Model3 annotated board photos

Technical discussion for those interested in Supermodel development and Model 3 reverse engineering. Prospective contributors welcome.
Forum rules
Keep it classy!

  • No ROM requests or links.
  • Do not ask to be a play tester.
  • Do not ask about release dates.
  • No drama!

Model3 annotated board photos

Postby model3man » Mon Jul 27, 2020 12:34 am

I have a few Step2 board sets. There isn't much documentation on the physical hardware besides the filter board pinouts and the chip part nos in MAME, so here is my attempt at documenting the overall board structure.

The PCI footprint is probably a leftover from early DVT and, like the service buttons and various jumpers, were never removed as each board was expensive enough to justify a tech touching it for go/nogo production.

CPU Board

The 2x SCSP configuration was also used on Cool Riders (System H1) and also 1x SCSP used on the rare Flash Beats rhythm game.

Security board on the HD68 connector is a 315-5881 microprocessor with some sram and GALs. The 315-5881 was integrated into Hikaru games as well as Naomi carts. The same connector is also present but unused on System H1 (Cool Riders). It seems to be reflashable. PowerPC can dma data to/from this processor to decrypt it before uploading it to the 2d tilegen (Dirt Devils, others)


Present, but unpopulated:
Symbios SYM53C810A PCI-SCSI bridge. Step1 seems to have leftover bits of SCSI stuff in the ppc code, was it actually used for anything, or just a remnant of dev? It's present on Step1, but its connector still is missing.

MAX232 serial UART and DB9 connector. PPC code is full of debug printfs as usual. Would be fun to see those going during gameplay.

Fullsize https://i.imgur.com/clU3y8q.jpg
Image










Real3D board


By opening the Real3D Pro/1000 firmware image from the Lockheed sdk and analyzing it, I saw codenames for a lot of the asics in debug prints. Funny enough - they are all planet names of the solar system, starting from the inside of the system (Mercury) and working outwards in the solar system as the graphics data is produced along the pipeline. :lol: Also helpful are the test points on the silkscreen which give away the chip's original names. Given Sega's propensity to write chip part numbers under the chip package on the PCB, there may be more detailed part numbers on there, but I'm not going to desolder mine to check :D

Then, I booted my Daytona2 boardstack with various pins shorted on each ram to determine which rams where labeled as what, in the memory test. Further combined with my spotty knowledge about 90s fixed function GPU architectures, here are my thoughts on theory of operation:

Starting at the beginning of the pipeline --

PCI bridge - probably a NEC/Fujitsu gate array. Sega-designed, since it is not fabbed in Hong Kong like the rest of the Real3d chipset.

Mercury & Venus - I am a bit unclear on the role of this and Venus. But we know that most scenegraph data will be stored in VROM statically and accessed on demand - in fact, the VROM bus is synchronous and accessed faster than the asynchronous CROM or SROM. Additionally, some games upload dynamic mesh data on a per-frame basis. The culling processor is to take the camera position in the scenegraph and emit polygons contained in the view frustrum and nothing but, so dynamic mesh data probably lives in one of those SGRAMs. Mercury probably stores dynamic scenegraph data like transformation matrices for all the models and attribute data that changes at runtime. However, it may be possible that mesh data is not streamed and instead must live entirely in culling RAM - this is what Real3D does, and it has 8Mbyte. Mercury probably does scene graph traversal and rough rejection, Venus probably runs a DSP (is firmware loaded over jtag? or is it mask only) doing vertex T&L and passing 2d triangles to Earth.

From here the polygons are split into two identical rasterization pipelines, which are set up in scanline interleave ala nvidia SLI. Each set handles one field (odd or even scanlines)

Earth - rasterizer (edge/span walker and depth rejection). The service menu list the Mitsubishi 3dram connected as the depth buffer, so Zbuffer compares happen here. Additionally, each Earth chip is connected to its own set of 3x mitsubishi 3drams which are used as the framebuffer, probably split into R/G/B components. Interestingly, the rams have integrated pixel ALUs to support blending over existing framebuffer data. This prevents the Earth chip from ever having to readback the existing framebuffer data for a RMW blending cycle. Doing it this way makes Z-buffering incur no performance penalty and means draw order doesn't matter (No early z-sort necessary). Of course, this makes the rams a lot more complex, and worth a look in themselves...

Mars - texturing unit. Each ASIC is wired to 4 megabytes of DRAM, for an effective bus width of 128 bits. Each Earth chip has two of these texturing units. However, there are a number of ways they could have set up their texturing - Real3D overview says low-end units had 8MB of texture memory. So my guess is that there are only 4Mbytes of unique texture memory, and it is duped multiple times over each of the 4x Mars chips. This is to perform multiple lookups per cycle, which is a key part of mipmapping. The Real3D docs state that the system does support trilinear filtering with mipmapping, so you do need to LERP between two set of texture samples per cycle - the larger mipmap and the smaller one. The parent Earth chip interpolate the two texels and sends the shaded fragment to the framebuffer where it is blended with existing framebuffer contents.
The line size is 128 bits - which at 16bpp works out to 8 pixels. However, these DRAMs are actually special Mitsubishi "Cache DRAMs", which basically incorporates a 1K texel cache. So instead of putting cache on the ASIC they likely use this one in the memory. You can load the cache and then start another fetch while reading it out. The cache would provide a 32x32 block, which when doing the right texture swizzling is a pretty respectable amount (This is also the minimum supported texture size by Real3d). However, the texture layout in RAM could be done many different ways that would all be transparent to software.

Here is where the Sega implementation starts to differ considerably from the Lockheed one - Real3D has a "scroll layer" that shows 2d elements like sky backgrounds. This is part of the Jupiter chip. However, Sega decided to swap in their System24 2d PPU which was also used in the previous Model 2. This lives on the CPU board and is completely separate, but the frame timing lined up so it emits pixels at the same rate.

Jupiter - Sega's modified Jupiter doesn't have any 2d generation in it, but it reads out the 3d framebuffer and composites this with the 2d PPU output, which is digital RGB. The composited output is sent to the video output DAC turning into standard analog rgb. Both 3d odd/even video fields are interleaved into progressive output. I am not sure what the Sega 315-5648 chip is doing - maybe it's for deinterleaving stereo crts? There is space for another DAC for dual outputs. This chip was also used on Model2 and System H1 boards.


Fullsize https://i.imgur.com/n42LCxO.jpg
Image

https://www.bloomberg.com/press-release ... hics-chips

Clock rates for Real3d seem to be 50MHz on Pro/1000 as well as Step 1.0. Step 1.5 seems to be 66MHz. My Step 2.0 boards have a 33mhz oscillator so they may be 66MHz as well. So just doing some guessing, that puts the fill rate of this system at 133 Mpixel/sec. If the clock rate was increased too 100mhz, two pipelines means 200Mpix/sec fillrate.

A very interesting board, and the discrete architecture is neat in the current age of wholly-integrated SoCs and other such boring stuff.
Last edited by model3man on Tue Jul 28, 2020 12:11 am, edited 4 times in total.
model3man
 
Posts: 24
Joined: Mon Jul 13, 2020 4:15 am

Re: Model3 annotated board photos

Postby Bart » Mon Jul 27, 2020 11:30 am

Wow! This is super useful stuff. Thank you for doing this. Ian and I have frequently theorized about how the Real3D operates and some of our hypotheses may be testable by quantifying exactly how much RAM it has and to which ASICs the RAM chips are connected. For example, does the Real3D double buffer culling RAM? The Real3D SDK refers to part of it as "ping pong memory", which strongly suggests it is double buffered so that as the device renders one frame, the next frame's transformation matrices can be updated. But curiously, display list memory does not seem to be double buffered and it is possible to emulate the entire system without treating the memory as double buffered.

Likewise, does the tile generator operate in sync with the raster beam, as the original System 24 part does, or has it been modified to write to a frame buffer so that it can be composited with the 3D frame buffer? If the former, what is the size of the 3D frame buffer memory and how is it structured? Ian discovered that transparencies seem to be handled in a way that suggests the frame is rendered into two separate buffers and then composited. Layer priorities might also need to be encoded in there for compositing with the tilegen.

Lastly, the RS232 port is super interesting. We always knew it was there but the problem is that we don't know where it is mapped on the system. It is probably in the system register space but I don't think we've looked closely enough to determine whether any games might be generating debug spew. There is definitely debug text embedded in the ROMs but a lot of it is related to hidden menus (some of which can only be triggered with ROM patches) rather than any log output. If you know to the contrary, please elaborate. If we could figure out the RS232 port, and wire one up, then we could run arbitrary code on the Model 3. But without an example of code actually writing to it, I'm afraid I don't have the skillset and tools necessary to figure it out.

Right now, I have to burn EPROMs, which is incredibly cumbersome and also damaging to the boards. Furthermore, it is getting harder and harder to find the necessary parts and they do wear out over time.

I'm curious about the Lost World guns. There are apparently two variants, neither of which I've seen the boards for. One variant apparently uses analog guns but one variant uses some sort of a serial interface. How are these connected to the Model 3 board? If it's a bidirectional interface, that would solve our problems. If it turns out that some Model 3 boards actually use an RS232 interface for light guns or other controls, that would be a big deal. I can easily code up a ROM that accepts arbitrary data from a PC, allowing us to quickly test anything we want.
User avatar
Bart
Site Admin
 
Posts: 3086
Joined: Thu Sep 01, 2011 2:13 pm
Location: Reno, Nevada

Re: Model3 annotated board photos

Postby Bart » Mon Jul 27, 2020 11:49 am

Forgot to ask: can we get these images un-annotated as well (to more clearly see the part numbers)?
User avatar
Bart
Site Admin
 
Posts: 3086
Joined: Thu Sep 01, 2011 2:13 pm
Location: Reno, Nevada

Re: Model3 annotated board photos

Postby Bart » Mon Jul 27, 2020 1:29 pm

Forgot to reply to a couple points:

model3man wrote:Security board on the HD68 connector is a 315-5881 microprocessor with some sram and GALs. The 315-5881 was integrated into Hikaru games as well as Naomi carts. The same connector is also present but unused on System H1 (Cool Riders). It seems to be reflashable. PowerPC can dma data to/from this processor to decrypt it before uploading it to the 2d tilegen (Dirt Devils, others)


Thanks to amazing work by some brilliant folks that have contributed to MAME, Supermodel handles this. We used MAME's code for this.

Present, but unpopulated:
Symbios SYM53C810A PCI-SCSI bridge. Step1 seems to have leftover bits of SCSI stuff in the ppc code, was it actually used for anything, or just a remnant of dev? It's present on Step1, but its connector still is missing.


Step 1.0 and 1.5 use the SCSI controller for DMA. The Pro-1000 image generators used a SCSI interface for talking to the host workstation. On Model 3, the SCSI chip initially remained to serve only as a DMA controller for copying data from PowerPC RAM to the Real3D's culling RAM and polygon/texture FIFO. It has access to the entire system bus and my Model 3 test program is successfully able to use it to copy within PowerPC RAM, too. On Step 2.x, what appears to be a proprietary DMA controller was introduced, presumably inside one of the custom ASICs.

At some point, we made a tenuous association between the DMA device and a particular PCI device ID that corresponds to 'SEGA' as the vendor (which is what they use for all the custom Real3D chips) but I'm not sure how we made the connection. There is a comment about it in the Supermodel source code. Maybe we saw that this particular PCI device was configured just before DMA was first accessed but this could also simply indicate that the DMA destination needed to be brought up first.
User avatar
Bart
Site Admin
 
Posts: 3086
Joined: Thu Sep 01, 2011 2:13 pm
Location: Reno, Nevada

Re: Model3 annotated board photos

Postby model3man » Mon Jul 27, 2020 3:38 pm

Bart wrote:Likewise, does the tile generator operate in sync with the raster beam, as the original System 24 part does, or has it been modified to write to a frame buffer so that it can be composited with the 3D frame buffer? If the former, what is the size of the 3D frame buffer memory and how is it structured? Ian discovered that transparencies seem to be handled in a way that suggests the frame is rendered into two separate buffers and then composited. Layer priorities might also need to be encoded in there for compositing with the tilegen.


Does the system let 3d elements occlude 2d? Approaching this from a hardware designer standpoint, I wouldn't composite back into a framebuffer, becaues it would break the design of the System32. Is it possible that they could chroma key polygons in 3d space when compositing? If I could see some screenshots of this happening maybe some ideas would pop up.

Bart wrote:Step 1.0 and 1.5 use the SCSI controller for DMA. The Pro-1000 image generators used a SCSI interface for talking to the host workstation. On Model 3, the SCSI chip initially remained to serve only as a DMA controller for copying data from PowerPC RAM to the Real3D's culling RAM and polygon/texture FIFO. It has access to the entire system bus and my Model 3 test program is successfully able to use it to copy within PowerPC RAM, too. On Step 2.x, what appears to be a proprietary DMA controller was introduced, presumably inside one of the custom ASICs.


Interesting, this might be the Sega asic that steps in front of the Real3d pipeline on Step2.

Bart wrote:Lastly, the RS232 port is super interesting. We always knew it was there but the problem is that we don't know where it is mapped on the system. It is probably in the system register space but I don't think we've looked closely enough to determine whether any games might be generating debug spew. There is definitely debug text embedded in the ROMs but a lot of it is related to hidden menus (some of which can only be triggered with ROM patches) rather than any log output. If you know to the contrary, please elaborate. If we could figure out the RS232 port, and wire one up, then we could run arbitrary code on the Model 3. But without an example of code actually writing to it, I'm afraid I don't have the skillset and tools necessary to figure it out.


I wonder if it would be possible to find an exploit in a game's bookkeeping SRAM parsing code and get it to dereference a bad pointer to get code execution. But as you say, without code reading from the serial port or writing it, hard to know anything. Will probably order some parts and stick the port on the scope to see if Daytona2 does anything with it.

Bart wrote:Right now, I have to burn EPROMs, which is incredibly cumbersome and also damaging to the boards. Furthermore, it is getting harder and harder to find the necessary parts and they do wear out over time.

In my spare time, I've been tracing out the rom board pinouts for making a fpga-based ram emulator - one day I'll have Sega Rally 2 running :lol: SROM is the easiest, then I'll take a look at CROM. I can't actually find any visual difference in the Step1 vs Step2 rom boards, but they are different part numbers... maybe it's more than just different GAL code? I would be more than willing to set you up with one to get some more hardware homebrew happening :mrgreen: Trying to keep myself from buying the Scud Race on ebay right now to get a step1 board...

Bart wrote:I'm curious about the Lost World guns. There are apparently two variants, neither of which I've seen the boards for. One variant apparently uses analog guns but one variant uses some sort of a serial interface. How are these connected to the Model 3 board? If it's a bidirectional interface, that would solve our problems. If it turns out that some Model 3 boards actually use an RS232 interface for light guns or other controls, that would be a big deal. I can easily code up a ROM that accepts arbitrary data from a PC, allowing us to quickly test anything we want.

http://solid-orange.com/1611

The lightguns appear to just output analog 0-5v for the X/Y axes with a digital signal for "Gun pointed at screen or not". Some later versions for other platforms seem to only output serial.

Bart wrote:Forgot to ask: can we get these images un-annotated as well (to more clearly see the part numbers)?


https://i.imgur.com/ufomJc8.jpg
https://i.imgur.com/zXahJf7.jpg
https://i.imgur.com/upsIyje.jpg


One of my boards is Step 2.0 while the other is Step 2.1. The pcb itself is the same, but a couple ICs are revised. I'd be interested to know why...
I have seen at least two different revisions of the Step2 CPU board, with different ram configurations. Maybe a supply chain issue. Probably not any tangible difference.

Another thing I noticed: on Step 2.x boards, there is a jumper called "LOS" with one position marked "OVERLOAD". Line of sight maybe? On Real3D, there was a deprecated API call that sets the "overload mode" which is what happens when the hardware exceeds 1 frame time @ 60hz. It either proceeds rendering into the next frame, or it simply stops rendering and drops polygons (Just like PowerVR when you exceed per-tile poly limits...)
Daytona doesn't seem to do anything noticeably different with this jumper. Maybe it was set on a per-game basis for when they just couldn't hit 57.5hz all the time...
model3man
 
Posts: 24
Joined: Mon Jul 13, 2020 4:15 am

Re: Model3 annotated board photos

Postby Bart » Mon Jul 27, 2020 6:18 pm

model3man wrote:
Bart wrote:Likewise, does the tile generator operate in sync with the raster beam, as the original System 24 part does, or has it been modified to write to a frame buffer so that it can be composited with the 3D frame buffer? If the former, what is the size of the 3D frame buffer memory and how is it structured? Ian discovered that transparencies seem to be handled in a way that suggests the frame is rendered into two separate buffers and then composited. Layer priorities might also need to be encoded in there for compositing with the tilegen.


Does the system let 3d elements occlude 2d? Approaching this from a hardware designer standpoint, I wouldn't composite back into a framebuffer, becaues it would break the design of the System32. Is it possible that they could chroma key polygons in 3d space when compositing? If I could see some screenshots of this happening maybe some ideas would pop up.


It does allow this. There are 4 tile map layers but as far as their interaction with the 3D layer goes, you can assume there are only two. I believe they can all be drawn below the 3D graphics, above, or can sandwich the 3D layer. Off-hand, I can't remember whether there is a 3D clear color specified anywhere but I think there is not. If there is a background tile map layer, that is the background that will show through. I think in cases where all tile layers are rendered on top, the game will use a skybox and therefore every pixel is accounted. I don't know what happens if tile layers are rendered on top, totally transparent, and no 3D graphics are on-screen.

Furthermore -- and this is something Ian worked out so I'm unsure of how it works exactly -- on per viewport level, there is something called "scroll fog", which apparently somehow modulates the bottom layers with fog.

I think this could all be done without rendering out the tile layers to a buffer. The fog is a bit harder to explain but I'm not even fully sure how it works. It could for example be rendered as the background clear color for the viewport and, if the frame buffer has an alpha channel, could use that alpha channel to encode a per-pixel signal indicating whether to blend or replace pixels at the compositing stage.

I think that on tilemap+sprite hardware, sprites are output as color values plus priority signals and compositing is done that way. Something similar could have been done here, as weird as that sounds.

I wonder if it would be possible to find an exploit in a game's bookkeeping SRAM parsing code and get it to dereference a bad pointer to get code execution. But as you say, without code reading from the serial port or writing it, hard to know anything. Will probably order some parts and stick the port on the scope to see if Daytona2 does anything with it.


I would just burn an EPROM that contains a loader program capable of communicating with the PC via the serial port. I've successfully deployed my own software to Step 1.0 boards already. Step 2.0 would require a little bit of trial and error to deduce the correct data to write to JTAG to get the board up but it would be the same process I went through for Step 1.x.
If you find that Daytona USA is manipulating the serial port, that would be a really helpful discovery! It probably wouldn't be too hard to identify where the debug output is happening and then deduce how the port might work.

In my spare time, I've been tracing out the rom board pinouts for making a fpga-based ram emulator - one day I'll have Sega Rally 2 running :lol: SROM is the easiest, then I'll take a look at CROM. I can't actually find any visual difference in the Step1 vs Step2 rom boards, but they are different part numbers... maybe it's more than just different GAL code? I would be more than willing to set you up with one to get some more hardware homebrew happening :mrgreen: Trying to keep myself from buying the Scud Race on ebay right now to get a step1 board...


That would be really great! You are thinking of building a replacement ROM board altogether then. We had at some point thought about building an adapter only the four main program EPROMs that would slide into the 4 DIP slots. I never got around to doing it though. Even if I could build a flash ROM adapter, that would enormously cut down on dev time. An SRAM-based emulator would be the best case scenario.

Are you tracing out the board by visual inspection? Is the connector used to stack the PCBs a standard one by the way?

Bart wrote:I'm curious about the Lost World guns. There are apparently two variants, neither of which I've seen the boards for. One variant apparently uses analog guns but one variant uses some sort of a serial interface. How are these connected to the Model 3 board? If it's a bidirectional interface, that would solve our problems. If it turns out that some Model 3 boards actually use an RS232 interface for light guns or other controls, that would be a big deal. I can easily code up a ROM that accepts arbitrary data from a PC, allowing us to quickly test anything we want.

http://solid-orange.com/1611

The lightguns appear to just output analog 0-5v for the X/Y axes with a digital signal for "Gun pointed at screen or not". Some later versions for other platforms seem to only output serial.


The page mentions that the Model 2-style guns with IO board are also supported on Model 3. I haven't seen this board before. If it connects via a bi-directional serial interface, it would be interesting to inspect one and how it connects to the rest of the system.

Another thing I noticed: on Step 2.x boards, there is a jumper called "LOS" with one position marked "OVERLOAD". Line of sight maybe? On Real3D, there was a deprecated API call that sets the "overload mode" which is what happens when the hardware exceeds 1 frame time @ 60hz. It either proceeds rendering into the next frame, or it simply stops rendering and drops polygons (Just like PowerVR when you exceed per-tile poly limits...)
Daytona doesn't seem to do anything noticeably different with this jumper. Maybe it was set on a per-game basis for when they just couldn't hit 57.5hz all the time...


That's really interesting -- did you used to work with the Pro-1000? We have an SDK disk for it and have dug into it pretty extensively. It really helped us figure out missing bits of the polygon header, culling RAM nodes, and viewports, in addition to some other things. But there is still a surprising amount of mystery surrounding how frame timing works. If my turnaround time on deploying code were faster, I bet we could solve it.

What we don't fully understand is how frame rendering is triggered or how much time is spent on it. We've gotten pretty close. I have a bunch of notes and screenshots of test programs I've run that I really need to dig up and summarize again but I think the key finding was that two things need to happen: a dummy write to 0x88000000 (which is in the Real3D space) and also a write to a specific register in tilegen space. I forget whether or not I tested simply writing to the latter but writing only to the former is insufficient. It then appears that, no matter when this "trigger" is generated, the device begins and finishes rendering at specific points of the frame. A "ping pong" bit is flipped (not sure whether this corresponds to a frame buffer page flip or a culling RAM page flip) at always the exact same part of a frame (something like 11ms in).

I'm not sure whether this means that the Real3D is only spending ~66% of a frame rendering or whether there is an extra frame of latency and this 11ms point is the cut-off for which the frame buffer must be ready when the next frame rolls around 6 ms later (each frame is about 17.4 ms at 57.5 Hz).

I've tried hard to get insider information on this system but unfortunately no one remembers anything nor has any documentation lying around. And I wonder if there is even a single Pro-1000 still gathering dust somewhere in the world :)
User avatar
Bart
Site Admin
 
Posts: 3086
Joined: Thu Sep 01, 2011 2:13 pm
Location: Reno, Nevada

Re: Model3 annotated board photos

Postby Ian » Tue Jul 28, 2020 4:08 pm

What puzzles me is the frame buffer memory.. where is it? How large is it exactly. These should be pretty basic questions but we don't know. A lot of systems use the same memory for the frame buffer as the texture memory, but I'm pretty sure the real3d doesn't. Most games completely fill the texture memory so there is no free for a frame buffer.
Ian
 
Posts: 2044
Joined: Tue Feb 23, 2016 9:23 am

Re: Model3 annotated board photos

Postby Bart » Tue Jul 28, 2020 5:45 pm

Ian wrote:What puzzles me is the frame buffer memory.. where is it? How large is it exactly. These should be pretty basic questions but we don't know. A lot of systems use the same memory for the frame buffer as the texture memory, but I'm pretty sure the real3d doesn't. Most games completely fill the texture memory so there is no free for a frame buffer.


He highlighted it. The part number is M5M410092AFP. These are Mitsubishi 3D-RAM, a form of what I think is now called "active memory": memory that also included an ALU and could be configured to perform arithmetic operations suitable for 3D graphics applications, such as blending. I have a manual somewhere that I grabbed years ago and can upload it if either of you need it. A quick search of this part number brings up data sheets that claim it is configured as:

Memory capacity: 10M
320Kx32DRAM
64x32SRAM
32-bit processing core

It's a weird configuration but 320*1024*4 == 1310720 bytes == 10 megabits. There are six of these, which gives a whopping 7.5 megabytes of frame buffer memory! That's significantly more than texture RAM. At 496x384x32bpp, you would need only 0.72MB. Maybe this isn't just for the frame buffer? Certainly we can see that there is more than enough memory here to support your hypothesis that the frame was rendered in two passes and then composited...
User avatar
Bart
Site Admin
 
Posts: 3086
Joined: Thu Sep 01, 2011 2:13 pm
Location: Reno, Nevada

Re: Model3 annotated board photos

Postby model3man » Tue Jul 28, 2020 6:31 pm

Bart wrote:That's really interesting -- did you used to work with the Pro-1000? We have an SDK disk for it and have dug into it pretty extensively. It really helped us figure out missing bits of the polygon header, culling RAM nodes, and viewports, in addition to some other things. But there is still a surprising amount of mystery surrounding how frame timing works. If my turnaround time on deploying code were faster, I bet we could solve it.

What we don't fully understand is how frame rendering is triggered or how much time is spent on it. We've gotten pretty close. I have a bunch of notes and screenshots of test programs I've run that I really need to dig up and summarize again but I think the key finding was that two things need to happen: a dummy write to 0x88000000 (which is in the Real3D space) and also a write to a specific register in tilegen space. I forget whether or not I tested simply writing to the latter but writing only to the former is insufficient. It then appears that, no matter when this "trigger" is generated, the device begins and finishes rendering at specific points of the frame. A "ping pong" bit is flipped (not sure whether this corresponds to a frame buffer page flip or a culling RAM page flip) at always the exact same part of a frame (something like 11ms in).

I'm not sure whether this means that the Real3D is only spending ~66% of a frame rendering or whether there is an extra frame of latency and this 11ms point is the cut-off for which the frame buffer must be ready when the next frame rolls around 6 ms later (each frame is about 17.4 ms at 57.5 Hz).

I've tried hard to get insider information on this system but unfortunately no one remembers anything nor has any documentation lying around. And I wonder if there is even a single Pro-1000 still gathering dust somewhere in the world :)


No, if only I had more real3d info :cry: Seems the units in the field if they were in government were probably carefully destroyed per DoD standards. Hell, they may have been export controlled, who knows. The curious part of me wonders how many were actually sold.

As I remember, overload is also mentioned in the Pro/1000 firmware rom among some printfs. There was a lot of interesting in there. Open P1_P4.bin and search for "field_sync_align"...
For example, " MWW (which asic) - Mode Word Write (JU,ME,VE,EAx,MAxx)" There's your codenames again. MARS are denoted as 00, 01, 10, 11, in a two-unit configuration, which matches the test points on Sega's board. Also, Real3D has a Pluto chip which isn't present on Model3 (or it was replaced by the 2D tilegen).It seems that because Pluto is tied to the genlock hardware and also directly generates the video signal, that the sync timing will concern Pluto/Mercury.
There is also a list of register dumps for each chip, starting at "Pluto 0x%08x". Actually, looking at these, it appears MARS also does the gouraud shading in addition to texturing.

Ian wrote:What puzzles me is the frame buffer memory.. where is it? How large is it exactly. These should be pretty basic questions but we don't know. A lot of systems use the same memory for the frame buffer as the texture memory, but I'm pretty sure the real3d doesn't. Most games completely fill the texture memory so there is no free for a frame buffer.


Each Earth rasterizer has its own 3x Mitsubishi 3drams. One per color component (R, G, B). They can be scanned out to the display at the same time the Earth is sending them pixels to blend. I checked the PCB to see how they are wired.

Each field0/1 pair has their video outputs tied in parallel, which is fine because you will only be reading pixels from one or ther other for scanline interlave. Each of the rams has all 16 bits of pixel output wired, so they are probably outputting odd/even pixels horizontally as well, which is a supported mode in the ram datasheet. DRAM control signals are shared within each field.
Each ram has a 32bit data input, and 4 x8 ROP/Blend units. Each blender can be configured so as to support all OpenGL blend modes of the day. My guess is, the Earth is sending the framebuffer two shaded pixels per clock @ 8bits each, with each having an 8bit alpha channel, across 3 color channels. These two pixels may either be 2 separate textures, for multitexture blending, or simply two adjacent shaded fragments for faster fill rate, I don't know which.
Additionally, there must be enough space within the rams for at least two framebuffers.

Each ram combined holds 1280*1024 8bit words. Three combined is 1280*1024 24bit words. So, each field combined holds a total of 3.84mbytes. Both fields combined yields 7.68Mbytes
They are definitely not using the full space of the rams, but they are using multiple rams to increase bandwidth and allow more on-screen complexity at a lower resolution.
model3man
 
Posts: 24
Joined: Mon Jul 13, 2020 4:15 am

Re: Model3 annotated board photos

Postby Bart » Tue Jul 28, 2020 6:50 pm

model3man wrote:No, if only I had more real3d info :cry: Seems the units in the field if they were in government were probably carefully destroyed per DoD standards. Hell, they may have been export controlled, who knows. The curious part of me wonders how many were actually sold.


I don't think they were used exclusively for defense applications and some made it to the civilian simulation sector. There's got to be one sitting around somewhere in a private collection... If I could only track down some companies that had them.

Each Earth rasterizer has its own 3x Mitsubishi 3drams. One per color component (R, G, B). They can be scanned out to the display at the same time the Earth is sending them pixels to blend. I checked the PCB to see how they are wired.

Each field0/1 pair has their video outputs tied in parallel, which is fine because you will only be reading pixels from one or ther other for scanline interlave. Each of the rams has all 16 bits of pixel output wired, so they are probably outputting odd/even pixels horizontally as well, which is a supported mode in the ram datasheet. DRAM control signals are shared within each field.
Each ram has a 32bit data input, and 4 x8 ROP/Blend units. Each blender can be configured so as to support all OpenGL blend modes of the day. My guess is, the Earth is sending the framebuffer two shaded pixels per clock @ 8bits each, with each having an 8bit alpha channel, across 3 color channels. These two pixels may either be 2 separate textures, for multitexture blending, or simply two adjacent shaded fragments for faster fill rate, I don't know which.
Additionally, there must be enough space within the rams for at least two framebuffers.

Each ram combined holds 1280*1024 8bit words. Three combined is 1280*1024 24bit words. So, each field combined holds a total of 3.84mbytes. Both fields combined yields 7.68Mbytes
They are definitely not using the full space of the rams, but they are using multiple rams to increase bandwidth and allow more on-screen complexity at a lower resolution.

[/quote]

This is interesting. Ian thinks that translucent and opaque polygons are actually written to two separate buffers before being combined. Do you think the system supports that configuration? Supermodel achieves correct translucency in the new 3D engine by rendering this way. Ian can explain better but I seem to recall that one clue was that multiple translucent polygons overlapping a piece of opaque content appear to blend only once with the opaque content. For example, shadows are often comprised of multiple overlapping dark, alpha-enabled polygons but the artifacts that occur if rendered in OpenGL in any render order are simply not present. Likewise, there is a scene in Emergency Call Ambulance where a number of translucent glass shards are rendered and, IIRC, when they overlap, they appear to behave as only a single unified layer.
User avatar
Bart
Site Admin
 
Posts: 3086
Joined: Thu Sep 01, 2011 2:13 pm
Location: Reno, Nevada

Next

Return to The Dark Room

Who is online

Users browsing this forum: No registered users and 1 guest

cron