Forums

Sega Master System / Mark III / Game Gear
SG-1000 / SC-3000 / SF-7000 / OMV
Home - Forums - Games - Scans - Maps - Cheats - Credits
Music - Videos - Development - Hacks - Translations - Homebrew

View topic - Sega AI Computer reverse engineering thread

Reply to topic Goto page 1, 2, 3, 4  Next
Author Message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Sega AI Computer reverse engineering thread
Post Posted: Mon Jan 26, 2015 3:03 pm
Last edited by Bock on Thu Jan 29, 2015 12:57 pm; edited 2 times in total
.....

Also see the public thread
http://www.smspower.org/forums/15004-SegaAIComputerSoftware
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Software rom dumps
Post Posted: Mon Jan 26, 2015 3:04 pm
Last edited by Bock on Sun Feb 08, 2015 8:04 pm; edited 3 times in total
Dumped by itoh-san (filenames in Japanese)
The cards uses the same pinout as Sega My Cards

*EDIT* added the same files with names transcribed to English.

*EDIT* those dumps are incomplete. See discussion.
Sega_AI_Games.zip (392.69 KB)

  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
BIOS roms
Post Posted: Mon Jan 26, 2015 3:05 pm
Dumped by Chris Covell
Here are the dumped ROMs from the AI and the Sound Box.

Sega_AI_BIOS_ROMs.zip (98.81 KB)

  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Tue Jan 27, 2015 12:28 am
Last edited by ccovell on Sun Mar 08, 2015 12:39 am; edited 5 times in total
Here's an early tech data dump:

The MyCard pinout is identical to regular SMS MyCards, apparently.

We listened to one tape. Each audio clip has a modulated data burst before it, presumably for the CPU/tape to identify the clip.

The E000/F000 ROMs we dumped have JIS-encoded text, the E000 has Romaji-Hiragana transcription strings, and an internal date of 7/19/86; the F000 ROM has (Prolog?) error strings, cartridge insertion error messages, and Hiragana-Kanji conversion strings.

The Sound Pack ROM has instrument strings, etc. of course. Also, it has this text:
Quote
Programed by SHUN ARAI.Produced by YASUHIGE KOBAYASHI.Special Thanks KAMIYA STUDIO & PHILOS
...
R&D No.6SOUND BOARD V1.187/08/12 SEGA


The system indeed (?) has 128K main RAM, 64K VRAM, making it almost MSX-compatible. According to the promotional materials on the SMSPower page, the video portion "satisfies MSX2" so maybe all that is missing to make the AI an MSX computer is the BIOS & BASIC software on ROMs?

I tried out a sampling of the software with the Sound Board, and many of them produced FM music instead of simple PSG without the board. All FM is mixed in with everything else, including the PSG, which is still used for rhythm hits; the speech chip, which is used in "Popo's Adventure" ("take a big hamburger" it says, eg.); and the sound from the cassette, which is mostly narration and hints.

So far, the "Folk & Fairy Tales" (w/ Cassette), "Popo's Adventure" (w/ Cass.), and the 3 music programs "Runrun Music", "Tantan Rhythm", and "Ranran Melody" have FM music with the sound board connected. The other set of 9 "Wonder School" packages have PSG music only.

I've noticed that the quality of art & music is a bit higher in the software of the two packages with cassettes. Possibly they used different software developers and/or educational companies (Linguaphone in this case.)

The games/stories with the cassette are rather fun to play, with voice clips streamed from tape, and sometimes spoken by the speech synthesizer... but clearly this computer was screaming out for random access media for sound, like CD or solid-state ROMs. The tape sometimes seeks back and forth for 5-15 seconds for the right voice clip, while the game and player (kids) wait. :-)

I've attached some RGB screengrabs that I took. Hopefully emulation of the AI will come sometime for better screenshots... speaking of which, anyone know of a modern V20 disassembler program?

Sega AI Computer quick PCB overview

Major ICs

IC 1   D701080-5      (86/09?) NEC V20 CPU       DIP40
IC 2   315-5200      (86/25)   SEGA          QFP100
IC 3   27C512-25      (86/15)   64K EPROM "E000  8/24"
IC 4   27C512-25      (86/06)   64K EPROM "F000  7/21"
IC 5   MPR-7689      (86/22) SEGA "264 AA E79" 128K CHR ROM DIP28
IC 10   V9938            Yamaha MSX2 VDP
IC 13   D7759C         (86/12)   NEC Speech Synthesizer   DIP40
IC 14   MPR-7619      (86/23)   SEGA ROM for D7759C   DIP28
IC 15   MPR-7620      (86/23)   SEGA ROM for D7759C   DIP28
IC 16   SN76489AN         TI PSG         DIP16
IC 17   D8251AFC      (86/09)   NEC Communications Interface DIP28
IC 18   315-5201      (86/25)   SEGA (bodge wire on pins 9,10) DIP20
IC 19   M5204A         (87?/01) OKI
IC 20   D8255AC-2      (86/08)   NEC Peripheral Interface DIP40

IC 6,7,8,9,11,12   D41464C-12   NEC 32K DRAMs - 128K RAM, 64K VRAM

Crystals, etc

X1   20.000            "KDS 6D"
X2   21.47727         "KDS"
X3   ?            "CSB 640 P"

Connectors

CN1   6-pin DIN Power connector
CN2   8-pin DIN "AUX" connector
CN3   Video phono jack
CN4   Audio phono jack
CN5   35-pin Sega MyCard connector
CN6   60-pin expansion connector A1..A30 Bottom, B1..B30 Top
CN7   9-pin header connector to "Joy, Button, LED" unit
CN8   13(?) pin flat flex connector to pressure pad
CN9   9-pin header connector to tape drive motor, etc.
CN10   13-pin header connector to tape heads
JP2   2-wire header to SW2 button board
PJ1   7-wire header to Keyboard / Mic connector board
MIC   2-wire header to mic on KB/Mic board
SW1   Reset Switch

Power switch is on the AC Adaptor

Joypad unit (by Mitsumi) has U/D/L/R, "PL" and "PR" buttons, and a power LED.

Power Connector Pinout (Seen from AC Adaptor plug):               
   1     5        1  12V COM    5   5V COM
      6           2  12V OUT    6   5V OUT
   2     4        3   5V COM       
      3           4   5V OUT

AUX Connector Pinout:
   7   6          1 to +5V via 990 Ohm R   5 csync
  3  8  1         2 GND               6 green
   5   4          3 blue              7 Audio out
     2            4 to +5V via 120 Ohm R   8 red

New JIS Keyboard Connector Pinout:
    1 2           1,2,3 data lines
  3 4   5         4 ??          5,8 data lines
   6 7 8          6 GND         7 +5V


AI Sound Box, Model "AI-2002"

ICs on board:

IC 2      TMP82C53F-2    (91/09)   Toshiba (Peripheral Timer?)
IC 3      HN27512G-25   (87/12) Hitachi 64K EPROM
IC 6      YM2151      (91/10) Yamaha FM chip
IC 7      TMP82C55AF-10    (88/15)   Toshiba (Peripheral Interface?)
IC 8      YM3012      (91/10) Yamaha Stereo DAC
IC 9      HA17358         Hitachi Dual Op-Amp
IC 10      LC7537N         Sanyo (Volume Control IC)
IC 11      C324C      (90/42)   NEC Quad Op-Amp
IC 12      LA4520         (Sanyo Power Audio Amp?)
IC 16-19   MB81464-12   (91/12) Fujitsu 32K DRAMs


Misc Flat DIPs

IC ??      LS125A         Hitachi Line Driver
IC ??      HC04         TI Inverter
IC ??      74HC157A x2      Toshiba
IC ??      HC138         TI
IC ??      HC139         TI



TMP82C55AF-10 Peripheral Interface pinout (incomplete)

    33      23
    _|_______|_
34--|    T    |--22
    |TMP82C55 |
    |         |
44--|         |--12
    \_________|
     |       |
     1      11

 1 -                12 -        23 - B.7    34 -
 2 - GND            13 - C.3    24 - +5V    35 - A.7
 3 - Address 1      14 - B.0    25 - D7     36 - A.6
 4 - Address 0      15 - B.1    26 - D6     37 - A.5
 5 - Port C bit 7   16 - B.2    27 - D5     38 - A.4
 6 - " C.6          17 -        28 - D4     39 -
 7 - C.5            18 - B.3    29 - D3     40 - A.3
 8 - C.4            19 - B.4    30 - D2     41 - A.2
 9 - C.0            20 - B.5    31 - D1     42 - A.1
10 - C.1            21 - B.6    32 - D0     43 - A.0
11 - C.2            22 -        33 -        44 -

Port B on the sound box's 82C55 is connected to the LC7537N volume control IC.
B.0 connects to pin 20 (DI); B.1 to pin 21 (CLK); and B.2 to pin 22 (CE).
B.7 connects to an output enable for pin 18 of the TMP82C53F peripheral timer.


CN2 "Music Keyboard" connector:
UL..........................UR
 1  2  3  4  5  6  7  8  9 10
11 12 13 14 15 16 17 18 19 20

1,2,11,12 - GND

 6 - Port A bit 6
 7 - Port A bit 4
 8 - Port A bit 2
 9 - Port A bit 0
16 - Port A bit 7
17 - Port A bit 5
18 - Port A bit 3
19 - Port A bit 1

 3 - Port C bit 2
 4 - Port C bit 4
 5 - Port C bit 6
10 - Port C bit 7
13 - Port C bit 1
14 - Port C bit 3
15 - Port C bit 5
20 - Port C bit 0

AI_Capture01.png (149.3 KB)
AI Computer Bootup
AI_Capture01.png
AI_Capture02.png (228.69 KB)
in-game example
AI_Capture02.png

  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Pictures
Post Posted: Thu Jan 29, 2015 9:38 am
Chris has uploaded a bunch of pictures here
http://www.chrismcovell.com/data/AI_Photos.zip

As I understand pictures 01 to 10 are of the Sound Box.
Pictures 11 to 45 are of the Sega AI main unit. We might need more detailed pictures of the main board?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Post Posted: Thu Jan 29, 2015 10:56 am
Last edited by Bock on Fri Feb 06, 2015 12:07 pm; edited 1 time in total
I have added the following people to this thread

Chris Covell
Charles MacDonald
Kale (MESS/MAME)
Etabeta (MESS/MAME)
jdg (MESS/MAME)
Paul Baker
Maxim
yaz0r
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Thu Jan 29, 2015 5:15 pm
I had done some work on a V30 system and used nasm and ndisasm as I wasn't using the NEC specific extra opcodes added to the x86 instruction set. You can use "unidasm" which comes with MAME that supports the V20 directly, and I believe it supports the extra opcodes.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Post Posted: Thu Jan 29, 2015 7:41 pm
So the E000 program has a date of 7/19/86 (86 week ~29)
The main computer hardware has chips dated up to 86 week 25 (or 87 week 1 depending on what's on that OKI chip)

Sound Box program has a date of 87/08/12.
Sound Box hardware has chips up to 91/12 !
That is particularly odd - a span of 5 years!

I have another Sound Box which I could inspect so see if the dates matches, but it is tucked away in storage, I will try to get it next week as I am travelling to Paris.

I have a lead on friend-of-a-friend who have worked on the Sega AI in Japan. We could ask her questions on this type of stuff (dates, software, what was the plan etc.)
  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Fri Jan 30, 2015 7:58 am
Last edited by ccovell on Sun Mar 08, 2015 12:36 am; edited 8 times in total
Okay, so I haven't touched or looked at x86 assembly in 19 years... :-/

The F000 ROM appears to be segment F000:xxxx, and there is a proper jump instruction at FFFF:00 ($FFF0 in the EPROM.) which jumps to a "reset" routine at $1000 in the "F000" ROM. Anybody who is interested can start disassembly from there.

After a little peeking and prodding:
Sega AI V20 Memory Space by Segment
-----------------------------------
0: RAM  (Stack set to $443E here on startup)
1: RAM
2: Sound Box DRAM
3: Sound Box DRAM
4: (open bus)
5:   "
6:   "
7:   "
-
8: Expansion Bus (eg: Sound Box)
9: (open bus)
A: MyCard Cartridge space (and mapper regs)
B: MyCard Cartridge space (or mirror of $Axxxx for mappered games)
-
C: Character ROM low 64k
D: Character ROM high 64k
E: BIOS ROM "E000"
F: BIOS ROM "F000"


Some MyCard games have mapper hardware, in which case they have a fixed 16K bank at
$A0000-$A3FFF, with two more selectable bank spaces at $A4000-A7FFF and $A8000-$ABFFF.
These selectable banks are chosen by writing the bank number to $AFFFE-F.
Mappered games have open bus at $AC000-$AFFFF, and the $Bxxxx area is a mirror of $Axxxx.

For example, Ocean Fantasy writes $80,$00,$01,$02 to $AFFFC-F.

Most earlier AI MyCards have no mapper, and have a flat 128K ROM spanning $A0000-$BFFFF.


Ports
-----

Writing:

$00-03: V9938 VDP ports 0-3
-------
$04-07: D8255AC peripheral ports
-------
$0B:   Bit 0 is the speech chip Standalone / Slave (/MD) line...?
----
   - $01,$00 written to port $0B at BIOS startup


$0C/$0D: SN76489AN PSG chip
--------
   - $9F,$BF,$DF,$FF written to port $0C at BIOS startup

$14/$15: PD7759C Speech Synth command port
--------
   - In Standalone mode, a preset word is chosen through this port.
   - In Slave mode, ADPCM data are streamed to this port by the CPU.

$16:   ???
----
   - Writing a 1 to bit 5 causes a CPU crash
   - Writing a 1 to bit 4 causes an audible "pop"

$17:   Speech Synth address/data/mem mapper?
----
   - "Eigo de Game" 2 writes 0,2,4,7,$d,$e to this port, then
     enables interrupts.  An interrupt-driven routine then writes
     $01 to port $B, then ADPCM data to port $14, then $00 to $B again.

$1C-$1E: Touch Pad reset/latch ports
--------

$20-21: Sound Box's YM2151 FM ports
-------
$24-27: Sound Box's TMP82C53F timer ports
-------
$28-2B: Sound Box's TMP82C55AF peripheral ports
-------
   - Port B bits 0,1,2 are connected to the Sanyo Volume Control IC's
     "DI", "CLK", and "CE" input pins, respectively.

   - Port B bit 7 controls an "output enable" line for the TMP82C53F
     timer device pin 18, whatever that is.


Reading:

$04:   Joypad & Buttons
----
   MVrl-RLDU


$05:   Button & Tape Sensor
----
   CHTW-gYPB

r: "PR" trigger (named "Point Right" in manual)
l: "PL" trigger ("Point Left")
RLDU: pad direction
B: grey trigger Button near touch panel/pad (named "Touch Button")
--
P: touch-sensitive Pad is being pressed
Y: touch-sensitive pad coordinate data are readY
--
C: CN9 pin 8
H: cassette Head engaged sensor
T: cassette Tape insertion sensor
W: cassette Write enable sensor
M: Microphone sensor (1 = sound detected)
V: Voice chip (PD7759C) /BUSY line: 0 when this chip is streaming a sample.
g: keyboard pin 3 (see below)
--

A 0 bit means button/pad/panel is pressed, 1 means released.

$06:   JIS Keyboard Lines
----
   ikfe-????

$07:   j???-????
----

efghijk: Keyboard connector pinouts (1-5,8)
(Connector pin 5 seems to map to i/j in ports 6/7 simultaneously(?)
 

$16:   Speech Synth ???? line?
----

$1E:   Touch Pad X/Y data (after reset/latched)
----
   - "Mozart Academy", for example, reads the pad with this sequence:
     0->Port $1C, 1->Port $1D, load CW (alias CX) register with $0108, do delay loop.
     Read Port $5 bit 1 to see if pad pressed.  If not, exit.  If so:
     0->Port $1D,$1C,$1E in that order, load CW with $0061 to delay.
     Read Port $5 bit 2 to see if X data is ready.  If not, exit.  If so:
     Read Port $1E for Touch Pad X-axis data (& store it somewhere.)
     1->Port $1C, load CW with $0014 to delay. 0->Port $1E, load CW with $0061 to delay.
     Read Port $5 bit 2 to see if Y data is ready.  If not, exit.  If so:
     Read Port $1E for Touch Pad Y-axis data (finally!)

Extra notes
-----------

Peripherals, AI MyCard appear to be mapped at $8xxxx and $A0000-$BFFFF

The AI ROM checks for signature bytes $55,$AA at $8FFD2; failing that, $AFFD2.
If found, it calls the far pointer at ($8FFF8) or ($AFFF8).

Later on, the AI ROM checks for signature bytes $55,$AA at $80002, $A0002.
It would appear that the peripherals/cards have two entry points?

The Sound Box appears to identify itself at $80000.  It has $55,$AA pointers
both at $80002 and $8FFD2.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Sat Jan 31, 2015 3:45 pm
Here's a WAV file of 3 data bursts from one of the tapes, if anybody wants to try to decode the modulating format:

http://www.chrismcovell.com/data/AItape.zip
AItape.zip (213.19 KB)

  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 19 Oct 1999
  • Posts: 14723
  • Location: London
Reply with quote
Post Posted: Sat Jan 31, 2015 5:29 pm
Did you compare to the Sega Basic encoding?
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Post Posted: Sat Jan 31, 2015 7:05 pm
$0C:
----
   - $9F,$BF,$DF,$FF written to at BIOS startup

That's SN76489-series sequence for "reset all 4 channels volumes".
  View user's profile Send private message Visit poster's website
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Sun Feb 01, 2015 7:57 am
hi, sorry for the late show up but it's been an hell of a week at job
anyway, in attachment you can find a very barebone MESS driver for this system to help starting some debug

I have just mapped CPU ROMs and given some RAM in the 0x00000-0x1ffff range: this allows the CPU to start running code

I've also mapped the SN76489 at 0x0c of the IO address map, but I still have to figure out whether the V9938 is mapped at 0x00-0x03 or 0x04-0x07 (or both, since accesses could be masked out)

I'm not very familiar with the NEC CPUs, so it's a bit of a steep learning curve, but I'll try to do my best to help with the MESS side

instruction to test the code:
1. download MAME/MESS source from this link (main mamedev.org website is down today :( )

http://emumovies.com/aarongiles/releases/mame0158s.zip

and unzip it in a folder of your choice

2. unzip the attachment here and put segaai.c source into src/mess/drivers/

3. apply the segaai.diff patch

at this stage you have two compiling options:

 make TARGET=mess SUBTARGET=tiny


and

 make TARGET=mess


The former produces a "messtiny" executable which only supports Sega AI system. The latter compiles the whole tree and gives an executable supporting all systems emulated by MESS. The advantage of the former is that it takes less time to compile :)

Once you have built the executable of your choice, you shall rename the bios zipfile to "segaai.zip" and put it in a roms/ folder. Then, you can start emulation+debugger by typing
mess segaai -debug

at command line

You can also try to mount the cards by launching
mess segaai -debug -cart /absolute/path/to/the/carts/my_game.aic

but at the moment there is no visible result

Let me know if you need any further help with MESS compiling/launching :)
segaai.zip (3.51 KB)

  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Mon Feb 02, 2015 1:04 am
Does anybody have a precompiled binary to offer?

Also, I'd recommend compiling/running the MESS AI driver without the Sound Box ROM being automatically mapped, as it could be responsible for the main BIOS hanging (no FM hardware/interface mapped yet!).
  View user's profile Send private message Visit poster's website
  • Joined: 31 Jan 2015
  • Posts: 3
Reply with quote
Post Posted: Mon Feb 02, 2015 2:15 am
Here is my precompiled version.

I looked at that stuff a bit, looks like the bios dies waiting for memory at 251A to have a bit cleared (around E000:D67C).
I have been looking for code that's trying to do that, and the interrupt code at E000:D9D7 tries to do something of the sort, but it doesn't fully addup yet.
messtiny.zip (2.03 MB)

  View user's profile Send private message
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Mon Feb 02, 2015 6:28 am
ccovell wrote
Does anybody have a precompiled binary to offer?

Also, I'd recommend compiling/running the MESS AI driver without the Sound Box ROM being automatically mapped, as it could be responsible for the main BIOS hanging (no FM hardware/interface mapped yet!).


I'm on an old macosx machine, so I cannot offer binaries, sorry (and thanks yaz0r for filling this gap)
the soundbox ROM is loaded but not mapped anywhere, so at the moment it cannot affect in any way emulation
  View user's profile Send private message
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Mon Feb 02, 2015 7:11 am
by comparing the code with some other drivers using the same VDP, it seems that the chip might be awaiting for an interrupt any other scanline (but I've asked judge for confirmation that I've hooked up the chip correctly, which might not be the case).

adding this, it leads the bios to check the 0x55 0xAA signature and hang around the routines at 0xEB354

you can see the new code in attachment (I have also added the soundbox mapping at 0x80000, but it is commented out currently... feel free to uncomment it, if you want to see what happens in this case)

I have to go to work now, so I won't be able to do much until tonight.

EDIT: mmm... there might be something wrong going on, though: the signature is checked at ffd2 instead of 0002, because ix = ffd0 when the routine starts... I definitely need to contact someone with more experience with this NEC CPU

EDIT2: judge pointed out that I was not handling correctly the CPU IRQ... I have replaced the attachment with a slightly better one (the CPU seems to go wrong in a different way now ;) )
segaai.c (6.52 KB)

  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Mon Feb 02, 2015 1:49 pm
Yes, thanks Yaz0r, and sorry for the request, but could someone provide updated MESS (Win, whatever?) binaries as this evolves?

Simply compiling unofficial MESS on a fresh computer turns into a fool's errand... install an SVN that lords over your folders... get mingw, patch the source... oops, download DX libraries... oops the later versions of MAME need more than that, please ask on IRC for newest info, etc. <--webpage actually says this. All this for a binary executable that someone here more than likely has compiled as well.
  View user's profile Send private message Visit poster's website
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Mon Feb 02, 2015 2:44 pm
you just need the 0.158 source I linked above, and the official tools from http://www.mamedev.org/tools/

then you uncompress both the source and the tool, and you apply the diff I posted above

then you are ready to build the emulator. no git setup is needed (especially because Bock has asked to keep temporarily private the driver, so you would not find the segaai source in the repo)
  View user's profile Send private message
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Mon Feb 02, 2015 2:58 pm
in the meanwhile, by returning the proper value at IRQ (kudos to judge) and by treating IO 0x04/0x07 as some sort of RW regs, we get a much more stable execution, up to the point of a long series of 0x0A writes to IO 0x17...
segaai.c (6.86 KB)

  View user's profile Send private message
  • Joined: 31 Jan 2015
  • Posts: 3
Reply with quote
Post Posted: Mon Feb 02, 2015 5:37 pm
ccovell wrote
Yes, thanks Yaz0r, and sorry for the request, but could someone provide updated MESS (Win, whatever?) binaries as this evolves?


I can try to do that yeah, but I'm on pst timezone, so probably out of sync with you guys. I will make a build of what's available when I get home tonight.
  View user's profile Send private message
  • Joined: 31 Jan 2015
  • Posts: 3
Reply with quote
Post Posted: Mon Feb 02, 2015 11:46 pm
Btw, what happens when the hardware is booted without a card? Is there a startup screen of some kind?
  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Tue Feb 03, 2015 12:56 am
Yes, without a card, it draws the logo screen seen at the top of this thread. It draws the screen from the top, scanline-by-scanline, "waits" for a second, then if no card is inserted, it shows a message in Japanese at the bottom asking the user to insert a card, while the lines on the grid scroll forward in a simple animation.
  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Tue Feb 03, 2015 2:38 pm
etabeta wrote
EDIT: mmm... there might be something wrong going on, though: the signature is checked at ffd2 instead of 0002, because ix = ffd0 when the routine starts... I definitely need to contact someone with more experience with this NEC CPU


Something seems very wrong. Perhaps it's a programmer's bug? Or disassembler's bug?

Right before the cart check, the code sets IY=0, but then IX is what gets checked. Perhaps the original programmers meant to make it IX=0?

Later on in the code (which the emu hasn't gotten to yet) it checks both $80000 and $A0000 memory regions again, this time with IX=0 properly. Hmmm...

Edit: the Sound Box has the $55AA signature at both $0002 and FFD2, so maybe this is a feature... a weird one.

Edit 2: Okay, I've written a small program to an EEPROM that I've put in the Sound Box. Since the V20 jumps to ($8FFF8) located in the sound box right after it clears RAM, it's a useful place to test out code. My code writes to port $0C right now, and I can hear the SN sound chip do its thing and observe the chip's data lines. From here I guess I'll try to use one of the SN data lines as an RS-232 output...?
  View user's profile Send private message Visit poster's website
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Wed Feb 04, 2015 2:03 pm
sorry, I'm super busy at work and had no time for emulation.
however, the checks at 0xffd0 were due to a missing IRQ ack in the driver. the latest source pass beyond that point (even if I don't remember whether it checks both locations or only 0x0002)

also, judge commented that probably 0x04-0x07 could be related to the i8255 (maybe keyboard inputs?)
I hope to have some more spare time in the next few days
  View user's profile Send private message
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Wed Feb 04, 2015 8:47 pm
It looks like the 8255 is hooked up at I/O ports 0x04-0x07.
I can see it setting the control register to put port A and port B into input mode combined with reads from I/O ports 0x04 and 0x05 (port A and B).

After reading I/O port 0x05 bits 4 and 5 are checked a lot; I have no idea what these bits mean yet.

There seems to be some correlation between writes to I/O port 0x17 and reads from I/O port 0x05, at this point this could also just be a coincidence.

There is also the possibility that the 8251 is used for serial communication with the keyboard. Did you check if there's some kind of microcontroller in the keyboard?
  View user's profile Send private message
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Wed Feb 04, 2015 9:25 pm
By the way, X3 is almost certainly a 640kHz clock. This is a standard input clock for a uPD7759, which is right next to it.

The soundbox 8255 is at I/O ports 0x28-0x2B Port A is set to input, Port B and C are set output. Port C seems to select the music keyboard row and Port A is read for pressed keys.

The soundbox 8253 is at I/O ports 0x24-0x27.

That leaves I/O ports 0x20-0x21 for the YM2151 on the soundbox
  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Thu Feb 05, 2015 1:49 am
Unfortunately, the auctions for the AI computer, software didn't include the keyboard unit, so we don't have one.

Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.
  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Thu Feb 05, 2015 3:50 am
ccovell wrote

Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.


The 7759 doesn't have any built in memory and interfaces to 128K of external ROM. From the PCB picture it looks like it is wired up to MPR-7919 and MPR-7920.

However for a computer I would imagine some of that address space is also mapped to RAM so software can provide their own samples somehow. But if not, then the sample set is strictly limited to what's in the ROM.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Links
Post Posted: Thu Feb 05, 2015 7:46 am
1. For a list of the keys - Attached a picture of the Keyboard from
https://www.flickr.com/photos/tomconte/5992707827/

The Computer History Museum in California appears to have a Sega AI with the Keyboard. It's not impossible to get access to it but I'd imagine it would take a while. I'll see how to contact them just in case, to see if they have software.

2. The guy from AssemblerGames at some point got hold of a prototype. I don't know where it went. (three pages articles)

https://web.archive.org/web/20081204130344/http://assembler.roarvgm.com/ai_8300....

3. This website has the flyers in Japanese
http://park21.wakwak.com/~suka/sega/catalog/AIcom/AI.html
Not sure there's anything of technical use there. Interesting that the software packaging appears different than the "final" packaging.

4. An article in Famitsu I found while scouting the Japanese web
17969407_22.jpg (48.23 KB)
17969407_22.jpg

  View user's profile Send private message Visit poster's website
  • Joined: 28 Sep 1999
  • Posts: 1197
Reply with quote
Post Posted: Thu Feb 05, 2015 3:54 pm
Bock wrote
The Computer History Museum in California appears to have a Sega AI with the Keyboard. It's not impossible to get access to it but I'd imagine it would take a while. I'll see how to contact them just in case, to see if they have software.


One of the curators (Al Kossow) is a MAME contributor and is very friendly so I'm sure he'd be willing to help you. If you need me to do anything in person, I've been there before on some MAME related business as well.
  View user's profile Send private message Visit poster's website
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Thu Feb 05, 2015 4:07 pm
ccovell wrote
Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.


At which I/O port did you find the 7759?
  View user's profile Send private message
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Post Posted: Thu Feb 05, 2015 4:33 pm
Charles MacDonald wrote
One of the curators (Al Kossow) is a MAME contributor and is very friendly so I'm sure he'd be willing to help you. If you need me to do anything in person, I've been there before on some MAME related business as well.


Well realistically I am not being helpful with the reverse engineering and likely won't have time to do so in the upcoming month. But if someone here think there's a legit reason to open the keyboard we can ask for that. I am more interested in asking if they have any documentation and/or software. The earlier if we could get access to and scan it would be great. Maybe you could query Al Kossow if he can get access to their inventory and ask for exact Sega AI stuff they have?
  View user's profile Send private message Visit poster's website
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Thu Feb 05, 2015 9:46 pm
After playing with IRQs a bit more and fixing a small bug in the IRQ handling in MAME's NEC cpu core...

EDIT: It's not really a bug in the NEC cpu core. The V20 IRQs are level triggered; so there is a bit more magic inside the AI going on.

EDIT2: Attached updated code.

I don't see a message appearing about inserting a cartridge only a big black bar at the bottom of the screen. This is accompanied with a lot of reads from Cxxxx. Perhaps this is where some character rom should be mapped (MPR-7689?).
segaai_boot.png (6.41 KB)
segaai_boot.png
segaai.zip (4.11 KB)
Updated WIP driver

  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Fri Feb 06, 2015 2:13 am
OK, I'll see what I can get at Cxxxx.

In the meantime, good job getting the screen up and running!

With the Sound Box attached, I connected the output line of the Sound Box's keyboard pins to one or more input pins, and it suddenly played an FM instrument and printed "piano" on the screen! From this, pressing U/D on the pad cycled through the various instruments, and the PL/PR buttons lowered and raised the volume.

So yeah, good call on the keyboard scanning/mapping.
aiscr_10.jpg (80.45 KB)
aiscr_10.jpg
aiscr_11.jpg (67.26 KB)
aiscr_11.jpg

  View user's profile Send private message Visit poster's website
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Fri Feb 06, 2015 6:01 am
OK, I've updated the tech info on this page with your port IDs and other findings to date.

Also, yes, the MPR ROM is in fact a 128K Character ROM, with 16x16 1bpp Kanji, etc graphics! It gets mapped to C0000-DFFFF.

I've also made an RS-232 dumper program, so I've managed to dump the whole V20 address space. Attached are dumps with/without the "Eigo de Game 1" MyCard inserted. (Ignore 8xxxx space, as it's my dumping program in the Sound Box slot.)

Also, a correction: RAM is at segments 0,1, (not 0,2 as I can see in the C source).
0-F_dump.zip (403.84 KB)
MPR-7689.zip (68.27 KB)

  View user's profile Send private message Visit poster's website
  • Joined: 01 Jun 2010
  • Posts: 46
Reply with quote
Post Posted: Fri Feb 06, 2015 6:31 am
Cool! with the new chr rom, we indeed get the message attached, which has something to do with the soundbox, I guess, since it appears after the system has failed to retrieve the ROM signature at 0x80002

by mapping the soundbox ROM into the proper location (see attached source), emulation proceeds and it starts reading and writing a lot in the 0x3f*** and 0x4**** ranges

it's probably time to try getting some inputs into the system, which I'll try to do later today if they don't give me any new deadlines at work
0000.png (7.68 KB)
0000.png
segaai.c (10.04 KB)

  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Fri Feb 06, 2015 8:39 am
Last edited by ccovell on Fri Feb 06, 2015 2:59 pm; edited 3 times in total
Speaking of inputs, here is a port read map:


  | 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
--+------------------------------------------------
00| FF 9F FF FF 7F 7F F0 FF 00 00 .. XX XX XX .. ..
10| .. .. .. .. FF FF 00 .. .. .. .. .. .. .. 00 ..
20| .. 00 .. 00 00 FF FF .. 00 00 00 FF .. .. .. ..
30| .. 00 .. 00 00 FF FF .. 00 00 00 FF .. .. .. ..
40| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
50| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
60| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
70| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
80| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
90| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
A0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
B0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
C0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
D0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
E0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
F0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..


The dots all show up as "$EB", which I assume to be open bus.

Port 0's data toggles randomly (?) between $00 and $FF; Port 1's between $1F and $9F.

Reading ports $B, $C, $D all causes the CPU to freeze or something similarly bad.

Ports $4, $5 are for the buttons, etc on the AI:
4: M?rl-RLDU, 5: ??TW-g??B

r: "PR" trigger
l: "PL" trigger
RLDU: pad direction
B: grey trigger Button near touch panel
T: cassette Tape insertion sensor
W: cassette Write enable sensor
M: Microphone sensor (1 = sound detected)
g: keyboard pin 3 (see below)

A 0 bit means button is pressed, 1 means released.

JIS Keyboard Ports:
6: ikfe-????, 7: j???-????

efghijk: Keyboard connector pinouts (1-5,8)
(Connector pin 5 seems to map to i/j in ports 6/7 simultaneously(?)

Edited with more port bits.
  View user's profile Send private message Visit poster's website
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Fri Feb 06, 2015 9:26 am
ccovell wrote
Ports $4, $5 are for the buttons, etc on the AI:
4: ??rl-RLDU, 5: ??T?-???B

r: "PR" trigger
l: "PL" trigger
RLDU: pad direction
B: grey trigger Button near touch panel
T: cassette Tape insertion sensor

A 0 bit means button is pressed, 1 means released.

That's all I have for now!


Nice, I saw the BIOS checking those r, l, and T bits of these I/O ports quite a lot. This explains some things.

Also looking at the I/O port read map, the 0x20-0x2F I/O ports of the soundbox are mirrored at 0x30-0x3F.
  View user's profile Send private message
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Fri Feb 06, 2015 7:15 pm
ccovell wrote

JIS Keyboard Ports:
6: ikfe-????, 7: j???-????


I/O port 6 is the 8255's Port C that is in both input & output mode. The top 4 bits are input, the low 4 bits are used as outputs.
  View user's profile Send private message
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Fri Feb 06, 2015 7:24 pm
Bock wrote
Dumped by itoh-san (filenames in Japanese)
The cards uses the same pinout as Sega My Cards

*EDIT* added the same files with names transcribed to English.


I noticed the following dumps are missing the signature bytes:
- Alice world
- Andersen Dream
- Cinderella Labyrinth
- Columbus Map
- Gulliver Pocket
- Mozart Academy
- Robinson Land
- Runrun Music
- Tantan Rhythm

Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?
  View user's profile Send private message
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Fri Feb 06, 2015 10:07 pm
It looks like the 8251 can be found at I/O ports 0x08-0x09.
Any bytes sent would trigger an IRQ at vector 0xf9, and bytes received would trigger an IRQ at vector 0xfa.
  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Fri Feb 06, 2015 11:59 pm
jdg wrote
I noticed the following dumps are missing the signature bytes:
- Alice world
- Andersen Dream
- Cinderella Labyrinth
- Columbus Map
- Gulliver Pocket
- Mozart Academy
- Robinson Land
- Runrun Music
- Tantan Rhythm

Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?

They might not be absolutely necessary for a game to start up. For example, I made my code jump to the $A0028 vector in a couple cards, and they didn't start up (might even be some kind of test routine.) Have you seen anywhere in the AI BIOS where it jumps to the cartridge area in a different way?
  View user's profile Send private message Visit poster's website
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Sat Feb 07, 2015 12:36 am
ccovell wrote
jdg wrote
I noticed the following dumps are missing the signature bytes:
- Alice world
- Andersen Dream
- Cinderella Labyrinth
- Columbus Map
- Gulliver Pocket
- Mozart Academy
- Robinson Land
- Runrun Music
- Tantan Rhythm

Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?

They might not be absolutely necessary for a game to start up. For example, I made my code jump to the $A0028 vector in a couple cards, and they didn't start up (might even be some kind of test routine.) Have you seen anywhere in the AI BIOS where it jumps to the cartridge area in a different way?


Not yet; it could be that the ones with a signature have 'real code' in them whereas other types of carts have some kind of interpreted (prolog) code in them or something. Currently in the emulated code in mess, none of the carts boot properly yet; I'm still investigating why. It's a nice puzzle :)
  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Sat Feb 07, 2015 3:06 am
etabeta, if you make an updated ai driver, can you tell us or provide links to MESS 8255 and 8253 c drivers? The latest source you provided failed to compile for me because these were not found or erroneously called or something.
  View user's profile Send private message Visit poster's website
  • Site Admin
  • Joined: 08 Jul 2001
  • Posts: 8648
  • Location: Paris, France
Reply with quote
Post Posted: Sat Feb 07, 2015 11:26 am
Would you rather work on a private fork of MAME/MESS ? (I have a paid github account for private forking). It looks like emulation may happen soon, in which case I think it would make sense to keep the data private until it is mostly figured out. If we had released the earlier dumps without the Character ROM it would have been a bit of a non-event.
  View user's profile Send private message Visit poster's website
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Sat Feb 07, 2015 12:46 pm
We also need to find a way to get dumps of the other 2 MPR chips (the 2 attached to the 7759).

I think in the zip that etabeta originally posted, the 8253 and 8255 need to be enabled in the tiny.mak file to make it compile.
  View user's profile Send private message
  • Joined: 26 Dec 2004
  • Posts: 374
  • Location: Japan
Reply with quote
Post Posted: Sat Feb 07, 2015 3:05 pm
I programmed up an I/O port writing program, so I'm testing some stuff out:

$0B:   ??? (Sound, Speech chip reset line?)
----
   - $01,$00 written to at startup

$0C/$0D: SN76489AN PSG chip
--------
   - $9F,$BF,$DF,$FF written to at BIOS startup

$14/$15: PD7759C Speech Synth command port
--------

$16:   ???
----
   - Writing a 1 to bit 5 causes a CPU crash
   - Writing a 1 to bit 4 causes an audible "pop"
  View user's profile Send private message Visit poster's website
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Sat Feb 07, 2015 3:45 pm
ccovell wrote
etabeta, if you make an updated ai driver, can you tell us or provide links to MESS 8255 and 8253 c drivers? The latest source you provided failed to compile for me because these were not found or erroneously called or something.


This should fix it with a slightly different approach which requires no changes to checked out/downloaded mame/mess code.

segaai.zip contains 3 files: src/mess/drivers/segaai.c, src/mess/segaai.mak, and src/mess/segaai.lst

Just place the files in a copy of the mame/mess source code and compile with something like:
make TARGET=mess SUBTARGET=segaai

to build a variant of MESS with only the sega ai driver. This builds pretty quickly.

BTW, to focus on the main unit I have disabled the soundbox in the sega ai driver file.
segaai.zip (6.5 KB)
MESS/MAME code overlay

  View user's profile Send private message
  • Joined: 13 Mar 2007
  • Posts: 51
  • Location: Portugal
Reply with quote
Post Posted: Sun Feb 08, 2015 8:49 am
ccovell wrote

Mapper Hardware?
----------------
Ocean Fantasy writes $80,$00,$01,$02 to $AFFFC-F


I am starting to suspect that there might be some mapper involved here as well.

Also in Eigo de Game 1 it writes $00 to $AFFFC and $AFFFD.
Then it writes $08 to $AFFFF, copies $4000 bytes from $A4000 to RAM, writes $09 to $AFFFF, copies $4000 bytes again, writes $0A to $AFFFF, copes $4000 bytes, writes $0B to $AFFFF, and copes another $4000 bytes.
After this sequence it seems to expect 64k of data to be available in ram at $1xxxx.

Perhaps this might also explain why some of the dumps look odd...

The banking might not be the same in all games:
Eigo de Game 2 writes bank numbers for $AFFFF and reads back contents from $A8000-$ABFFF.
  View user's profile Send private message
Reply to topic Goto page 1, 2, 3, 4  Next



Back to the top of this page

Back to SMS Power!