Sega System C2 hardware notes (2003)
From Sega Retro
This is a copy of an "unofficial" document containing original research, for use as a source on Sega Retro. This page likely exists for historical purposes - the contents should ideally be copy-edited and wikified to make better use of Sega Retro's software. Original source: http://cgfm2.emuviews.com/txt/c2tech.txt |
Sega System C2 hardware notes by Charles MacDonald WWW: http://cgfm2.emuviews.com Unpublished work Copyright 2000-2003 Charles MacDonald This document is in a very preliminary state and is subject to change. Most everything within has been tested and verified on a System C2 board, but please be aware that my testing methods or interpretations of results could be flawed. I can't guarantee that everything is 100% accurate. Table of contents 1. 68000 memory map 2. uPD7759 3. Video hardware and EPM5032 registers 4. I/O chip 5. Hardware information 6. Jumper settings 7. Connector pinouts 8. Credits and Acknowledgements 9. Disclaimer ---------------------------------------------------------------------------- 68000 memory map ---------------------------------------------------------------------------- $000000-$0FFFFF : Data from EPROMs in EVEN0 and ODD0 sockets. $100000-$1FFFFF : Data from EPROMs in EVEN1 and ODD1 sockets. $200000-$7FFFFF : Reading or writing this area causes a lockup. $800000-$83FFFF : Protection register and video control. $840000-$87FFFF : I/O chip. $880000-$8BFFFF : uPD7759 interface. $8C0000-$8FFFFF : Color RAM (1K, mirrored every 1K) $900000-$9FFFFF : Mirror of $800000-$8FFFFF area. $A00000-$BFFFFF : Reading or writing this area causes a lockup. $C00000-$DFFFFF : VDP $E00000-$FFFFFF : Work RAM (64K, mirrored every 64K) The details of the protection register, video control register, I/O chip, and uPD7759 are explained later on. If any EPROMs are missing from the program ROM sockets the corresponding memory locations will return the prefetch value. For example: ; Assume EVEN1/ODD1 missing move.w #$100000, d0 ; Read from second ROM pair nop ; D0 = $4E71 The VDP is only accessible at specific addresses within the memory range allocated to it. Reading or writing an invalid address will cause a lockup. Here's a bitmask of the address bus to indicate which addresses are valid: MSB LSB 110??000????????000rrrrr 1 - Bit must be '1' 0 - Bit must be '0' ? - Value does not matter r - VDP internal register ($00-$1F) To my knowledge all games only access the VDP at $C00000-$C0001F, and do not use any of the mirrored locations. For all memory within $800000-$9FFFFF, writing to even addresses has no effect and reading from them returns the MSB of the prefetch value. ---------------------------------------------------------------------------- uPD7759 ---------------------------------------------------------------------------- The System C2 board uses a NEC uPD7759 chip which can play back ADPCM samples. It can use up to 128K of ROM directly, so additional bits are provided through the I/O chip to control banking, allowing for 512K of ROM to be used in four 128K banks. Writing to any odd address within $880000-$8BFFFF will send the value to the message input of the uPD7759. Reading any odd address returns $FF. The status of the uPD7759 /BUSY pin can be read through bit 6 of I/O chip port C. I don't know how the uPD7759 is reset, which apparently is necessary when switching banks so the chip will re-read the header data at the start of the bank. ---------------------------------------------------------------------------- Video hardware and EPM5032 registers ---------------------------------------------------------------------------- An Altera EPM5032 EPLD device is used to control some aspects of the video hardware and provide a protection feature that games use to prevent bootlegging. It has the following pinout: Pin Type Description 1 Input /VSYNC from VDP pin 41 2 Clock 53.693 MHz clock from OSC1 3 Output Output to D1A input of 74LS08. 4 Output To /BLANK input on color encoder 5 Output Clock input of LS373 to latch color bus data 6 Output To /SHADE input on color encoder 9 Input 68000 A8 10 Input 68000 /LDS 11 Input Bit 7 of latched color bus data 12 Input/Output Connected to pin 19 of 315-5242 13 Input /HSYNC from VDP pin 43 14 Input SPA/B from VDP pin 40 15 Input Connected to pin 3 of 315-5394 16 Input 68000 R//W 17 Input 68000 D3 18 Input 68000 D2 19 Input 68000 D1 20 Input 68000 D0 23 Output Color RAM A8 24 Output Color RAM A7 25 Output Color RAM A6 26 Output Color RAM A5 27 Output Bit 6 of latched color bus data 28 Output Bit 5 of latched color bus data Pins 7,22 are +5V, pins 8,21 are ground. Pin 3 is connected to D1A of an AND gate, D1B is from +5V and the output of the gate goes to 315-5394 pin 1. I don't know what this is for. The /HSYNC output of the VDP appears to be the dot clock, as it is fed into the clock input of the color encoder. The EPM5032 controls the clock input of a LS373 which is used to latch the color bus outputs. The latched data is then sent to the EPM5032 and color RAM. The internal registers of the EPM5032 only appear at odd addresses. A8 is used to select the protection or video control register, so they are mirrored: $800000-$8001FF : Protection register $800200-$8003FF : Video control register : $83FC00-$83FDFF : Protection register $83FE00-$83FFFF : Video control register These registers are write only. Reading any odd address returns the currently selected value from the protection table in D3-D0, with D7-D4 set to one. All games access the protection register at $800001 and the video control register at $800201. Video control register Bits 3-0 of the value written to the video control register are used as follows: D3 : ? (No effect) D2 : 0= Pixels 262-319 are blanked, 1= Pixels 262-319 are visible. D1 : 0= Pixels are wider and there is some flickering, 1= Normal display D0 : 0= Screen on, 1= Screen blanked All games write $06 for a normal display and $07 to turn off the screen. When the screen is blanked via bit 0 or 2, the /BLANK input on the color encoder is asserted and a black color is output, which is unrelated to any value stored in color RAM. This also disables shadow/hilight effects so it isn't possible to make the black color lighter or darker. It would seem that the Sega C2 video hardware only allows a 320 pixel display to be used. Trying to use a 256 pixel display results in an unstable display. While the VDP may be putting out the right signals, chances are the EPM5032 is programmed to support the 320 pixel mode exclusively. Shadow/Hilight mode The VDP outputs a signal which indicates if the current pixel data on the color bus should be shown normally, or if shadow/hilight effects should be applied. I'm assuming the EPM5032 gets this information, as it is in control of the /SHADE pin of the color encoder. There is no distinction made between shadow or hilight sprites (pixel data is $3E or $3F) either. It is up to bit 15 of the color RAM data to tell the color encoder to apply shadow or hilight effects, regardless of the VDP which can only indicate in general if an effect should be applied, not which one it is. Color RAM The analog RGB output of the VDP is not used. Instead the VDP has an 8-bit bus (which I'll call the color bus, using Yamaha's terminology) that transmits graphics data. It would seem to have the following format: D7 - Normal or shadow/hilight effect indicator D6 - Sprite or background pixel indicator D5 - Bit 1 of palette select D4 - Bit 0 of palette select D3 - Bit 3 of pixel data D2 - Bit 2 of pixel data D1 - Bit 1 of pixel data D0 - Bit 0 of pixel data Bits 7-5 go through the EPM5032 chip, so it isn't possible to tell which bits serve what purpose. The function of these bits could be swapped around. The color bus goes to 4K of color RAM, which is arranged as 2Kx16. The color RAM data is fed into a 315-5242 encoder, which outputs 15-bit RGB color and can apply shadow or hilight effects. Part of the color bus is shared with the EPM5032 chip which controls the color encoder, provides palette banking (there's more color RAM than could be addressed by the color bus), and to control the palettes selected as part of a protection feature. Here's a layout of how the color RAM is interfaced to the rest of the system: A0 - Color bus bit 0 A1 - Color bus bit 1 A2 - Color bus bit 2 A3 - Color bus bit 3 A4 - Color bus bit 4 A5 - EPM5032 pin 26 (Color bus bit 5) A6 - EPM5032 pin 25 A7 - EPM5032 pin 24 A8 - EPM5032 pin 23 (Color bus bit 6) A9 - I/O chip port H bit 0 A10 - I/O chip port H bit 1 This arrangement divides the color RAM into four 1K units which are selected by I/O chip port H. The EPM5032 controls how the current 1K unit of color RAM is used. Despite the possibilities of the EPM5032 controlling multiple aspects about how the color RAM is accessed, nearly all games have the same implementation: - The sprite/background indicator bit selects the first 512 bytes of the current 1K for background pixels, and the latter 512 bytes for sprite pixels. - Writing to the protection register sets two bank select values which divide the 512 bytes for backgrounds or sprites into four banks of 128 bytes: D0-D1 choose the background palette bank D3-D2 choose the sprite palette bank - The lower 6 bits of the color bus (color palette and pixel data) are used as an index into the remaining 128 bytes (64 words), and the value selected is sent to the color encoder. Here's a memory map of color RAM to represent this setup, for the current 1K chunk being used: $0000-$007F : Background palette data, for bank 0 $0080-$00FF : Background palette data, for bank 1 $0000-$017F : Background palette data, for bank 2 $0180-$01FF : Background palette data, for bank 3 $0200-$027F : Sprite palette data, for bank 0 $0280-$02FF : Sprite palette data, for bank 1 $0300-$037F : Sprite palette data, for bank 2 $0380-$03FF : Sprite palette data, for bank 3 Remember that by writing to the protection register, one of four banks can be selected for the backgrounds and for the sprites. When the CPU is accessing color RAM no banking is applied by the EPM5032, and it can freely read or write color RAM in 1K units as selected by port H of the I/O chip. VDP registers I'll only list some of the register bits that have alternate functions or ones that are worth mentioning. Register $80 D3 : 1= Alternating lines of the display are blanked, the lines selected change on even and odd frames. D1 : 1= This bit locks up the hardware when set. D0 : 1= External video input enable, but this results in bad sync since there is no external video source. Register $8B D7 : 1= VDP controls color bus. Reading or writing color RAM at any address only affects address zero, and the data read/written will often be corrupted. 0= CPU controls color bus. During this time garbage data is displayed on the screen if it is enabled. (through the video control register only, if the screen is blanked by bit 6 of register $81 there will still be garbage shown) D6 : 1= Setting this bit locks up the hardware when set. All games only access color RAM during the vertical blanking period, so the graphical garbage shown when the CPU hogs the color bus isn't visible. Register $8C D7 : 1= Setting this bit locks up the hardware when set. D6 : 1= Display is enabled 0= Display is blanked (black) D5 : 1= Bad sync, lines seem to be cropped to 256 pixels. D4 : 0= The background/sprite indicator bit is always set to zero, so the current background palette bank is used for sprites as well. 1= The background/sprite indicator bit works normally. D0 : 1= 320-pixel display 0= This should be a 256-pixel display, but you just get bad sync instead. Bits 1 and 2 of this register do not enable interlacing regardless of any setting. ---------------------------------------------------------------------------- I/O chip ---------------------------------------------------------------------------- The System C2 hardware uses a 315-5296 I/O chip, as found in many other Sega boards. It has 8 internal registers, eight I/O ports, and provides an interface to Yamaha FM sound chips. Here is a description of the I/O ports. I tested the board in a mini NeoGeo cabinet, so some of the button descriptions are specific to the NeoGeo only. $840001 - Port A - Player 1 inputs D7 : 0= UP pressed, 1= released D6 : 0= DOWN pressed, 1= released D5 : 0= LEFT pressed, 1= released D4 : 0= RIGHT pressed, 1= released D3 : 0= Button D pressed, 1= released D2 : 0= Button C pressed, 1= released D1 : 0= Button B pressed, 1= released D0 : 0= Button A pressed, 1= released $840003 - Port B - Player 2 inputs D7 : 0= UP pressed, 1= released D6 : 0= DOWN pressed, 1= released D5 : 0= LEFT pressed, 1= released D4 : 0= RIGHT pressed, 1= released D3 : 0= Button D pressed, 1= released D2 : 0= Button C pressed, 1= released D1 : 0= Button B pressed, 1= released D0 : 0= Button A pressed, 1= released $840005 - Port C - Miscellaneous inputs D7 : From MB3773P pin 1. (/RESET output) D6 : From uPD7759 pin 18. (/BUSY output) D5 : From pin 8 of CN2. D4 : From pin 7 of CN2. D3 : From pin 5 of CN2. D2 : From pin 4 of CN2. D1 : From pin 3 of CN2. D0 : From pin 2 of CN2. The trace to D7 comes out of a 74LS244 who's input is the MB3773P /RESET signal. It looks like the LS244 is always enabled as far as I can tell, so D7 will not be tristated and can't be used for anything else. $840007 - Port D - Miscellaneous outputs D7 : To pin 3 of JP15. (Watchdog clock control) D6 : To MUTE input pin on TDA1518BQ amplifier. D5 : To CN2 pin 10. (Unknown purpose) D4 : To CN2 pin 11. (Unknown purpose) D3 : To CN1 pin K. (Coin lockout 2) D2 : To CN1 pin 9. (Coin lockout 1) D1 : To CN1 pin J. (Coin meter 2) D0 : To CN1 pin 8. (Coin meter 1) The I/O chip pins for bits D0-D6 go through a A1603C amplifier, which allows large loads to be driven such as the coin meters, lockout hardware, and mute switch of the amplifier. Therefore pins 10, 11 of CN2 may be able to control lamps or other external hardware. $840009 - Port E - Service / Coin inputs D7 : Always returns '1' D6 : 0= SELECT GAME button pressed, 1= released D5 : 0= 2P START button pressed, 1= released D4 : 0= 1P START button pressed, 1= released D3 : 0= Service switch pressed, 1= released D2 : 0= Test switch pressed, 1= released D1 : 0= Coin inserted in 1P slot, 1= no coin D0 : 0= Coin inserted in 2P slot, 1= no coin $84000B - Port F - DIP switch #1 D7 : Switch #1 is 1=off, 0=on D6 : Switch #2 is 1=off, 0=on D5 : Switch #3 is 1=off, 0=on D4 : Switch #4 is 1=off, 0=on D3 : Switch #5 is 1=off, 0=on D2 : Switch #6 is 1=off, 0=on D1 : Switch #7 is 1=off, 0=on D0 : Switch #8 is 1=off, 0=on $84000D - Port G - DIP switch #2 D7 : Switch #1 is 1=off, 0=on D6 : Switch #2 is 1=off, 0=on D5 : Switch #3 is 1=off, 0=on D4 : Switch #4 is 1=off, 0=on D3 : Switch #5 is 1=off, 0=on D2 : Switch #6 is 1=off, 0=on D1 : Switch #7 is 1=off, 0=on D0 : Switch #8 is 1=off, 0=on $84000F - Port H - Miscellaneous outputs D7 : To pin A19 of CN4 D6 : To pin B19 of CN4 D5 : ? D4 : ? D3 : To pin 31 of uPD7759 sample ROM (A18 on a 27C040) D2 : To pin 30 of uPD7759 sample ROM (A17 on a 27C040) D1 : To A10 of color RAM D0 : To A9 of color RAM Bits 0,1 are used to control part of the color RAM banking, by selecting a 1K bank out of the total 4K of color RAM. The remaining address bits come from the EPM5032 EPLD chip and the VDP color bus. Bits 2,3 go through a set of jumpers that connect the pins indicated in the sample ROM socket to ground or to these pins. Bits 4,5 may be additional outputs for selecting the type of EPROM used for uPD7759 samples, but I haven't confirmed this. Bits 6,7 are outputs to the additional pins of the CN3. Protection registers $840011 - Returns $53 ('S') when read. $840013 - Returns $45 ('E') when read. $840015 - Returns $47 ('G') when read. $840017 - Returns $41 ('A') when read. Writing to these registers does nothing, they are read-only. Control registers $840019 - ? (Returns $FD when read) $84001B - ? (Returns $88 when read) $84001D - ? (Returns $FD when read) $84001F - ? (Returns $88 when read) Bits 2-0 of $84001D controls the state of the CNT2-0 output pins, which are used as follows: CNT0 - Connected to test point 2. CNT1 - ? CNT2 - Connected to pin 6 of missing GAL16V8 chip (IC23) ---------------------------------------------------------------------------- Hardware information ---------------------------------------------------------------------------- Audio output The left channel output of the YM3438 is connected to the rest of the audio mixing and amplification circuitry, the right channel output pin is unconnected. So even though a stereo sound chip is used, only mono output is available. Test points TP1 - From pin D of CN1. (+5V source, but missing FLT9 in path) TP2 - From CNT0 output of I/O chip. (bit 0 of $84001D) TP3 - From CKOT. (FM sound chip clock from I/O chip) TP4 - From 68000 pin 26. (FC2) TP5 - From 68000 pin 19. (/VMA) TP6 - From 68000 pin 20. (E) TP7 - From pin B18 of CN4. (additional pin of standard expansion connector) TP8 - From 15 of IC36. (where an extra GAL16V8 would go) The YM3438 doesn't use the clock signal from the I/O chip. Watchdog disable Cut the trace going between pin 1 of the Fujitsu MB3773 and a resistor to disconnect the /RESET output signal from the watchdog chip. ---------------------------------------------------------------------------- Jumper settings ---------------------------------------------------------------------------- JP5 - EPROM size for IC 31, 32 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3-2 shorted: EPROMs are 27C020 2-1 shorted: EPROMs are 27C040 JP7 - EPROM size for IC 33, 34 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3-2 shorted: EPROMs are 27C020 2-1 shorted: EPROMs are 27C040 JP15 - Watchdog control ~~~~~~~~~~~~~~~~~~~~~~~ This jumper normally has pins 2,1 shorted and pin 3 left open. Each pin has the following assignment: 1 - Output from VDP /HSYNC pin which is also shared with pin 13 (an input) on the EPM5032 EPLD chip. 2 - Goes to the MB3773B CK input. (input clock to watchdog chip) 3 - Output from bit 7 of I/O chip port D. It would seem that in the default state, the watchdog chip is prevented from causing a reset by receiving the horizontal sync pulse from the VDP. However, in my tests the system would always reset, so I disconnected the watchdog chip. It could be that /HSYNC was mislabeled in the Genesis schematics (JP15 pin 1 goes to VDP pin 43) or that perhaps /HSYNC doesn't work as one would expect. If the jumper has pins 3-2 shorted instead, then bit 7 of I/O chip port D provides the clock signal. I don't know how often bit 7 would have to be toggled to keep the watchdog going. JP16 - Unknown ~~~~~~~~~~~~~~ If pins 2-1 are shorted, the system is temporarily halted. JP17-JP20 - uPD7759 EPROM configuration ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ JP17 Pin 1 - From pin 12 of IC23 (74LS08). Pin 2 - Connected to pin 24 of socket. (/OE) Pin 3 - Connected to JP18 pin 1. (and something else?) JP18 Pin 1 - Connected to JP17 pin 3. (and something else?) Pin 2 - Connected to pin 2 of socket. (A16) Pin 3 - Ground JP19 Pin 1 - From bit 2 of I/O chip port H. Pin 2 - Connected to pin 30 of socket. (A17) Pin 3 - Ground JP20 Pin 1 - From bit 3 of I/O chip port H. Pin 2 - Connected to pin 31 of socket. (A18) Pin 3 - Ground I don't have the complete description of these jumpers, but basically they configure certain pins of the EPROM socket to handle chips with different capacities. In a Puyo Puyo 2 board with a 27C040, all four jumpers have pins 2-1 shorted with pin 3 left open. ---------------------------------------------------------------------------- Connector pinouts ---------------------------------------------------------------------------- CN1 (56-pin JAMMA edge connector) Not included, it's a standard JAMMA connector. CN2 (12-pin right-angle header) 1 - Ground 2 - Bit 0 of I/O chip port C 3 - Bit 1 of I/O chip port C 4 - Bit 2 of I/O chip port C 5 - Bit 3 of I/O chip port C 6 - Ground 7 - Bit 4 of I/O chip port C 8 - Bit 5 of I/O chip port C 9 - (N.C.) 10 - Bit 5 of I/O chip port D 11 - Bit 4 of I/O chip port D 12 - Ground Pins 1-5,7-8 are additional inputs, which might be used for other types of input devices. Pins 10,11 are outputs and are capable of driving large loads. They may be used for lamps or other external hardware. CN3 (10-pin right-angle header) 1 - +5V 2 - +5V 3 - +5V 4 - +5V 5 - (N.C.) 6 - Ground 7 - Ground 8 - Ground 9 - Ground 10 - +12V CN4 (20-pin two-row header) A1 - +5V B1 - +5V A2 - Ground B2 - Ground A3 - (N.C.) B3 - (N.C.) A4 - 68000 A1 B4 - 68000 A2 A5 - 68000 A3 B5 - 68000 A4 A6 - 68000 A5 B6 - 68000 D0 A7 - 68000 D1 B7 - 68000 D2 A8 - 68000 D3 B8 - 68000 D4 A9 - 68000 D5 B9 - 68000 D6 A10 - 68000 D7 B10 - 68000 /RD A11 - 68000 /LWR B11 - 68000 /UWR A12 - /RESET B12 - /CS A13 - (N.C.) B13 - (N.C.) A14 - Ground B14 - Ground A15 - +5V B15 - +5V A16 - ? B16 - ? A17 - To CN2 pin 7 B17 - To CN2 pin 8 A18 - ? B18 - ? A19 - I/O chip port H bit 6 B19 - I/O chip port H pit 7 A20 - ? B20 - ? The chip select signal for pin B12 comes from pin 17 of IC26, which is a GAL16V8 labeled as Sega part 315-5395. I don't know where in the memory map this is located at. I/O chip port C bits 4,5 are inputs connected to pins A17/B17, which are also shared with CN2 pins 7,8. I/O chip port H bits 6,7 are outputs connected to pins A19/B19. Pins 16-20 for both rows are a Sega C2 specific addition to this standard type of connector which is used in other Sega boards. (After Burner II, Galaxy Force II, System 16B, System 18, System 24) This connector is used in other games for an I/O board. (e.g. analog inputs for Heavyweight Champ on System 16B, 4-player inputs for D.D. Crew on System 18) ---------------------------------------------------------------------------- Credits and Acknowledgements ---------------------------------------------------------------------------- - Haze for his assistance with c2emu and technical advice. - Aaron Giles for documenting the protection scheme. - MD Game Sales for the Sega C2 boards. - Chris MacDonald for support and testing. ---------------------------------------------------------------------------- Disclaimer ---------------------------------------------------------------------------- If you use any information from this document, please credit me (Charles MacDonald) and optionally provide a link to my webpage (http://cgfm2.emuviews.com/) so interested parties can access it. The credit text should be present in the accompanying documentation of whatever project which used the information, or even in the program itself (e.g. an about box). Regarding distribution, you cannot put this document on another website, nor link directly to it.