It is currently Wed Dec 12, 2018 3:57 pm

All times are UTC - 7 hours





Post new topic Reply to topic  [ 14 posts ] 
Author Message
PostPosted: Sat Feb 17, 2018 4:07 am 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 709
MGC-002, titled 2-in-1 Uzi Lightgun, is a multicart from TXC Corporation. Software-wise, it includes nothing special --- Operation Wolf from Taito, and Space Shadow from Bandai. What I find interesting is that rather than patching the games for whatever multicart hardware they could be using, they built a board that can function as an MMC1 for Operation Wolf, and as Mapper 70 for Space Shadow.

Emulation-wise, there is one register at $4120 (at least that's the address that the code writes to):
Code:
   4120   ------pm      Mode Register
      m   - mode
         "0" - mapper 70 mode
         "1" - mapper 1 mode
      p   - prg 64K block in 70 mapper mode

and the $8000-$FFFF address range functioning as a latch in Mapper 70 mode, and as the usual MMC1 registers in Mapper 1 mode, although I am not sure how completely the MMC1's functionality is replicated.

In order to achieve that, along with a number of 74LS chips, a 24-pin chip that I think is the TXC 05-00002-010 IC (marked "52S") seems to play a role in this, connected in an entirely different manner compared to Mappers 36, 132 and 173. In particular, pin 5, whose function is unknown so far, seems to be connected in a meaningful manner (to PRG pin 24). On the other hand, since pin 12 seems to be connected to GND, maybe it's just the kind of PAL that the TXC IC on the Mapper 173 board pretended to be but wasn't. Unfortunately, the whole cascade of logic gates is a bit too difficult for me to follow.

Here are three PCB images, originally taken by CaH4e3: front, front (some chips removed), back.


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 11:55 am 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
I think, by context, the 52S has to be an MMC1 clone instead. But I'm also tracing the board, unless Krzysiobal beats me to it ;)

edit: About 90% of what I can trace without egregious guessing, and the pins that are easily traced are clearly the same positions as the MMC1. (pins 5, 12-15, 18, 19, 24)

Functionality appears to be:
* two '161s - mapper 70 compatibility, with support for 64K PRG and 128K CHR
* '32 - 16+16F bank behavior for mapper 70
* two '257s - select MMC1 or 161+161+32 output
* '175 (labelled otherwise) - the new latch
* '138 - decoding address for latch

Not clear what the blue bodge wire is doing; it appears to connect the same pins as the cut trace that it's replacing.

By availability, the range mask for the mode register, I think it has to $E100—A5 doesn't get up there, but A14, /ROMSEL, A8, A13, R/W, and M2 meander their way around.


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 1:53 pm 
Offline

Joined: Tue Feb 14, 2017 9:50 am
Posts: 97
On my cartridge the trace is cut and the cable rather goes to pin 53.


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 1:58 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
That's connecting CIRAM A10 to PPU A10, for vertical mirroring / horizontal layout.

I'm not certain whether denying or relying on the MMC1 for mirroring control surprises me more. Certainly the menu could have set it correctly before switching into the game ... as long as the game doesn't write to its bankswitching register in the same place that the MMC1 will interpret as controlling mirroring.


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 2:13 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 709
The multicart writes:

before showing the menu: $00 to $4120 and $20 to $8387.
before running Operation Wolf: $21 to $4120
before running Space Shadow: $62 to $4120

Space Shadow writes to $C4xx to bankswitch.

Space Shadow needs Vertical Mirroring, otherwise the screen will not go black when firing the zapper, and the shot will not be registered unless the mouse pointer is over a dark patch of background.

For correct emulation, I need to AND the MMC1 bank with $07 and OR it with $08 to make it work properly. I'm not sure if that "PRG Base" is taken from the Mode register (using bits that CaH3e did not document), or whether it's hard-wired into the board assembly.


Last edited by NewRisingSun on Sat Feb 17, 2018 2:16 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 2:16 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
NewRisingSun wrote:
I'm not sure if that "PRG Base" is taken from the Mode register (using bits that CaH3e did not document), or whether it's hard-wired into the board assembly.
Both? PRG A17, CHR A17, both '257s select inputs, all appear to be the same as the new register's "m" bit.

Specifically:

Left '257 selects PRG A14, A15, A16, and CHR A12, either from the '161+'161'+'23 (when low) or from the MMC1 (when high)
Right '257 selects CHR A13, A14, A15, A16. (same sense)
Left '161 holds PRG A14 and A15, before passing through the 74'32.
Right '161 holds CHR A13 through A16.
'175 holds A17 always and PRG A16 when in mapper 70 mode.

It sounds like the menu probably could have gotten away with setting the MMC1 mirroring control register in the menu rather than requiring rework.


Last edited by lidnariq on Sat Feb 17, 2018 2:28 pm, edited 2 times in total.

Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 2:22 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 709
Dumb question on the side: if a ROM chip has both Chip Enable and Output Enable pins, what's the difference between disabling one versus the other?


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 2:23 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
For ROMs that can't be written (due to being mask, or requiring higher voltage, or just not having /WR connected), power consumption and speed of replying.

(/CE low - use more power, reply faster:

A "200ns" ROM is one that will have a correct output on the data pins no later than 200ns after /CE falls, assuming /OE is low and nothing else changes. At the same time, if /CE is already low and /OE falls, or the address bus changes, almost all ROMs I've seen are ready in half the time.

At the same time, /CE low often consumes 30-70mA, whereas /CE high usually consumes 1mA or even much less.)


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 2:38 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
Here's the stack of images from my tracing:


Attachments:
File comment: red, green: from card edge solder side/component side
yellow: ROM Standard pinout or high confidence guess
purple: guess
blue: low confidence guess

MGC-002-overlay.png
MGC-002-overlay.png [ 27.22 KiB | Viewed 1821 times ]
mgc-002-back-realigned.jpg
mgc-002-back-realigned.jpg [ 584.02 KiB | Viewed 1821 times ]
mgc-002-front-realigned.jpg
mgc-002-front-realigned.jpg [ 600.07 KiB | Viewed 1821 times ]
Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 9:52 pm 
Offline

Joined: Sun Jun 12, 2011 12:06 pm
Posts: 446
Location: Poland
I think I got it:

Thank's lidnariq for suggesting that 74138's pin2 is CPU-!ROMSEL. Anyway, A5 is not taken into account so idea why 0x4120.
Register mask: 0xE100

Image Image


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 10:22 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
Heh, I liked your version of events before you updated from my guesswork :)

None of our versions of the traces going between the '138 and the left '161 make me happy: they all feel too wiggly.

Regardless, none justify the write the menu does to $8387 or why exactly one of the two data inputs on the left '161 is grounded...


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 11:15 pm 
Offline

Joined: Thu May 19, 2005 11:30 am
Posts: 709
krzysiobal wrote:
Anyway, A5 is not taken into account so idea why 0x4120.
That's quite common. AVE, Sachen and Hacker carts also mask $E100, yet the games almost always write to $4120. I think the habit got started by Joy Van/Idea-Tek programmers who associated address $4100 with the JV001/TXC 05-00002-010 IC and $4120 with the simpler bus-conflict-avoiding data latch.

As I understand krzysiobal's schematic, bits 5 and 6 written to $4120 are ignored (U10, clocked by U7's $E001 mask, sees only D0 and D1)? And Mirroring is hard-wired (using an actual wire :)) to Vertical?

I intend to assign Mapper 297 (TXC 01-22110-000) for this board.


Top
 Profile  
 
PostPosted: Sat Feb 17, 2018 11:33 pm 
Offline

Joined: Sun Apr 13, 2008 11:12 am
Posts: 7817
Location: Seattle
NewRisingSun wrote:
As I understand krzysiobal's schematic, bits 5 and 6 written to $4120 are ignored (U10, clocked by U7's $E001 mask, sees only D0 and D1)?
Yeah, neither of us saw any way for other interesting signals to get over there.


Top
 Profile  
 
PostPosted: Mon Feb 19, 2018 4:55 am 
Offline

Joined: Mon Dec 12, 2011 8:15 pm
Posts: 429
Txc is mmc1+mapper70.

this cart newstar version, OW is mapper 70.

this rom nestopia plus!R215 is support!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group