20 Mar 2020

Kiki Kaikai - Taito 1986

One of those boards where bootlegs are much more common than originals.
For this particular title it's definitely better to avoid bootlegs; bootleggers couldn't reproduce the MCU and handcrafted something which is far from being faithful to the original: collision detection is buggy and some ennemies can't kill you!

Anyway, I got that board 5 years ago and attempted a repair at that time with the very few tools I had handy (note to self : a good job starts with good tools).

Game would only display a static green line at the top of the screen :

I started to probe the basics and found immediately there was no CPU activity (or only for a fraction of second). Program ROMs dumped good, however data lines were unhealthy on the work RAM (6264 type). I replaced it and got it changed nothing. I continued probing the other RAMs and found sound RAM (6116 type) was likely dead too. This time I got a coloured band of garbage on screen with pattern changing like something was alive. And it was, I could coin the game and hear sound:

Next RAM in line was the one for video (two chips actually), where I found most address lines where actually floating. They go through four ALS169 chips which had most outputs dead. I replaced the four of them and finally got something on screen looking more or less to what it should be:

I left the repair here... And 4 years and 3 house moves later I resumed my work. Only to discover board wasn't booting anymore but was trying to display some kind of error:

Not really legible in those conditions.

An other 6 months and 2 house moves later I went back to probing... I found the two LS298s driving colour data were dead. Installing new chips revealed the following message:

Oh, it all makes sense now, after 4 years the sound ROM has developped bit rot and is now corrupted! NOT! Sound ROM dumped fine but to rule it our I burnt a new one: no difference.
In fact here's what I discovered:
- sound ROM not present or even just a single byte corrupted! = game doesn't boot, black screen
- sound RAM not present = game doesn't boot, black screen
- sound CPU (Z80) not present = SOUND ROM ERROR
Sound RAM had already been replaced and was still good, Z80 CPU was good too... The connection between those all probed OK.
There wasn't much left in line except the YM2203. It's tied to the dipswitch banks directly without any kind of external pull-up resistances and most inputs were floating: clearly the chip suffered from internal failure. Installing a fresh one fixed the game completely:

Game fixed.

24 Jan 2020

Power Drift - Sega (Y board) 1988

I was told the game was dead. I was full of apprehension, this hardware isn't really simple, triple 68k CPU based, loads of custom chips...

Anyway, after a quick look at the boards I could see someone previously attempted a repair. Grrr... I HATE that. Some wires had been soldered directly on the solder side of the connectors, one of the custom chips on the bottom board had the word "SYNC" carved on it (and indeed it was the one generating the sync signal), the 315-5242 colour encoder had a 'X' carved on it (X for dead/faulty?),  ground trace on the video had vaporised, blue signal was shorted to what used to be ground before the trace got burnt and lastly an other custom chip had been reflowed. Well, well, well...

I plugged it without much hope and to my surprise there was no image (no RGB signals or sync at all)  but game logic was working with sound and inputs were responsive. Not as bad as expected. Maybe.

I probe the RGB signals and they were all low, no activity at all. They were coming directly from the colour encoder. I continued to probe the board and found SPACE signal (could be considered as the video blanking signal) was always active (low). That could surely explain why the RGB signals had no activity. Following the path of that signal lead me to the 315-5325 PAL chip. In fact the BLANK signal coming from that same custom chip generating the sync signal was always active too (low). I feared the custom chip was faulty but it was the PAl that had its input internally shorted to ground. Since it seemed easy enough to guess how the SPACE signal was generated from the BLANK and KILL signal (a simple AND) I rebuilt it externally using a LS08. Full of hope I tried my bodgy fix and:

I obtained an image with wrong colours. To me blue colour was missing and of course it was confirmed by probing at the video connector. I went back to the 315-5242 colour encoder and probed the transistor responsible of the last stage of amplification for the blue colour : it was shorted. I replaced it and blue reappeared:

But colour were still wrong, a sign that the 315-5325 PAL had more internal damage than the shorted input involved in the SPACE signal generation. I couldn't find the jed file to program a fresh one online so my last hope was Mark Haysman from retroclinic but unfortunately he wouldn't share the file with me but would accept to sell me a replacement chip (as said before this is the same since from the chip I can reverse the equations). For those who follow this blog you already know that this is how I started to reverse those Sega PLD chips.

A couple of weeks later I was lucky enough to have someone (member Trol) accepting to send me the chip from his working board for me to reverse it and fix my game. At the end he even found a spare 315-5325 he had spared from a part board. Great! It confirmed it was the last issue the board had:

And of course I reversed the chip:

IC134 bottom board, ref. 315-5325 (PAL16R4) reversed in a GAL16V8 (many thanks to member @Trol for sending me a replacement chip):

Game fixed.

Easy repair, isn't it?

19 Jan 2020

OutRun - Sega 1986

My favourite arcade game ever!
Previous owner said it was working with graphic problems. Err... It was faaaaaaaaaar from that.

Anyway, main CPU ROMs were all missing (4 * 27C512) so i reinstalled them and powered the board. As often with "working boards with graphic glitches" it appeared to be completely dead.
Looking at the top board closer I was horrified to see so many fujitsu TTL chips. And by probing few of them randowmly my fear was just confirmed: an other case of fujitsu plague. I pulled them all (61 on the top baod and weirdly enough none on the bottom board) and out of curiosity tested them: "only" 32 were declared bad by my programmer. I fitted new parts and game booted, which was a good start, but graphics weren't at their best. Also music was completely missing but samples worked.

Regarding the missing music, with the use of my audio probe I could hear the digital (distorted) signal entering the YM3012 but nothing came out. It was of course faulty and a new one fixed sound completely.
For the graphic issue, probing around the RAMs on the top board, I found most address lines were floating on the road RAMs. This lead me to four LS367s (IC23/25/41/43): inputs were toggling so as the gate/enable signals but most outputs were silent. I pulled the four of them and they all failed the IC test on my programmer. On a side note they were from SGS and I've noticed recently a lot of them were starting to fail at an alarming rate (will we face a SGS plague in a close future?).

Ok that's definitely better but were are the sprites? My thinking was that, for them to be completely missing it should be something quite upstream or vital in the sprite generation. Probing the 315-5228 PLD (CK2605) revealed one of its outputs was dead. Having reversed many of those Sega PLDs recently I blessed myself for having done so! I burnt a replacement in a GAL16V8 and sprites were back. Many of the jed files (including the ones I've reversed) are available from jammarcade.net, definitely worth checking there.

Game fixed.

Yeah, 38 faulty chips...

12 Jan 2020

Super Monaco GP - Sega (X board) 1989

Got that board in a deal to be able to test my PCM reproduction on X board and Y board hardware.
I was told the board worked with graphic issues. Let's see!

First both main and sub CPUs were missing so as three ROMS: one main CPU, one for sprites and one for sound. I populated the board with fresh parts and I plugged the game. Nothing, black screen, no sound, no activity on busses whatsoever. What a surprise...

I probed the main CPU RAMs and found activity for only a fraction of second before CPU crashed... Data signals were unhealthy and since two RAM chips used were shiny ones (on the 4 tied to main CPU) they were the most probable cause to me. Of course tested out of circuit they failed miserably. I also noticed they were many of those RAMs peppered on the board so decided to probe them all and sure enough two were also faulty on the sub CPU. 4 bad RAMs to start with! The good news is game then started, with sound, but with graphic glitches as well.

Typical mask ROMs failure here on sprites. I dumped them all (16 of them) and two turned out to be bad. The second good news is X boards have DIP32 sockets even though original mask ROMs used are 1Mb DIP28 chips, and non JEDEC DIP32 EPROMs can be used in place. Replacing them got me a fully working game:

For 5min before screen got badly corrupted.

Probing here and there I found half of the address lines on the tile ROMs were floating. Tracing them back led me to a LS374 with all outputs floating. Inputs were toggling so as control signals. Piggybacing a good known chip cleared the issue so it was definitely proven bad.

Since then I've played the game for few hours without any new appearing issue. Let's hope it lasts!

Game fixed.

27 Dec 2019

Sega PAL dumps

While working on a Sega Y board I found out one of the PAL chip was actually faulty (IC134 on the bottom board, PAL16R4 device, ref. 315-5325). I managed to recreate the faulty part externally but I wanted to make it neater. So I started my quest to find a dump for this PAL and the only result I got was retroclinic.

I promptly contacted Mark Haysman but he wouldn't share the jed file however he would sell a replacement chip to me (which is the same, from the chip I can reverse equations). This is when I realised so few of those dumps were available and the few I could find were either non working or untested. So here starts my quest to dump and reverse as many of them as I could.

You'll find below link to the jed files, feel free to share or host but please give credit.
Everything you'll find here has been tested on real hardware unless noted.

Reorganised for clarity.

[EDIT 2]
I received a lot of questions regarding the brute-force method for registered PALs.
YES they can be brute-forced. I've designed my own dumper then coded a piece of software allowing me to assign pins as inputs, outputs or bidirectional, mapping OE and CK pins, etc. Lastly it reduces equations and deducts state machine logic based on common pre-defined patterns (e.g. shifter).

Hang-On hardware:

IC5 OBJ board (the one under the sound board), ref. 315-5121, 82S153 device read and converted to GAL16V8:

IC100 video board (the one under the CPU board), ref. 315-5106 (PAL16R6), brute forced and reversed in a GAL16V8:

IC125 video board (the one under the CPU board), ref. 315-5122 (PAL16R6), brute forced and reversed in a GAL16V8:

OutRun hardware:

IC26 top board, ref. 315-5223A, CK2605 device read and converted to GA22V10 (wouldn't fit in a GAL16V8 since pin 11 can't be configured as an output, fits in a GAL18V10 see below). Simply tie pins 10 & 12 (ground) and leave pins 11/12/13/14 sticking out of the socket (pin 1 aligned to pin 1).

IC26 top board, ref. 315-5223A (CK2605) reversed in a GAL18V10:

IC62 top board, ref. 315-5225 (PAL16R4), brute forced and reversed in a GAL16V8:

IC79 top board, ref. 315-5226 (PAL16R4), brute forced and reversed in a GAL16V8:

IC108 top board, ref. 315-5224, CK2605 device read and converted to GAL16V8:

System 16B:

@G8 on the motherboard, ref. 315-5213 (PAL16R6), brute-forced and reversed in a GAL16V8 (also used on Y board hardware, IC20 on bottom board):

System 18:

IC25 on the motherboard, ref. 315-5390 (PALCE16V8H), brute-forced and reversed in a GAL16V8:

IC62 on the motherboard, ref. 315-5375 (PAL16R6), brute-forced and reversed in a GAL16V8:

IC72 on the motherboard, ref. 315-5389 (PALCE16V8H), brute-forced and reversed in a GAL16V8:

IC74 on the motherboard, ref. 315-5374 (PALCE16V8H), brute-forced and reversed in a GAL16V8:

Sega X board hardware:

IC18, ref. 315-5280 (CK2605) reversed in a GAL16V8:

IC84, ref. 315-5278, PAL16L8 device recreated from the schematics for a GAL16V8 since it was completely missing from my board:

IC109, ref. 315-5290, PAL16L8 device brute-forced and converted to GAL16V8:

IC117, ref. 315-5291, PAL16L8 device brute-forced and converted to GAL16V8:

IC127, ref. 315-5304 (PAL16R6, all games except After Burner), reversed in a GAL16V8:

IC127, ref. 315-5279 (PAL16R6, only After Burner), reversed in a GAL16V8 (not tested):

Sega Y board hardware:

IC20 top board, ref. 315-5314, PAL16L8 device brute-forced and converted to GAL16V8:

IC49 top board, ref. 315-5316 (PAL16L8) reversed in a GAL16V8:

IC76 top board, ref. 315-5315, PAL16L8 device brute-forced and converted to GAL16V8:

IC96 top board, ref. 315-5318, PAL16L8 device brute-forced and converted to GAL16V8:

IC98 top board, ref. 315-5317, PAL16R4 device brute-forced and converted to GAL16V8:

IC103 top board, ref. 315-5280, CK2605 device read and converted in a GAL16V8:

IC104 top board, ref. 315-5328 (CK2678), won't fit in a GAL16V8 (pins 9 & 11 are outputs, fits in a GAL18V10 see below). Bridge pins 10 & 12 of the GAL22V10 and leave pins 11/11/13/14 sticking out of the socket. Also bridge pins 9 & 14.

IC104 top board, ref. 315-5328 (CK2678) reversed in a GAL18V10:

IC20 bottom board, ref. 315-5213 (PAL16R6), brute-forced and reversed in a GAL16V8 (also used @G8 on System 16B motherboards):
IC43 bottom board, ref. 315-5319, PAL16L8 device brute-forced and converted to GA22V10 (wouldn't fit in a GAL16V8 because of missing feedback, fits in a GAL18V10 see below). Simply tie pins 10 & 12 (ground) and leave pins 11/12/13/14 sticking out of the socket (pin 1 aligned to pin 1).

IC43 bottom board, ref. 315-5319 (PAL16L8) reversed in a GAL18V10:

IC134 bottom board, ref. 315-5325 (PAL16R4) reversed in a GAL16V8 (many thanks to member trol for sending me a replacement chip):

9 Oct 2019

Turbo OutRun - Sega 1989

Turbo OutRun on the bench today (OutRun hardware). I really like to work on this hardware, I find it very easy to fix, design is made in a way different fonctions are made quite independent and neatly organised on the boards, THT custom chips are rock solid (and can be found on S16B motherboards anyway) and the only weakness is the PCM SMD chip which has been reproduced. That's maybe also because I've worked on those boards a lot and know them by rote.

I got this boardset as a gift from member kingau, many thanks to him.

Upon first inspection I immediately noticed a kit from Sega Resurection had been installed (standard 68k for main CPU and the 4 main CPU ROMs) in order to "desuicide" the game. Original CPU MODULE (FD1094) and ROMs were also included.

Once plugged game actually started, I could add coins and start a new game but image wasn't syncing and samples were buggy.

I probed the sync signal on connector H (bottom board) but it was missing. It's coming from a LS125 (IC91) and sure enough input was pulsing but output was dead. I replaced it and could finally play a psychedelic version of Turbo OutRun:

There was some more work needed...
Obviously there was something wrong with the palette circuitry, and probing in that area revealed IC98 (LS241, bottom board) driving the palette RAMs /WR and /OE signals had one of it's output stuck high (/WR signal of RAM IC92) meaning nothing was never written to that RAM. I installed a new one which revealed more problems:

Oops, forgot to take a picture!

This time it was a tile problem, again probing on the bottom board revealed all data signal for RAM IC64 were unhealthy. Piggybacking a good chip on IC60 (LS374) cleared the fault. Now all graphics were much better, however now I could clearly see road was missing:

Turned out both road ROMs (IC11 & IC47) had been replaced by 27C512 chips (64kB) when they should be 27C256 (32kB).
Of course that shouldn't be a problem if you double the file before burning it but here I didn't even check the content of the ROMs and installed fresh 27C256s instead, which restored the road:

Graphics were all good... Only for few minutes when suddenly all sprites disappeared:

Some address signals were flacky on the object RAMs. Cause was a faulty LS367 (IC49, bottom board):

Then to conclude the repair I had a look at the sample area (top board). I quickly found one of the RAMs (IC91 , top board) was faulty by piggybacking a good one.

Game fixed.

A handful of chips later...

P.S.: Out of curiosity I installed the OG CPU module and ROMs and surprisingly game booted without any issue!

27 Sept 2019

Sega System 18 romboard custom chip reversed (315-5436)

Just a short video to show the small adapter board I've designed to convert the SDIP64 package pinout to the PLCC84 package used by the CPLD I've choosen:

Works flawlessly.