Difference between revisions of "Sega System C2 hardware notes (2003)"

From Sega Retro
(Undo revision 348733 by Black Squirrel (talk))
 
Line 2: Line 2:
  
  
−
<pre>-------------------------------------------------------------------------------
+
<pre>
−
notaz's SVP doc
 
−
$Id: svpdoc.txt 964 2014-09-23 00:27:41Z notaz $
 
−
Copyright 2008, Grazvydas Ignotas (notaz)
 
−
-------------------------------------------------------------------------------
 
  
−
If you use this, please credit me in your work or it's documentation.
+
Sega System C2 hardware notes
−
Tasco Deluxe should also be credited for his pioneering work on the subject.
+
by Charles MacDonald
−
Thanks.
+
WWW: http://cgfm2.emuviews.com
  
−
Use monospace font and disable word wrap when reading this document.
+
Unpublished work Copyright 2000-2003 Charles MacDonald
  
−
updates:
+
This document is in a very preliminary state and is subject to change.
−
2014-09-23: minor additions about memory map
+
Most everything within has been tested and verified on a System C2 board,
−
2008-03-05: added a few notes about arithmetic op operands.
+
but please be aware that my testing methods or interpretations of results
−
2008-02-06: added Tasco Deluxe's correction about PMC register reads.
+
could be flawed. I can't guarantee that everything is 100% accurate.
  
 +
Table of contents
  
−
-------------------------------------------------------------------------------
+
  1. 68000 memory map
−
  Table of Contents
+
2. uPD7759
−
-------------------------------------------------------------------------------
+
3. Video hardware and EPM5032 registers
−
+
4. I/O chip
−
  0. Introduction
+
5. Hardware information
−
  1. Overview
+
6. Jumper settings
−
  2. The SSP160x DSP
+
7. Connector pinouts
−
    2.1. General registers
+
8. Credits and Acknowledgements
−
    2.2. External registers
+
9. Disclaimer
−
    2.3. Pointer registers
 
−
    2.4. The instruction set
 
−
  3. Memory map
 
−
  4. Other notes
 
  
 +
----------------------------------------------------------------------------
 +
68000 memory map
 +
----------------------------------------------------------------------------
  
−
-------------------------------------------------------------------------------
+
$000000-$0FFFFF : Data from EPROMs in EVEN0 and ODD0 sockets.
−
  0. Introduction
+
$100000-$1FFFFF : Data from EPROMs in EVEN1 and ODD1 sockets.
−
-------------------------------------------------------------------------------
+
$200000-$7FFFFF : Reading or writing this area causes a lockup.
 +
$800000-$83FFFF : Protection register and video control.
 +
$840000-$87FFFF : I/O chip.
 +
$880000-$8BFFFF : uPD7759 interface.
 +
$8C0000-$8FFFFF : Color RAM (1K, mirrored every 1K)
 +
$900000-$9FFFFF : Mirror of $800000-$8FFFFF area.
 +
  $A00000-$BFFFFF : Reading or writing this area causes a lockup.
 +
$C00000-$DFFFFF : VDP
 +
$E00000-$FFFFFF : Work RAM (64K, mirrored every 64K)
  
−
This document is an attempt to provide technical information needed to
+
The details of the protection register, video control register, I/O chip,
−
emulate Sega's SVP chip. It is based on reverse engineering Virtua Racing
+
and uPD7759 are explained later on.
−
game and on various Internet sources. Only some of the information provided
 
−
here has been verified on the real hardware, so some things are likely to be
 
−
inaccurate.
 
  
−
The following information sources were used while writing this document
+
If any EPROMs are missing from the program ROM sockets the corresponding
−
and emulator implementation:
+
memory locations will return the prefetch value. For example:
  
−
  [1] SVP Reference Guide (annotated) and SVP Register Guide (annotated)
+
; Assume EVEN1/ODD1 missing
−
      by Tasco Deluxe < tasco.deluxe @ gmail.com >
+
        move.w  #$100000, d0    ; Read from second ROM pair
−
      http://www.sharemation.com/TascoDLX/SVP%20Reference%20Guide%202007.02.11.txt
+
        nop                    ; D0 = $4E71
−
      http://www.sharemation.com/TascoDLX/SVP%20Register%20Guide%202007.02.11.txt
 
−
  [2] SSP1610 disassembler
 
−
      written by Pierpaolo Prazzoli, MAME source code.
 
−
      http://mamedev.org/
 
−
  [3] SSP1601 DSP datasheet
 
−
      http://notaz.gp2x.de/docs/SSP1601.pdf
 
−
  [4] DSP page (with code samples) in Samsung Semiconductor website from 1997
 
−
      retrieved from Internet Archive: The Wayback Machine
 
−
      http://web.archive.org/web/19970607052826/www.sec.samsung.com/Products/dsp/dspcore.htm
 
−
  [5] Sega's SVP Chip: The Road not Taken?
 
−
      Ken Horowitz, Sega-16
 
−
      http://sega-16.com/feature_page.php?id=37&title=Sega's%20SVP%20Chip:%20The%20Road%20not%20Taken?
 
  
 +
The VDP is only accessible at specific addresses within the memory range
 +
allocated to it. Reading or writing an invalid address will cause a lockup.
 +
Here's a bitmask of the address bus to indicate which addresses are valid:
  
−
-------------------------------------------------------------------------------
+
MSB                  LSB
−
  1. Overview
+
  110??000????????000rrrrr
−
-------------------------------------------------------------------------------
 
  
−
The only game released with SVP chip was Virtua Racing. There are at least 4
+
1 - Bit must be '1'
−
versions of the game: USA, Jap and 2 different Eur revisions. Three of them
+
0 - Bit must be '0'
−
share identical SSP160x code, one of the Eur revisions has some differences.
+
? - Value does not matter
 +
r - VDP internal register ($00-$1F)
  
−
From the software developer's point of view, the game cartridge contains
+
To my knowledge all games only access the VDP at $C00000-$C0001F, and do not
−
at least:
+
use any of the mirrored locations.
  
−
  * Samsung SSP160x 16-bit DSP core, which includes [3]:
+
For all memory within $800000-$9FFFFF, writing to even addresses has no
−
    * Two independent high-speed RAM banks, accessed in single clock cycle,
+
effect and reading from them returns the MSB of the prefetch value.
−
      256 words each.
 
−
    * 16 x 16 bit multiply unit.
 
−
    * 32-bit ALU, status register.
 
−
    * Hardware stack of 6 levels.
 
−
  * 128KB of DRAM.
 
−
  * 2KB of IRAM (instruction RAM).
 
−
  * Memory controller with address mapping capability.
 
−
  * 2MB of game ROM.
 
  
−
[5] claims there is also "2 Channels PWM" in the cartridge, but it's either
+
----------------------------------------------------------------------------
−
not used or not there at all. European cartridge doesn't have audio pins
+
uPD7759
−
connected.
+
----------------------------------------------------------------------------
−
Various sources claim that SSP160x is SSP1601 which is likely to be true,
 
−
because the code doesn't seem to use any SSP1605+ features.
 
  
 +
The System C2 board uses a NEC uPD7759 chip which can play back ADPCM
 +
samples. It can use up to 128K of ROM directly, so additional bits are
 +
provided through the I/O chip to control banking, allowing for 512K of ROM
 +
to be used in four 128K banks.
  
−
-------------------------------------------------------------------------------
+
Writing to any odd address within $880000-$8BFFFF will send the value to
−
  2. The SSP160x DSP
+
  the message input of the uPD7759. Reading any odd address returns $FF.
−
-------------------------------------------------------------------------------
 
  
−
SSP160x is 16-bit DSP, capable of performing multiplication + addition in
+
The status of the uPD7759 /BUSY pin can be read through bit 6 of I/O chip
−
single clock cycle [3]. It has 8 general, 8 external and 8 pointer registers.
+
port C. I don't know how the uPD7759 is reset, which apparently is necessary
−
There is a status register which has operation control bits and condition
+
when switching banks so the chip will re-read the header data at the start
−
flags. Condition flags are set/cleared during ALU (arithmetic, logic)
+
of the bank.
−
operations. It also has 6-level hardware stack and 2 internal RAM banks
 
−
RAM0 and RAM1, 256 words each.
 
  
−
The device is only capable of addressing 16-bit words, so all addresses refer
+
----------------------------------------------------------------------------
−
to words (16bit value in ROM, accessed by 68k through address 0x84 would be
+
Video hardware and EPM5032 registers
−
accessed by SSP160x using address 0x42).
+
----------------------------------------------------------------------------
  
−
[3] mentions interrupt pins, but interrupts don't seem to be used by SVP code
+
An Altera EPM5032 EPLD device is used to control some aspects of the
−
(actually there are functions which look like interrupt handler routines, but
+
video hardware and provide a protection feature that games use to prevent
−
they don't seem to do anything important).
+
bootlegging. It has the following pinout:
  
−
2.1. General registers
+
Pin    Type            Description
−
----------------------
+
1      Input          /VSYNC from VDP pin 41
 +
2     Clock          53.693 MHz clock from OSC1
 +
3      Output          Output to D1A input of 74LS08.
 +
4      Output          To /BLANK input on color encoder
 +
5      Output          Clock input of LS373 to latch color bus data
 +
6      Output          To /SHADE input on color encoder
 +
9      Input          68000 A8
 +
10    Input          68000 /LDS
 +
11    Input          Bit 7 of latched color bus data
 +
12    Input/Output    Connected to pin 19 of 315-5242
 +
13    Input          /HSYNC from VDP pin 43
 +
14    Input          SPA/B from VDP pin 40
 +
15    Input          Connected to pin 3 of 315-5394
 +
16    Input          68000 R//W
 +
17    Input          68000 D3
 +
18    Input          68000 D2
 +
19    Input          68000 D1
 +
20    Input          68000 D0
 +
23    Output          Color RAM A8
 +
24    Output          Color RAM A7
 +
25    Output          Color RAM A6
 +
26    Output          Color RAM A5
 +
27    Output          Bit 6 of latched color bus data
 +
28    Output          Bit 5 of latched color bus data
  
−
There are 8 general registers: -, X, Y, A, ST, STACK, PC and P ([2] [4]).
+
Pins 7,22 are +5V, pins 8,21 are ground.
−
Size is given in bits.
 
  
−
2.1.1. "-"
+
Pin 3 is connected to D1A of an AND gate, D1B is from +5V and the output
−
  Constant register with all bits set (0xffff). Also used for programming
+
of the gate goes to 315-5394 pin 1. I don't know what this is for.
−
  external registers (blind reads/writes, see 2.2).
 
−
  size: 16
 
  
−
2.1.2. "X"
+
The /HSYNC output of the VDP appears to be the dot clock, as it is fed
−
  Generic register. Also acts as a multiplier 1 for P register.
+
into the clock input of the color encoder.
−
  size: 16
 
  
−
2.1.3. "Y"
+
The EPM5032 controls the clock input of a LS373 which is used to latch
−
  Generic register. Also acts as a multiplier 2 for P register.
+
the color bus outputs. The latched data is then sent to the EPM5032 and
−
  size: 16
+
color RAM.
  
−
2.1.4. "A"
+
The internal registers of the EPM5032 only appear at odd addresses. A8 is
−
  Accumulator. Stores the result of all ALU (but not multiply) operations,
+
used to select the protection or video control register, so they are
−
  status register is updated according to this. When directly accessed,
+
mirrored:
−
  only upper word is read/written. Low word can be accessed by using AL
 
−
  (see 2.2.8).
 
−
  size: 32
 
  
−
2.1.5. "ST"
+
$800000-$8001FF : Protection register
−
  STatus register. Bits 0-9 are CONTROL, other are FLAG [2]. Only some of
+
  $800200-$8003FF : Video control register
−
  them are actually used by SVP.
+
  :
−
  Bits: fedc ba98 7654 3210
+
  $83FC00-$83FDFF : Protection register
−
    210 - RPL    "Loop size". If non-zero, makes (rX+) and (rX-) respectively
+
$83FE00-$83FFFF : Video control register
−
                  modulo-increment and modulo-decrement (see 2.3). The value
 
−
                  shows which power of 2 to use, i.e. 4 means modulo by 16.
 
−
    43 - RB    Unknown. Not used by SVP code.
 
−
    5  - ST5    Affects behavior of external registers. See 2.2.
 
−
    6  - ST6    Affects behavior of external registers. See 2.2.
 
−
                  According to [3] (5,6) bits correspond to hardware pins.
 
−
    7  - IE    Interrupt enable? Not used by SVP code.
 
−
    8  - OP    Saturated value? Not used by SVP code.
 
−
    9  - MACS  MAC shift? Not used by SVP code.
 
−
    a  - GPI_0 Interrupt 0 enable/status? Not used by SVP code.
 
−
    b  - GPI_1 Interrupt 1 enable/status? Not used by SVP code.
 
−
    c  - L      L flag. Similar to carry? Not used by SVP code.
 
−
    d  - Z      Zero flag. Set after ALU operations, when all 32 accumulator
 
−
                  bits become zero.
 
−
    e  - OV    Overflow flag. Not used by SVP code.
 
−
    f  - N      Negative flag. Set after ALU operations, when bit31 in
 
−
                  accumulator is 1.
 
−
  size: 16
 
  
−
2.1.6. "STACK"
+
These registers are write only. Reading any odd address returns the
−
  Hardware stack of 6 levels [3]. Values are "pushed" by directly writing to
+
currently selected value from the protection table in D3-D0, with D7-D4
−
  it, or by "call" instruction. "Pop" is performed by directly reading the
+
set to one.
−
  register or by "ret" instruction.
 
−
  size: 16
 
  
−
2.1.7. "PC"
+
All games access the protection register at $800001 and the video control
−
  Program Counter. Can be written directly to perform a jump. It is not clear
+
register at $800201.
−
  if it is possible to read it (SVP code never does).
 
−
  size: 16
 
  
−
2.1.8. "P"
+
Video control register
−
  multiply Product - multiplication result register.
 
−
  Always contains 32-bit multiplication result of X, Y and 2 (P = X * Y * 2).
 
−
  X and Y are sign-extended before performing the multiplication.
 
−
  size: 32
 
  
−
2.2. External registers
+
Bits 3-0 of the value written to the video control register are used
−
-----------------------
+
as follows:
  
−
The external registers, as the name says, are external to SSP160x, they are
+
D3 : ? (No effect)
−
hooked to memory controller in SVP, so by accessing them we actually program
+
D2 : 0= Pixels 262-319 are blanked, 1= Pixels 262-319 are visible.
−
the memory controller. They act as programmable memory access registers or
+
D1 : 0= Pixels are wider and there is some flickering, 1= Normal display
−
external status registers [1]. Some of them can act as both, depending on how
+
D0 : 0= Screen on, 1= Screen blanked
−
ST5 ans ST6 bits are set in status register. After a register is programmed,
 
−
accessing it causes reads/writes from/to external memory (see section 3 for
 
−
the memory map). The access may also cause some additional effects, like
 
−
incremental of address, associated with accessed register.
 
−
In this document and my emu, instead of using names EXT0-EXT7
 
−
from [4] I used different names for these registers. Those names are from
 
−
Tasco Deluxe's [1] doc.
 
  
−
All these registers can be blind-accessed (as said in [1]) by performing
+
All games write $06 for a normal display and $07 to turn off the screen.
−
(ld -, PMx) or (ld PMx, -). This programs them to access memory (except PMC,
 
−
where the effect is different).
 
−
All registers are 16-bit.
 
  
−
2.2.1. "PM0"
+
When the screen is blanked via bit 0 or 2, the /BLANK input on the color
−
  If ST5 or ST6 is set, acts as Programmable Memory access register
+
encoder is asserted and a black color is output, which is unrelated to any
−
  (see 2.2.7). Else it acts as status of XST (2.2.4). It is also mapped
+
value stored in color RAM. This also disables shadow/hilight effects so
−
  to a15004 on 68k side:
+
it isn't possible to make the black color lighter or darker.
−
    ???????? ??????10
 
−
    0: set, when SSP160x has written something to XST
 
−
        (cleared when a15004 is read by 68k)
 
−
    1: set, when 68k has written something to a15000 or a15002
 
−
        (cleared on PM0 read by SSP160x)
 
−
  Note that this is likely to be incorrect, but such behavior is OK for
 
−
  emulation to work.
 
  
−
2.2.2. "PM1"
+
It would seem that the Sega C2 video hardware only allows a 320 pixel
−
  Programmable Memory access register. Only accessed with ST bits set by
+
display to be used. Trying to use a 256 pixel display results in an
−
  SVP code.
+
unstable display. While the VDP may be putting out the right signals,
 +
chances are the EPM5032 is programmed to support the 320 pixel mode
 +
exclusively.
  
−
2.2.3. "PM2"
+
Shadow/Hilight mode
−
  Same as PM1.
 
  
−
2.2.4. "XST"
+
The VDP outputs a signal which indicates if the current pixel data on
−
  If ST5 or ST6 is set, acts as Programmable Memory access register
+
the color bus should be shown normally, or if shadow/hilight effects should
−
  (only used by memory test code). Else it acts as eXternal STatus
+
be applied. I'm assuming the EPM5032 gets this information, as it is in
−
  register, which is also mapped to a15000 and a15002 on 68k side.
+
control of the /SHADE pin of the color encoder. There is no distinction
−
  Affects PM0 when written to.
+
made between shadow or hilight sprites (pixel data is $3E or $3F) either.
  
−
2.2.5. "PM4"
+
It is up to bit 15 of the color RAM data to tell the color encoder to
−
  Programmable Memory access register. Not affected by ST5 and ST6 bits,
+
apply shadow or hilight effects, regardless of the VDP which can only
−
  always stays in PMAR mode.
+
indicate in general if an effect should be applied, not which one it is.
  
−
2.2.6. "EXT5"
+
Color RAM
−
  Not used by SVP, so not covered by this document.
 
  
−
2.2.7. "PMC"
+
The analog RGB output of the VDP is not used. Instead the VDP has an 8-bit
−
  Programmable Memory access Control. It is set using 2 16bit writes, first
+
bus (which I'll call the color bus, using Yamaha's terminology) that
−
  address, then mode word. After setting PMAC, PMx should be blind accessed
+
transmits graphics data. It would seem to have the following format:
−
  using (ld -, PMx) or (ld PMx, -) to program it for reading or writing
 
−
  external memory respectively. Every PMx register can be programmed to
 
−
  access it's own memory location with it's own mode. Registers are programmed
 
−
  separately for reading and writing.
 
  
−
  Reading PMC register also shifts it's state (from "waiting for address" to
+
D7 - Normal or shadow/hilight effect indicator
−
  "waiting for mode" and back). In state "waiting for address" reads return
+
D6 - Sprite or background pixel indicator
−
  address word related to last PMx register accessed. If read in "waiting for
+
D5 - Bit 1 of palette select
−
  mode" state, we get the same value as in other state, but rotated by 4 (or
+
D4 - Bit 0 of palette select
−
  with nibbles swapped, VR always does this to words with both bytes equal,
+
D3 - Bit 3 of pixel data
−
  like 'abab' to get 'baba' for chessboard dithering effect).
+
D2 - Bit 2 of pixel data
 +
D1 - Bit 1 of pixel data
 +
D0 - Bit 0 of pixel data
  
−
  The address word contains bits 0-15 of the memory word-address.
+
Bits 7-5 go through the EPM5032 chip, so it isn't possible to tell which
−
  The mode word format is as follows:
+
bits serve what purpose. The function of these bits could be swapped around.
−
    dsnnnv?? ???aaaaa
 
−
    a: bits 16-20 of memory word-address.
 
−
    n: auto-increment value. If set, after every access of PMx, word-address
 
−
        value related to it will be incremented by (words):
 
−
          1 - 1    5 - 16
 
−
          2 - 2    6 - 32
 
−
          3 - 4    7 - 128
 
−
          4 - 8
 
−
    d: make auto-increment negative - decrement by count listed above.
 
−
    s: special-increment mode. If current address is even (when accessing
 
−
        programmed PMx), increment it by 1. Else, increment by 32. It is not
 
−
        clear what happens if d and n bits are also set (never done by SVP).
 
−
    v: over-write mode when writing, unknown when reading (not used).
 
−
        Over-write mode splits the word being written into 4 nibbles and only
 
−
        writes out ones which are non zero.
 
−
  When auto-increment is performed, it affects all 21 address bits.
 
  
−
2.2.8. "AL"
+
The color bus goes to 4K of color RAM, which is arranged as 2Kx16. The color
−
  This register acts more like a general register.
+
RAM data is fed into a 315-5242 encoder, which outputs 15-bit RGB color
−
  If this register is blind-accessed, it is "dummy programmed", i.e. nothing
+
and can apply shadow or hilight effects.
−
  happens and PMC is reset to "waiting for address" state.
 
−
  In all other cases, it is Accumulator Low - 16 least significant bits of
 
−
  accumulator. Normally reading acc (ld X, A) you get 16 most significant
 
−
  bits, so this allows you access the low word of 32bit accumulator.
 
  
−
2.3. Pointer registers
+
Part of the color bus is shared with the EPM5032 chip which controls the
−
----------------------
+
color encoder, provides palette banking (there's more color RAM than could
 +
be addressed by the color bus), and to control the palettes selected as
 +
part of a protection feature. Here's a layout of how the color RAM is
 +
interfaced to the rest of the system:
  
−
There are 8 8-bit pointer registers rX, which are internal to SSP160x and are
+
A0  - Color bus bit 0
−
used to access internal RAM banks RAM0 and RAM1, or program memory indirectly.
+
A1  - Color bus bit 1
−
r0-r3 (ri) point to RAM0, r4-r7 (rj) point to RAM1. Each bank has 256 words of
+
A2  - Color bus bit 2
−
RAM, so 8bit registers can fully address them. The registers can be accessed
+
A3  - Color bus bit 3
−
directly, or 2 indirection levels can be used [ (rX), ((rX)) ]. They work
+
A4  - Color bus bit 4
−
similar to * and ** operators in C, only they use different types of memory
+
A5  - EPM5032 pin 26 (Color bus bit 5)
−
and ((rX)) also performs post-increment. First indirection level (rX) accesses
+
A6  - EPM5032 pin 25
−
a word in RAMx, second accesses program memory at address read from (rX), and
+
A7  - EPM5032 pin 24
−
increments value in (rX).
+
A8  - EPM5032 pin 23 (Color bus bit 6)
 +
A9  - I/O chip port H bit 0
 +
A10 - I/O chip port H bit 1
  
−
Only r0,r1,r2,r4,r5,r6 can be directly modified (ldi r0, 5), or by using
+
This arrangement divides the color RAM into four 1K units which are
−
modifiers. 3 modifiers can be applied when using first indirection level
+
  selected by I/O chip port H. The EPM5032 controls how the current 1K unit
−
(optional):
+
of color RAM is used.
−
  + : post-increment (ld a, (r0+) ). Increment register value after operation.
 
−
      Can be made modulo-increment by setting RPL bits in status register
 
−
      (see 2.1.5).
 
−
  - : post-decrement. Also can be made modulo-decrement by using RPL bits in ST.
 
−
  +!: post-increment, unaffected by RPL (probably).
 
−
These are only used on 1st indirection level, so things like ( ld a, ((r0+)) )
 
−
and (ld X, r6-) are probably invalid.
 
  
−
r3 and r7 are special and can not be changed (at least Samsung samples [4] and
+
Despite the possibilities of the EPM5032 controlling multiple aspects
−
SVP code never do). They are fixed to the start of their RAM banks. (They are
+
about how the color RAM is accessed, nearly all games have the same
−
probably changeable for ssp1605+, Samsung's old DSP page claims that).
+
implementation:
−
1 of these 4 modifiers must be used on these registers (short form direct
 
−
addressing? [2]):
 
−
  |00: RAMx[0] The very first word in the RAM bank.
 
−
  |01: RAMx[1] Second word
 
−
  |10: RAMx[2] ...
 
−
  |11: RAMx[3]
 
  
−
2.4. The instruction set
+
- The sprite/background indicator bit selects the first 512 bytes of the
−
------------------------
+
  current 1K for background pixels, and the latter 512 bytes for sprite
 +
  pixels.
  
−
The Samsung SSP16 series assembler uses right-to-left notation ([2] [4]):
+
- Writing to the protection register sets two bank select values which
−
ld X, Y
+
  divide the 512 bytes for backgrounds or sprites into four banks of
−
means value from Y should be copied to X.
+
  128 bytes:
  
−
Size of every instruction is word, some have extension words for immediate
+
  D0-D1 choose the background palette bank
−
values. When writing an interpreter, 7 most significant bits are usually
+
  D3-D2 choose the sprite palette bank
−
enough to determine which opcode it is.
 
  
−
encoding bits are marked as:
+
- The lower 6 bits of the color bus (color palette and pixel data) are
−
rrrr - general or external register, in order specified in 2.1 and 2.2
+
  used as an index into the remaining 128 bytes (64 words), and the value
−
      (0 is '-', 1 'X', ..., 8 is 'PM0', ..., 0xf is 'AL')
+
  selected is sent to the color encoder.
−
dddd - same as above, as destination operand
 
−
ssss - same as above, as source operand
 
−
jpp  - pointer register index, 0-7
 
−
j    - specifies RAM bank, i.e. RAM0 or RAM1
 
−
i*  - immediate value bits
 
−
a*  - offset in internal RAM bank
 
−
mm  - modifier for pointer register, depending on register:
 
−
        r0-r2,r4-r6  r3,r7  examples
 
−
      0:    (none)     |00  ld  a, (r0)      cmp a, (r7|00)
 
−
      1:        +!    |01  ld  (r0+!), a    ld  (r7|01), a
 
−
      2:          -    |10  add a, (r0-)
 
−
      3:          +    |11
 
−
cccc - encodes condition, only 3 used by SVP, see check_cond() below
 
−
ooo  - operation to perform
 
  
−
Operation is written in C-style pseudo-code, where:
+
  Here's a memory map of color RAM to represent this setup, for the
−
program_memory[X] - access program memory at address X
+
  current 1K chunk being used:
−
RAMj[X]            - access internal RAM bank j=0,1 (RAM0 or RAM1), word
 
−
                    offset X
 
−
RIJ[X]            - pointer register rX, X=0-7
 
−
pr_modif_read(m,X) - read pointer register rX, applying modifier m:
 
−
                      if register is r3 or r7, return value m
 
−
                      else switch on value m:
 
−
                        0: return rX;
 
−
                        1: tmp = rX; rX++; return tmp; // rX+!
 
−
                        2: tmp = rX; modulo_decrement(rX); return tmp; // rX-
 
−
                        3: tmp = rX; modulo_increment(rX); return tmp; // rX+
 
−
                      the modulo value used (if used at all) depends on ST
 
−
                      RPL bits (see 2.1.5)
 
−
check_cond(c,f)    - checks if a flag matches f bit:
 
−
                    switch (c) {
 
−
                      case 0: return true;
 
−
                      case 5: return (Z == f) ? true : false; // check Z flag
 
−
                      case 7: return (N == f) ? true : false; // check N flag
 
−
                    } // other conditions are possible, but they are not used
 
−
update_flags()    - update ST flags according to last ALU operation.
 
−
sign_extend(X)    - sign extend 16bit value X to 32bits.
 
−
next_op_address() - address of instruction after current instruction.
 
  
−
2.4.1. ALU instructions
+
$0000-$007F : Background palette data, for bank 0
 +
$0080-$00FF : Background palette data, for bank 1
 +
$0000-$017F : Background palette data, for bank 2
 +
$0180-$01FF : Background palette data, for bank 3
 +
$0200-$027F : Sprite palette data, for bank 0
 +
$0280-$02FF : Sprite palette data, for bank 1
 +
$0300-$037F : Sprite palette data, for bank 2
 +
$0380-$03FF : Sprite palette data, for bank 3
  
−
All of these instructions update flags, which are set according to full 32bit
+
Remember that by writing to the protection register, one of four banks
−
accumulator. The SVP code only checks N and Z flags, so it is not known when
+
can be selected for the backgrounds and for the sprites.
−
exactly OV and L flags are set. Operations are performed on full A, so
 
−
(andi A, 0) would clear all 32 bits of A.
 
  
−
They share the same addressing modes. The exact arithmetic operation is
+
When the CPU is accessing color RAM no banking is applied by the EPM5032,
−
determined by 3 most significant (ooo) bits:
+
and it can freely read or write color RAM in 1K units as selected by
−
  001 - sub - subtract    (OP -=)
+
  port H of the I/O chip.
−
  011 - cmp - compare      (OP -, flags are updated according to result)
 
−
  100 - add - add          (OP +=)
 
−
  101 - and - binary AND  (OP &=)
 
−
  110 - or - binary OR    (OP |=)
 
−
  111 - eor - exclusive OR (OP ^=)
 
  
−
  syntax        encoding            operation
+
  VDP registers
−
OP  A, s      ooo0 0000 0000 rrrr  A OP r << 16;
 
−
OP  A, (ri)  ooo0 001j 0000 mmpp  A OP RAMj[pr_modif_read(m,jpp)] << 16;
 
−
OP  A, adr    ooo0 011j aaaa aaaa  A OP RAMj[a] << 16;
 
−
OPi A, imm    ooo0 1000 0000 0000  A OP i << 16;
 
−
              iiii iiii iiii iiii
 
−
op  A, ((ri)) ooo0 101j 0000 mmpp  tmp = pr_modif_read(m,jpp);
 
−
                                    A OP program_memory[RAMj[tmp]] << 16;
 
−
                                    RAMj[tmp]++;
 
−
op  A, ri    ooo1 001j 0000 00pp  A OP RIJ[jpp] << 16;
 
−
OPi simm      ooo1 1000 iiii iiii  A OP i << 16;
 
  
−
Note that in (OP A, s) case, if s is 32bit register, operation is performed on
+
I'll only list some of the register bits that have alternate functions or
−
all 32 bits, including when s is accumulator itself, like for (and A, A), which
+
ones that are worth mentioning.
−
is a valid operation.
 
  
−
There is also "perform operation on accumulator" instruction:
+
Register $80
  
−
  syntax        encoding            operation
+
  D3 : 1= Alternating lines of the display are blanked, the lines selected
−
  mod cond, op  1001 000f cccc 0ooo  if (check_cond(c,f)) switch(o) {
+
        change on even and odd frames.
−
                                      case 2: A >>= 1; break; // arithmetic shift
+
  D1 : 1= This bit locks up the hardware when set.
−
                                      case 3: A <<= 1; break;
+
  D0 : 1= External video input enable, but this results in bad sync since
−
                                      case 6: A = -A; break; // negate A
+
        there is no external video source.
−
                                      case 7: A = abs(A); break; // absolute val.
 
−
                                    } // other operations are possible, but
 
−
                                      // they are not used by SVP.
 
  
−
2.4.2. Load (move) instructions
+
Register $8B
  
−
These instructions never affect flags (even ld A).
+
D7 : 1= VDP controls color bus. Reading or writing color RAM at any address
−
If destination is A, and source is 16bit, only upper word is transfered (same
+
        only affects address zero, and the data read/written will often be
−
thing happens on opposite). If dest. is A, and source is P, whole 32bit value
+
        corrupted.
−
is transfered. It is not clear if P can be destination operand (probably not,
+
      0= CPU controls color bus. During this time garbage data is displayed
−
no code ever does this).
+
        on the screen if it is enabled. (through the video control
−
Writing to STACK pushes a value there, reading pops. It is not known what
+
        register only, if the screen is blanked by bit 6 of register $81
−
happens on overflow/underflow (never happens in SVP code).
+
        there will still be garbage shown)
−
ld -, - is used as a nop.
+
D6 : 1= Setting this bit locks up the hardware when set.
  
−
  syntax        encoding            operation
+
  All games only access color RAM during the vertical blanking period, so
−
ld  d, s      0000 0000 dddd ssss  d = s;
+
  the graphical garbage shown when the CPU hogs the color bus isn't visible.
−
  ld  d, (ri)  0000 001j dddd mmpp  d = RAMj[pr_modif_read(m,jpp)];
 
−
ld  (ri), s  0000 010j ssss mmpp  RAMj[pr_modif_read(m,jpp)] = s;
 
−
ldi d, imm    0000 1000 dddd 0000  d = i;
 
−
              iiii iiii iiii iiii
 
−
ld  d, ((ri)) 0000 101j dddd mmpp  tmp = pr_modif_read(m,jpp);
 
−
                                    d = program_memory[RAMj[tmp]];
 
−
                                    RAMj[tmp]++;
 
−
ldi (ri), imm 0000 110l 0000 mmpp  RAMj[pr_modif_read(m,jpp)] = i;
 
−
              iiii iiii iiii iiii
 
−
ld  adr, a    0000 111j aaaa aaaa  RAMj[a] = A;
 
−
ld  d, ri    0001 001j dddd 00pp  d = RIJ[jpp];
 
−
ld  ri, s    0001 010j ssss 00pp  RIJ[jpp] = s;
 
−
ldi ri, simm  0001 1jpp iiii iiii  RIJ[jpp] = i;
 
−
ld  d, (a)    0100 1010 dddd 0000  d = program_memory[A[31:16]];
 
−
                                    // read a word from program memory. Offset
 
−
                                    // is the upper word in A.
 
  
−
2.4.3. Program control instructions
+
Register $8C
  
−
Only 3 instructions: call, ret (alias of ld PC, STACK) and branch. Indirect
+
D7 : 1= Setting this bit locks up the hardware when set.
−
jumps can be performed by simply writing to PC.
+
D6 : 1= Display is enabled
 +
      0= Display is blanked (black)
 +
D5 : 1= Bad sync, lines seem to be cropped to 256 pixels.
 +
D4 : 0= The background/sprite indicator bit is always set to zero, so
 +
        the current background palette bank is used for sprites as well.
 +
      1= The background/sprite indicator bit works normally.
 +
D0 : 1= 320-pixel display
 +
      0= This should be a 256-pixel display, but you just get bad sync
 +
        instead.
  
−
  syntax          encoding            operation
+
  Bits 1 and 2 of this register do not enable interlacing regardless of
−
  call cond, addr  0100 100f cccc 0000  if (check_cond(c,f)) {
+
  any setting.
−
                  aaaa aaaa aaaa aaaa    STACK = next_op_address(); PC = a;
 
−
                                      }
 
−
bra  cond, addr  0100 110f cccc 0000  if (check_cond(c,f)) PC = a;
 
−
                  aaaa aaaa aaaa aaaa
 
−
ret              0000 0000 0110 0101  PC = STACK; // same as ld PC, STACK
 
  
−
2.4.4. Multiply-accumulate instructions
+
----------------------------------------------------------------------------
 +
I/O chip
 +
----------------------------------------------------------------------------
  
−
Not sure if (ri) and (rj) really get loaded into X and Y, but multiplication
+
The System C2 hardware uses a 315-5296 I/O chip, as found in many other Sega
−
result surely is loaded into P. There is probably optional 3rd operand (1, 0;
+
boards. It has 8 internal registers, eight I/O ports, and provides an
−
encoded by bit16, default 1), but it's not used by SVP code.
+
interface to Yamaha FM sound chips.
  
−
  syntax          encoding            operation
+
  Here is a description of the I/O ports. I tested the board in a mini NeoGeo
−
  mld  (rj), (ri)  1011 0111 nnjj mmii  A = 0; update_flags();
+
  cabinet, so some of the button descriptions are specific to the NeoGeo only.
−
                                      X = RAM0[pr_modif_read(m,0ii)];
 
−
                                      Y = RAM1[pr_modif_read(m,1jj)];
 
−
                                      P = sign_extend(X) * sign_extend(Y) * 2
 
−
mpya (rj), (ri)  1001 0111 nnjj mmii  A += P; update_flags();
 
−
                                      X = RAM0[pr_modif_read(m,0ii)];
 
−
                                      Y = RAM1[pr_modif_read(m,1jj)];
 
−
                                      P = sign_extend(X) * sign_extend(Y) * 2
 
−
mpys (rj), (ri)  0011 0111 nnjj mmii  A -= P; update_flags();
 
−
                                      X = RAM0[pr_modif_read(m,0ii)];
 
−
                                      Y = RAM1[pr_modif_read(m,1jj)];
 
−
                                      P = sign_extend(X) * sign_extend(Y) * 2
 
  
−
-------------------------------------------------------------------------------
+
  $840001 - Port A - Player 1 inputs
−
  3. Memory map
 
−
-------------------------------------------------------------------------------
 
  
−
The SSP160x can access it's own program memory, and external memory through EXT
+
D7 : 0= UP pressed, 1= released
−
registers (see 2.2). Program memory is read-execute-only, the size of this
+
D6 : 0= DOWN pressed, 1= released
−
space is 64K words (this is how much 16bit PC can address):
+
D5 : 0= LEFT pressed, 1= released
 +
D4 : 0= RIGHT pressed, 1= released
 +
D3 : 0= Button D pressed, 1= released
 +
D2 : 0= Button C pressed, 1= released
 +
D1 : 0= Button B pressed, 1= released
 +
D0 : 0= Button A pressed, 1= released
  
−
  byte address word address  name
+
  $840003 - Port B - Player 2 inputs
−
        0-  7ff        0- 3ff  IRAM
 
−
      800-1ffff      400-ffff  ROM
 
  
−
There were reports that SVP has internal ROM, but fortunately they were wrong.
+
D7 : 0= UP pressed, 1= released
−
The location 800-1ffff is mapped from the same location in the 2MB game ROM.
+
D6 : 0= DOWN pressed, 1= released
−
The IRAM is read-only (as SSP160x doesn't have any means of writing to it's
+
D5 : 0= LEFT pressed, 1= released
−
program memory), but it can be changed through external memory space, as it's
+
D4 : 0= RIGHT pressed, 1= released
−
also mapped there.
+
D3 : 0= Button D pressed, 1= released
 +
D2 : 0= Button C pressed, 1= released
 +
D1 : 0= Button B pressed, 1= released
 +
D0 : 0= Button A pressed, 1= released
  
−
The external memory space seems to match the one visible by 68k, with some
+
$840005 - Port C - Miscellaneous inputs
−
differences:
 
  
−
      68k space      SVP space  word address name
+
  D7 : From MB3773P pin 1. (/RESET output)
−
        0-1fffff      0-1fffff      0- fffff game ROM
+
  D6 : From uPD7759 pin 18. (/BUSY output)
−
  200000-2fffff              ?              ?  unused (1)
+
  D5 : From pin 8 of CN2.
−
  300000-31ffff  300000-31ffff  180000-18ffff DRAM
+
  D4 : From pin 7 of CN2.
−
  320000-37ffff              ?              ? 3 mirrors od DRAM
+
  D3 : From pin 5 of CN2.
−
  380000-38ffff              ?              ?  unused (1)
+
  D2 : From pin 4 of CN2.
−
              ?  390000-3907ff 1c8000-1c83ff  IRAM
+
  D1 : From pin 3 of CN2.
−
  390000-39ffff              ?              ? "cell arrange" 1
+
  D0 : From pin 2 of CN2.
−
  3a0000-3affff              ?              ? "cell arrange" 2
 
−
  3b0000-3fffff              ?              ? unused (2)
 
−
  a15000-a1500f            n/a            n/a  Status/control registers
 
  
−
  unused (1) - reads seem to return data from internal bus (last word read by
+
The trace to D7 comes out of a 74LS244 who's input is the MB3773P /RESET
−
                SSP160x). Writes probably have no effect.
+
signal. It looks like the LS244 is always enabled as far as I can tell,
−
  unused (2) - reads return 0xffff, writes have no effect.
+
so D7 will not be tristated and can't be used for anything else.
  
−
The external memory can be read/written by SSP160x (except game ROM, which can
+
$840007 - Port D - Miscellaneous outputs
−
only be read).
 
  
−
"cell arrange" 1 and 2 are similar to the one used in SegaCD, they map
+
D7 : To pin 3 of JP15. (Watchdog clock control)
−
300000-30ffff location to 390000-39ffff and 3a0000-3affff, where linear image
+
D6 : To MUTE input pin on TDA1518BQ amplifier.
−
written to 300000 can be read as VDP patterns at 390000. Virtua Racing doesn't
+
D5 : To CN2 pin 10. (Unknown purpose)
−
seem to use this feature, it is only used by memory test code.
+
D4 : To CN2 pin 11. (Unknown purpose)
 +
D3 : To CN1 pin K. (Coin lockout 2)
 +
D2 : To CN1 pin 9. (Coin lockout 1)
 +
D1 : To CN1 pin J. (Coin meter 2)
 +
D0 : To CN1 pin 8. (Coin meter 1)
  
−
Here is the list of status/control registers (16bit size):
+
The I/O chip pins for bits D0-D6 go through a A1603C amplifier, which allows
 +
large loads to be driven such as the coin meters, lockout hardware, and
 +
mute switch of the amplifier. Therefore pins 10, 11 of CN2 may be able to
 +
control lamps or other external hardware.
  
−
  addr  rst v description
+
  $840009 - Port E - Service / Coin inputs
−
  a15000  ffff  w/r command/result register. Visible as XST for SSP160x
 
−
                see (2.2.4).
 
−
  a15002  ffff  mirror of the above.
 
−
  a15004    0  status of command/result register (see 2.2.1).
 
−
  a15006  ffff  possibly halts the SVP. Before doing DMA from DRAM, 68k code
 
−
                writes 0xa, and after it's finished, writes 0. This is probably
 
−
                done to prevent SVP accessing DRAM and avoid bus clashes.
 
−
  a15008  ffff  possibly causes an interrupt. There is (unused?) code which
 
−
                writes 0, 1, and again 0 in sequence.
 
−
  a1500a  ffff  ?
 
−
  a1500c  ffff  ?
 
−
  a1500e  ffff  ?
 
  
−
-------------------------------------------------------------------------------
+
D7 : Always returns '1'
−
  4. Other notes
+
D6 : 0= SELECT GAME button pressed, 1= released
−
-------------------------------------------------------------------------------
+
D5 : 0= 2P START button pressed, 1= released
 +
D4 : 0= 1P START button pressed, 1= released
 +
D3 : 0= Service switch pressed, 1= released
 +
D2 : 0= Test switch pressed, 1= released
 +
  D1 : 0= Coin inserted in 1P slot, 1= no coin
 +
D0 : 0= Coin inserted in 2P slot, 1= no coin
  
−
The game has arcade-style memory self-check mode, which can be accessed by
+
$84000B - Port F - DIP switch #1
−
pressing _all_ buttons (including directions) on 3-button controller. There was
 
−
probably some loopback plug for this.
 
  
−
SVP seems to have DMA latency issue similar to one in Sega CD, as the code
+
D7 : Switch #1 is 1=off, 0=on
−
always sets DMA source address value larger by 2, then intended for copy.
+
D6 : Switch #2 is 1=off, 0=on
−
This is even true for DMAs from ROM, as it's probably hooked through SVP's
+
D5 : Switch #3 is 1=off, 0=on
−
memory controller.
+
D4 : Switch #4 is 1=off, 0=on
 +
D3 : Switch #5 is 1=off, 0=on
 +
D2 : Switch #6 is 1=off, 0=on
 +
D1 : Switch #7 is 1=off, 0=on
 +
D0 : Switch #8 is 1=off, 0=on
  
−
The entry point for the code seems to be at address 0x800 (word 0x400) in ROM,
+
$84000D - Port G - DIP switch #2
−
but it is not clear where the address is fetched from when the system powers
 
−
up. The memory test code also sets up "ld PC, .." opcodes at 0x7f4, 0x7f8 and
 
−
0x7fc, which jump to some routines, possibly interrupt handlers. This means
 
−
that mentioned addresses might be built-in interrupt vectors.
 
  
−
The SVP code doesn't seem to be timing sensitive, so it can be emulated without
+
D7 : Switch #1 is 1=off, 0=on
−
knowing timing of the instructions or even how fast the chip is clocked.
+
D6 : Switch #2 is 1=off, 0=on
−
Overclocking doesn't have any effect, underclocking causes slowdowns. Running
+
D5 : Switch #3 is 1=off, 0=on
−
10-12M instructions/sec (or possibly less) is sufficient.</pre>
+
D4 : Switch #4 is 1=off, 0=on
 +
D3 : Switch #5 is 1=off, 0=on
 +
D2 : Switch #6 is 1=off, 0=on
 +
D1 : Switch #7 is 1=off, 0=on
 +
D0 : Switch #8 is 1=off, 0=on
 +
 
 +
$84000F - Port H - Miscellaneous outputs
 +
 
 +
D7 : To pin A19 of CN4
 +
D6 : To pin B19 of CN4
 +
D5 : ?
 +
D4 : ?
 +
D3 : To pin 31 of uPD7759 sample ROM (A18 on a 27C040)
 +
D2 : To pin 30 of uPD7759 sample ROM (A17 on a 27C040)
 +
D1 : To A10 of color RAM
 +
D0 : To A9 of color RAM
 +
 
 +
Bits 0,1 are used to control part of the color RAM banking, by selecting
 +
a 1K bank out of the total 4K of color RAM. The remaining address bits
 +
come from the EPM5032 EPLD chip and the VDP color bus.
 +
 
 +
Bits 2,3 go through a set of jumpers that connect the pins indicated in
 +
the sample ROM socket to ground or to these pins.
 +
 
 +
Bits 4,5 may be additional outputs for selecting the type of EPROM used
 +
for uPD7759 samples, but I haven't confirmed this.
 +
 
 +
Bits 6,7 are outputs to the additional pins of the CN3.
 +
 
 +
Protection registers
 +
 
 +
$840011 - Returns $53 ('S') when read.
 +
$840013 - Returns $45 ('E') when read.
 +
$840015 - Returns $47 ('G') when read.
 +
$840017 - Returns $41 ('A') when read.
 +
 
 +
Writing to these registers does nothing, they are read-only.
 +
 
 +
Control registers
 +
 
 +
$840019 - ? (Returns $FD when read)
 +
$84001B - ? (Returns $88 when read)
 +
$84001D - ? (Returns $FD when read)
 +
$84001F - ? (Returns $88 when read)
 +
 
 +
Bits 2-0 of $84001D controls the state of the CNT2-0 output pins, which are
 +
used as follows:
 +
 
 +
CNT0 - Connected to test point 2.
 +
CNT1 - ?
 +
CNT2 - Connected to pin 6 of missing GAL16V8 chip (IC23)
 +
 
 +
----------------------------------------------------------------------------
 +
Hardware information
 +
----------------------------------------------------------------------------
 +
 
 +
Audio output
 +
 
 +
The left channel output of the YM3438 is connected to the rest of the audio
 +
mixing and amplification circuitry, the right channel output pin is
 +
unconnected. So even though a stereo sound chip is used, only mono output
 +
is available.
 +
 
 +
Test points
 +
 
 +
TP1 - From pin D of CN1. (+5V source, but missing FLT9 in path)
 +
TP2 - From CNT0 output of I/O chip. (bit 0 of $84001D)
 +
TP3 - From CKOT. (FM sound chip clock from I/O chip)
 +
TP4 - From 68000 pin 26. (FC2)
 +
TP5 - From 68000 pin 19. (/VMA)
 +
TP6 - From 68000 pin 20. (E)
 +
TP7 - From pin B18 of CN4. (additional pin of standard expansion connector)
 +
TP8 - From 15 of IC36. (where an extra GAL16V8 would go)
 +
 
 +
The YM3438 doesn't use the clock signal from the I/O chip.
 +
 
 +
Watchdog disable
 +
 
 +
Cut the trace going between pin 1 of the Fujitsu MB3773 and a resistor to
 +
disconnect the /RESET output signal from the watchdog chip.
 +
 
 +
----------------------------------------------------------------------------
 +
Jumper settings
 +
----------------------------------------------------------------------------
 +
 
 +
JP5 - EPROM size for IC 31, 32
 +
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
3-2 shorted: EPROMs are 27C020
 +
2-1 shorted: EPROMs are 27C040
 +
 
 +
JP7 - EPROM size for IC 33, 34
 +
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
3-2 shorted: EPROMs are 27C020
 +
2-1 shorted: EPROMs are 27C040
 +
 
 +
JP15 - Watchdog control
 +
~~~~~~~~~~~~~~~~~~~~~~~
 +
This jumper normally has pins 2,1 shorted and pin 3 left open. Each pin has
 +
the following assignment:
 +
 
 +
1 - Output from VDP /HSYNC pin which is also shared with pin 13 (an input)
 +
    on the EPM5032 EPLD chip.
 +
2 - Goes to the MB3773B CK input. (input clock to watchdog chip)
 +
3 - Output from bit 7 of I/O chip port D.
 +
 
 +
It would seem that in the default state, the watchdog chip is prevented from
 +
causing a reset by receiving the horizontal sync pulse from the VDP.
 +
However, in my tests the system would always reset, so I disconnected the
 +
watchdog chip. It could be that /HSYNC was mislabeled in the Genesis
 +
schematics (JP15 pin 1 goes to VDP pin 43) or that perhaps /HSYNC doesn't
 +
work as one would expect.
 +
 
 +
If the jumper has pins 3-2 shorted instead, then bit 7 of I/O chip port D
 +
provides the clock signal. I don't know how often bit 7 would have to be
 +
toggled to keep the watchdog going.
 +
 
 +
JP16 - Unknown
 +
~~~~~~~~~~~~~~
 +
If pins 2-1 are shorted, the system is temporarily halted.
 +
 
 +
JP17-JP20 - uPD7759 EPROM configuration
 +
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
JP17
 +
Pin 1 - From pin 12 of IC23 (74LS08).
 +
Pin 2 - Connected to pin 24 of socket. (/OE)
 +
Pin 3 - Connected to JP18 pin 1. (and something else?)
 +
 
 +
JP18
 +
Pin 1 - Connected to JP17 pin 3. (and something else?)
 +
Pin 2 - Connected to pin 2 of socket. (A16)
 +
Pin 3 - Ground
 +
 
 +
JP19
 +
Pin 1 - From bit 2 of I/O chip port H.
 +
Pin 2 - Connected to pin 30 of socket. (A17)
 +
Pin 3 - Ground
 +
 
 +
JP20
 +
Pin 1 - From bit 3 of I/O chip port H.
 +
Pin 2 - Connected to pin 31 of socket. (A18)
 +
Pin 3 - Ground
 +
 
 +
I don't have the complete description of these jumpers, but basically they
 +
configure certain pins of the EPROM socket to handle chips with different
 +
capacities.
 +
 
 +
In a Puyo Puyo 2 board with a 27C040, all four jumpers have pins 2-1 shorted
 +
with pin 3 left open.
 +
 
 +
----------------------------------------------------------------------------
 +
Connector pinouts
 +
----------------------------------------------------------------------------
 +
 
 +
CN1 (56-pin JAMMA edge connector)
 +
 
 +
  Not included, it's a standard JAMMA connector.
 +
 
 +
CN2 (12-pin right-angle header)
 +
 
 +
  1 - Ground
 +
  2 - Bit 0 of I/O chip port C
 +
  3 - Bit 1 of I/O chip port C
 +
  4 - Bit 2 of I/O chip port C
 +
  5 - Bit 3 of I/O chip port C
 +
  6 - Ground
 +
  7 - Bit 4 of I/O chip port C
 +
  8 - Bit 5 of I/O chip port C
 +
  9 - (N.C.)
 +
10 - Bit 5 of I/O chip port D
 +
11 - Bit 4 of I/O chip port D
 +
12 - Ground
 +
 
 +
Pins 1-5,7-8 are additional inputs, which might be used for other types
 +
of input devices.
 +
 
 +
Pins 10,11 are outputs and are capable of driving large loads. They may
 +
be used for lamps or other external hardware.
 +
 
 +
CN3 (10-pin right-angle header)
 +
 
 +
  1 - +5V
 +
  2 - +5V
 +
  3 - +5V
 +
  4 - +5V
 +
  5 - (N.C.)
 +
  6 - Ground
 +
  7 - Ground
 +
  8 - Ground
 +
  9 - Ground
 +
10 - +12V
 +
 
 +
CN4 (20-pin two-row header)
 +
 
 +
A1  - +5V                      B1  - +5V
 +
A2  - Ground                  B2  - Ground
 +
A3  - (N.C.)                  B3  - (N.C.)
 +
A4  - 68000 A1                B4  - 68000 A2
 +
A5  - 68000 A3                B5  - 68000 A4
 +
A6  - 68000 A5                B6  - 68000 D0
 +
A7  - 68000 D1                B7  - 68000 D2
 +
A8  - 68000 D3                B8  - 68000 D4
 +
A9  - 68000 D5                B9  - 68000 D6
 +
A10 - 68000 D7                B10 - 68000 /RD
 +
A11 - 68000 /LWR              B11 - 68000 /UWR
 +
A12 - /RESET                  B12 - /CS
 +
A13 - (N.C.)                  B13 - (N.C.)
 +
A14 - Ground                  B14 - Ground
 +
A15 - +5V                      B15 - +5V
 +
A16 - ?                        B16 - ?
 +
A17 - To CN2 pin 7            B17 - To CN2 pin 8
 +
A18 - ?                        B18 - ?
 +
A19 - I/O chip port H bit 6    B19 - I/O chip port H pit 7
 +
A20 - ?                        B20 - ?
 +
 
 +
The chip select signal for pin B12 comes from pin 17 of IC26, which is a
 +
GAL16V8 labeled as Sega part 315-5395. I don't know where in the memory map
 +
this is located at.
 +
 
 +
I/O chip port C bits 4,5 are inputs connected to pins A17/B17, which are
 +
also shared with CN2 pins 7,8.
 +
 
 +
I/O chip port H bits 6,7 are outputs connected to pins A19/B19.
 +
 
 +
Pins 16-20 for both rows are a Sega C2 specific addition to this standard
 +
type of connector which is used in other Sega boards. (After Burner II,
 +
Galaxy Force II, System 16B, System 18, System 24) This connector is used
 +
in other games for an I/O board. (e.g. analog inputs for Heavyweight Champ
 +
on System 16B, 4-player inputs for D.D. Crew on System 18)
 +
 
 +
----------------------------------------------------------------------------
 +
Credits and Acknowledgements
 +
----------------------------------------------------------------------------
 +
 
 +
- Haze for his assistance with c2emu and technical advice.
 +
- Aaron Giles for documenting the protection scheme.
 +
- MD Game Sales for the Sega C2 boards.
 +
- Chris MacDonald for support and testing.
 +
 
 +
----------------------------------------------------------------------------
 +
Disclaimer
 +
----------------------------------------------------------------------------
 +
 
 +
If you use any information from this document, please credit me
 +
(Charles MacDonald) and optionally provide a link to my webpage
 +
(http://cgfm2.emuviews.com/) so interested parties can access it.
 +
 
 +
The credit text should be present in the accompanying documentation of
 +
whatever project which used the information, or even in the program
 +
itself (e.g. an about box).
 +
 
 +
Regarding distribution, you cannot put this document on another
 +
website, nor link directly to it.
 +
 
 +
</pre>

Latest revision as of 14:41, 16 September 2016

Logo-txt.svg
 This is a copy of an "unofficial" document containing original research, for use as a source on Sega Retro. This page likely exists for historical purposes - the contents should ideally be copy-edited and wikified to make better use of Sega Retro's software.
Original source: http://cgfm2.emuviews.com/txt/c2tech.txt 



 Sega System C2 hardware notes
 by Charles MacDonald
 WWW: http://cgfm2.emuviews.com

 Unpublished work Copyright 2000-2003 Charles MacDonald

 This document is in a very preliminary state and is subject to change.
 Most everything within has been tested and verified on a System C2 board,
 but please be aware that my testing methods or interpretations of results
 could be flawed. I can't guarantee that everything is 100% accurate.

 Table of contents

 1. 68000 memory map
 2. uPD7759
 3. Video hardware and EPM5032 registers
 4. I/O chip
 5. Hardware information
 6. Jumper settings
 7. Connector pinouts
 8. Credits and Acknowledgements
 9. Disclaimer

 ----------------------------------------------------------------------------
 68000 memory map
 ----------------------------------------------------------------------------

 $000000-$0FFFFF : Data from EPROMs in EVEN0 and ODD0 sockets.
 $100000-$1FFFFF : Data from EPROMs in EVEN1 and ODD1 sockets.
 $200000-$7FFFFF : Reading or writing this area causes a lockup.
 $800000-$83FFFF : Protection register and video control.
 $840000-$87FFFF : I/O chip.
 $880000-$8BFFFF : uPD7759 interface.
 $8C0000-$8FFFFF : Color RAM (1K, mirrored every 1K)
 $900000-$9FFFFF : Mirror of $800000-$8FFFFF area.
 $A00000-$BFFFFF : Reading or writing this area causes a lockup.
 $C00000-$DFFFFF : VDP
 $E00000-$FFFFFF : Work RAM (64K, mirrored every 64K)

 The details of the protection register, video control register, I/O chip,
 and uPD7759 are explained later on.

 If any EPROMs are missing from the program ROM sockets the corresponding
 memory locations will return the prefetch value. For example:

 ; Assume EVEN1/ODD1 missing
        move.w  #$100000, d0    ; Read from second ROM pair
        nop                     ; D0 = $4E71

 The VDP is only accessible at specific addresses within the memory range
 allocated to it. Reading or writing an invalid address will cause a lockup.
 Here's a bitmask of the address bus to indicate which addresses are valid:

 MSB                  LSB
 110??000????????000rrrrr

 1 - Bit must be '1'
 0 - Bit must be '0'
 ? - Value does not matter
 r - VDP internal register ($00-$1F)

 To my knowledge all games only access the VDP at $C00000-$C0001F, and do not
 use any of the mirrored locations.

 For all memory within $800000-$9FFFFF, writing to even addresses has no
 effect and reading from them returns the MSB of the prefetch value.

 ----------------------------------------------------------------------------
 uPD7759
 ----------------------------------------------------------------------------

 The System C2 board uses a NEC uPD7759 chip which can play back ADPCM
 samples. It can use up to 128K of ROM directly, so additional bits are
 provided through the I/O chip to control banking, allowing for 512K of ROM
 to be used in four 128K banks.

 Writing to any odd address within $880000-$8BFFFF will send the value to
 the message input of the uPD7759. Reading any odd address returns $FF.

 The status of the uPD7759 /BUSY pin can be read through bit 6 of I/O chip
 port C. I don't know how the uPD7759 is reset, which apparently is necessary
 when switching banks so the chip will re-read the header data at the start
 of the bank.

 ----------------------------------------------------------------------------
 Video hardware and EPM5032 registers
 ----------------------------------------------------------------------------

 An Altera EPM5032 EPLD device is used to control some aspects of the
 video hardware and provide a protection feature that games use to prevent
 bootlegging. It has the following pinout:

 Pin    Type            Description
 1      Input           /VSYNC from VDP pin 41
 2      Clock           53.693 MHz clock from OSC1
 3      Output          Output to D1A input of 74LS08.
 4      Output          To /BLANK input on color encoder
 5      Output          Clock input of LS373 to latch color bus data
 6      Output          To /SHADE input on color encoder
 9      Input           68000 A8
 10     Input           68000 /LDS
 11     Input           Bit 7 of latched color bus data
 12     Input/Output    Connected to pin 19 of 315-5242
 13     Input           /HSYNC from VDP pin 43
 14     Input           SPA/B from VDP pin 40
 15     Input           Connected to pin 3 of 315-5394
 16     Input           68000 R//W
 17     Input           68000 D3
 18     Input           68000 D2
 19     Input           68000 D1
 20     Input           68000 D0
 23     Output          Color RAM A8
 24     Output          Color RAM A7
 25     Output          Color RAM A6
 26     Output          Color RAM A5
 27     Output          Bit 6 of latched color bus data
 28     Output          Bit 5 of latched color bus data

 Pins 7,22 are +5V, pins 8,21 are ground.

 Pin 3 is connected to D1A of an AND gate, D1B is from +5V and the output
 of the gate goes to 315-5394 pin 1. I don't know what this is for.

 The /HSYNC output of the VDP appears to be the dot clock, as it is fed
 into the clock input of the color encoder.

 The EPM5032 controls the clock input of a LS373 which is used to latch
 the color bus outputs. The latched data is then sent to the EPM5032 and
 color RAM.

 The internal registers of the EPM5032 only appear at odd addresses. A8 is
 used to select the protection or video control register, so they are
 mirrored:

 $800000-$8001FF : Protection register
 $800200-$8003FF : Video control register
 :
 $83FC00-$83FDFF : Protection register
 $83FE00-$83FFFF : Video control register

 These registers are write only. Reading any odd address returns the
 currently selected value from the protection table in D3-D0, with D7-D4
 set to one.

 All games access the protection register at $800001 and the video control
 register at $800201.

 Video control register

 Bits 3-0 of the value written to the video control register are used
 as follows:

 D3 : ? (No effect)
 D2 : 0= Pixels 262-319 are blanked, 1= Pixels 262-319 are visible.
 D1 : 0= Pixels are wider and there is some flickering, 1= Normal display
 D0 : 0= Screen on, 1= Screen blanked

 All games write $06 for a normal display and $07 to turn off the screen.

 When the screen is blanked via bit 0 or 2, the /BLANK input on the color
 encoder is asserted and a black color is output, which is unrelated to any
 value stored in color RAM. This also disables shadow/hilight effects so
 it isn't possible to make the black color lighter or darker.

 It would seem that the Sega C2 video hardware only allows a 320 pixel
 display to be used. Trying to use a 256 pixel display results in an
 unstable display. While the VDP may be putting out the right signals,
 chances are the EPM5032 is programmed to support the 320 pixel mode
 exclusively.

 Shadow/Hilight mode

 The VDP outputs a signal which indicates if the current pixel data on
 the color bus should be shown normally, or if shadow/hilight effects should
 be applied. I'm assuming the EPM5032 gets this information, as it is in
 control of the /SHADE pin of the color encoder. There is no distinction
 made between shadow or hilight sprites (pixel data is $3E or $3F) either.

 It is up to bit 15 of the color RAM data to tell the color encoder to
 apply shadow or hilight effects, regardless of the VDP which can only
 indicate in general if an effect should be applied, not which one it is.

 Color RAM

 The analog RGB output of the VDP is not used. Instead the VDP has an 8-bit
 bus (which I'll call the color bus, using Yamaha's terminology) that
 transmits graphics data. It would seem to have the following format:

 D7 - Normal or shadow/hilight effect indicator
 D6 - Sprite or background pixel indicator
 D5 - Bit 1 of palette select
 D4 - Bit 0 of palette select
 D3 - Bit 3 of pixel data
 D2 - Bit 2 of pixel data
 D1 - Bit 1 of pixel data
 D0 - Bit 0 of pixel data

 Bits 7-5 go through the EPM5032 chip, so it isn't possible to tell which
 bits serve what purpose. The function of these bits could be swapped around.

 The color bus goes to 4K of color RAM, which is arranged as 2Kx16. The color
 RAM data is fed into a 315-5242 encoder, which outputs 15-bit RGB color
 and can apply shadow or hilight effects.

 Part of the color bus is shared with the EPM5032 chip which controls the
 color encoder, provides palette banking (there's more color RAM than could
 be addressed by the color bus), and to control the palettes selected as
 part of a protection feature. Here's a layout of how the color RAM is
 interfaced to the rest of the system:

 A0  - Color bus bit 0
 A1  - Color bus bit 1
 A2  - Color bus bit 2
 A3  - Color bus bit 3
 A4  - Color bus bit 4
 A5  - EPM5032 pin 26 (Color bus bit 5)
 A6  - EPM5032 pin 25
 A7  - EPM5032 pin 24
 A8  - EPM5032 pin 23 (Color bus bit 6)
 A9  - I/O chip port H bit 0
 A10 - I/O chip port H bit 1

 This arrangement divides the color RAM into four 1K units which are
 selected by I/O chip port H. The EPM5032 controls how the current 1K unit
 of color RAM is used.

 Despite the possibilities of the EPM5032 controlling multiple aspects
 about how the color RAM is accessed, nearly all games have the same
 implementation:

 - The sprite/background indicator bit selects the first 512 bytes of the
   current 1K for background pixels, and the latter 512 bytes for sprite
   pixels.

 - Writing to the protection register sets two bank select values which
   divide the 512 bytes for backgrounds or sprites into four banks of
   128 bytes:

   D0-D1 choose the background palette bank
   D3-D2 choose the sprite palette bank

 - The lower 6 bits of the color bus (color palette and pixel data) are
   used as an index into the remaining 128 bytes (64 words), and the value
   selected is sent to the color encoder.

 Here's a memory map of color RAM to represent this setup, for the
 current 1K chunk being used:

 $0000-$007F : Background palette data, for bank 0
 $0080-$00FF : Background palette data, for bank 1
 $0000-$017F : Background palette data, for bank 2
 $0180-$01FF : Background palette data, for bank 3
 $0200-$027F : Sprite palette data, for bank 0
 $0280-$02FF : Sprite palette data, for bank 1
 $0300-$037F : Sprite palette data, for bank 2
 $0380-$03FF : Sprite palette data, for bank 3

 Remember that by writing to the protection register, one of four banks
 can be selected for the backgrounds and for the sprites.

 When the CPU is accessing color RAM no banking is applied by the EPM5032,
 and it can freely read or write color RAM in 1K units as selected by
 port H of the I/O chip.

 VDP registers

 I'll only list some of the register bits that have alternate functions or
 ones that are worth mentioning.

 Register $80

 D3 : 1= Alternating lines of the display are blanked, the lines selected
         change on even and odd frames.
 D1 : 1= This bit locks up the hardware when set.
 D0 : 1= External video input enable, but this results in bad sync since
         there is no external video source.

 Register $8B

 D7 : 1= VDP controls color bus. Reading or writing color RAM at any address
         only affects address zero, and the data read/written will often be
         corrupted.
      0= CPU controls color bus. During this time garbage data is displayed
         on the screen if it is enabled. (through the video control
         register only, if the screen is blanked by bit 6 of register $81
         there will still be garbage shown)
 D6 : 1= Setting this bit locks up the hardware when set.

 All games only access color RAM during the vertical blanking period, so
 the graphical garbage shown when the CPU hogs the color bus isn't visible.

 Register $8C

 D7 : 1= Setting this bit locks up the hardware when set.
 D6 : 1= Display is enabled
      0= Display is blanked (black)
 D5 : 1= Bad sync, lines seem to be cropped to 256 pixels.
 D4 : 0= The background/sprite indicator bit is always set to zero, so
         the current background palette bank is used for sprites as well.
      1= The background/sprite indicator bit works normally.
 D0 : 1= 320-pixel display
      0= This should be a 256-pixel display, but you just get bad sync
         instead.

 Bits 1 and 2 of this register do not enable interlacing regardless of
 any setting.

 ----------------------------------------------------------------------------
 I/O chip
 ----------------------------------------------------------------------------

 The System C2 hardware uses a 315-5296 I/O chip, as found in many other Sega
 boards. It has 8 internal registers, eight I/O ports, and provides an
 interface to Yamaha FM sound chips.

 Here is a description of the I/O ports. I tested the board in a mini NeoGeo
 cabinet, so some of the button descriptions are specific to the NeoGeo only.

 $840001 - Port A - Player 1 inputs

 D7 : 0= UP pressed, 1= released
 D6 : 0= DOWN pressed, 1= released
 D5 : 0= LEFT pressed, 1= released
 D4 : 0= RIGHT pressed, 1= released
 D3 : 0= Button D pressed, 1= released
 D2 : 0= Button C pressed, 1= released
 D1 : 0= Button B pressed, 1= released
 D0 : 0= Button A pressed, 1= released

 $840003 - Port B - Player 2 inputs

 D7 : 0= UP pressed, 1= released
 D6 : 0= DOWN pressed, 1= released
 D5 : 0= LEFT pressed, 1= released
 D4 : 0= RIGHT pressed, 1= released
 D3 : 0= Button D pressed, 1= released
 D2 : 0= Button C pressed, 1= released
 D1 : 0= Button B pressed, 1= released
 D0 : 0= Button A pressed, 1= released

 $840005 - Port C - Miscellaneous inputs

 D7 : From MB3773P pin 1. (/RESET output)
 D6 : From uPD7759 pin 18. (/BUSY output)
 D5 : From pin 8 of CN2.
 D4 : From pin 7 of CN2.
 D3 : From pin 5 of CN2.
 D2 : From pin 4 of CN2.
 D1 : From pin 3 of CN2.
 D0 : From pin 2 of CN2.

 The trace to D7 comes out of a 74LS244 who's input is the MB3773P /RESET
 signal. It looks like the LS244 is always enabled as far as I can tell,
 so D7 will not be tristated and can't be used for anything else.

 $840007 - Port D - Miscellaneous outputs

 D7 : To pin 3 of JP15. (Watchdog clock control)
 D6 : To MUTE input pin on TDA1518BQ amplifier.
 D5 : To CN2 pin 10. (Unknown purpose)
 D4 : To CN2 pin 11. (Unknown purpose)
 D3 : To CN1 pin K. (Coin lockout 2)
 D2 : To CN1 pin 9. (Coin lockout 1)
 D1 : To CN1 pin J. (Coin meter 2)
 D0 : To CN1 pin 8. (Coin meter 1)

 The I/O chip pins for bits D0-D6 go through a A1603C amplifier, which allows
 large loads to be driven such as the coin meters, lockout hardware, and
 mute switch of the amplifier. Therefore pins 10, 11 of CN2 may be able to
 control lamps or other external hardware.

 $840009 - Port E - Service / Coin inputs

 D7 : Always returns '1'
 D6 : 0= SELECT GAME button pressed, 1= released
 D5 : 0= 2P START button pressed, 1= released
 D4 : 0= 1P START button pressed, 1= released
 D3 : 0= Service switch pressed, 1= released
 D2 : 0= Test switch pressed, 1= released
 D1 : 0= Coin inserted in 1P slot, 1= no coin
 D0 : 0= Coin inserted in 2P slot, 1= no coin

 $84000B - Port F - DIP switch #1

 D7 : Switch #1 is 1=off, 0=on
 D6 : Switch #2 is 1=off, 0=on
 D5 : Switch #3 is 1=off, 0=on
 D4 : Switch #4 is 1=off, 0=on
 D3 : Switch #5 is 1=off, 0=on
 D2 : Switch #6 is 1=off, 0=on
 D1 : Switch #7 is 1=off, 0=on
 D0 : Switch #8 is 1=off, 0=on

 $84000D - Port G - DIP switch #2

 D7 : Switch #1 is 1=off, 0=on
 D6 : Switch #2 is 1=off, 0=on
 D5 : Switch #3 is 1=off, 0=on
 D4 : Switch #4 is 1=off, 0=on
 D3 : Switch #5 is 1=off, 0=on
 D2 : Switch #6 is 1=off, 0=on
 D1 : Switch #7 is 1=off, 0=on
 D0 : Switch #8 is 1=off, 0=on

 $84000F - Port H - Miscellaneous outputs

 D7 : To pin A19 of CN4
 D6 : To pin B19 of CN4
 D5 : ?
 D4 : ?
 D3 : To pin 31 of uPD7759 sample ROM (A18 on a 27C040)
 D2 : To pin 30 of uPD7759 sample ROM (A17 on a 27C040)
 D1 : To A10 of color RAM
 D0 : To A9 of color RAM

 Bits 0,1 are used to control part of the color RAM banking, by selecting
 a 1K bank out of the total 4K of color RAM. The remaining address bits
 come from the EPM5032 EPLD chip and the VDP color bus.

 Bits 2,3 go through a set of jumpers that connect the pins indicated in
 the sample ROM socket to ground or to these pins.

 Bits 4,5 may be additional outputs for selecting the type of EPROM used
 for uPD7759 samples, but I haven't confirmed this.

 Bits 6,7 are outputs to the additional pins of the CN3.

 Protection registers

 $840011 - Returns $53 ('S') when read.
 $840013 - Returns $45 ('E') when read.
 $840015 - Returns $47 ('G') when read.
 $840017 - Returns $41 ('A') when read.

 Writing to these registers does nothing, they are read-only.

 Control registers

 $840019 - ? (Returns $FD when read)
 $84001B - ? (Returns $88 when read)
 $84001D - ? (Returns $FD when read)
 $84001F - ? (Returns $88 when read)

 Bits 2-0 of $84001D controls the state of the CNT2-0 output pins, which are
 used as follows:

 CNT0 - Connected to test point 2.
 CNT1 - ?
 CNT2 - Connected to pin 6 of missing GAL16V8 chip (IC23)

 ----------------------------------------------------------------------------
 Hardware information
 ----------------------------------------------------------------------------

 Audio output

 The left channel output of the YM3438 is connected to the rest of the audio
 mixing and amplification circuitry, the right channel output pin is
 unconnected. So even though a stereo sound chip is used, only mono output
 is available.

 Test points

 TP1 - From pin D of CN1. (+5V source, but missing FLT9 in path)
 TP2 - From CNT0 output of I/O chip. (bit 0 of $84001D)
 TP3 - From CKOT. (FM sound chip clock from I/O chip)
 TP4 - From 68000 pin 26. (FC2)
 TP5 - From 68000 pin 19. (/VMA)
 TP6 - From 68000 pin 20. (E)
 TP7 - From pin B18 of CN4. (additional pin of standard expansion connector)
 TP8 - From 15 of IC36. (where an extra GAL16V8 would go)

 The YM3438 doesn't use the clock signal from the I/O chip.

 Watchdog disable

 Cut the trace going between pin 1 of the Fujitsu MB3773 and a resistor to
 disconnect the /RESET output signal from the watchdog chip.

 ----------------------------------------------------------------------------
 Jumper settings
 ----------------------------------------------------------------------------

 JP5 - EPROM size for IC 31, 32
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 3-2 shorted: EPROMs are 27C020
 2-1 shorted: EPROMs are 27C040

 JP7 - EPROM size for IC 33, 34
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 3-2 shorted: EPROMs are 27C020
 2-1 shorted: EPROMs are 27C040

 JP15 - Watchdog control
 ~~~~~~~~~~~~~~~~~~~~~~~
 This jumper normally has pins 2,1 shorted and pin 3 left open. Each pin has
 the following assignment:

 1 - Output from VDP /HSYNC pin which is also shared with pin 13 (an input)
     on the EPM5032 EPLD chip.
 2 - Goes to the MB3773B CK input. (input clock to watchdog chip)
 3 - Output from bit 7 of I/O chip port D.

 It would seem that in the default state, the watchdog chip is prevented from
 causing a reset by receiving the horizontal sync pulse from the VDP.
 However, in my tests the system would always reset, so I disconnected the
 watchdog chip. It could be that /HSYNC was mislabeled in the Genesis
 schematics (JP15 pin 1 goes to VDP pin 43) or that perhaps /HSYNC doesn't
 work as one would expect.

 If the jumper has pins 3-2 shorted instead, then bit 7 of I/O chip port D
 provides the clock signal. I don't know how often bit 7 would have to be
 toggled to keep the watchdog going.

 JP16 - Unknown
 ~~~~~~~~~~~~~~
 If pins 2-1 are shorted, the system is temporarily halted.

 JP17-JP20 - uPD7759 EPROM configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 JP17
 Pin 1 - From pin 12 of IC23 (74LS08).
 Pin 2 - Connected to pin 24 of socket. (/OE)
 Pin 3 - Connected to JP18 pin 1. (and something else?)

 JP18
 Pin 1 - Connected to JP17 pin 3. (and something else?)
 Pin 2 - Connected to pin 2 of socket. (A16)
 Pin 3 - Ground

 JP19
 Pin 1 - From bit 2 of I/O chip port H.
 Pin 2 - Connected to pin 30 of socket. (A17)
 Pin 3 - Ground

 JP20
 Pin 1 - From bit 3 of I/O chip port H.
 Pin 2 - Connected to pin 31 of socket. (A18)
 Pin 3 - Ground

 I don't have the complete description of these jumpers, but basically they
 configure certain pins of the EPROM socket to handle chips with different
 capacities.

 In a Puyo Puyo 2 board with a 27C040, all four jumpers have pins 2-1 shorted
 with pin 3 left open.

 ----------------------------------------------------------------------------
 Connector pinouts
 ----------------------------------------------------------------------------

 CN1 (56-pin JAMMA edge connector)

  Not included, it's a standard JAMMA connector.

 CN2 (12-pin right-angle header)

  1 - Ground
  2 - Bit 0 of I/O chip port C
  3 - Bit 1 of I/O chip port C
  4 - Bit 2 of I/O chip port C
  5 - Bit 3 of I/O chip port C
  6 - Ground
  7 - Bit 4 of I/O chip port C
  8 - Bit 5 of I/O chip port C
  9 - (N.C.)
 10 - Bit 5 of I/O chip port D
 11 - Bit 4 of I/O chip port D
 12 - Ground

 Pins 1-5,7-8 are additional inputs, which might be used for other types
 of input devices.

 Pins 10,11 are outputs and are capable of driving large loads. They may
 be used for lamps or other external hardware.

 CN3 (10-pin right-angle header)

  1 - +5V
  2 - +5V
  3 - +5V
  4 - +5V
  5 - (N.C.)
  6 - Ground
  7 - Ground
  8 - Ground
  9 - Ground
 10 - +12V

 CN4 (20-pin two-row header)

 A1  - +5V                      B1  - +5V
 A2  - Ground                   B2  - Ground
 A3  - (N.C.)                   B3  - (N.C.)
 A4  - 68000 A1                 B4  - 68000 A2
 A5  - 68000 A3                 B5  - 68000 A4
 A6  - 68000 A5                 B6  - 68000 D0
 A7  - 68000 D1                 B7  - 68000 D2
 A8  - 68000 D3                 B8  - 68000 D4
 A9  - 68000 D5                 B9  - 68000 D6
 A10 - 68000 D7                 B10 - 68000 /RD
 A11 - 68000 /LWR               B11 - 68000 /UWR
 A12 - /RESET                   B12 - /CS
 A13 - (N.C.)                   B13 - (N.C.)
 A14 - Ground                   B14 - Ground
 A15 - +5V                      B15 - +5V
 A16 - ?                        B16 - ?
 A17 - To CN2 pin 7             B17 - To CN2 pin 8
 A18 - ?                        B18 - ?
 A19 - I/O chip port H bit 6    B19 - I/O chip port H pit 7
 A20 - ?                        B20 - ?

 The chip select signal for pin B12 comes from pin 17 of IC26, which is a
 GAL16V8 labeled as Sega part 315-5395. I don't know where in the memory map
 this is located at.

 I/O chip port C bits 4,5 are inputs connected to pins A17/B17, which are
 also shared with CN2 pins 7,8.

 I/O chip port H bits 6,7 are outputs connected to pins A19/B19.

 Pins 16-20 for both rows are a Sega C2 specific addition to this standard
 type of connector which is used in other Sega boards. (After Burner II,
 Galaxy Force II, System 16B, System 18, System 24) This connector is used
 in other games for an I/O board. (e.g. analog inputs for Heavyweight Champ
 on System 16B, 4-player inputs for D.D. Crew on System 18)

 ----------------------------------------------------------------------------
 Credits and Acknowledgements
 ----------------------------------------------------------------------------

 - Haze for his assistance with c2emu and technical advice.
 - Aaron Giles for documenting the protection scheme.
 - MD Game Sales for the Sega C2 boards.
 - Chris MacDonald for support and testing.

 ----------------------------------------------------------------------------
 Disclaimer
 ----------------------------------------------------------------------------

 If you use any information from this document, please credit me
 (Charles MacDonald) and optionally provide a link to my webpage
 (http://cgfm2.emuviews.com/) so interested parties can access it.

 The credit text should be present in the accompanying documentation of
 whatever project which used the information, or even in the program
 itself (e.g. an about box).

 Regarding distribution, you cannot put this document on another
 website, nor link directly to it.
Retrieved from "https://segaretro.org/index.php?title=Sega_System_C2_hardware_notes_(2003)&oldid=348734"