Monday, October 28, 2013

Jazz Disassemblies Ep3: Sega Genesis Saving Teardown

I love the Sega Genesis, but rarely do anything with it. I have made a handful of reproduction carts in the past because there is nothing better than playing games on real hardware but I always have a regret after destroying a donor cartridge, whether it is sports or not. One of the goals I always set myself up with during a creating is to use 100% renewable components. By renewable, I mean of course modern and commercially produced components; nothing salvaged and nothing obsolete. Having nothing obsolete is very difficult in my circle of interests, but salvaging components is my greatest downfall.

During my journeys into the technologies that Sega and other companies used within the cartridges for the Sega Genesis/MegaDrive, I have found three official forms of saving data. Two forms use serial EEPROMs and the third uses the tried-and-true parallel SRAM with battery backup. My goal is to recreate these cartridges using new components and my stretch goal is to expand the addressable memory or just to improve them in some way while making the carts themselves renewable.

We already know that the plastic shells can be remade by the everyday hobbyist and their 3D printers and circuit boards can be fabricated by Chinese companies for pennies on the dollar. All that leave now is the components which are definitely on their way out of style. The components that we are looking for are 8- and 16-bit, parallel ROMs and RAMs. Referring to a statement above: by renewable I meant purchasable from Mouser or Digikey, etc in large quantities which will later be restored. Glancing at Mouser (My supplier of choice) I have already been able to locate a handful of ROMs and RAMs that come in both selectable 8- and 16-bit configurations!

The next goal I will have is to recreate the higher density logic with PLDs, but that is best left for another time.

1. KM62256 Parallel SRAM

These boards found in most of the miserable football and soccer games. Until I find another varient, I will cover one such board revision: "171-6279A"

The board seems to be made by Sega though I have long lost the ROM which was originally soldered in. It contains:

1x (CE) 47uF electrolytic capacitor
5x (C1-C5) .1uF ceramic capacitors
1x (BAT) CR2032 coin-cell battery
1x (IC1) 42-pin Mask ROM (27c160 equivalent) - 16Mbit
1x (IC2) KM62256BPL-7L, 32Kx8 bit (32Kbyte) Low Power CMOS Static RAM
1x (IC3) BA6162, Reset IC with battery backup function by Rohm
2x (IC4, IC5) 74HC00AP, Quad two-input NAND gate

I have already recreated everything on the board in Eagle PCB libraries including the board dimensions and general component layout. Tracing all of the connections is slower work and I will get to that eventually. In the meantime, my goal is to layout a functionally-identical board with 3v3 ROM/RAM, SMT caps and level shifters for proper data flow. THen we will have ourselves a flash cartridge!

Above you have seen the board itself with and without components. Ignore the text on the Mask ROM though since I just stuck a random IC in there to show it with one.

Looks pretty good if I do say so myself, though the traces are not as authentic as the layout. Sega never seemed to use top-side pads. They have vias which allow for double sided boards, but I have only seen EA cartridges that use top-side pads. These pads of course make for miserable desoldering since I need much more heat... and patience.

Some fun facts about this board is that the ROM is 16-bits but the SRAM is only 8-bit. Although I do not have the full details on how the software accesses these, the Gen/MD has two pins which are called !LDSW and !UDSW (Upper Data Set Write and Lower Data Set Write). When reading from RAM, the processor ignores the upper byte of data since there should be nothing there. While writing though, the !LDSW pin goes low which enables the !WE pin on our RAM. These two pins are for transferring 8-bits (one byte) at a time rather than 16 (two bytes).Not knowing how to activate either of these pins, it would seem that someone may add a second SRAM and use the currently unused !UDSW pin as the enable.

The above picture is how I found the glue logic for addressing our memories. Only 6 out of 8 gates are used which is a waste of space and battery power since the unused pins are connected to the Vout pin on our reset IC. If you think about it, the three NAND gates that have both inputs connected act as NOT gates which is something we would take into consideration if we were to redesign this with single-gate SMT ICs or on a PLD.

one problem I have with this board is that A21 and A22 are simply left hanging. Just a guess, but using A20 as a ROm address and A21 in the logic would expand the addressable memory, but Sega chose not to for some reason.

2. Acclaim Serial 24LC02B RAM

The next board I will cover is the P/N 670120 REV 2 by Acclaim. The contents of our board are as follow:

1x (C1) 47uF electrolytic capacitor
4x (C2-C5) 0.1uF ceramic capacitors
2x (R1, R2) 4.7K Ohm resistors
1x (U1) Mask ROM (capacity not yet known)
1x (U2) 74ALS138N, 1-of-8 decoder/demultiplexer
1x (U3) 74ALS74AN, Dual D-type flip-flop with set and reset
1x (U4) 74ALS125AN, Quad TRI-STATE Buffer
1x (U5) 24LC02B, I2C™ Serial EEPROM (2K capacity)

As you can see, the naming routines is different than that of Sega and yet again, we could reduce the chip count to much less with a PLD. U2-U4 could easily be designed in a PLD to reduce space and cost. For the time being, I assume the resistors are pull-ups or pull-downs.

3. Acclaim Serial 24LC04B RAM w/ LZ95A53

You're probably thinking that I recycled this board from a previous post and yes, yes I have. It does pertain to the topic though and I can probably shed a little more light on the special IC now that I know more about !LDSW and serial eeproms.

Anyhow, this board contains:

1x (C1) 47uF electrolytic capacitor
4x (C2-C5) 0.1uF ceramic capacitors
1x (R1) 10K Ohm resistor
2x (U1, U2) Mask ROMs (27c160 equivalents)
1x (U3) Acclaim LZ95A53 (memory mapper, glue logic, serial data interpreter, etc)
1x (U4) 24LC04B, I2C™ Serial EEPROM (4K capacity)

Above is the board that I created by probing all of the traces. Looks nice, but my next goal would be to reverse engineer the Acclaim's LZ95A53. Unfortunately, I have no scope to do so...

The above picture is my schematic which shows the connections on the LZ95A53. I had to make an addition to my cartridge connector since it uses several different pins that very few others use. I believe that the Acclaim's LZ95A53 IC contains the same logic as the board which used the 24lc02 serial RAM. Again, I cannot test this theory.

In hindsight, all of these boards used 27c160 equivalent Mask ROMs. The 27c160 can store a 2MB ROM which means the board with 2 Mask ROMs had a 4MB game. A piece of information for those making reproduction carts with the 27c400, 800, 160 and 322's, the first three mentioned all have a !BYTE pin. This pin allows for the EPROM to function as either an 8-bit or 16-bit ROM which means you may use it in many different systems.

Besides a little bit of work on the silkscreens, these boards are all ready to send to any fab house, granted they make 1.6mm thick boards. I will also be adding some more pictures of the other two boards shortly. Thanks for reading.

Friday, October 11, 2013

List of things I will order again from Mouser

Maybe its a silly blog post, but it may help someone. Here I will post and frequently update items that I ordered from Mouser and liked so much that I would or will order from them again. I will try to follow the layout of:

Name - info w/link
Why I liked it
My picture - if available

Mouser has millions of items and more than half of which have no pictures. Some of these don't even have that great of datasheets to read through, so ordering parts can become exhausting and stressful.

Once this list becomes larger, go ahead and hit Ctrl + F to search for an item you might need; for example, an ISP, USB or MIDI connector, the common 104 ceramic cap or whatever else. The things I look for in an item are cost and usefulness. I need a cheap item that works for me without begin crap.

0.1uF leaded Ceramic Capacitor
$0.10 x 1, $0.08 x 100
2.54 mm lead spacing takes up minimal room but is easy to solder by hand.

USB Connector female TYPE B in Black w/rear shield
$0.63 x 1, $0.53 x 10
Cheapest I could find and has angled legs to hold itself in place prior to soldering.

3mm Red LED
$0.07 x 1
Simple 3mm diameter, rests flat on your board.

3mm Green LED
$0.08 x 1
Simple 3mm diameter, drawback: legs flair out so it does not rest flat on your board.

Elusive 3-row, 26-pin D-sub connector
$1.53 x 1
Super cheap considering the regular going price. Fits Macintosh LC Apple IIe card.

Hood to fit 26-pin connector
$0.46 x 1
Fits 2-row/15-pin connector and 3-row/26-pin connector

Atmega8515 TQFP-44
$2.66 x 1, $2.54 x 10
Cheapest option and easy to solder package, small size

Solder Flux Pen
$4.78 x 1
Coolest, best, cheapest felt tip pen with soldering flux inside! It lasts and lasts.

Gameboy MBC - Which to choose?

Just a quick overview for unfamiliar readers before we get into the thick of it.

The Nintendo Gameboy uses a Memory Bank Controller inside of official cartridges for switching between banks of memory and ultimately expanding the addressable memory. The MBC will switch between banks of both ROM and RAM so that the programmer may code larger games and backup more data in save files.

There are four main MBC's numbered 1 through 5 and excluding 4. The reason I am writing this is because each following revision did not simply add more addressable memory. Each one has unique capabilities built in as well as expanding the addressable memory. in general the MBC's function by waiting for specific data bits to be written to yet more specific memory locations. Once the data in question is written to the specific memory location, the MBC switches the active bank of ROM and RAM to accommodate more code.
I will summarize each MBC as well as quote some information from datasheets.


Is the first in the series of controllers which did only expand the addressable memory. Since the gameboy has 16 address pins and 8 data pins running through to the cartridge, the gameboy may without an MBC address only read from and write to a maximum of 256Kbits or 32Kbytes which is incredibly small considering Mario Land has 12 massive levels with multiple means of gameplay including the platformer and shooter, in both an airplane and submarine. Some of these levels even have secondary underworlds where Mario drops to an extra map off screen to collect secret coins or other items.

In any case, the MBC1 has two different modes to choose from. There is the 16Mbit ROM/8KByte RAM and 4Mbit ROM/32KByte RAM. 

Note: RAM is an external IC which needs to be connected to a battery while disconnected from gameboy power to retain data.


Similarly to the MBC1, the MBC2 maps extra banks of memory with specific memory writes; however, it may only map up to 2Mbits or 256Kbytes of ROM. Why a decrease? Well the magical thing about the MBC2 is that it contains 512 x 4 bits of SRAM built into the IC itself. This saves a lot of room on your cartridge board granted you are designing one.

The MBC2 can save money on RAM and space on your board if you are programming a small game that requires little ROM and RAM. Referring to the MBC1 above, if you wanted to offer a saving feature, you would need to source a RAM IC as well and route all of the Address, data and control pins to another location on the board.


The MBC3 may again address up to 16Mbits of memory, but has a major feature built like the MBC2 has RAM. The MBC3 has an RTC or Real Time Clock built in. The RTC while still needing battery power when disconnected, offers a real-time count so that games such as pokemon may tell whether it is night or day, or when an hour in real life has passed for example.

Some games use the MBC3 without utilizing the RTC, but games that do include Pokemon of Generation 2 and Harvest Moon.


Lastly, the MBC5 is the final Memory Bank Controller from Nintendo. This particular MBC does not come with internal RAM or an RTC. It simply maps huge amounts of memory. It may map up to 64Mbits of ROM and up to 1Mbit of RAM but not both. There are different configurations to choose from; these are just the maximums.

This MBC which I find in nearly every Gameboy Color cartridge regardless of ROM size is guaranteed to work with the GBC's double speed mode. The others seem to work just fine too though, considering any GB game will run on your GBC.

For more information on how to use the MBC's with software, please refer to "Cartridge Types" in this document:

MBC CPLD Clones & Reproductions

Aside from the Official Nintendo MBC's, people have had major success in recreating them using CPLD's. Both Homebrew developers and Chinese pirating companies that is.

Since the MBC2 and MBC3 contain separate ICs, recreating them is much too difficult for a single person. MBC1 and MBC5 on the other hand can and have been redesigned by using CPLD's. They way they work as mentioned above is that they look for specific data bytes to be written to specific address locations. This Logic can be entirely drawn out using logic gates, which in turn can be programmed onto the CPLD.


The MBC1 being the most simple, can be drawn using as little as 11 gates! (granted you do not need RAM)


The MBC5 is much more complex of course, but it has also been cloned successfully by at least two separate people using two different CPLD's. One person used the XC9536 and the other person used the XC9572.

and XC9572

Depending on the number of inputs and outputs, more complex logic ought to be designed using PLD's or CPLD's. Not only can you save money on IC's, but space on your circuit boards. More often than not, a logic IC will take up space on your board and have a handful of unused pins and gates which is wasteful and lazy.

As always, thanks for reading! I hope I opened someone's eyes to new and old hardware.