U4.

What I saw and what CaH4e3 wrote differs from what bunnyboy said in the nesmuseum, though. I'm not certain what to think of that.

The two PRG bits are used in an UNROM style banking fashion, with a fixed bank from $c000-$ffff and switchable from $8000-$bfff. The other two OR gates are used to select when to load the banking register: nROMSEL OR READnotWRITE OR A14. This means the register is actually mapped over the entire $8000-$bfff range. This makes up the 74ls32 labeled U7.

The 4 chr address lines through the NAND gate U6 (against PPU A12) so that the $0000-$0fff pattern table is always bank 15 and the $1000-$1fff pattern table is the two's complement of the written bank. (This is isomorphic to what CaH4e3 wrote: 0 and ($bank&15), modulo concerns about which 32kB are battery-backed.) (Also, the C bits are out of order as 3012, but it's RAM, so it doesn't matter)

This, however, leaves U5 (another '32), U8 (another '00), U9 (a '74) and U10 (a 4040).

Part of U5 and ¼ of U8 (as an inverter) is used to make the two 32kB RAMs act like one homogenous 64kB memory space, but some of the traces in the area are confusing. Another ¼ of U8 is used to prevent bus conflicts.

Jumpers: J3 vs J4 selects respectively whether one or both SRAMs are battery backed.
J1 vs J2 has something to do with how it selects the not-necessarily-battery-backed SRAM, but I can't follow the traces under U5 to figure it out.

The 4040 is a 12 bit counter IC, and its 2^12s bit (or something else, probably 2^11s bit, see traces near R2) is connected via a BJT to the cartridge edge /IRQ line. The counter is clocked by M2. Q5 also goes somewhere under the 74'74 U9. This should produce interrupts—as far as I can tell, ungatably so— at some multiple of 437 Hz.

Finally, CPU D2 is connected to the D input of one of the two D registers inside the 74'74, but I cannot figure out under what conditions it uses it. This is far enough away from the cartridge edge that there are no lower address lines than /ROMSEL, so I'm hard pressed to think of anything sensible it could be doing.

Does anyone have any insights, or a cartridge to measure?

Posts: 9774
Joined: Sun Apr 13, 2008 11:12 am
Location: Seattle

Post by lidnariq » Tue Jul 31, 2012 9:58 pm

Of course I work on this more and come up with something complete, but maybe someone else will take a gander at the things that puzzle me.

So, all the remaining ICs are part of the battery-backed RAM protection circuit. The 74hct74 enables or disables the SRAMs nSELected lines; the transistor Q2 clears both registers in the '74 when the Vcc line fails. (In turn driving the inverted output on pin 7 high, which is then ORed in U5 with the select lines)

The NAND gate in U8 on pins 8-10 should generate the clock strobe to the secondary D register in the '74, mapping it to writes to $c000-$ffff. The board was originally laid out to use CPU A7 for the data input; however the one pictured in NesCartDB has been revised to use CPU D2.

First question: any guesses why they rewired this? The actual code alternates between writing $FF -> $F080 and $00 -> $F000 over and over.

In any case, this means that the CPU can disable the battery-backed SRAM protection by writing 1 then 0 to the relevant bit (whether it's A7, D2, or something else).

However, it seems that the Q5 bit of the 74HCT4040 U10 goes to the /PRESET line of the primary D register in the '74, perpetually setting the bit and therefore driving the inverted output low. So as long as M2 is running, every 32 1.8MHz clock cycles the SRAM will be de-protected. So there's no need for the CPU code to deprotect it.

Thus the second question: Any idea why both methods for deprotecting would be present? It's not like the anything could disable the M2-based deprotector.

Or, is my guess wrong here? Where else could Q5 go? The only inputs that don't have traces definitively going to them are the primary /PRESET and secondary CLOCK inputs. If I have these backwards, what's going on instead?

Final point, for clarification on the jumpers:
J2 means only the 32k SRAM labeled U1 has its nSELECT line driven high on +5V fail; J1 means both do. Thus, J1+J4 is correct for battery-backing 64kB; J2+J3 is correct for only battery backing U1 and not U2.

All my analysis has been done by labelling and painting over the images of the PCBs in GIMP; I have a 4MB .xcf file that I can PM people a URL to if they want it. (for bandwidth reasons I don't want to post it publicly)

User avatar
Posts: 586
Joined: Thu Jan 03, 2008 1:48 pm

Re: Racermate Challenge 2

Post by B00daW » Fri Aug 03, 2012 10:04 am

Sent you a private message.

Posts: 790
Joined: Sun Jun 12, 2011 12:06 pm
Location: Poland

Re: Racermate Challenge 2

Post by krzysiobal » Sun Oct 18, 2020 4:53 am

I wonder what is the reason for all pull-ups on data & address lines. Is it to limit the current of RAM in standby mode?
From my experience, if RAM does not have "L" letter (low-power) then the amount of current it draws changes if you start touching its legs by finger for example (when powered by battery)

Post Reply