06978: plotting, puzznic, cachat, tubeit, palamed, plgirls, plgirls2: Source of IRQ 0 + info on control register

ID	Category [?]	Severity [?]	Reproducibility	Date Submitted	Last Update
06978	Known Issues/To-Do's	Minor	Always	May 23, 2018, 00:25	May 29, 2018, 00:11

Tester	cmonkey	View Status	Public	Platform	MAME (Official Binary)
Assigned To		Resolution	Open	OS	MacOS X
Status [?]	Acknowledged			Driver	taito/taito_l.cpp
Version	0.197	Fixed in Version		Build	64-bit
		Fixed in Git Commit		Github Pull Request #

Summary	06978: plotting, puzznic, cachat, tubeit, palamed, plgirls, plgirls2: Source of IRQ 0 + info on control register
Description	IRQ 0 -------- The source of IRQ 0 is /IRQ from the YM2203 in the single processor L System games. Pin 25 (/IRQ) of the YM2203 is connected to pin 37 of the TC0090LVC. Pin 25 is pulled low when either timer-A or timer-B expires, and that triggers IRQ 0. I've looked through the code of all the single processor games and none of them actually start either of the timers (although all of them do actually initialise both timers). MAME currently fires IRQ 0 at scanline 120 for all L System games. I currently own Plotting, Puzznic (effectively the same base board as Plotting) and Play Girls single processor boards and have verified my findings on those boards. I'd imagine that all single processor boards have pin 25 of the YM2203 connected to pin 37 of the TC0090LVC. Steps to reproduce this, on hardware, are detailed below. I've looked at the dual and triple cpu games and found the following :- Kuri Kinton - IRQ 0 routine is just ei/ret and is not enabled. The timers on the sound chip are NOT started by the audio program. I don't know what pin 37 of the TC0090LVC is connected to as I don't own a Kuri Kinton board Evil Stone - not looked at the code for this game, nor do I own this board Fighting Hawk - pin 37 of the TC0090LVC is connected to pin 62 of the TC0170ABT custom. There's very little documentation available for this custom and I've no idea what it does or what pin 62 is. The IRQ 0 routine in the main program is simply a ret statement and IRQ 0 is never enabled. Pin 16 (/INT) of the audio CPU is connected to pin 25 (/IRQ) of the YM2203. The audio program starts the timers and interrupts are generated on the audio CPU by the YM2203, as expected. I own a Fighting Hawk board. Raimais - pin 37 of the TC0090LVC is connected to pin 4 (/INT L) of the MB8421 dual port ram. The slave CPU /NMI (pin 17) is connected to pin 48 (INT /R) of the dual port ram. The IRQ 0 routine in the main program is simply a ret statement and IRQ 0 is never enabled. Pin 16 of the audio CPU is connected to pin 56 (/IRQ) of the YM2610. The audio program starts the timers and interrupts are generated on the audio CPU by the YM2610, as expected. The slave and audio CPU's run at 8MHz (measured by me, on my own board, pics attached). The L System driver incorrectly has them at 4MHz (12000000/3) and states that these are "not verified". I've also verified the TC0090LVC runs at 6.66528 MHz on this board, from pin 5 of the 74F74 (which is connected to pin 122 of CPU). This is shown as "needs verification from pin 122" in the driver. Champion Wrestler - I've not looked at the code for this game yet, although I do own a Champion Wrestler board and it's on my list of things to do next Control register --------------------- This is shown as "function unknown" for all the single processor games (with the exception of the American Horseshoes). The control register is used for coin counters & coin lockouts. I've studied the code for Plotting and Play Girls 2 and have verified my findings on those boards. The control register for Plotting is at $b800 and is comprised of :- bit 0 - coin lockout #1 bit 1 - coin lockout #2 bit 2 - coin counter #1 bit 3 - coin counter #2 These values are clocked through a 74LS174 to a TD62064 and then out to the JAMMA edge connector. Play Girls 2 follows a slightly different pattern and utilises 6 bits instead of 4 for the control register :- bit 0 - coin counter #1 (this output does NOT go to the JAMMA edge connector, instead it goes to pin 3 of an unpopulated 4-pin area to the left of the 74LS174) (can be seen at http://blog.system11.org/wp-content/uploads/2013/09/1809_playgirls2_conv.jpg) bit 1 - coin counter #2 (this output does NOT go to the JAMMA edge connector, instead it goes to pin 4 of an unpopulated 4-pin area to the left of the 74 LS174) bit 2 - coin counter #1 bit 3 - coin counter #2 bit 4 - coin lockout #1 bit 5 - coin lockout #2 I haven't looked at the control register code of any of the other single processor games but I'd be surprised if it wasn't used for coin counters/lockouts on all of them.
Steps To Reproduce	The simplest way to demonstrate this functionality, on real hardware (using Plotting as my target board), is to change 4 bytes in the program :- 1) change the byte at $0036 to any non-zero value (this is a debug flag which, when non-zero, means the rom check is skipped) 2) change the word at $099c from 3b 00 to 8f 05 (this is the address IRQ0 will jump to when it fires, it's the start of the service menu code) 3) change the byte at $0bfe from 30 to 35 (this changes ld a,$30 to ld a,$35 and will start timer-A on the sound chip) With these changes made the game will boot to service mode approx 1 frame after timer-A has been started (the period of timer-A is 16.39 milliseconds). This is because the timer expires, triggers IRQ0 and the code jumps to the new address. This simple demo can be seen in this video (you can just about see the service mode test grid appear when the logic probe goes low when timer-A expires) :- Changing the byte at $0bfe back to 30 will allow the game to boot as normal (when running on hardware) as timer-A will not be started. When running on MAME however the code will still jump to the service mode as IRQ0 always fires at scanline 120. A slightly more complex example involves resetting timer-B in the IRQ 0 routine, when it expires. This is done by making the following changes :- 1) change debug flag at $0036 to any non-zero value 2) change word at $099c from 3b 00 to 00 5d (new IRQ 0 routine address) 3) change byte at $0bf7 from d0 to 00 (this sets timer-B period to 88.49ms (approx 5.3 frames)) 4) change byte at $0bfe from 30 to 2a (this loads/enables/starts timer-B) 5) insert new IRQ 0 routine at $5d00 f5 push af c5 push bc e5 push hl 21 00 a0 ld hl,$a000 ; point HL at the sound chip 06 27 ld b,$27 ; register $27 3e 2a ld a,$2a ; load/enable/start timer-B cd b6 1a call $1ab6 ; send data to sound chip e1 pop hl c1 pop bc f1 pop af c3 3b 00 jp $003b ; jump to ei/reti The results of the above code changes can be seen in this video. You can see pin 25 of the YM2203 (and hence pin 37 of the CPU) pulsing low when timer-B expires and is reset by the IRQ 0 routine.
Additional Information	I realise that adding the correct IRQ 0 trigger mechanism will have very little effect on the single processor games (the only difference being that they'll no longer call IRQ 0 at scanline 120 but that routine is merely an ei/reti combo in all the single processor games so the timing difference, per frame, will be 18 T-states plus the overhead of servicing the interrupt). I'd still very much like to see the correct behaviour emulated, if purely for personal reasons, as I'm planning on writing an audio engine to run on the Plotting board which requires the sound chip timers to generate an interrupt and it would be beneficial to be able to test the audio engine in MAME before deploying to hardware. Thank you for all the hard work and dedication that the MAME dev team consistently put in to constantly improve MAME.
Github Commit

Flags	Verified with Original, Noted in Source, Verified with Code
Regression Version
Affected Sets / Systems	plotting, puzznic, cachat, tubeit, palamed, plgirls, plgirls2

Attached Files	Raimais main CPU.jpg (2,843,079 bytes) May 23, 2018, 00:25 Uploaded by cmonkey Raimais main CPU speed
	Raimais slave CPU.jpg (2,513,770 bytes) May 23, 2018, 00:26 Uploaded by cmonkey Raimais slave CPU speed
	Raimais audio CPU.jpg (2,543,931 bytes) May 23, 2018, 00:27 Uploaded by cmonkey Raimais audio CPU speed
	Raimais pin 11 PAL.jpg (3,039,581 bytes) May 29, 2018, 00:11 Uploaded by cmonkey
	LQV-8M00-012.pdf (752,276 bytes) May 29, 2018, 00:11 Uploaded by cmonkey

No.15039 Kale Developer May 23, 2018, 15:16	Interesting stuff, thanks for sharing!
No.15051 AJR Developer May 28, 2018, 19:25	The 8 MHz readings on Raimais don't quite make sense to me, since parts labeled Z0840004PSC are only rated for 4 MHz.
No.15053 cmonkey Tester May 29, 2018, 00:10	Hmmm, this is rather strange. Pin 6 of the slave and audio CPUs are both connected to pin 12 of PAL B36-05 @ IC11. The equation for pin 12 is simply passing through whatever is received on pin 11 (according to running jedutil on the B36-05 PAL dump from Porchy's site). Pin 11 of the PAL is connected to pin 1 of the 8MHz oscillator. I've managed to find the datasheet for that oscillator (attached) and it looks like it can do internal dividing of the master clock frequency to output either 8MHz, 4MHz or 2MHz on three different pins. So, going by the datasheet, pin 1 (OUT 2) should be a 4MHz output and pin 2 (OUT 1), which is connected to pin 63 (master clock input) of the YM2610, should be 8MHz. I've just checked the frequency on pins 11 and 12 of the PAL and, as expected, it's 4MHz on both (pic attached of pin 11 reading). I then checked pin 63 on the YM2610 and it's 8MHz, as expected. I then double checked the frequency on pin 6 of both the Z80's and it's still showing as 8MHz. How does that work when pin 6 of both Z80's is connected to pin 12 of the PAL and that pin is showing a 4MHz reading??