Forums

.....

Also see the public thread
http://www.smspower.org/forums/15004-SegaAIComputerSoftware

Dumped by itoh-san (filenames in Japanese)
The cards uses the same pinout as Sega My Cards

*EDIT* added the same files with names transcribed to English.

*EDIT* those dumps are incomplete. See discussion.

Sega_AI_Games.zip (392.69 KB)

Sega_AI_Games (English names).rar (371.26 KB)

Dumped by Chris Covell

Here are the dumped ROMs from the AI and the Sound Box.

Sega_AI_BIOS_ROMs.zip (98.81 KB)

Here's an early tech data dump:

The MyCard pinout is identical to regular SMS MyCards, apparently.

We listened to one tape. Each audio clip has a modulated data burst before it, presumably for the CPU/tape to identify the clip.

The E000/F000 ROMs we dumped have JIS-encoded text, the E000 has Romaji-Hiragana transcription strings, and an internal date of 7/19/86; the F000 ROM has (Prolog?) error strings, cartridge insertion error messages, and Hiragana-Kanji conversion strings.

The Sound Pack ROM has instrument strings, etc. of course. Also, it has this text:

Quote

Programed by SHUN ARAI.Produced by YASUHIGE KOBAYASHI.Special Thanks KAMIYA STUDIO & PHILOS
...
R&D No.6SOUND BOARD V1.187/08/12 SEGA

The system indeed (?) has 128K main RAM, 64K VRAM, making it almost MSX-compatible. According to the promotional materials on the SMSPower page, the video portion "satisfies MSX2" so maybe all that is missing to make the AI an MSX computer is the BIOS & BASIC software on ROMs?

I tried out a sampling of the software with the Sound Board, and many of them produced FM music instead of simple PSG without the board. All FM is mixed in with everything else, including the PSG, which is still used for rhythm hits; the speech chip, which is used in "Popo's Adventure" ("take a big hamburger" it says, eg.); and the sound from the cassette, which is mostly narration and hints.

So far, the "Folk & Fairy Tales" (w/ Cassette), "Popo's Adventure" (w/ Cass.), and the 3 music programs "Runrun Music", "Tantan Rhythm", and "Ranran Melody" have FM music with the sound board connected. The other set of 9 "Wonder School" packages have PSG music only.

I've noticed that the quality of art & music is a bit higher in the software of the two packages with cassettes. Possibly they used different software developers and/or educational companies (Linguaphone in this case.)

The games/stories with the cassette are rather fun to play, with voice clips streamed from tape, and sometimes spoken by the speech synthesizer... but clearly this computer was screaming out for random access media for sound, like CD or solid-state ROMs. The tape sometimes seeks back and forth for 5-15 seconds for the right voice clip, while the game and player (kids) wait. :-)

I've attached some RGB screengrabs that I took. Hopefully emulation of the AI will come sometime for better screenshots... speaking of which, anyone know of a modern V20 disassembler program?

Sega AI Computer quick PCB overview

Major ICs

IC 1 D701080-5    (86/09?) NEC V20 CPU    DIP40
IC 2 315-5200    (86/25) SEGA       QFP100
IC 3 27C512-25    (86/15) 64K EPROM "E000 8/24"
IC 4 27C512-25    (86/06) 64K EPROM "F000 7/21"
IC 5 MPR-7689    (86/22) SEGA "264 AA E79" 128K CHR ROM DIP28
IC 10 V9938          Yamaha MSX2 VDP
IC 13 D7759C       (86/12) NEC Speech Synthesizer DIP40
IC 14 MPR-7619    (86/23) SEGA ROM for D7759C DIP28
IC 15 MPR-7620    (86/23) SEGA ROM for D7759C DIP28
IC 16 SN76489AN       TI PSG       DIP16
IC 17 D8251AFC    (86/09) NEC Communications Interface DIP28
IC 18 315-5201    (86/25) SEGA (bodge wire on pins 9,10) DIP20
IC 19 M5204A       (87?/01) OKI
IC 20 D8255AC-2    (86/08) NEC Peripheral Interface DIP40

IC 6,7,8,9,11,12 D41464C-12 NEC 32K DRAMs - 128K RAM, 64K VRAM

Crystals, etc

X1 20.000          "KDS 6D"
X2 21.47727       "KDS"
X3 ?          "CSB 640 P"

Connectors

CN1 6-pin DIN Power connector
CN2 8-pin DIN "AUX" connector
CN3 Video phono jack
CN4 Audio phono jack
CN5 35-pin Sega MyCard connector
CN6 60-pin expansion connector A1..A30 Bottom, B1..B30 Top
CN7 9-pin header connector to "Joy, Button, LED" unit
CN8 13(?) pin flat flex connector to pressure pad
CN9 9-pin header connector to tape drive motor, etc.
CN10 13-pin header connector to tape heads
JP2 2-wire header to SW2 button board
PJ1 7-wire header to Keyboard / Mic connector board
MIC 2-wire header to mic on KB/Mic board
SW1 Reset Switch

Power switch is on the AC Adaptor

Joypad unit (by Mitsumi) has U/D/L/R, "PL" and "PR" buttons, and a power LED.

Power Connector Pinout (Seen from AC Adaptor plug):
1 5 1 12V COM 5 5V COM
6 2 12V OUT 6 5V OUT
2 4 3 5V COM
3 4 5V OUT

AUX Connector Pinout:
7 6 1 to +5V via 990 Ohm R 5 csync
3 8 1 2 GND       6 green
5 4 3 blue    7 Audio out
2 4 to +5V via 120 Ohm R 8 red

New JIS Keyboard Connector Pinout:
1 2 1,2,3 data lines
3 4 5 4 ?? 5,8 data lines
6 7 8 6 GND 7 +5V

AI Sound Box, Model "AI-2002"

ICs on board:

IC 2    TMP82C53F-2 (91/09) Toshiba (Peripheral Timer?)
IC 3    HN27512G-25 (87/12) Hitachi 64K EPROM
IC 6    YM2151    (91/10) Yamaha FM chip
IC 7    TMP82C55AF-10 (88/15) Toshiba (Peripheral Interface?)
IC 8    YM3012    (91/10) Yamaha Stereo DAC
IC 9    HA17358       Hitachi Dual Op-Amp
IC 10    LC7537N       Sanyo (Volume Control IC)
IC 11    C324C    (90/42) NEC Quad Op-Amp
IC 12    LA4520       (Sanyo Power Audio Amp?)
IC 16-19 MB81464-12 (91/12) Fujitsu 32K DRAMs

Misc Flat DIPs

IC ??    LS125A       Hitachi Line Driver
IC ??    HC04       TI Inverter
IC ??    74HC157A x2    Toshiba
IC ??    HC138       TI
IC ??    HC139       TI

TMP82C55AF-10 Peripheral Interface pinout (incomplete)

33 23
_|_______|_
34--| T |--22
|TMP82C55 |
| |
44--| |--12
\_________|
| |
1 11

1 - 12 - 23 - B.7 34 -
2 - GND 13 - C.3 24 - +5V 35 - A.7
3 - Address 1 14 - B.0 25 - D7 36 - A.6
4 - Address 0 15 - B.1 26 - D6 37 - A.5
5 - Port C bit 7 16 - B.2 27 - D5 38 - A.4
6 - " C.6 17 - 28 - D4 39 -
7 - C.5 18 - B.3 29 - D3 40 - A.3
8 - C.4 19 - B.4 30 - D2 41 - A.2
9 - C.0 20 - B.5 31 - D1 42 - A.1
10 - C.1 21 - B.6 32 - D0 43 - A.0
11 - C.2 22 - 33 - 44 -

Port B on the sound box's 82C55 is connected to the LC7537N volume control IC.
B.0 connects to pin 20 (DI); B.1 to pin 21 (CLK); and B.2 to pin 22 (CE).
B.7 connects to an output enable for pin 18 of the TMP82C53F peripheral timer.

CN2 "Music Keyboard" connector:
UL..........................UR
1 2 3 4 5 6 7 8 9 10
11 12 13 14 15 16 17 18 19 20

1,2,11,12 - GND

6 - Port A bit 6
7 - Port A bit 4
8 - Port A bit 2
9 - Port A bit 0
16 - Port A bit 7
17 - Port A bit 5
18 - Port A bit 3
19 - Port A bit 1

3 - Port C bit 2
4 - Port C bit 4
5 - Port C bit 6
10 - Port C bit 7
13 - Port C bit 1
14 - Port C bit 3
15 - Port C bit 5
20 - Port C bit 0

AI_Capture01.png (149.3 KB)

AI Computer Bootup

AI_Capture02.png (228.69 KB)

in-game example

Chris has uploaded a bunch of pictures here
http://www.chrismcovell.com/data/AI_Photos.zip

As I understand pictures 01 to 10 are of the Sound Box.
Pictures 11 to 45 are of the Sega AI main unit. We might need more detailed pictures of the main board?

I have added the following people to this thread

Chris Covell
Charles MacDonald
Kale (MESS/MAME)
Etabeta (MESS/MAME)
jdg (MESS/MAME)
Paul Baker
Maxim
yaz0r

I had done some work on a V30 system and used nasm and ndisasm as I wasn't using the NEC specific extra opcodes added to the x86 instruction set. You can use "unidasm" which comes with MAME that supports the V20 directly, and I believe it supports the extra opcodes.

So the E000 program has a date of 7/19/86 (86 week ~29)
The main computer hardware has chips dated up to 86 week 25 (or 87 week 1 depending on what's on that OKI chip)

Sound Box program has a date of 87/08/12.
Sound Box hardware has chips up to 91/12 !
That is particularly odd - a span of 5 years!

I have another Sound Box which I could inspect so see if the dates matches, but it is tucked away in storage, I will try to get it next week as I am travelling to Paris.

I have a lead on friend-of-a-friend who have worked on the Sega AI in Japan. We could ask her questions on this type of stuff (dates, software, what was the plan etc.)

Okay, so I haven't touched or looked at x86 assembly in 19 years... :-/

The F000 ROM appears to be segment F000:xxxx, and there is a proper jump instruction at FFFF:00 ($FFF0 in the EPROM.) which jumps to a "reset" routine at $1000 in the "F000" ROM. Anybody who is interested can start disassembly from there.

After a little peeking and prodding:

Sega AI V20 Memory Space by Segment
-----------------------------------
0: RAM (Stack set to $443E here on startup)
1: RAM
2: Sound Box DRAM
3: Sound Box DRAM
4: (open bus)
5: "
6: "
7: "
-
8: Expansion Bus (eg: Sound Box)
9: (open bus)
A: MyCard Cartridge space (and mapper regs)
B: MyCard Cartridge space (or mirror of $Axxxx for mappered games)
-
C: Character ROM low 64k
D: Character ROM high 64k
E: BIOS ROM "E000"
F: BIOS ROM "F000"

Some MyCard games have mapper hardware, in which case they have a fixed 16K bank at
$A0000-$A3FFF, with two more selectable bank spaces at $A4000-A7FFF and $A8000-$ABFFF.
These selectable banks are chosen by writing the bank number to $AFFFE-F.
Mappered games have open bus at $AC000-$AFFFF, and the $Bxxxx area is a mirror of $Axxxx.

For example, Ocean Fantasy writes $80,$00,$01,$02 to $AFFFC-F.

Most earlier AI MyCards have no mapper, and have a flat 128K ROM spanning $A0000-$BFFFF.

Ports
-----

Writing:

$00-03: V9938 VDP ports 0-3
-------
$04-07: D8255AC peripheral ports
-------
$0B: Bit 0 is the speech chip Standalone / Slave (/MD) line...?
----
- $01,$00 written to port $0B at BIOS startup

$0C/$0D: SN76489AN PSG chip
--------
- $9F,$BF,$DF,$FF written to port $0C at BIOS startup

$14/$15: PD7759C Speech Synth command port
--------
- In Standalone mode, a preset word is chosen through this port.
- In Slave mode, ADPCM data are streamed to this port by the CPU.

$16: ???
----
- Writing a 1 to bit 5 causes a CPU crash
- Writing a 1 to bit 4 causes an audible "pop"

$17: Speech Synth address/data/mem mapper?
----
- "Eigo de Game" 2 writes 0,2,4,7,$d,$e to this port, then
   enables interrupts. An interrupt-driven routine then writes
   $01 to port $B, then ADPCM data to port $14, then $00 to $B again.

$1C-$1E: Touch Pad reset/latch ports
--------

$20-21: Sound Box's YM2151 FM ports
-------
$24-27: Sound Box's TMP82C53F timer ports
-------
$28-2B: Sound Box's TMP82C55AF peripheral ports
-------
- Port B bits 0,1,2 are connected to the Sanyo Volume Control IC's
   "DI", "CLK", and "CE" input pins, respectively.

- Port B bit 7 controls an "output enable" line for the TMP82C53F
   timer device pin 18, whatever that is.

Reading:

$04: Joypad & Buttons
----
MVrl-RLDU

$05: Button & Tape Sensor
----
CHTW-gYPB

r: "PR" trigger (named "Point Right" in manual)
l: "PL" trigger ("Point Left")
RLDU: pad direction
B: grey trigger Button near touch panel/pad (named "Touch Button")
--
P: touch-sensitive Pad is being pressed
Y: touch-sensitive pad coordinate data are readY
--
C: CN9 pin 8
H: cassette Head engaged sensor
T: cassette Tape insertion sensor
W: cassette Write enable sensor
M: Microphone sensor (1 = sound detected)
V: Voice chip (PD7759C) /BUSY line: 0 when this chip is streaming a sample.
g: keyboard pin 3 (see below)
--

A 0 bit means button/pad/panel is pressed, 1 means released.

$06: JIS Keyboard Lines
----
ikfe-????

$07: j???-????
----

efghijk: Keyboard connector pinouts (1-5,8)
(Connector pin 5 seems to map to i/j in ports 6/7 simultaneously(?)

$16: Speech Synth ???? line?
----

$1E: Touch Pad X/Y data (after reset/latched)
----
- "Mozart Academy", for example, reads the pad with this sequence:
   0->Port $1C, 1->Port $1D, load CW (alias CX) register with $0108, do delay loop.
   Read Port $5 bit 1 to see if pad pressed. If not, exit. If so:
   0->Port $1D,$1C,$1E in that order, load CW with $0061 to delay.
   Read Port $5 bit 2 to see if X data is ready. If not, exit. If so:
   Read Port $1E for Touch Pad X-axis data (& store it somewhere.)
   1->Port $1C, load CW with $0014 to delay. 0->Port $1E, load CW with $0061 to delay.
   Read Port $5 bit 2 to see if Y data is ready. If not, exit. If so:
   Read Port $1E for Touch Pad Y-axis data (finally!)

Extra notes
-----------

Peripherals, AI MyCard appear to be mapped at $8xxxx and $A0000-$BFFFF

The AI ROM checks for signature bytes $55,$AA at $8FFD2; failing that, $AFFD2.
If found, it calls the far pointer at ($8FFF8) or ($AFFF8).

Later on, the AI ROM checks for signature bytes $55,$AA at $80002, $A0002.
It would appear that the peripherals/cards have two entry points?

The Sound Box appears to identify itself at $80000. It has $55,$AA pointers
both at $80002 and $8FFD2.

Here's a WAV file of 3 data bursts from one of the tapes, if anybody wants to try to decode the modulating format:

http://www.chrismcovell.com/data/AItape.zip

AItape.zip (213.19 KB)

Did you compare to the Sega Basic encoding?

$0C:
----
- $9F,$BF,$DF,$FF written to at BIOS startup

That's SN76489-series sequence for "reset all 4 channels volumes".

hi, sorry for the late show up but it's been an hell of a week at job
anyway, in attachment you can find a very barebone MESS driver for this system to help starting some debug

I have just mapped CPU ROMs and given some RAM in the 0x00000-0x1ffff range: this allows the CPU to start running code

I've also mapped the SN76489 at 0x0c of the IO address map, but I still have to figure out whether the V9938 is mapped at 0x00-0x03 or 0x04-0x07 (or both, since accesses could be masked out)

I'm not very familiar with the NEC CPUs, so it's a bit of a steep learning curve, but I'll try to do my best to help with the MESS side

instruction to test the code:
1. download MAME/MESS source from this link (main mamedev.org website is down today :( )

http://emumovies.com/aarongiles/releases/mame0158s.zip

and unzip it in a folder of your choice

2. unzip the attachment here and put segaai.c source into src/mess/drivers/

3. apply the segaai.diff patch

at this stage you have two compiling options:

make TARGET=mess SUBTARGET=tiny

and

make TARGET=mess

The former produces a "messtiny" executable which only supports Sega AI system. The latter compiles the whole tree and gives an executable supporting all systems emulated by MESS. The advantage of the former is that it takes less time to compile :)

Once you have built the executable of your choice, you shall rename the bios zipfile to "segaai.zip" and put it in a roms/ folder. Then, you can start emulation+debugger by typing

mess segaai -debug

at command line

You can also try to mount the cards by launching

mess segaai -debug -cart /absolute/path/to/the/carts/my_game.aic

but at the moment there is no visible result

Let me know if you need any further help with MESS compiling/launching :)

segaai.zip (3.51 KB)

Does anybody have a precompiled binary to offer?

Also, I'd recommend compiling/running the MESS AI driver without the Sound Box ROM being automatically mapped, as it could be responsible for the main BIOS hanging (no FM hardware/interface mapped yet!).

Here is my precompiled version.

I looked at that stuff a bit, looks like the bios dies waiting for memory at 251A to have a bit cleared (around E000:D67C).
I have been looking for code that's trying to do that, and the interrupt code at E000:D9D7 tries to do something of the sort, but it doesn't fully addup yet.

messtiny.zip (2.03 MB)

ccovell wrote

Does anybody have a precompiled binary to offer?

Also, I'd recommend compiling/running the MESS AI driver without the Sound Box ROM being automatically mapped, as it could be responsible for the main BIOS hanging (no FM hardware/interface mapped yet!).

I'm on an old macosx machine, so I cannot offer binaries, sorry (and thanks yaz0r for filling this gap)
the soundbox ROM is loaded but not mapped anywhere, so at the moment it cannot affect in any way emulation

by comparing the code with some other drivers using the same VDP, it seems that the chip might be awaiting for an interrupt any other scanline (but I've asked judge for confirmation that I've hooked up the chip correctly, which might not be the case).

adding this, it leads the bios to check the 0x55 0xAA signature and hang around the routines at 0xEB354

you can see the new code in attachment (I have also added the soundbox mapping at 0x80000, but it is commented out currently... feel free to uncomment it, if you want to see what happens in this case)

I have to go to work now, so I won't be able to do much until tonight.

EDIT: mmm... there might be something wrong going on, though: the signature is checked at ffd2 instead of 0002, because ix = ffd0 when the routine starts... I definitely need to contact someone with more experience with this NEC CPU

EDIT2: judge pointed out that I was not handling correctly the CPU IRQ... I have replaced the attachment with a slightly better one (the CPU seems to go wrong in a different way now ;) )

segaai.c (6.52 KB)

Yes, thanks Yaz0r, and sorry for the request, but could someone provide updated MESS (Win, whatever?) binaries as this evolves?

Simply compiling unofficial MESS on a fresh computer turns into a fool's errand... install an SVN that lords over your folders... get mingw, patch the source... oops, download DX libraries... oops the later versions of MAME need more than that, please ask on IRC for newest info, etc. <--webpage actually says this. All this for a binary executable that someone here more than likely has compiled as well.

you just need the 0.158 source I linked above, and the official tools from http://www.mamedev.org/tools/

then you uncompress both the source and the tool, and you apply the diff I posted above

then you are ready to build the emulator. no git setup is needed (especially because Bock has asked to keep temporarily private the driver, so you would not find the segaai source in the repo)

in the meanwhile, by returning the proper value at IRQ (kudos to judge) and by treating IO 0x04/0x07 as some sort of RW regs, we get a much more stable execution, up to the point of a long series of 0x0A writes to IO 0x17...

segaai.c (6.86 KB)

ccovell wrote

Yes, thanks Yaz0r, and sorry for the request, but could someone provide updated MESS (Win, whatever?) binaries as this evolves?

I can try to do that yeah, but I'm on pst timezone, so probably out of sync with you guys. I will make a build of what's available when I get home tonight.

Btw, what happens when the hardware is booted without a card? Is there a startup screen of some kind?

Yes, without a card, it draws the logo screen seen at the top of this thread. It draws the screen from the top, scanline-by-scanline, "waits" for a second, then if no card is inserted, it shows a message in Japanese at the bottom asking the user to insert a card, while the lines on the grid scroll forward in a simple animation.

etabeta wrote

EDIT: mmm... there might be something wrong going on, though: the signature is checked at ffd2 instead of 0002, because ix = ffd0 when the routine starts... I definitely need to contact someone with more experience with this NEC CPU

Something seems very wrong. Perhaps it's a programmer's bug? Or disassembler's bug?

Right before the cart check, the code sets IY=0, but then IX is what gets checked. Perhaps the original programmers meant to make it IX=0?

Later on in the code (which the emu hasn't gotten to yet) it checks both $80000 and $A0000 memory regions again, this time with IX=0 properly. Hmmm...

Edit: the Sound Box has the $55AA signature at both $0002 and FFD2, so maybe this is a feature... a weird one.

Edit 2: Okay, I've written a small program to an EEPROM that I've put in the Sound Box. Since the V20 jumps to ($8FFF8) located in the sound box right after it clears RAM, it's a useful place to test out code. My code writes to port $0C right now, and I can hear the SN sound chip do its thing and observe the chip's data lines. From here I guess I'll try to use one of the SN data lines as an RS-232 output...?

sorry, I'm super busy at work and had no time for emulation.
however, the checks at 0xffd0 were due to a missing IRQ ack in the driver. the latest source pass beyond that point (even if I don't remember whether it checks both locations or only 0x0002)

also, judge commented that probably 0x04-0x07 could be related to the i8255 (maybe keyboard inputs?)
I hope to have some more spare time in the next few days

It looks like the 8255 is hooked up at I/O ports 0x04-0x07.
I can see it setting the control register to put port A and port B into input mode combined with reads from I/O ports 0x04 and 0x05 (port A and B).

After reading I/O port 0x05 bits 4 and 5 are checked a lot; I have no idea what these bits mean yet.

There seems to be some correlation between writes to I/O port 0x17 and reads from I/O port 0x05, at this point this could also just be a coincidence.

There is also the possibility that the 8251 is used for serial communication with the keyboard. Did you check if there's some kind of microcontroller in the keyboard?

By the way, X3 is almost certainly a 640kHz clock. This is a standard input clock for a uPD7759, which is right next to it.

The soundbox 8255 is at I/O ports 0x28-0x2B Port A is set to input, Port B and C are set output. Port C seems to select the music keyboard row and Port A is read for pressed keys.

The soundbox 8253 is at I/O ports 0x24-0x27.

That leaves I/O ports 0x20-0x21 for the YM2151 on the soundbox

Unfortunately, the auctions for the AI computer, software didn't include the keyboard unit, so we don't have one.

Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.

ccovell wrote

Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.

The 7759 doesn't have any built in memory and interfaces to 128K of external ROM. From the PCB picture it looks like it is wired up to MPR-7919 and MPR-7920.

However for a computer I would imagine some of that address space is also mapped to RAM so software can provide their own samples somehow. But if not, then the sample set is strictly limited to what's in the ROM.

1. For a list of the keys - Attached a picture of the Keyboard from
https://www.flickr.com/photos/tomconte/5992707827/

The Computer History Museum in California appears to have a Sega AI with the Keyboard. It's not impossible to get access to it but I'd imagine it would take a while. I'll see how to contact them just in case, to see if they have software.

2. The guy from AssemblerGames at some point got hold of a prototype. I don't know where it went. (three pages articles)

https://web.archive.org/web/20081204130344/http://assembler.roarvgm.com/ai_8300....

3. This website has the flyers in Japanese
http://park21.wakwak.com/~suka/sega/catalog/AIcom/AI.html
Not sure there's anything of technical use there. Interesting that the software packaging appears different than the "final" packaging.

4. An article in Famitsu I found while scouting the Japanese web

5992707827_5b3b864a14_o.jpg (560.37 KB)

17969407_22.jpg (48.23 KB)

Bock wrote

The Computer History Museum in California appears to have a Sega AI with the Keyboard. It's not impossible to get access to it but I'd imagine it would take a while. I'll see how to contact them just in case, to see if they have software.

One of the curators (Al Kossow) is a MAME contributor and is very friendly so I'm sure he'd be willing to help you. If you need me to do anything in person, I've been there before on some MAME related business as well.

ccovell wrote

Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.

At which I/O port did you find the 7759?

Charles MacDonald wrote

One of the curators (Al Kossow) is a MAME contributor and is very friendly so I'm sure he'd be willing to help you. If you need me to do anything in person, I've been there before on some MAME related business as well.

Well realistically I am not being helpful with the reverse engineering and likely won't have time to do so in the upcoming month. But if someone here think there's a legit reason to open the keyboard we can ask for that. I am more interested in asking if they have any documentation and/or software. The earlier if we could get access to and scan it would be great. Maybe you could query Al Kossow if he can get access to their inventory and ask for exact Sega AI stuff they have?

After playing with IRQs a bit more and fixing a small bug in the IRQ handling in MAME's NEC cpu core...

EDIT: It's not really a bug in the NEC cpu core. The V20 IRQs are level triggered; so there is a bit more magic inside the AI going on.

EDIT2: Attached updated code.

I don't see a message appearing about inserting a cartridge only a big black bar at the bottom of the screen. This is accompanied with a lot of reads from Cxxxx. Perhaps this is where some character rom should be mapped (MPR-7689?).

segaai_boot.png (6.41 KB)

segaai_boot_text.png (5.6 KB)

segaai.zip (4.11 KB)

Updated WIP driver

OK, I'll see what I can get at Cxxxx.

In the meantime, good job getting the screen up and running!

With the Sound Box attached, I connected the output line of the Sound Box's keyboard pins to one or more input pins, and it suddenly played an FM instrument and printed "piano" on the screen! From this, pressing U/D on the pad cycled through the various instruments, and the PL/PR buttons lowered and raised the volume.

So yeah, good call on the keyboard scanning/mapping.

aiscr_10.jpg (80.45 KB)

aiscr_11.jpg (67.26 KB)

OK, I've updated the tech info on this page with your port IDs and other findings to date.

Also, yes, the MPR ROM is in fact a 128K Character ROM, with 16x16 1bpp Kanji, etc graphics! It gets mapped to C0000-DFFFF.

I've also made an RS-232 dumper program, so I've managed to dump the whole V20 address space. Attached are dumps with/without the "Eigo de Game 1" MyCard inserted. (Ignore 8xxxx space, as it's my dumping program in the Sound Box slot.)

Also, a correction: RAM is at segments 0,1, (not 0,2 as I can see in the C source).

0-F_dump.zip (403.84 KB)

MPR-7689.zip (68.27 KB)

Cool! with the new chr rom, we indeed get the message attached, which has something to do with the soundbox, I guess, since it appears after the system has failed to retrieve the ROM signature at 0x80002

by mapping the soundbox ROM into the proper location (see attached source), emulation proceeds and it starts reading and writing a lot in the 0x3f*** and 0x4**** ranges

it's probably time to try getting some inputs into the system, which I'll try to do later today if they don't give me any new deadlines at work

0000.png (7.68 KB)

segaai.c (10.04 KB)

Speaking of inputs, here is a port read map:

| 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
--+------------------------------------------------
00| FF 9F FF FF 7F 7F F0 FF 00 00 .. XX XX XX .. ..
10| .. .. .. .. FF FF 00 .. .. .. .. .. .. .. 00 ..
20| .. 00 .. 00 00 FF FF .. 00 00 00 FF .. .. .. ..
30| .. 00 .. 00 00 FF FF .. 00 00 00 FF .. .. .. ..
40| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
50| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
60| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
70| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
80| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
90| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
A0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
B0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
C0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
D0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
E0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..
F0| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..

The dots all show up as "$EB", which I assume to be open bus.

Port 0's data toggles randomly (?) between $00 and $FF; Port 1's between $1F and $9F.

Reading ports $B, $C, $D all causes the CPU to freeze or something similarly bad.

Ports $4, $5 are for the buttons, etc on the AI:
4: M?rl-RLDU, 5: ??TW-g??B

r: "PR" trigger
l: "PL" trigger
RLDU: pad direction
B: grey trigger Button near touch panel
T: cassette Tape insertion sensor
W: cassette Write enable sensor
M: Microphone sensor (1 = sound detected)
g: keyboard pin 3 (see below)

A 0 bit means button is pressed, 1 means released.

JIS Keyboard Ports:
6: ikfe-????, 7: j???-????

efghijk: Keyboard connector pinouts (1-5,8)
(Connector pin 5 seems to map to i/j in ports 6/7 simultaneously(?)

Edited with more port bits.

ccovell wrote

Ports $4, $5 are for the buttons, etc on the AI:
4: ??rl-RLDU, 5: ??T?-???B

r: "PR" trigger
l: "PL" trigger
RLDU: pad direction
B: grey trigger Button near touch panel
T: cassette Tape insertion sensor

A 0 bit means button is pressed, 1 means released.

That's all I have for now!

Nice, I saw the BIOS checking those r, l, and T bits of these I/O ports quite a lot. This explains some things.

Also looking at the I/O port read map, the 0x20-0x2F I/O ports of the soundbox are mirrored at 0x30-0x3F.

ccovell wrote

JIS Keyboard Ports:
6: ikfe-????, 7: j???-????

I/O port 6 is the 8255's Port C that is in both input & output mode. The top 4 bits are input, the low 4 bits are used as outputs.

Bock wrote

Dumped by itoh-san (filenames in Japanese)
The cards uses the same pinout as Sega My Cards

*EDIT* added the same files with names transcribed to English.

I noticed the following dumps are missing the signature bytes:
- Alice world
- Andersen Dream
- Cinderella Labyrinth
- Columbus Map
- Gulliver Pocket
- Mozart Academy
- Robinson Land
- Runrun Music
- Tantan Rhythm

Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?

It looks like the 8251 can be found at I/O ports 0x08-0x09.
Any bytes sent would trigger an IRQ at vector 0xf9, and bytes received would trigger an IRQ at vector 0xfa.

jdg wrote

I noticed the following dumps are missing the signature bytes:
- Alice world
- Andersen Dream
- Cinderella Labyrinth
- Columbus Map
- Gulliver Pocket
- Mozart Academy
- Robinson Land
- Runrun Music
- Tantan Rhythm

Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?

They might not be absolutely necessary for a game to start up. For example, I made my code jump to the $A0028 vector in a couple cards, and they didn't start up (might even be some kind of test routine.) Have you seen anywhere in the AI BIOS where it jumps to the cartridge area in a different way?

ccovell wrote

jdg wrote

I noticed the following dumps are missing the signature bytes:
- Alice world
- Andersen Dream
- Cinderella Labyrinth
- Columbus Map
- Gulliver Pocket
- Mozart Academy
- Robinson Land
- Runrun Music
- Tantan Rhythm

Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?

They might not be absolutely necessary for a game to start up. For example, I made my code jump to the $A0028 vector in a couple cards, and they didn't start up (might even be some kind of test routine.) Have you seen anywhere in the AI BIOS where it jumps to the cartridge area in a different way?

Not yet; it could be that the ones with a signature have 'real code' in them whereas other types of carts have some kind of interpreted (prolog) code in them or something. Currently in the emulated code in mess, none of the carts boot properly yet; I'm still investigating why. It's a nice puzzle :)

etabeta, if you make an updated ai driver, can you tell us or provide links to MESS 8255 and 8253 c drivers? The latest source you provided failed to compile for me because these were not found or erroneously called or something.

Would you rather work on a private fork of MAME/MESS ? (I have a paid github account for private forking). It looks like emulation may happen soon, in which case I think it would make sense to keep the data private until it is mostly figured out. If we had released the earlier dumps without the Character ROM it would have been a bit of a non-event.

We also need to find a way to get dumps of the other 2 MPR chips (the 2 attached to the 7759).

I think in the zip that etabeta originally posted, the 8253 and 8255 need to be enabled in the tiny.mak file to make it compile.

I programmed up an I/O port writing program, so I'm testing some stuff out:

$0B: ??? (Sound, Speech chip reset line?)
----
- $01,$00 written to at startup

$0C/$0D: SN76489AN PSG chip
--------
- $9F,$BF,$DF,$FF written to at BIOS startup

$14/$15: PD7759C Speech Synth command port
--------

$16: ???
----
- Writing a 1 to bit 5 causes a CPU crash
- Writing a 1 to bit 4 causes an audible "pop"

ccovell wrote

etabeta, if you make an updated ai driver, can you tell us or provide links to MESS 8255 and 8253 c drivers? The latest source you provided failed to compile for me because these were not found or erroneously called or something.

This should fix it with a slightly different approach which requires no changes to checked out/downloaded mame/mess code.

segaai.zip contains 3 files: src/mess/drivers/segaai.c, src/mess/segaai.mak, and src/mess/segaai.lst

Just place the files in a copy of the mame/mess source code and compile with something like:

make TARGET=mess SUBTARGET=segaai

to build a variant of MESS with only the sega ai driver. This builds pretty quickly.

BTW, to focus on the main unit I have disabled the soundbox in the sega ai driver file.

segaai.zip (6.5 KB)

MESS/MAME code overlay

ccovell wrote

Mapper Hardware?
----------------
Ocean Fantasy writes $80,$00,$01,$02 to $AFFFC-F

I am starting to suspect that there might be some mapper involved here as well.

Also in Eigo de Game 1 it writes $00 to $AFFFC and $AFFFD.
Then it writes $08 to $AFFFF, copies $4000 bytes from $A4000 to RAM, writes $09 to $AFFFF, copies $4000 bytes again, writes $0A to $AFFFF, copes $4000 bytes, writes $0B to $AFFFF, and copes another $4000 bytes.
After this sequence it seems to expect 64k of data to be available in ram at $1xxxx.

Perhaps this might also explain why some of the dumps look odd...

The banking might not be the same in all games:
Eigo de Game 2 writes bank numbers for $AFFFF and reads back contents from $A8000-$ABFFF.

Author	Message
Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Sega AI Computer reverse engineering thread Posted: Mon Jan 26, 2015 3:03 pm Last edited by Bock on Thu Jan 29, 2015 12:57 pm; edited 2 times in total
	..... Also see the public thread http://www.smspower.org/forums/15004-SegaAIComputerSoftware

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Software rom dumps Posted: Mon Jan 26, 2015 3:04 pm Last edited by Bock on Sun Feb 08, 2015 8:04 pm; edited 3 times in total
	Dumped by itoh-san (filenames in Japanese) The cards uses the same pinout as Sega My Cards EDIT added the same files with names transcribed to English. EDIT those dumps are incomplete. See discussion. Sega_AI_Games.zip (392.69 KB) Sega_AI_Games (English names).rar (371.26 KB)

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	BIOS roms Posted: Mon Jan 26, 2015 3:05 pm
	Dumped by Chris Covell Here are the dumped ROMs from the AI and the Sound Box. Sega_AI_BIOS_ROMs.zip (98.81 KB)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Tue Jan 27, 2015 12:28 am Last edited by ccovell on Sun Mar 08, 2015 12:39 am; edited 5 times in total
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Here's an early tech data dump: The MyCard pinout is identical to regular SMS MyCards, apparently. We listened to one tape. Each audio clip has a modulated data burst before it, presumably for the CPU/tape to identify the clip. The E000/F000 ROMs we dumped have JIS-encoded text, the E000 has Romaji-Hiragana transcription strings, and an internal date of 7/19/86; the F000 ROM has (Prolog?) error strings, cartridge insertion error messages, and Hiragana-Kanji conversion strings. The Sound Pack ROM has instrument strings, etc. of course. Also, it has this text: Quote Programed by SHUN ARAI.Produced by YASUHIGE KOBAYASHI.Special Thanks KAMIYA STUDIO & PHILOS ... R&D No.6SOUND BOARD V1.187/08/12 SEGA The system indeed (?) has 128K main RAM, 64K VRAM, making it almost MSX-compatible. According to the promotional materials on the SMSPower page, the video portion "satisfies MSX2" so maybe all that is missing to make the AI an MSX computer is the BIOS & BASIC software on ROMs? I tried out a sampling of the software with the Sound Board, and many of them produced FM music instead of simple PSG without the board. All FM is mixed in with everything else, including the PSG, which is still used for rhythm hits; the speech chip, which is used in "Popo's Adventure" ("take a big hamburger" it says, eg.); and the sound from the cassette, which is mostly narration and hints. So far, the "Folk & Fairy Tales" (w/ Cassette), "Popo's Adventure" (w/ Cass.), and the 3 music programs "Runrun Music", "Tantan Rhythm", and "Ranran Melody" have FM music with the sound board connected. The other set of 9 "Wonder School" packages have PSG music only. I've noticed that the quality of art & music is a bit higher in the software of the two packages with cassettes. Possibly they used different software developers and/or educational companies (Linguaphone in this case.) The games/stories with the cassette are rather fun to play, with voice clips streamed from tape, and sometimes spoken by the speech synthesizer... but clearly this computer was screaming out for random access media for sound, like CD or solid-state ROMs. The tape sometimes seeks back and forth for 5-15 seconds for the right voice clip, while the game and player (kids) wait. :-) I've attached some RGB screengrabs that I took. Hopefully emulation of the AI will come sometime for better screenshots... speaking of which, anyone know of a modern V20 disassembler program? Sega AI Computer quick PCB overview Major ICs IC 1 D701080-5 (86/09?) NEC V20 CPU DIP40 IC 2 315-5200 (86/25) SEGA QFP100 IC 3 27C512-25 (86/15) 64K EPROM "E000 8/24" IC 4 27C512-25 (86/06) 64K EPROM "F000 7/21" IC 5 MPR-7689 (86/22) SEGA "264 AA E79" 128K CHR ROM DIP28 IC 10 V9938 Yamaha MSX2 VDP IC 13 D7759C (86/12) NEC Speech Synthesizer DIP40 IC 14 MPR-7619 (86/23) SEGA ROM for D7759C DIP28 IC 15 MPR-7620 (86/23) SEGA ROM for D7759C DIP28 IC 16 SN76489AN TI PSG DIP16 IC 17 D8251AFC (86/09) NEC Communications Interface DIP28 IC 18 315-5201 (86/25) SEGA (bodge wire on pins 9,10) DIP20 IC 19 M5204A (87?/01) OKI IC 20 D8255AC-2 (86/08) NEC Peripheral Interface DIP40 IC 6,7,8,9,11,12 D41464C-12 NEC 32K DRAMs - 128K RAM, 64K VRAM Crystals, etc X1 20.000 "KDS 6D" X2 21.47727 "KDS" X3 ? "CSB 640 P" Connectors CN1 6-pin DIN Power connector CN2 8-pin DIN "AUX" connector CN3 Video phono jack CN4 Audio phono jack CN5 35-pin Sega MyCard connector CN6 60-pin expansion connector A1..A30 Bottom, B1..B30 Top CN7 9-pin header connector to "Joy, Button, LED" unit CN8 13(?) pin flat flex connector to pressure pad CN9 9-pin header connector to tape drive motor, etc. CN10 13-pin header connector to tape heads JP2 2-wire header to SW2 button board PJ1 7-wire header to Keyboard / Mic connector board MIC 2-wire header to mic on KB/Mic board SW1 Reset Switch Power switch is on the AC Adaptor Joypad unit (by Mitsumi) has U/D/L/R, "PL" and "PR" buttons, and a power LED. Power Connector Pinout (Seen from AC Adaptor plug): 1 5 1 12V COM 5 5V COM 6 2 12V OUT 6 5V OUT 2 4 3 5V COM 3 4 5V OUT AUX Connector Pinout: 7 6 1 to +5V via 990 Ohm R 5 csync 3 8 1 2 GND 6 green 5 4 3 blue 7 Audio out 2 4 to +5V via 120 Ohm R 8 red New JIS Keyboard Connector Pinout: 1 2 1,2,3 data lines 3 4 5 4 ?? 5,8 data lines 6 7 8 6 GND 7 +5V AI Sound Box, Model "AI-2002" ICs on board: IC 2 TMP82C53F-2 (91/09) Toshiba (Peripheral Timer?) IC 3 HN27512G-25 (87/12) Hitachi 64K EPROM IC 6 YM2151 (91/10) Yamaha FM chip IC 7 TMP82C55AF-10 (88/15) Toshiba (Peripheral Interface?) IC 8 YM3012 (91/10) Yamaha Stereo DAC IC 9 HA17358 Hitachi Dual Op-Amp IC 10 LC7537N Sanyo (Volume Control IC) IC 11 C324C (90/42) NEC Quad Op-Amp IC 12 LA4520 (Sanyo Power Audio Amp?) IC 16-19 MB81464-12 (91/12) Fujitsu 32K DRAMs Misc Flat DIPs IC ?? LS125A Hitachi Line Driver IC ?? HC04 TI Inverter IC ?? 74HC157A x2 Toshiba IC ?? HC138 TI IC ?? HC139 TI TMP82C55AF-10 Peripheral Interface pinout (incomplete) 33 23 _\|_______\|_ 34--\| T \|--22 \|TMP82C55 \| \| \| 44--\| \|--12 \_________\| \| \| 1 11 1 - 12 - 23 - B.7 34 - 2 - GND 13 - C.3 24 - +5V 35 - A.7 3 - Address 1 14 - B.0 25 - D7 36 - A.6 4 - Address 0 15 - B.1 26 - D6 37 - A.5 5 - Port C bit 7 16 - B.2 27 - D5 38 - A.4 6 - " C.6 17 - 28 - D4 39 - 7 - C.5 18 - B.3 29 - D3 40 - A.3 8 - C.4 19 - B.4 30 - D2 41 - A.2 9 - C.0 20 - B.5 31 - D1 42 - A.1 10 - C.1 21 - B.6 32 - D0 43 - A.0 11 - C.2 22 - 33 - 44 - Port B on the sound box's 82C55 is connected to the LC7537N volume control IC. B.0 connects to pin 20 (DI); B.1 to pin 21 (CLK); and B.2 to pin 22 (CE). B.7 connects to an output enable for pin 18 of the TMP82C53F peripheral timer. CN2 "Music Keyboard" connector: UL..........................UR 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 1,2,11,12 - GND 6 - Port A bit 6 7 - Port A bit 4 8 - Port A bit 2 9 - Port A bit 0 16 - Port A bit 7 17 - Port A bit 5 18 - Port A bit 3 19 - Port A bit 1 3 - Port C bit 2 4 - Port C bit 4 5 - Port C bit 6 10 - Port C bit 7 13 - Port C bit 1 14 - Port C bit 3 15 - Port C bit 5 20 - Port C bit 0 AI_Capture01.png (149.3 KB) AI Computer Bootup AI_Capture02.png (228.69 KB) in-game example

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Pictures Posted: Thu Jan 29, 2015 9:38 am
	Chris has uploaded a bunch of pictures here http://www.chrismcovell.com/data/AI_Photos.zip As I understand pictures 01 to 10 are of the Sound Box. Pictures 11 to 45 are of the Sega AI main unit. We might need more detailed pictures of the main board?

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Thu Jan 29, 2015 10:56 am Last edited by Bock on Fri Feb 06, 2015 12:07 pm; edited 1 time in total
	I have added the following people to this thread Chris Covell Charles MacDonald Kale (MESS/MAME) Etabeta (MESS/MAME) jdg (MESS/MAME) Paul Baker Maxim yaz0r

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Thu Jan 29, 2015 5:15 pm
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	I had done some work on a V30 system and used nasm and ndisasm as I wasn't using the NEC specific extra opcodes added to the x86 instruction set. You can use "unidasm" which comes with MAME that supports the V20 directly, and I believe it supports the extra opcodes.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Thu Jan 29, 2015 7:41 pm
	So the E000 program has a date of 7/19/86 (86 week ~29) The main computer hardware has chips dated up to 86 week 25 (or 87 week 1 depending on what's on that OKI chip) Sound Box program has a date of 87/08/12. Sound Box hardware has chips up to 91/12 ! That is particularly odd - a span of 5 years! I have another Sound Box which I could inspect so see if the dates matches, but it is tucked away in storage, I will try to get it next week as I am travelling to Paris. I have a lead on friend-of-a-friend who have worked on the Sega AI in Japan. We could ask her questions on this type of stuff (dates, software, what was the plan etc.)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Fri Jan 30, 2015 7:58 am Last edited by ccovell on Sun Mar 08, 2015 12:36 am; edited 8 times in total
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Okay, so I haven't touched or looked at x86 assembly in 19 years... :-/ The F000 ROM appears to be segment F000:xxxx, and there is a proper jump instruction at FFFF:00 ($FFF0 in the EPROM.) which jumps to a "reset" routine at $1000 in the "F000" ROM. Anybody who is interested can start disassembly from there. After a little peeking and prodding: Sega AI V20 Memory Space by Segment ----------------------------------- 0: RAM (Stack set to $443E here on startup) 1: RAM 2: Sound Box DRAM 3: Sound Box DRAM 4: (open bus) 5: " 6: " 7: " - 8: Expansion Bus (eg: Sound Box) 9: (open bus) A: MyCard Cartridge space (and mapper regs) B: MyCard Cartridge space (or mirror of $Axxxx for mappered games) - C: Character ROM low 64k D: Character ROM high 64k E: BIOS ROM "E000" F: BIOS ROM "F000" Some MyCard games have mapper hardware, in which case they have a fixed 16K bank at $A0000-$A3FFF, with two more selectable bank spaces at $A4000-A7FFF and $A8000-$ABFFF. These selectable banks are chosen by writing the bank number to $AFFFE-F. Mappered games have open bus at $AC000-$AFFFF, and the $Bxxxx area is a mirror of $Axxxx. For example, Ocean Fantasy writes $80,$00,$01,$02 to $AFFFC-F. Most earlier AI MyCards have no mapper, and have a flat 128K ROM spanning $A0000-$BFFFF. Ports ----- Writing: $00-03: V9938 VDP ports 0-3 ------- $04-07: D8255AC peripheral ports ------- $0B: Bit 0 is the speech chip Standalone / Slave (/MD) line...? ---- - $01,$00 written to port $0B at BIOS startup $0C/$0D: SN76489AN PSG chip -------- - $9F,$BF,$DF,$FF written to port $0C at BIOS startup $14/$15: PD7759C Speech Synth command port -------- - In Standalone mode, a preset word is chosen through this port. - In Slave mode, ADPCM data are streamed to this port by the CPU. $16: ??? ---- - Writing a 1 to bit 5 causes a CPU crash - Writing a 1 to bit 4 causes an audible "pop" $17: Speech Synth address/data/mem mapper? ---- - "Eigo de Game" 2 writes 0,2,4,7,$d,$e to this port, then enables interrupts. An interrupt-driven routine then writes $01 to port $B, then ADPCM data to port $14, then $00 to $B again. $1C-$1E: Touch Pad reset/latch ports -------- $20-21: Sound Box's YM2151 FM ports ------- $24-27: Sound Box's TMP82C53F timer ports ------- $28-2B: Sound Box's TMP82C55AF peripheral ports ------- - Port B bits 0,1,2 are connected to the Sanyo Volume Control IC's "DI", "CLK", and "CE" input pins, respectively. - Port B bit 7 controls an "output enable" line for the TMP82C53F timer device pin 18, whatever that is. Reading: $04: Joypad & Buttons ---- MVrl-RLDU $05: Button & Tape Sensor ---- CHTW-gYPB r: "PR" trigger (named "Point Right" in manual) l: "PL" trigger ("Point Left") RLDU: pad direction B: grey trigger Button near touch panel/pad (named "Touch Button") -- P: touch-sensitive Pad is being pressed Y: touch-sensitive pad coordinate data are readY -- C: CN9 pin 8 H: cassette Head engaged sensor T: cassette Tape insertion sensor W: cassette Write enable sensor M: Microphone sensor (1 = sound detected) V: Voice chip (PD7759C) /BUSY line: 0 when this chip is streaming a sample. g: keyboard pin 3 (see below) -- A 0 bit means button/pad/panel is pressed, 1 means released. $06: JIS Keyboard Lines ---- ikfe-???? $07: j???-???? ---- efghijk: Keyboard connector pinouts (1-5,8) (Connector pin 5 seems to map to i/j in ports 6/7 simultaneously(?) $16: Speech Synth ???? line? ---- $1E: Touch Pad X/Y data (after reset/latched) ---- - "Mozart Academy", for example, reads the pad with this sequence: 0->Port $1C, 1->Port $1D, load CW (alias CX) register with $0108, do delay loop. Read Port $5 bit 1 to see if pad pressed. If not, exit. If so: 0->Port $1D,$1C,$1E in that order, load CW with $0061 to delay. Read Port $5 bit 2 to see if X data is ready. If not, exit. If so: Read Port $1E for Touch Pad X-axis data (& store it somewhere.) 1->Port $1C, load CW with $0014 to delay. 0->Port $1E, load CW with $0061 to delay. Read Port $5 bit 2 to see if Y data is ready. If not, exit. If so: Read Port $1E for Touch Pad Y-axis data (finally!) Extra notes ----------- Peripherals, AI MyCard appear to be mapped at $8xxxx and $A0000-$BFFFF The AI ROM checks for signature bytes $55,$AA at $8FFD2; failing that, $AFFD2. If found, it calls the far pointer at ($8FFF8) or ($AFFF8). Later on, the AI ROM checks for signature bytes $55,$AA at $80002, $A0002. It would appear that the peripherals/cards have two entry points? The Sound Box appears to identify itself at $80000. It has $55,$AA pointers both at $80002 and $8FFD2.

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Sat Jan 31, 2015 3:45 pm
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Here's a WAV file of 3 data bursts from one of the tapes, if anybody wants to try to decode the modulating format: http://www.chrismcovell.com/data/AItape.zip AItape.zip (213.19 KB)

Maxim Site Admin Joined: 19 Oct 1999 Posts: 14745 Location: London	Posted: Sat Jan 31, 2015 5:29 pm
	Did you compare to the Sega Basic encoding?

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Sat Jan 31, 2015 7:05 pm
	$0C: ---- - $9F,$BF,$DF,$FF written to at BIOS startup That's SN76489-series sequence for "reset all 4 channels volumes".

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Sun Feb 01, 2015 7:57 am
etabeta Joined: 01 Jun 2010 Posts: 46	hi, sorry for the late show up but it's been an hell of a week at job anyway, in attachment you can find a very barebone MESS driver for this system to help starting some debug I have just mapped CPU ROMs and given some RAM in the 0x00000-0x1ffff range: this allows the CPU to start running code I've also mapped the SN76489 at 0x0c of the IO address map, but I still have to figure out whether the V9938 is mapped at 0x00-0x03 or 0x04-0x07 (or both, since accesses could be masked out) I'm not very familiar with the NEC CPUs, so it's a bit of a steep learning curve, but I'll try to do my best to help with the MESS side instruction to test the code: 1. download MAME/MESS source from this link (main mamedev.org website is down today :( ) http://emumovies.com/aarongiles/releases/mame0158s.zip and unzip it in a folder of your choice 2. unzip the attachment here and put segaai.c source into src/mess/drivers/ 3. apply the segaai.diff patch at this stage you have two compiling options: make TARGET=mess SUBTARGET=tiny and make TARGET=mess The former produces a "messtiny" executable which only supports Sega AI system. The latter compiles the whole tree and gives an executable supporting all systems emulated by MESS. The advantage of the former is that it takes less time to compile :) Once you have built the executable of your choice, you shall rename the bios zipfile to "segaai.zip" and put it in a roms/ folder. Then, you can start emulation+debugger by typing mess segaai -debug at command line You can also try to mount the cards by launching mess segaai -debug -cart /absolute/path/to/the/carts/my_game.aic but at the moment there is no visible result Let me know if you need any further help with MESS compiling/launching :) segaai.zip (3.51 KB)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Mon Feb 02, 2015 1:04 am
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Does anybody have a precompiled binary to offer? Also, I'd recommend compiling/running the MESS AI driver without the Sound Box ROM being automatically mapped, as it could be responsible for the main BIOS hanging (no FM hardware/interface mapped yet!).

yaz0r Joined: 31 Jan 2015 Posts: 3	Posted: Mon Feb 02, 2015 2:15 am
yaz0r Joined: 31 Jan 2015 Posts: 3	Here is my precompiled version. I looked at that stuff a bit, looks like the bios dies waiting for memory at 251A to have a bit cleared (around E000:D67C). I have been looking for code that's trying to do that, and the interrupt code at E000:D9D7 tries to do something of the sort, but it doesn't fully addup yet. messtiny.zip (2.03 MB)

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Mon Feb 02, 2015 6:28 am
etabeta Joined: 01 Jun 2010 Posts: 46	ccovell wrote Does anybody have a precompiled binary to offer? Also, I'd recommend compiling/running the MESS AI driver without the Sound Box ROM being automatically mapped, as it could be responsible for the main BIOS hanging (no FM hardware/interface mapped yet!). I'm on an old macosx machine, so I cannot offer binaries, sorry (and thanks yaz0r for filling this gap) the soundbox ROM is loaded but not mapped anywhere, so at the moment it cannot affect in any way emulation

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Mon Feb 02, 2015 7:11 am
etabeta Joined: 01 Jun 2010 Posts: 46	by comparing the code with some other drivers using the same VDP, it seems that the chip might be awaiting for an interrupt any other scanline (but I've asked judge for confirmation that I've hooked up the chip correctly, which might not be the case). adding this, it leads the bios to check the 0x55 0xAA signature and hang around the routines at 0xEB354 you can see the new code in attachment (I have also added the soundbox mapping at 0x80000, but it is commented out currently... feel free to uncomment it, if you want to see what happens in this case) I have to go to work now, so I won't be able to do much until tonight. EDIT: mmm... there might be something wrong going on, though: the signature is checked at ffd2 instead of 0002, because ix = ffd0 when the routine starts... I definitely need to contact someone with more experience with this NEC CPU EDIT2: judge pointed out that I was not handling correctly the CPU IRQ... I have replaced the attachment with a slightly better one (the CPU seems to go wrong in a different way now ;) ) segaai.c (6.52 KB)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Mon Feb 02, 2015 1:49 pm
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Yes, thanks Yaz0r, and sorry for the request, but could someone provide updated MESS (Win, whatever?) binaries as this evolves? Simply compiling unofficial MESS on a fresh computer turns into a fool's errand... install an SVN that lords over your folders... get mingw, patch the source... oops, download DX libraries... oops the later versions of MAME need more than that, please ask on IRC for newest info, etc. <--webpage actually says this. All this for a binary executable that someone here more than likely has compiled as well.

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Mon Feb 02, 2015 2:44 pm
etabeta Joined: 01 Jun 2010 Posts: 46	you just need the 0.158 source I linked above, and the official tools from http://www.mamedev.org/tools/ then you uncompress both the source and the tool, and you apply the diff I posted above then you are ready to build the emulator. no git setup is needed (especially because Bock has asked to keep temporarily private the driver, so you would not find the segaai source in the repo)

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Mon Feb 02, 2015 2:58 pm
etabeta Joined: 01 Jun 2010 Posts: 46	in the meanwhile, by returning the proper value at IRQ (kudos to judge) and by treating IO 0x04/0x07 as some sort of RW regs, we get a much more stable execution, up to the point of a long series of 0x0A writes to IO 0x17... segaai.c (6.86 KB)

yaz0r Joined: 31 Jan 2015 Posts: 3	Posted: Mon Feb 02, 2015 5:37 pm
yaz0r Joined: 31 Jan 2015 Posts: 3	ccovell wrote Yes, thanks Yaz0r, and sorry for the request, but could someone provide updated MESS (Win, whatever?) binaries as this evolves? I can try to do that yeah, but I'm on pst timezone, so probably out of sync with you guys. I will make a build of what's available when I get home tonight.

yaz0r Joined: 31 Jan 2015 Posts: 3	Posted: Mon Feb 02, 2015 11:46 pm
yaz0r Joined: 31 Jan 2015 Posts: 3	Btw, what happens when the hardware is booted without a card? Is there a startup screen of some kind?

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Tue Feb 03, 2015 12:56 am
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Yes, without a card, it draws the logo screen seen at the top of this thread. It draws the screen from the top, scanline-by-scanline, "waits" for a second, then if no card is inserted, it shows a message in Japanese at the bottom asking the user to insert a card, while the lines on the grid scroll forward in a simple animation.

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Tue Feb 03, 2015 2:38 pm
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	etabeta wrote EDIT: mmm... there might be something wrong going on, though: the signature is checked at ffd2 instead of 0002, because ix = ffd0 when the routine starts... I definitely need to contact someone with more experience with this NEC CPU Something seems very wrong. Perhaps it's a programmer's bug? Or disassembler's bug? Right before the cart check, the code sets IY=0, but then IX is what gets checked. Perhaps the original programmers meant to make it IX=0? Later on in the code (which the emu hasn't gotten to yet) it checks both $80000 and $A0000 memory regions again, this time with IX=0 properly. Hmmm... Edit: the Sound Box has the $55AA signature at both $0002 and FFD2, so maybe this is a feature... a weird one. Edit 2: Okay, I've written a small program to an EEPROM that I've put in the Sound Box. Since the V20 jumps to ($8FFF8) located in the sound box right after it clears RAM, it's a useful place to test out code. My code writes to port $0C right now, and I can hear the SN sound chip do its thing and observe the chip's data lines. From here I guess I'll try to use one of the SN data lines as an RS-232 output...?

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Wed Feb 04, 2015 2:03 pm
etabeta Joined: 01 Jun 2010 Posts: 46	sorry, I'm super busy at work and had no time for emulation. however, the checks at 0xffd0 were due to a missing IRQ ack in the driver. the latest source pass beyond that point (even if I don't remember whether it checks both locations or only 0x0002) also, judge commented that probably 0x04-0x07 could be related to the i8255 (maybe keyboard inputs?) I hope to have some more spare time in the next few days

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Wed Feb 04, 2015 8:47 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	It looks like the 8255 is hooked up at I/O ports 0x04-0x07. I can see it setting the control register to put port A and port B into input mode combined with reads from I/O ports 0x04 and 0x05 (port A and B). After reading I/O port 0x05 bits 4 and 5 are checked a lot; I have no idea what these bits mean yet. There seems to be some correlation between writes to I/O port 0x17 and reads from I/O port 0x05, at this point this could also just be a coincidence. There is also the possibility that the 8251 is used for serial communication with the keyboard. Did you check if there's some kind of microcontroller in the keyboard?

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Wed Feb 04, 2015 9:25 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	By the way, X3 is almost certainly a 640kHz clock. This is a standard input clock for a uPD7759, which is right next to it. The soundbox 8255 is at I/O ports 0x28-0x2B Port A is set to input, Port B and C are set output. Port C seems to select the music keyboard row and Port A is read for pressed keys. The soundbox 8253 is at I/O ports 0x24-0x27. That leaves I/O ports 0x20-0x21 for the YM2151 on the soundbox

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Thu Feb 05, 2015 1:49 am
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Unfortunately, the auctions for the AI computer, software didn't include the keyboard unit, so we don't have one. Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese.

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Thu Feb 05, 2015 3:50 am
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	ccovell wrote Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese. The 7759 doesn't have any built in memory and interfaces to 128K of external ROM. From the PCB picture it looks like it is wired up to MPR-7919 and MPR-7920. However for a computer I would imagine some of that address space is also mapped to RAM so software can provide their own samples somehow. But if not, then the sample set is strictly limited to what's in the ROM.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Links Posted: Thu Feb 05, 2015 7:46 am
	1. For a list of the keys - Attached a picture of the Keyboard from https://www.flickr.com/photos/tomconte/5992707827/ The Computer History Museum in California appears to have a Sega AI with the Keyboard. It's not impossible to get access to it but I'd imagine it would take a while. I'll see how to contact them just in case, to see if they have software. 2. The guy from AssemblerGames at some point got hold of a prototype. I don't know where it went. (three pages articles) https://web.archive.org/web/20081204130344/http://assembler.roarvgm.com/ai_8300.... 3. This website has the flyers in Japanese http://park21.wakwak.com/~suka/sega/catalog/AIcom/AI.html Not sure there's anything of technical use there. Interesting that the software packaging appears different than the "final" packaging. 4. An article in Famitsu I found while scouting the Japanese web 5992707827_5b3b864a14_o.jpg (560.37 KB) 17969407_22.jpg (48.23 KB)

Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Posted: Thu Feb 05, 2015 3:54 pm
Charles MacDonald Joined: 28 Sep 1999 Posts: 1197	Bock wrote The Computer History Museum in California appears to have a Sega AI with the Keyboard. It's not impossible to get access to it but I'd imagine it would take a while. I'll see how to contact them just in case, to see if they have software. One of the curators (Al Kossow) is a MAME contributor and is very friendly so I'm sure he'd be willing to help you. If you need me to do anything in person, I've been there before on some MAME related business as well.

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Thu Feb 05, 2015 4:07 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	ccovell wrote Does the uPD7759 have an internal vocabulary ROM? When I was writing ports to it while testing last night, it spat out phrases, "Ichi Ni, Ue Migi", etc, in Japanese. At which I/O port did you find the 7759?

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Thu Feb 05, 2015 4:33 pm
	Charles MacDonald wrote One of the curators (Al Kossow) is a MAME contributor and is very friendly so I'm sure he'd be willing to help you. If you need me to do anything in person, I've been there before on some MAME related business as well. Well realistically I am not being helpful with the reverse engineering and likely won't have time to do so in the upcoming month. But if someone here think there's a legit reason to open the keyboard we can ask for that. I am more interested in asking if they have any documentation and/or software. The earlier if we could get access to and scan it would be great. Maybe you could query Al Kossow if he can get access to their inventory and ask for exact Sega AI stuff they have?

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Thu Feb 05, 2015 9:46 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	After playing with IRQs a bit more and fixing a small bug in the IRQ handling in MAME's NEC cpu core... EDIT: It's not really a bug in the NEC cpu core. The V20 IRQs are level triggered; so there is a bit more magic inside the AI going on. EDIT2: Attached updated code. I don't see a message appearing about inserting a cartridge only a big black bar at the bottom of the screen. This is accompanied with a lot of reads from Cxxxx. Perhaps this is where some character rom should be mapped (MPR-7689?). segaai_boot.png (6.41 KB) segaai_boot_text.png (5.6 KB) segaai.zip (4.11 KB) Updated WIP driver

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Fri Feb 06, 2015 2:13 am
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	OK, I'll see what I can get at Cxxxx. In the meantime, good job getting the screen up and running! With the Sound Box attached, I connected the output line of the Sound Box's keyboard pins to one or more input pins, and it suddenly played an FM instrument and printed "piano" on the screen! From this, pressing U/D on the pad cycled through the various instruments, and the PL/PR buttons lowered and raised the volume. So yeah, good call on the keyboard scanning/mapping. aiscr_10.jpg (80.45 KB) aiscr_11.jpg (67.26 KB)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Fri Feb 06, 2015 6:01 am
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	OK, I've updated the tech info on this page with your port IDs and other findings to date. Also, yes, the MPR ROM is in fact a 128K Character ROM, with 16x16 1bpp Kanji, etc graphics! It gets mapped to C0000-DFFFF. I've also made an RS-232 dumper program, so I've managed to dump the whole V20 address space. Attached are dumps with/without the "Eigo de Game 1" MyCard inserted. (Ignore 8xxxx space, as it's my dumping program in the Sound Box slot.) Also, a correction: RAM is at segments 0,1, (not 0,2 as I can see in the C source). 0-F_dump.zip (403.84 KB) MPR-7689.zip (68.27 KB)

etabeta Joined: 01 Jun 2010 Posts: 46	Posted: Fri Feb 06, 2015 6:31 am
etabeta Joined: 01 Jun 2010 Posts: 46	Cool! with the new chr rom, we indeed get the message attached, which has something to do with the soundbox, I guess, since it appears after the system has failed to retrieve the ROM signature at 0x80002 by mapping the soundbox ROM into the proper location (see attached source), emulation proceeds and it starts reading and writing a lot in the 0x3f* and 0x4** ranges it's probably time to try getting some inputs into the system, which I'll try to do later today if they don't give me any new deadlines at work 0000.png (7.68 KB) segaai.c (10.04 KB)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Fri Feb 06, 2015 8:39 am Last edited by ccovell on Fri Feb 06, 2015 2:59 pm; edited 3 times in total
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Speaking of inputs, here is a port read map: \| 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F --+------------------------------------------------ 00\| FF 9F FF FF 7F 7F F0 FF 00 00 .. XX XX XX .. .. 10\| .. .. .. .. FF FF 00 .. .. .. .. .. .. .. 00 .. 20\| .. 00 .. 00 00 FF FF .. 00 00 00 FF .. .. .. .. 30\| .. 00 .. 00 00 FF FF .. 00 00 00 FF .. .. .. .. 40\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 50\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 60\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 70\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 80\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 90\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. A0\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. B0\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. C0\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. D0\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. E0\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. F0\| .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. The dots all show up as "$EB", which I assume to be open bus. Port 0's data toggles randomly (?) between $00 and $FF; Port 1's between $1F and $9F. Reading ports $B, $C, $D all causes the CPU to freeze or something similarly bad. Ports $4, $5 are for the buttons, etc on the AI: 4: M?rl-RLDU, 5: ??TW-g??B r: "PR" trigger l: "PL" trigger RLDU: pad direction B: grey trigger Button near touch panel T: cassette Tape insertion sensor W: cassette Write enable sensor M: Microphone sensor (1 = sound detected) g: keyboard pin 3 (see below) A 0 bit means button is pressed, 1 means released. JIS Keyboard Ports: 6: ikfe-????, 7: j???-???? efghijk: Keyboard connector pinouts (1-5,8) (Connector pin 5 seems to map to i/j in ports 6/7 simultaneously(?) Edited with more port bits.

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Fri Feb 06, 2015 9:26 am
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	ccovell wrote Ports $4, $5 are for the buttons, etc on the AI: 4: ??rl-RLDU, 5: ??T?-???B r: "PR" trigger l: "PL" trigger RLDU: pad direction B: grey trigger Button near touch panel T: cassette Tape insertion sensor A 0 bit means button is pressed, 1 means released. That's all I have for now! Nice, I saw the BIOS checking those r, l, and T bits of these I/O ports quite a lot. This explains some things. Also looking at the I/O port read map, the 0x20-0x2F I/O ports of the soundbox are mirrored at 0x30-0x3F.

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Fri Feb 06, 2015 7:15 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	ccovell wrote JIS Keyboard Ports: 6: ikfe-????, 7: j???-???? I/O port 6 is the 8255's Port C that is in both input & output mode. The top 4 bits are input, the low 4 bits are used as outputs.

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Fri Feb 06, 2015 7:24 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Bock wrote Dumped by itoh-san (filenames in Japanese) The cards uses the same pinout as Sega My Cards EDIT added the same files with names transcribed to English. I noticed the following dumps are missing the signature bytes: - Alice world - Andersen Dream - Cinderella Labyrinth - Columbus Map - Gulliver Pocket - Mozart Academy - Robinson Land - Runrun Music - Tantan Rhythm Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these?

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Fri Feb 06, 2015 10:07 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	It looks like the 8251 can be found at I/O ports 0x08-0x09. Any bytes sent would trigger an IRQ at vector 0xf9, and bytes received would trigger an IRQ at vector 0xfa.

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Fri Feb 06, 2015 11:59 pm
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	jdg wrote I noticed the following dumps are missing the signature bytes: - Alice world - Andersen Dream - Cinderella Labyrinth - Columbus Map - Gulliver Pocket - Mozart Academy - Robinson Land - Runrun Music - Tantan Rhythm Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these? They might not be absolutely necessary for a game to start up. For example, I made my code jump to the $A0028 vector in a couple cards, and they didn't start up (might even be some kind of test routine.) Have you seen anywhere in the AI BIOS where it jumps to the cartridge area in a different way?

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Sat Feb 07, 2015 12:36 am
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	ccovell wrote jdg wrote I noticed the following dumps are missing the signature bytes: - Alice world - Andersen Dream - Cinderella Labyrinth - Columbus Map - Gulliver Pocket - Mozart Academy - Robinson Land - Runrun Music - Tantan Rhythm Could they be incorrectly dumped? Or if they are some interpreted code, how would one start these? They might not be absolutely necessary for a game to start up. For example, I made my code jump to the $A0028 vector in a couple cards, and they didn't start up (might even be some kind of test routine.) Have you seen anywhere in the AI BIOS where it jumps to the cartridge area in a different way? Not yet; it could be that the ones with a signature have 'real code' in them whereas other types of carts have some kind of interpreted (prolog) code in them or something. Currently in the emulated code in mess, none of the carts boot properly yet; I'm still investigating why. It's a nice puzzle :)

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Sat Feb 07, 2015 3:06 am
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	etabeta, if you make an updated ai driver, can you tell us or provide links to MESS 8255 and 8253 c drivers? The latest source you provided failed to compile for me because these were not found or erroneously called or something.

Bock Site Admin Joined: 08 Jul 2001 Posts: 8652 Location: Paris, France	Posted: Sat Feb 07, 2015 11:26 am
	Would you rather work on a private fork of MAME/MESS ? (I have a paid github account for private forking). It looks like emulation may happen soon, in which case I think it would make sense to keep the data private until it is mostly figured out. If we had released the earlier dumps without the Character ROM it would have been a bit of a non-event.

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Sat Feb 07, 2015 12:46 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	We also need to find a way to get dumps of the other 2 MPR chips (the 2 attached to the 7759). I think in the zip that etabeta originally posted, the 8253 and 8255 need to be enabled in the tiny.mak file to make it compile.

ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	Posted: Sat Feb 07, 2015 3:05 pm
ccovell Joined: 26 Dec 2004 Posts: 374 Location: Japan	I programmed up an I/O port writing program, so I'm testing some stuff out: $0B: ??? (Sound, Speech chip reset line?) ---- - $01,$00 written to at startup $0C/$0D: SN76489AN PSG chip -------- - $9F,$BF,$DF,$FF written to at BIOS startup $14/$15: PD7759C Speech Synth command port -------- $16: ??? ---- - Writing a 1 to bit 5 causes a CPU crash - Writing a 1 to bit 4 causes an audible "pop"

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Sat Feb 07, 2015 3:45 pm
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	ccovell wrote etabeta, if you make an updated ai driver, can you tell us or provide links to MESS 8255 and 8253 c drivers? The latest source you provided failed to compile for me because these were not found or erroneously called or something. This should fix it with a slightly different approach which requires no changes to checked out/downloaded mame/mess code. segaai.zip contains 3 files: src/mess/drivers/segaai.c, src/mess/segaai.mak, and src/mess/segaai.lst Just place the files in a copy of the mame/mess source code and compile with something like: make TARGET=mess SUBTARGET=segaai to build a variant of MESS with only the sega ai driver. This builds pretty quickly. BTW, to focus on the main unit I have disabled the soundbox in the sega ai driver file. segaai.zip (6.5 KB) MESS/MAME code overlay

jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	Posted: Sun Feb 08, 2015 8:49 am
jdg Joined: 13 Mar 2007 Posts: 51 Location: Portugal	ccovell wrote Mapper Hardware? ---------------- Ocean Fantasy writes $80,$00,$01,$02 to $AFFFC-F I am starting to suspect that there might be some mapper involved here as well. Also in Eigo de Game 1 it writes $00 to $AFFFC and $AFFFD. Then it writes $08 to $AFFFF, copies $4000 bytes from $A4000 to RAM, writes $09 to $AFFFF, copies $4000 bytes again, writes $0A to $AFFFF, copes $4000 bytes, writes $0B to $AFFFF, and copes another $4000 bytes. After this sequence it seems to expect 64k of data to be available in ram at $1xxxx. Perhaps this might also explain why some of the dumps look odd... The banking might not be the same in all games: Eigo de Game 2 writes bank numbers for $AFFFF and reads back contents from $A8000-$ABFFF.

Forums

View topic - Sega AI Computer reverse engineering thread