This is a somewhat generic idea, but I’ve implemented it for a specific purpose. In trying to be able to dump all the TMS7000 series processors’ internal mask rom I’ve come across some pretty unique ones. The latest ones are the TMS70C46 processors found in the TI-74 basicalc and the FIA-10 financial calculator. These calculators seem to contain internal mask rom, but they also have built in address decoding to select different memory chips for different regions of memory.
This makes it more difficult to capture any of the reads to external memory because now we need to know which region it’s trying to read. I attempted to diode-or these together and use the standard dumper we have been using, but that didn’t work and it’s hard to know why. I am fairly confident that for the FIA-10 I know where it either executes all of its code from, or where it gets at least some from: the external mask rom.
I have already desoldered this ROM to read the contents, but now I want to put my own code there. Not just code, it would be very convenient to actually talk to the processor and command reads and writes to different regions to see what happens. I have a way to do this, it’s called Demon Debugger. There isn’t a target for the tms7k yet, but that part shouldn’t be too hard. What I need now is a way to get our code into the processor. Our latest version of Demon Debugger fits where a standard 2716 would go and uses certain regions for input and output so we could just replace the external mask rom if we know what area it’s trying to read. But how do I cable that in to this SOIC chip?
This is the latest board I got sponsored by PCBWay. This is what I’m calling the ‘mousebites’ adapter. That’s the term I’ve seen for castelated pins on the side of a board, and I think it’s cute. I used the datasheet for the exact mask rom that was installed there to get all the measurements needed to line up my board so it can be soldered where the rom chip used to be.
After installing this I realized it would be a perfect use case for a flexible PCB, but I didn’t notice the plastic bumps securing the board before I got this installed. That being said I got this one made in white with black silkscreen and that looks very sharp. I can tell why most boards tend to be green, because I can’t see the traces on the board as well with the white. The silkscreen on the soldermask though, that’s very distinct with this color combination. If you’re going to enter PCBWay’s 10th aniversary contest, this could be a good choice for your design. That is if you don’t want to venture into their full color printing.
This is what it looks like with a standard rom in the socket that I intend to use for demon debugger. It’s fairly rigid, but with all that leverage I’m afraid it’s going to rip traces right off the board. In order to prove it works as-is I put the same data from the mask rom on a standard 27256 to see if it’ll boot.
And it does! This sort of adapter has many uses, but unfortunately the orientation is pretty specific. I designed this one to stick out the edge of the calculator. If the orientation were flopped it would not work at all. If I made this as a flex pcb it would be more generic, but even then it’s not a sure thing. As it is this one works and I’ll be interested to see how It works with demon debugger.
Do not use git branches, this is a way to lose shit you’ve been working on. Do not use git stashes, this is a way to lose shit you’ve been working on *and it’s not backed up anywhere*. Git is just too complicated to use all of it and expect to not lose stuff. I’m trying to get back into this project after an entire year and figuring out where we left off and what was going wrong has been a whole ordeal.
This is the resumption of a project on dumping the internal contents of the tms7000 processor. Over a year ago we had moved on from the hardware SPI implementation of the revision A to the parallel approach of revision B. I don’t recall why we moved to a parallel interface, but I think it had to do with one of the pincount reduced chips not being compatible with our original SPI method. I think the later bigger chips are also not compatible with SPI though, so I’ll update this when I find out. The board with no revision had no ability to detect CMOS/NMOS and had a different resistor value for the LED. Revision A added those, and revision B changed from SPI to parallel.
In the interim since the last update we have been designing adapters for a whole new series of chips. The 7xx8 chips. These are bigger pincount chips that seem to be one of the last sort of tms7000 around. They look like they were more popular in europe and that’s where we found this databook. This is a 1991 version of the tms7000 databook and it’s not scanned or on bitsavers yet. I’d like to do that at some point, but for now I took pictures of the most interesting sections and they are up on my github.
The board was designed specifically to work with the DIP40 variant of the tms7000 but we now have adapters to successfully dump the:
DIP 28 0.07″ pitch
DIP 40 0.07″ pitch
DIP 64 0.07″ pitch
DIP 64
PLCC 44
PLCC 68
QFP 64
Today’s PCBWay sponsored board is this nice QFP64 adapter. It worked first try because the chip inside is basically the same as everything else, I just used the new databook to connect the dots. I got this one in a stylish yellow. I think it looks just as good as yesterday’s red, but in an unexpected way. This is one that you might think at first glance is a flex PCB, but it’s not.
There is a problem with the tms7000 dumpers we have though. rev.A only works on the 40 pin, and 44 pin chips. rev.B theoretically works on all of them, but it has issues locking up on certain 40 pin chips though. We’re not 100% sure why, but it may have to do with the fact we’re clocking the chip and we don’t do it fast enough to keep the memory alive in certain ones. So we have this conundrum, all* chips can be dumped, but not with one universal dumper. This is a problem we’re actively working on and hope to get it solved soon. We have a lot of chips purchased from ebay and dumps of them all up on github so we can test until they all work. An interesting aspect about this project is they all have internal rom. Ignore the part number printed on the chip, they all have some sort of mask rom. We have even found some that we think are factory test roms and are loaded in multiple different package chips we got from different sources. Others may be rejects that TI re-labeled to sell as external-only versions, but they still sent them out the door with code in them. If you have truly done everything, and I mean everything else important in life and you need some sort of project… feel free to start disassembling this code discovered in NOS chips from ebay.
The asterisk in the last paragraph is for another couple chips, the QFP60 and the 54 pin 0.07″ pitch DIP, those have a different pinout and addressing modes that we don’t have a databook for. I took a stab at guessing some of it, but apparently I guessed wrong and they didn’t work. I have an upcoming entry talking about the plans to dump those.
This is another project not up for purchase because really, no one needs these. Well, maybe one person a decade, but I’m happy to mail them my 4 spare boards when that comes up. The dumper itself might go up there but not until it’s fixed.
I’ve taken a liking to this small, simple speaker and when I went to go recommend it to someone as a diagnostics tool I found that you can’t get it anymore. Not retail anyway. This is my attempt to make a work-alike version and maybe eventually it will get cleaned up into a version that can be ‘mass’ produced for anyone that wants one. I don’t have this up on PCBWay to order mostly because I designed it around parts in my junk drawer, but I will send you one if you want. I consider this an actually useful bit of test equipment. If you want to know what sound a device you’re fixing is trying to make, this works quickly. If you’re trying to diagnose an audio circuit like an amplifier you can use this like an oscilloscope and follow the signal through the device by listening. You just have to take a headphone cable, split one end, and poke the circuit with the input signal end while grounding the ground pin, and you can follow the signal until it foes away and then you may have the problem component. I found bad slide pots this way in a mixing deck once.
On the left you can see the Archer 277-1008B speaker, in the middle the more modern Radio shack version, and then there’s mine. The original one snaps together and I cribbed my schematic almost entirely from that one, but I made my own changes to fit the parts I had and the features I wish the original had. The Radio shack one has one screw holding it together and a barrel jack for external power if you want. It also has a note calling out that it is center positive as a previous version was not (bad move, but good for fixing it). Mine has a number of alterations and I think it is somewhat improved.
As for the schematic I did a couple things. First I added a power indicator, these speakers will kill batteries if left on and there’s just no way to know if it’s on without twiddling the knob and listening for the crackle. Second I added a switch, the volume pots I had didn’t have a built in switch and I found some switches in a bin that I could use up on this project. The volume pot is actually something I designed a footprint for specifically because I have a ton of them and they’re all identical and I wanted an excuse to use them on something. They’re Allen Bradley parts salvaged by an old Ham that I knew at a previous job. The last thing I did was to use the audio pass-through on the output jack so that when you plugged in headphones the speaker was disabled. This did not work initially, but all the versions built after that used the proper jacks.
The board is an interesting design, I made it as compact as possible while still incorporating mounting holes and all the ports on one side. I could have gone with some surface mount parts but do you know how many 10k through hole resistors I have? They have to go somewhere.
Something I didn’t realize until right now is that I managed to keep all the traces on one side and except ground. I also kept all the traces as thick as I could so there’s be no tearing them off the board when reworking it.
This project did serve as a way for me to use some of these parts. Just look at them, they’re fantastic. These potentiometers aren’t actually the 5K that the original circuit called for, they’re 100K which means that this version has less impedance applied to the circuit it connects to so it will pass more noise. The pot is used as a simple voltage divider though so the range is unaffected in this application.
These switches are also something I’m trying to use up. I have so many parts with a little variance that I’m storing in so many little drawers that I really want to cut down on storing them all. If I can manage to use them in projects, then I don’t have to keep them around. I have used several different switches on the 5 boards I built up and this one is curious. You’d expect because it’s a slider switch that in this position it’s ‘on’. It’s not. The guts of this switch resemble those of a toggle switch where the contacts joined are the ones the lever is *not* pointing at. I have regular toggles too, but this one is backwards. I’m glad I’m using them up.
You may have also noticed that his board is in stylish red silkscreen. I figured this time I’d try out something else from PCBWay since they offered to sponsor this project. I already knew they could do the silkscreen crisp and small, but now I can see how well the white silk shows up on red boards. I think it works pretty well, and if you want something to stand out in a clear case this will certainly do it. Getting boards made from these guys is such a labor saver when it comes to clearing up my parts at home. With code the temptation is to try to write it so you can re-use it forever. With PCBs it used to be such a burden to get boards made professionally that you had to get it right on the first try and they had to work in batches of thousands. I can confidently say if you have 5 of one obscure part and you want to put it to use: design a board. Get it made. Solder the parts in. You are done. You don’t have to spend time drilling, or filing, or whittling with a craft knife to make some strange part fit proto-board. measure it with a $20 pair of calipers, draw it up, and have PCBWay build you a bespoke kit of your very own (parts only included if you ask).
Everything on this board is salvaged, the speakers and switches mean that I’ll have to design and print bespoke enclosures for each one of these. There’s no way this design is just ready to order, but when I get my bed adhesion problem fixed I’ll get some enclosures made and four lucky people can get one of these projects for themselves. If you want to play around with the design it is up on my github, but I do not recommend you just have the gerbers made because I cannot tell you where to find one of those potentiometers aside from my junk drawer. I do genuinely think this is a useful design and I expect that for a reasonable price it could be test equipment people would want, just not 1000 of this particular revision.
I fucked up. One of my latest projects did not immediately work and it’s for the dumbest reason. This also has implications on past projects too, so buckle in.
This project will be featured next, but the important thing right now is that it uses a headphone jack. I have a preferred headphone jack that I like to use, a standard footprint that lets me use both salvaged and new parts. This also has some cool features.
This is the footprint I mean. You have probably seen it around but you may never have wondered what those 5 pins are doing there. The plug that goes in here only has 3 wires so why 5? Well, I’ll show you
This is what they do, there’s a left and right channel and also pass-through pins that are connected when the plug is not inserted. You can see from this picture that it is frequently used to disable the internal speaker when an external one is plugged in. When my device didn’t do what I suspected I measured the pins on the board and I did not see those pins connected when no plug was inserted. I opened up one of these jacks and this is what I was.
Uhhh…. not good. I think I know what that is, but let’s examine the datasheet real quick.
Yeah, that is an electrically isolated switch that connects when a plug is inserted. Useful, but unexpected. Why did I get nothing out of the speaker?
Well, it’s because I fed the audio out the right pins, but the speaker was just connected to the switch which I thought was a pass-through. This one doesn’t get the ‘mute speaker if jack plugged in’ feature, but I jumpered over the pins so now it does both. The jacks pictured at the top are ones I bought from digikey that do act how I expect. The ones from LCSC have this strange configuration that fits the standard footprint, but behaves entirely differently. What other implications does this have?
This is not the first time I’ve used those headphone jacks. And I even shipped them out to people after I tested them (working I thought!). What are the implications of using those on this design?
The microphone input is not grounded when not in use, it may have some static on it. Not the end of the world. Same with the speaker in connection, noisy but OK. The line out and speaker out though, We have an issue! In both cases when you plug a cable in it closes the switch and makes the audio output mono. That’s not good. Can it be fixed?
Yeah, but it’s not pretty. I’m really not happy about this turn of events and I’ll be using these parts up on things that don’t use the pass through function and never ordering them again. The datasheets were right, they were just unexpectedly laid out.
The last board variant I have done is the 0021 lights board. Architecturally this is very similar to the character board, but even from the earliest variant this board never had audio functionality. That means the designers used all 16 outputs from the PIA on this card to drive 24v controlled lights.
The lion’s share of 0021 rev.a is shared with the character card, in fact even the chip locations are shared with 0004 rev.b. If you look at the two unused chip locations on this board, they used to be populated on the character card. The upper one does not have power to it because it was originally an op-amp chip and did not have power on the diagonal opposite pins. The power that did run there was 12v and -12v and that is now gone.
This is the modification for this card to give it 16 outputs. We now use two of the open collector outputs from the 7406 instead of adding another uln2003. That means these outputs are not as powerful, but I think the lights were relay controlled so in this case the high current is not as needed.
The final board is 0021 rev.f, and I think that naming is probably misleading. This board is part of the post-1993 redesign so it is based off the 0034 rev.e. I think these boards were designed at the same time because 0034 rev.e changes the DIP resistor packs to be 7 resistors per for LEDs and then those two remaining resistors are used on 0021 rev.f. This board includes all the changes from 0034 rev.e except it removes the jumpers for 5v/24v. These boards were never used to drive something like the A/V switcher, so that’s not needed.
That’s it for all the boards I have re-made in KiCAD. If you want a lights board there is no functional difference between rev.a and rev.f. They both have the same electrical interface, they fit the same connector, and all software that talks to one talks to the other. I have the boards up here on github, but feel free to ask me about any issues you may have with one of these setups. I may know something after digging so deep into all this.
There is a whole whack of these, but there aren’t a ton of changes from one to the next so I’ll go over all the details with the first one, then I’ll only go over the differences from board to board.
This is the rev.a character board 0004. The only difference between this one and all subsequent boards is this one is about 19mm longer than all the rest. It will fit in the card cage, but it will stick out a bit. The board layout is kind of interesting in that it includes a lot of empty IC sockets for potential bodges that may be needed. Let’s look at the schematic one bit at a time.
On the left we have power coming in and the board ID header. This lets you connect the chip select for the 6821 PIA to one of 10 pins on the card edge so it can be uniquely selected by the CPU card. If you really wanted to you could set two cards the same and have them mirror their movements, but I can’t think of a practical use for that. Then we have CA2 controlling the ‘high’ voltage. It switches the 24v supply out to the character ribbon cable to control all the solenoids out on the character. At the bottom right we have the returns from the solenoids and each can be grounded to complete the circuit for the solenoid. These are tied to LEDs so you can see what movements are being commanded to the animatronics. If the fuse blows these LEDs and the solenoids will not function. This card has 14 outputs, but that’s for a good reason.
This is the audio section that is only present on the 0004 character cards (I have seen rev.a and rev.b). This works with the 0003 audio card to choose one of four audio tracks to play. I know it only chooses one because it uses a 74ls42 to pick and that chip has mutually exclusive outputs. In this case the remaining 2 bits of the PIA are being used to pick which track, and CB2 is being used to enable audio at all. Once the track is selected (I suspect it’s 3 tracks from a reel to reel and one for mirroring the background game room audio) it gets amplified and volume controlled before exiting the card onto pin 2 of the character connector.
This is the circuit on the solenoid driver card. It seems to be a matching, or isolation transformer and a relay controlled by the 24v line to the solenoid card. I don’t know if there was supposed to be an amplifier at the character, or it was just a speaker coil, but this is how these characters worked. If you have the more modern 0033 audio card this output would still work because two of the four channels are still available to be chosen from (one being the reel to reel, the other being the background audio). The ROM that’s driving your unit just had to control the audio on the character card, which the one that we have disassembled does.
This cyberamic tester now makes more sense. It seems to sit between the computer and the animatronic to indicate what solenoids are trying to energize, over-riding them, and also having an output for the audio signal.
0004 rev.b really just changed the board length. There’s nothing else of note, but this is the standard board size going forward.
0034 rev.a dropped the analog portion. It does not re-use the outputs controlling it however, so if you want to run the same code that twiddles those bits that is perfectly safe, it just does not do anything. They updated the logo to this square one, and removed one DIP resistor pack in favor of individual resistors as there are less than a full pack being used with the audio stuff gone. The 12v and -12v stuff from the audio stuff still exists, but it just has capacitors and test points on this board, neither of which are needed for this card’s functionality. This card is intended to pair with 0033 audio cards because those do not need the character cards to handle the audio, but as stated above they still can, but for 2-channel functionality instead of 4).
0034 rev.d is a major overhaul and the first post-1993 board I’ve done a reproduction of. There are a bunch of changes, but largely not to the functionality. The solder-in fuse has been replaced with a fuse holder, the transistor was changed to a more modern TIP130A, and the spare chip locations are gone. All the 12v and -12v stuff is gone because this board doesn’t really share that same heritage and got a big facelift. The main chip is the same, but the IC socket with jumper packs to select only one board ID is replaced with a set of dip switches with a stern warning to only select one at a time. That is because the chip driving all those chip selects is a 74LS42 which drives one output low and all the other outputs high. Selecting multiple IDs at once would connect 5v and ground together and that wouldn’t be good. The other major change is a set of jumpers that you can connect to make he output voltage 24v or 5v. This is because the character cards from this generation were re-used as general purpose output pins to control an external A/V switcher. This generation did not use the audio card at all. Those resistors that were split off before are now back together in a SIP resistor pack. There is also a new logo, but this time it’s on the silkscreen.
The last character card I have seen is the 0034 rev.e board. There are only minimal changes from the last one. The capacitors are now multi-footprint so you can populate them with two different pin-spacing parts depending on what you have. The 24v/5v jumpers now have a default position of 25v and you have to cut the copper to get a 5v board. The silk now has different reference designators, and the underlying references may have changed in the last revision but the silk had values there and not the references. There’s also a sort of unexplained track re-routing. These tracks seem to dart around some non-existent chips, and since I know what the immediate previous version was, I have to assume this was maybe to add some other function but it was dropped.
That’s it, that’s all there is for the character cards. I have versions of all of these up on github, but there’s really only two you might want. If you need audio functionality, use 0004 rev.b as it’s the right length. If you do not need audio functionality and you want the modern amenities go with 0034 rev.d. I’m not sure how I feel about dip switches, if you don’t realize which way is ‘on’ you may accidentally short it out. I will be continuing to explain the subsystems and functionality of the cyberamic control system in upcoming posts (I think I only have one more). Feel free to ask me about any issues you may have with one of these setups. I may know something after digging so deep into all this.
The third board I’m going to try to explain is the audio board. This one was harder to do than the others because even though the transport board had an incorrect and incomplete schematic, this board had no schematics. That means I had to put together these replicas based on a bunch of reasonably good pictures, some measurements done at the museum who let us have some time with the cards, the disassembled code, and the other cards for reference. This ends up being a big puzzle figuring out where all the connections go, and sometimes it takes some looking at the datasheets for the parts and saying ‘well, this has to be pulled high otherwise it would never work’ and just rolling with it.
The first card I want to talk about is the 06-0003 rev.c board. I only have rev.c of this board, but it is clearly the earlier board. It has two main functions, measuring the room audio level, and controlling the volume of all the audio channels. We’ll start with the first part.
This is the automatic gain control microphone input. I don’t know exactly what all the filtering is doing but I know the main thrust of what’s happening. The room audio is picked up, amplified, filtered in what I assume is an envelope circuit to get a nice smooth analog value for the average room volume. That audio is fed into 8 comparators that compare the analog room audio level to a set of fixed voltage offsets coming from that large resistor ladder with many taps. This produces one of 9 states, either the audio level is below the first comparator, or it is at or above the level of any of the comparators in the chain. This is not a binary counter sort of situation, if it is halfway up the possible volumes then the bottom 4 comparators are all detecting it.
The 7 most significant bits of this are put directly on the LEDs on the front of the card. Even with no CPU installed, this circuitry will detect the room audio and present it on the LEDs. That data is then fed to the onboard 6821 PIA chip so the state can be read by the CPU. Once the CPU decides what to do with the audio streams based on the ambient audio level and the automatic gain control knob on the front panel (or a possibly just a table lookup in some versions) it commands the DAC chips to control the audio levels.
There are four sections on this card that look identical to this. This operates in an… interesting way. I would expect a digital to analog converter to take a purely digital signal and reproduce it between a high and a low fixed threshold. That is not what this does. One of the threshold pins is fed analog audio and the output is that audio, but gain controlled to 256 possible levels. I suppose you can use a DAC with external Vref pins as a fancy volume control, but I didn’t expect that. I said there are 4 of these circuits, so that means 4 input pins for 4 analog audio sources and 4 pins on the card edge connector to put the 4 gain controlled audio signals. There is one slightly different channel though.
This one takes the background audio (game room music) in with its own volume pot to set the relative level. It mixes it with the microphone input, not the AGC mic, but the microphone where an employee might make announcements. That audio then passes through the same amplification stage as the rest, including going out to one of 4 pins on the bus for gain controlled audio. This stream just also passes through another amplification stage with its own volume control pot and goes out a separate output dedicated for the background audio. The output here always has the combination of game room audio and microphone going out, it just gets volume controlled by the AGC circuitry.
Up at the top of the connector are the 4 channels of audio that go out on the bus, all amplified equally. At the bottom you can see the analog channels in and out. I have only labeled one of them R2R audio meaning reel to reel because the cable setups I have seen only have that pin carrying the audio from the reel to reel show tape. Where do the other channels come from? I don’t know.
This is that section of the backplane schematic. Ignore J19 for now, this card does not use that. The backplane has 3 RCA connectors for the background audio in and out, the microphone for AGC, and not pictured is the employee announcement microphone that looks like it comes in from the big power supply/button unit. J14 is a big Molex connector that has a cable that goes to the reel to reel machine. On the one in the museum the pins for aux audio are not populated, I only determined that’s what they do from looking at how this card functions. The reel to reel already has two tracks, one for data and one for audio. Was this originally used with a 4-track reel to reel machine with 3 audio tracks that could play in parallel? Maybe, but I’ve never seen documentation that indicates that or tapes with 4 channels of audio. How does the audio get out of this card cage? Well, for this card (0003) you need to pair it with the older character card (0004) and on those cards they decode which of the 4 audio tracks to output and output them locally at the character. I’ll get to that in my next entry.
The next card I have is 0033 rev.a. Note the extra 3 in the tens place, this card is not a predecessor to the last card, it is a successor and is not fully backwards compatible with it. The AGC functionality is the same, but only two of the audio amplification sections are present. Those sections then do this:
If you squint you can see the similarities. The background audio and reel to reel audio sections are the same. At the point they go out on to the card edge connector (which still happens) they are also connected to this analog switch. This switch picks which audio channel will go out the new mixed output. The way it’s wired we could have one or both or neither output, but I suspect they are never both output at once. This means that the single audio output either functions like the room speakers, or it puts out the show audio instead while a show is running. The output stage re-uses the two op-amps from the now missing aux channels and tit has its own volume pot for setting the level. This audio does go out J19 on the backplane.
Here’s the thing, I’ve never seen a backplane with J19. It’s always added by hand like this, and this is the third backplane I’ve checked. Clearly the backplane was designed for the 0003 board that didn’t need this and was retrofitted, but were any backplanes produced with J19 installed? the schematic I have has it on there.
There are some routing choices that make it obvious that 0033 came later and was modified to suit. The wires that just chop through the ground plane there at the bottom for one. There’s also some traces on the back of the board that dodge chips no longer present and connections that used to be for the other two analog audio inputs. Here’s some important things to note:
If you have a 0003 audio board
you must use it with 0004 series character cards
the character audio comes out those cards
you are compatible with 4-channel recordings (early?)
If you have a 0033 audio board
you can use any character card
the character audio comes out J19 on the backplane
you are only compatible with two-channel reel-to-reel recordings
The ROMs Frank and I have disassembled have code that controls both the audio switching on the character cards and the audio switching on the audio board. This makes it universal and can work in either setup. The ROMs we have are only for The King configuration, however, so it remains to be seen what additional control is done to handle other character audio.
I think it’s super cool to be able to have the audio come out of the animatronic that’s currently talking, as well as having multiple channels that can talk over/with each other. Apparently this was used for some early setups, but did not stick around as the audio from the characters was not loud enough. As always the cyberamic stuff is all on github here. I will be continuing to explain the subsystems and functionality of the cyberamic control system in upcoming posts. Feel free to ask me about any issues you may have with one of these setups. I may know something after digging so deep into all this.
Evan's Techie-Blog 