Model3 annotated board photos

[Bart]

Well well well. What do we have here:

Code: Select all

0005d2c0h: 0A 00 00 00 0A 07 20 52 65 62 6F 6F 74 69 6E 67 ; ...... Rebooting
0005d2d0h: 20 4E 6F 77 21 21 21 20 0A 00 00 00 4D 6F 64 65 ;  Now!!! ....Mode
0005d2e0h: 20 77 6F 72 64 20 67 65 74 20 66 61 69 6C 65 64 ;  word get failed
0005d2f0h: 21 21 0A 00 4D 6F 64 65 20 77 6F 72 64 20 70 75 ; !!..Mode word pu
0005d300h: 74 20 66 61 69 6C 65 64 21 21 0A 00 0A 0A 4C 6F ; t failed!!....Lo
0005d310h: 61 64 20 53 74 61 74 73 3A 0A 0A 00 54 6F 74 61 ; ad Stats:...Tota
0005d320h: 6C 20 43 6C 6F 63 6B 73 3A 20 20 20 20 20 20 20 ; l Clocks:       
0005d330h: 20 20 25 31 38 64 0A 00 50 72 65 73 73 20 72 65 ;   %18d..Press re
0005d340h: 74 75 72 6E 20 74 6F 20 74 61 6B 65 20 6A 75 70 ; turn to take jup
0005d350h: 69 74 65 72 2F 70 6C 75 74 6F 20 6F 75 74 20 6F ; iter/pluto out o
0005d360h: 66 20 72 65 73 65 74 20 61 6E 64 20 63 6F 6E 74 ; f reset and cont
0005d370h: 69 6E 75 65 0A 00 00 00 25 31 30 73 20 2D 20 30 ; inue....%10s - 0
0005d380h: 58 25 30 31 78 25 30 37 78 0A 00 00 57 6F 72 64 ; X%01x%07x...Word
0005d390h: 20 43 6F 75 6E 74 00 00 44 61 74 61 20 56 61 6C ;  Count..Data Val
0005d3a0h: 75 65 73 00 70 72 6F 63 65 73 73 5F 72 73 32 33 ; ues.process_rs23
0005d3b0h: 32 3A 20 4A 74 61 67 20 77 72 69 74 65 20 74 69 ; 2: Jtag write ti
0005d3c0h: 6D 65 64 20 6F 75 74 2E 0A 00 00 00 70 72 6F 63 ; med out.....proc
0005d3d0h: 65 73 73 5F 72 73 32 33 32 3A 20 4A 74 61 67 20 ; ess_rs232: Jtag
0005d3e0h: 72 65 61 64 20 74 69 6D 65 64 20 6F 75 74 2E 0A ; read timed out..

Code: Select all

0006b100h: 00 00 00 00 00 00 00 00 40 28 23 29 72 73 32 33 ; ........@(#)rs23
0006b110h: 32 5F 75 69 2E 63 09 35 2E 31 36 5B 31 31 2F 32 ; 2_ui.c.5.16[11/2
0006b120h: 31 2F 39 37 5D 20 28 43 29 20 43 6F 70 79 72 69 ; 1/97] (C) Copyri
0006b130h: 67 68 74 20 31 39 39 36 20 4C 6F 63 6B 68 65 65 ; ght 1996 Lockhee
0006b140h: 64 20 4D 61 72 74 69 6E 20 43 6F 72 70 6F 72 61 ; d Martin Corpora
0006b150h: 74 69 6F 6E 00 00 00                            ; tion...


[biggestsonicfan]

I don't regret posting at all!

Got a logic analyzer on the way. I hope to help in any way I can!

[Bart]

I don't regret posting at all!

Got a logic analyzer on the way. I hope to help in any way I can!

I thought about this a bit more. I think the best approach is actually as follows:

1. Write a unidirectional bit banger that transmits data via the joystick inputs. I think this would absolutely be possible. And to be honest it would be enough and would not require any hardware modifications. A loader could be written to write programs received from the computer directly to RAM and execute them.

2. If we want to go deeper and start running experiments on the 422 port, the loader in [1] would allow this. I am not confident I could figure out that port in one or two attempts, which means multiple painful EPROM cycles and further damaging the socket. However, I could almost certainly get [1] working in a single try.

3. Finally, for the sake of completeness, it would be great to disassemble the Pro-1000 firmware and learn where the 232 port may be hiding. Also worth adding support for the Pro-1000 itself to Supermodel.

Thoughts?

[biggestsonicfan]

Time to come a little bit clean here. I don't come from a Model3 background, but a Model2 background. I have reverse engineered the game Sonic the Fighters to a point where I can insert my own code and do most anything I want with the hardware. I've become most interested in the serial port for reasons listed in this thread, a nice arcade board to pc interface could be handy for very many reasons. The Model2 and Model3 both have the SCSP interfaced to the RS-422 and MIDI interfaces. I figure the communication method of the SCSP won't change between the versions, and I can at least document what I can to trail-blaze whatever useful info might help for Model3. I also did a little digging as I believe the SCSP also handles the serial interface (and MIDI adapter via serial) on the Sega Saturn, but it uses RS-232, which is a bit confusing. I theorize that while it might have been more costly to produce for the chip, the SCSP might support both RS-232 and RS-422, but probably not at the same time. Again, just a working theory.

Using what documentation is in MAME for the Model2 along with my disassemblies of various games, I do see activity on the Model2's serial for a surprising amount of games, including Sonic the Fighters, mostly as a short burst of data on startup, but with games like House of the Dead, it's essential for the serial port to be connected to the gun board, or the game will refuse to start. In fact, the Model3 has The Lost World: Jurassic Park as a lightgun game, which I believe twistedsymphony has documented as using RS-232 for it's communication protocol to the gun board.

EDIT: I've had a bit of back and forth with a MAME contributor on twitter specifically about the SCSP's role for the serial on the Model2/3, here's what they had to say:

Model 2/3 bridges SCSP MIDI comms thru a 8251 i/f, cfr. the midi_in calls in serial_r/w functions.

[Bart]

That's interesting re: 8251. I don't recall seeing any registers being set up that resemble an 8251.

Lost World sounds like a very promising place to start digging. If you're able and willing to help with the software reverse engineering, we'd welcome the help. I'm pretty slammed with a startup and like 5 other side projects right now However, I would like to find some time to finally implement my idea for using the input pins as a way to load programs. Getting RS-232 or RS-422 working would be better because transfer rates will almost certainly be much higher. I'm not sure how the inputs are wired up and how quickly they can be changed but I would assume that a few times per frame would be no problem and that's enough to get something basic going.

[biggestsonicfan]

Well I'll start with what I have, since I'm tackling the RS-422 on the Model2 first, we'll see if I can get communication going between the board and a computer, from there it should just be a matter of translating that to the Model3. I don't have any Model3 hardware to poke or prod, but I did some Daytona USA 2: Battle on the Edge poking that I need to re-investigate, but beside that, I think I'm starting to get a little off topic.

EDIT: So tracing the Model2b's RS422 port, it leads to a SN751798B near the i960 cpu, that's why I didn't find it anywhere near the the SCSP. The 8251-compatible uPD71051C appears to only be on the Model2a (maybe the Model2c?). I wonder if the Model3 has a SN75179B as well, if so, we've found our serial port chip.

EDIT: This old post was spot on:

Lost World Jurassic Park can use the Sega custom 315-5649 I/O Controller's RS-422 bus to communicate with with the older optical gun I/O board used in Virtua Cop 2 and House of the Dead 1

Looking at pictures of the Model2c board on ebay, the model2c also uses the SN75179B and not the uPD71051C. So apparently, if the SCSP is involved somehow, it would have to have the SCSP talking to the 315-5649, as that's what's connected to the SN75179B on my Model2b board. Looks like I was wrong in my assumption, dang!