Charles MacDonald's Home Page

News (7/21/14)

FD1089/MC8123 utility update

I've updated the FD1089 key management tool to support a brute-force LCG seed search function for the MC8123. This was used to produce a key for Sega's Center Court that was recently dumped and added to MAME.

Some plaintext must be provided to carry out the search. It only took 8 bytes of data from Passing Shot to make a match, in this case the code for the NMI handler that sends ADPCM data to the uPD7759 was used as it was the least likely to be altered in Center Court. The tool supports searching for plaintext within a range of addresses so that matches can be made if the encrypted code or data is a different location than expected.

MPEG card adapter

I've been meaning to try OSH Park for a while, and designed a simple circuit to test out their fabrication service. This is an adapter for the Sega Saturn MPEG card, which plugs into a PCI Express connector on one side and goes to a 27C4096 pinout on the other side. The adapter makes it easy to dump the ROM contents without desoldering the PLCC ROM on the card.

The boards came out fairly well; one of them had some bridged traces which were fixed by using a fiberglass pen to remove the solder resist and then a utility knife to split the traces apart. For a two-layer board like this it's easy to see the traces clearly through the soldermask with a LED light held underneath, so a good practice before soldering is to make a visual inspection to find etching problems. To simplify the routing I removed the unused pins from the PCIe connector, allowing everything to fit on a small board.

News (6/13/14)

Inside the Innovation PS2 VGA adapter

Innovation used to sell a low-cost VGA adapter for the PlayStation 2. As you might expect, it doesn't really upscale RGB video to VGA like the more expensive adapters do.

The adapter is based around the Averlogic AL250 scan doubler and Phillips SAA7111A Enhanced Video Input Processor (EVIP). The EVIP converts composite video or S-Video (selectable by a pushbutton on the device) to digital RGB (5:6:5) data, which the AL250 scan-doubles to 31 KHz and outputs as analog RGB, suitable for driving a VGA monitor. The output is limited to 640x480 at 60 Hz. A PIC clone (Elan EM78P153) is used to program both chips after power-up, control their reset line, and handle the input button and output LEDs.

Power management

The adapter is powered by a dongle that fits into a spare memory card slot, which contains two diodes in series to reduce the 8V output of the PS2, that in turn powers a 7805 regulator in the adapter. This makes it incompatible with the Slim PS2 which no longer supplies 8V on the memory card port as a way of preventing third party memory cards from operating correctly. Internally the 5V supply is used to power the PIC and AL250 chip, and two more diodes in series are used to produce 3.3V (closer to 3.19V) for the EVIP. Strangely the 5V output from the PS2 A/V port is not used at all and is only routed to the multi A/V pass-through connector. Perhaps it can't provide as much current as the 8V rail can.

I2C bus traffic

The PIC communicates to both chips over an I2C bus. It has no I2C controller and uses a software implementation. I had a LPC1769 microcontroller handy which has a function for monitoring I2C traffic in a non-invasive way, allowing one to eavesdrop on the bus. Using that I was able to make logs of the register accesses made by the PIC.

There seems to be a malformed read operation when reading the status register of the AL250, but I think the data read isn't used and it is a dummy operation anyway because the PIC does not react differently if the return value changes.

Image quality

The chipset has a lot of functionality for tweaking the quality of the display, and even supports an on-screen menu, but none of it is used by the PIC. It was probably too costly to add an EEPROM to retain user specified settings, add the additional push buttons on the adapter, and develop a complete user interface. The default settings used by the PIC give a display a washed out picture that saturates too strongly towards white, but you can compensate for this in games that have a brightness control by turning it down all the way.

Other functions

The adapter has a switch for routing either the scan-doubled PS2 video or VGA passthrough video to the output connector, as well as the PS2 audio or line-in input to the line-out output. It also has three unused locations for LEDs that the PIC controls, possibly to indicate the source input and pass-through state. If you add the LEDs in, all three are pulsed in sequence during power-up, the leftmost is lit when composite video is used, the rightmost is lit when S-Video is used, and the middle has no other function. The adapter comes in a black plastic case instead of a transparent one which is why no LEDs were installed to begin with.

It's hard to recommend this adapter unless all you have is a VGA monitor. It works as advertised, but converting S-Video to 640x480 VGA leaves a lot to be desired and using composite video is even worse. Nevertheless it is an interesting, low-cost solution for getting VGA video out of the PS2 (or the original PlayStation, which it is fully compatible with).

News (6/12/14)

PlayStation memory card access

I've been working on a USB interface to read PlayStation memory cards. Part of the research involved determining the timing for the signals between the console and the memory cards. There's not a lot of detailed information available online so I wanted to share what I had found.

Signals (also represented as their SPI equivalents)

  • Data output from host (PlayStation) to card. (CMD, or MOSI)
  • Clock output from host to card. (CLK, or SCLK)
  • Enable output from host to card, active low. (EN#, or CS#)
  • Data input from card to host. (DATA, or MISO)
  • Data acknowledge output from card to host, active low. (ACK#)
CLK output (from host to card)
  • 250 KHz clock rate.
  • 50/50 duty cycle (high for 2us, low for 2us).
  • Idle state is high.
CMD output (from host to card)
  • Data changes during negative edge of the clock.
  • Data is stable during the positive edge of the clock (so the card can latch it)
  • Data words are eight bits wide, sent LSB first.
  • Idle state is high.
EN# output (from host to card)
  • 34.13us delay between EN# going low and the first negative edge of the clock.
DATA output (from card to host)
  • Data changes during negative edge of the clock.
  • Data is stable during the positive edge of the clock (so the host can latch it)
  • Idle state is low.
ACK# output (from card to host)
  • Active low, pulse width is 2.13us.
  • Time from rising edge of CLK to falling edge of ACK is 8.26us typical, 7.51us minimum.
  • Time from rising edge of ACK to falling edge of CLK is 50.44us typical, 12.46us minimum.
    (end of transferring byte N to start of transferring byte N+1)
  • Typical times are for regular I/O, minimum times are for reading a 128-byte memory card sector.

Acknowledge function

The ACK pulse indicates when the memory card is done processing the byte that was just shifted in. During certain operations the ACK response is delayed for a considerable amount of time. For example when sending a read command, there is a 1.6ms delay after the the seventh command byte is sent and the ACK is received. This is likely due to the hardware in the memory card needing time to copy flash data from parallel memory to internal storage which can then be shifted out serially. So the ACK signal can be thought of a wait signal.

After an ACK is receieved it is acceptable to wait a long amount of time before sending the next byte. Some games use a 378us delay between shifting out 0x81 to start a memory card command before sending out the rest of the command bytes. Other games send the remaining bytes immediately.

Official memory card

The official memory card contains an 8-bit shift register that is read and written in parallel. The shift register input comes from the host data output pin (CMD), and the shift register output goes to the host data input pin (DATA).

The memory card hardware needs some time to read the current byte out of the shift register and load a new byte into it. If the host does not wait for an ACK response, the hardware has insufficient time to load new data. As a result, the data written to the card will be shifted back out, appearing like a loop-back device with a 1 byte delay. For example if bytes N through N+3 are written, the data received for bytes N+1 to N+3 will be the data written for bytes N to N+2.

Third party memory cards

These cards use slow and inexpensive PICs which have a low pin count, so it takes them longer to access parallel flash memory. To compensate, they delay ACK even longer during read and write operations. This is why third party cards tend to have much slower access times compared to official cards. When designing your own memory card device you can delay ACK as necessary. But I don't know if the memory card libraries that games use impose an upper limit on how long they'll wait for an acknowledge.

Interfacing a card to a microcontroller

The memory card is connected to a synchronous serial port in the PSX CPU, which happens to be very similar to the SPI bus. Because of this similarity it is possible to use a microcontroller with SPI support to communicate with it. You need to use SPI mode 0 (CPOL=0, CPHA=0) to exchange data in a compatible way with the card.

SPI controllers typically expect MSB-first data, so you may have to bit-swap the data sent and received to compensate if there is no option for LSB-first transmission. Typically SPI controllers are designed to do back-to-back transfer of data bytes, but in this case ACK must be polled for proper operation between each byte transferred. This makes it impractical to use FIFO or DMA functions.

The cards are designed to be used with a 250 KHz clock rate, but I was able to drive the official memory cards in excess of 1 MHz without problems when reading data. However at higher speeds the majority of the time is taken up by waiting for the ACK response and the increased data rate does little to decrease the transfer time per byte. Boosting the clock rate does not increase access time significantly.


Here are some captures to show the general overview of a transfer.

The first image shows the start of a memory card read happening. When 0x81 is shifted out, the memory card responds and the controller does not (it expects 0x01). The missing ACK pulse for the last byte (0x5C) occurs much later.

The second image starts from when that ACK is received. The rest of the read command finishes and memory card sector data starts to transfer at a higher frequency.

Old News (6/12/14)

PlayStation Game Shark clone

A few months ago I developed a Game Shark compatible clone device for the PlayStation. Unlike the original Game Shark, this one has a high speed USB interface and proper level shifting between the 3.6V and 5V parts, as well as headers to access the digital audio outputs.

The small green PCB on the back is a switching power supply to convert 7.5V to 5.0V, and the three status LEDs are for USB enumeration, switch state, and 5V power. The switch allows you to boot directly into the game if turned off or into the firmware if turned on. Up to 512K of flash memory is supported, divided into two banks of 256K selectable by a jumper. This allows more than one type of firmware to be available.

I've developed software that allows for uploading and downloading memory, running programs, and accessing files on a connected PC over USB, so you can simulate CD file access over USB without having to burn a CD when testing software. Transfer rates are around 480Kb/sec, a good deal faster than real CD access.

I still need to add PS-EXE loading and functionality for cheat codes and cheat searching. My long-term goal for the project was to make a modern replacement for Datel's cheat searching program that required DOS and the Comms Link ISA card. But that may be an impractical amount of work to do.

The hardest part was finding a connector that fits in the PlayStation PIO port. The FX2 series of connectors from Hirose are almost perfect, and the wedge-shaped connector can have the edges easily sanded down to fit into the square PIO port. What's interesting is that the FX2 series have a zig-zag pin ordering that is inverted from the unbranded connectors found on official and clone cheat cartridges, so you can't use the same PCB layout with a scavenged connector, or put a FX2 connector on an existing cheat cartridge.

This ended up being a fun project, it's something I wanted to design for a long time and the results were better than expected.