Help with reverse engineering - Unexpected behavior of PEEL18cv8  - Page 1
Forum section: electronics / projects

author: fabiodl
author_rank: Frequent Contributor
timestamp: December 22, 2019, 07:50:04 am
content: Hello, in attempt to repair a broken Mega CD I am trying to reverse engineer a working PEEL18cv8 (whole storyhttps://www.obscuregamers.com/threads/sega-cd-has-no-bad-memory-but-still-shows-corrupted-graphics.1136/).The PEEL, whose datasheet is herehttp://www.farnell.com/datasheets/31598.pdfis used in this circuithttps://github.com/fabiodl/peelDecoder/blob/master/schematic.pdfAs you can see, two of the inputs are ground, and none of the I/O pins appear to be used as inputs.I took out the chip, and tested it on a breadboard with a microcontroller (an atmega328pb, for what it matters).I applied few million random inputs. Indeed, the output buffers seem to be always enabled. I tested it by having the micro controller pull the pins 12 to 19 up and down through 3.3K resistors, and confirmed that each of the outputs doesn't change when pulling it either up or down.Now, few observations on the PEEL architecture. The outputs (which, as stated above, are are always enabled) are either connected to the combinatorial network or to the flip-flop outputs.Now let us suppose we have some input Inp1 applied to the 8 inputs, and the associated output Out1. We flip one of the input pins, which is not the clock, i.e. we flip one of the pins 2 to 7. Let us call this input Inp2, and the associated ouput Out2. We now revert back to Inp1, i.e. Inp3=Inp1 and observe the output Out3.Suppose Out3 is different from Out1. The input is the same, so there must have been a change in the flip-flops state. Since we never touched the clk pin, we know that a global async clear must have happened. The async clear is a combination of inputs and feedback (which can come from the flip-flops), so it is not sure that the same inputs will generate a clear any time. However, we know that the internal state (if it matters) was set in a way that allowed the async clear to happen, because otherwise we would not have Out3 different from Out1. Now, we know that Inp3 (=Inp1) cannot be the cause of the async clear. If it was, the clear should have occurred when we first applied Inp1. We conclude that Inp2 was the cause of the async clear.Now suppose we do some other random input flips, and we arrive at a point where we apply Inp4,Inp5,Inp6 with Inp4=Inp6, Out4 different from Out6, and Inp5=Inp2. We know that also in this case the internal state was such to cause an async clear, and that Inp4=Inp6 can be ruled out for the above reasoning.Now, for Inp2=Inp5, the flip flop state has just been cleared, and the inputs are the same. So I would expect to observe the same output. The problem is that, with the real chip, it is not!!Here is an example. each row is an input (pin 1 to pin 8 ) / output(pin 19 down to 12), expressed in hex, with the least significant bit of the input being pin1, and the least significant bit out the output being pin 19....28 6c38 ec28 ec......30 8c38 ac30 cIs there something flawed in my reasoning? I confirmed the chip is still working after data acquisition. I confirmed the dumper program is working fine by connecting inputs to outputs in a loopback. I do not think the clock is receiving spurious transitions, as all I do to change the input is PORTB=(PORTB&~MASK) | (newData &MASK) . I read the outputs after 10uS of changing the inputs, so the chip has plenty of time to complete the transitions.

author: up8051
author_rank: Frequent Contributor
timestamp: December 22, 2019, 10:17:14 pm
content: Did you try to read PEEL in programmer (for exaple Labtool48)?Reverse engineering will be simpler if you catch logic signals in real device. You can use inexpensive logic analyzer USBee ,Saleae Logic or something compatibile with Sigrok.

author: fabiodl
author_rank: Frequent Contributor
timestamp: December 23, 2019, 02:21:12 am
content: Unluckily it seems the chip is read protected.I also collected data with the chip in circuit, but the meaning of the various signals is not well documented, so it's hard to guess its function.As for the observed strange behavior, my current hypothesis is that they implemented a sort of SR latch using the combinatorial feedback

author: up8051
author_rank: Frequent Contributor
timestamp: December 23, 2019, 06:52:45 pm
content: Some information about signal is avaliable here (page 71):https://gamesx.com/wiki/lib/exe/fetch.php?media=schematics:mega-cd_maintenance_manual_export_august_1992_rev_a.pdfBut the information is in Japanese.

author: fabiodl
author_rank: Frequent Contributor
timestamp: December 24, 2019, 01:31:19 am
content: Thank you. The hand written part, isn't it?I speak japanese, and I already saw that but the information is not very much detailed. Here is what it translates toIROM : when main cpu accesses 0~3FFFF (if cartridge is present $400000~$43FFFICAS0: IROM,IRAS2,IFDC shared when main cpu readsIUWR,ILWR: IROM,IRAS2,IDC shared when main cpu writesIRAS2: used together with IASEL,ICAS2IASEL: when accessing the 4MD-ram. they are input in the following order IRAS2->IASEL->ICAS2ICAS2IFDC: when accessing a G/A internal registerIFRES: when power on reset the G/AVA17~1: main ncpu address busVD15~0 main cpu data busoxbrom when main cpu reads 0~1FFFF. However, when reading $72, xbrom is not set, and vd15~0 is set setwith the register $A12006IXAS when IA17~14 or BA13~1 from the sub-cpu are valid subIXUDS when lines BD15~8 are valid from the sub cpu to the G/AIXLDS when lines BD15~8 are valid from the sub cpu to the G/AIRXW low when sub cpu puts data on BD15~0IFC0~1 when the sub cpu is in intack it becomes H,HIA17~14,BA13~1 address bus from the sub-cpu. From the internal of the G/A, for PCM only when doing DMA BA13~1 is outputBD15~0 data bus of the sub-cpuOCLK 12.M clock signal for the sub-cpuOHALT output by the GA to halt the sub-cpuORESET output by the GA (when RESETTING, HALT is also output)ODTACK when the sub cpu reads/write, and data is validOIPL2~0 interrupt signals for the sub-cpu

author: up8051
author_rank: Frequent Contributor
timestamp: December 25, 2019, 08:14:18 am
content: Can you show some signal diagrams from oryginal device?Do you know what memories are used in cardrige connected to MD slot?

author: up8051
author_rank: Frequent Contributor
timestamp: December 28, 2019, 11:14:52 pm
content: Are you still interested in reverse engineering?

author: fabiodl
author_rank: Frequent Contributor
timestamp: December 30, 2019, 02:38:27 am
content: Thank you for your comment. Unlucky all the information is that manual you linked.However I think I understood what is happening. Some outputs are a function of themselves. They implemented latches using the combinatorial part, instead of using the registers, probably to allow multiple clocks

author: up8051
author_rank: Frequent Contributor
timestamp: December 30, 2019, 09:35:27 pm
content: After some reverse engineering:OUT5 = /CAS0OUT6 (RAS2_FB)= RAS2Out6 is equil RAS2 but with some delay (used for lach on Out8)/OUT8 = OUT8 * CAS2 * /RAS2 * RAS2_FB+ /OUT8 * /RAS2+ /OUT8 * /CAS2TR_DIR = /OUT8 * /CAS0+ /OUT8 * CAS0 * CAS2 * RAS2+ OUT8 * /CAS0 * /ROM+ OUT8 * /CAS0 */ FDCNow I'm trying to reverse OUT7.

author: fabiodl
author_rank: Frequent Contributor
timestamp: December 31, 2019, 04:06:37 am
content: Thank you It seems to match what I found outsee the function physicalVerify herehttps://github.com/fabiodl/peelDecoder/blob/master/trivialComb.cpp

author: BlackEagle
author_rank: Newbie
timestamp: October 31, 2022, 11:18:02 am
content: Hi. Is there any news on this? Anyone created a board with the other chips and the programmed PEEL18cv8 board on it or is everyone just creating his own board trying to fix his mega cd? I am defintely not in the game of reverse engineering but as a repair person I'd like to at least open source the schematic / design / code for this so anyone can recreate this Sega Mega CD / Sega Mega Drive connector board. Another connector board will somehow work but not really so I guess a lot of Japanese Mega CD 1 are R.I.P. till this project continues. There is some code here but since I don't know the rest of the board it doesn't help really:https://www.obscuregamers.com/threads/reverse-engineering-the-sega-mega-cd-315-5540.1221...