Thunder Fox repair log

 PCB Repair Logs, Repair Logs  Comments Off on Thunder Fox repair log
Jun 032016
 

Got this Thunder Fox PCB from a friend to repair.

thunderfox1b

It had 2 issues:

  • Vertical lines on some sprites.
  • No sound.

thunderfox2

I had a working Thunder Fox PCB with me so I started the easy way to swap sprites ROMs between the boards and got the sprites working again with replacing the one labeled c28-03 at location IC29 (#1 on the PCB picture above). I reburned a 27C400 EPROM as a replacement.

thunderfox3

For the sound part, I could notice there was no analog output signal at pin 27 on the YM2610 sound chip but all its data inputs and data lines on the sounds ROMs were pulsing. I also noticed the signal on the IRQ (pin 56) was stuck low (it was pulsing on my working board). The IRQ signal is an output so it made me think the YM2610 was clearly the faulty one so I replaced it but with no change…

The IRQ pin was still stuck low so I traced it to pin 16 of the Z80. Strange because it is an input pin on it but sometimes if a pin is dead it takes over and pushes down the data that comes from an other chip. So I tried replacing the Z80 (#2 on the PCB picture above) and finally got the sound working. That was it !

 Posted by at 8:50 am
Jun 012016
 

Initial Symptoms

  • Static junk on screen, which changes between reboots.
  • No sound or evidence that game is running in background.

Sony PVM monitor wouldn’t sync in RGB mode, but would (for some reason) in Y/R-Y/B-Y mode.

Random junk when powered on

Random junk when powered. (purple image is due to monitor problem)

CPU Boot Problem

Probing CPU interrupts showed that sometimes V-Blank interrupts were active, sometimes not. Initial check of EPROMs showed that one was dead, but replacing did not solve the problem. Probing with a logic analyser showed that the data/address bus of the main CPU was pulsing, and the game wasn’t watchdogging so deeper investigation was required.

Tracing with a Saleae logic-8 showed that the first v-sync interrupt was getting acknowledged by the CPU, but subsequent interrupts were ignored. Digging futher I generated a partially complete address/data trace by the (shared) data+address bus and the bus status lines (BS0-2). Since my analyser is only 8-bits, I could only trace 5 data+address lines at once. I wrote a script to combine multiple traces using the bus status lines to synchronise the data. Luckily the behaviour was deterministic, and I could extract enough trace data (12-bits of both data and address) to work out a full trace by correlating the data with a mapped ROM dump from Mame. Doing this I found that one of the RAMs was faulty; The stack was getting corrupted, causing a ret instruction to jump to an unexpected program address. Swapping the program RAM resulted in the game booting.

Bad SRAM of main CPU. Socketed and replaced.

Bad SRAM of main CPU. Socketed and replaced.

New Symptoms:

  • Some tiles have flickering horizontal bars
  • Some tiles seem to not change from top to bottom (in horizonal screen)
  • Sound crackly and missing music
Background tiles are corrupted

Background tiles are corrupted

Tile Corruption Problem

Probing the tile ROMs shows that ROM U105 address lines 1-4 were floating. These were driven by the SEI0020BU custom chip at U102. Pulling the SEI0020BU and swapping it with it’s neighbour switched the tile corruption. Clearly the SEI0020BU was the cause of the problem. Annoyingly these aren’t easy to come by.

Reverse Engineering the SEI0020BU

I guessed that the main function of the SEI0020BU was to drive the addresses of the ROM chip in the direction of the raster. I checked the connections of the SEI0020BU with a multimeter and worked out the function of each pin (see schematic below for more details).

Checking the Mame source confirmed that the address mapping for this chip corresponded with the x-axis scroll register. I guessed the purpose of the chip was to store an x-axis scroll offset and add that result to the raster x-position. I guessed that only 8 bits of shift were actually needed, and I knocked up a prototype on a breadboard, which seemed to work well.

SEI0020BU breadboard prototype

SEI0020BU breadboard prototype

With a working prototype, I got to work using CadSoft EAGLE (PCB CAD tool) to design a PCB daughterboard for a more permanent solution. The PCB was printed by Seeed, and delivered in a few weeks.

First SEI0020BU daughter board

First SEI0020BU daughter board

Once the printed PCBs were delivered, they seemd to work well, but I’d made a few mistakes. Firstly, the output from the LS156 should have been pulled high. Secondly, only 8 bits for the shift offset was insufficient – I actually needed 9 bits. This was a stupid mistake – I’d been unable to test the full shift range properly on my test rig because of a faulty joystick adaptor! Once I tested the board in a cabinet, it was clear that scrolling too far to the left (offset register wraps) causes the tiles to distort (-1 wrapped to 255 instead of 511).

I managed to hack a fix onto the PCB by piggy backing an extra 8-bit buffer and a 4-bit adder onto the PCB, cutting a trace and wiring up with patch wires. The modified PCB finally worked properly, and the graphics were fixed. I wasn’t happy with it though – I’d printed a PCB, so I thought I may as well finish the job!

Patched SEI0020BU Replacement Daughterboard

Patched SEI0020BU replacement daughterboard

I modified my design in Eagle (see schematic below), and ordered a new set of PCBs to be printed.

SEI0020BU Schematic

Schematic for Raiden SEI0020BU replacement

The new PCBs arrived, and worked perfectly – phew!

Final working SEI0020BU replacement daughterboard

Final working SEI0020BU replacement daughterboard

Sound Fix

Sound was working, but distorted and noisy. Probing the sound input to the amplifier with an oscillioscope showed that the signal was weak. This was driven by the HB-41 SIL package. The inputs to the HB-41 looked clean, so it looked like it was bad.

Faulty HB-41 SIL package

Faulty HB-41 SIL package

Luckily I had a spare on a Seibu Soccer donor board. Hooking it up solved the sound problem. Job done!

Image is clean, and game now functions correctly.

Image is clean, and game now functions correctly. Colour correct in arcade cabinet.

BINman 3.5.1 update

 General  Comments Off on BINman 3.5.1 update
May 302016
 

binman351

I’ve been working on this a bit recently, mainly to add a few things I wanted it to do but also did a rewrite of a few things which Caius has been bug testing for me.

-Moved the HEX view to the relevant menu’s
-It can now compare the two loaded files and it will give a match percentage output and say how many bytes are different.
-Can now create a new file within the program and can choose what to fill it with.
-Added auto concatenation depending on the EPROM selected. I recently found myself doubling up (or sometimes more) ROM files to fit into larger EPROM’s and just wanted a quick way of doing this.

There is probably a few other things added/different too.

As always it requires .NET to run

 Posted by at 4:48 pm
May 292016
 

In the past days Seb reported some bugs in the Golden Axe (317-0121) Japanese decrypted ROM set. Bugs manifest in this way (his words)

When you let turn demo few minutes and launch game, the second enemy of the first level doesn’t appear and you can’t moving forward. Else if you launch game directly after power up the pcb there is no issue.
Besides, in two players game mode, when player one die and stop to play, the game freeze. I saw this bug at last level and can’t confirm this appear in all level.

Thanks to Seb for his feedback.

 Posted by at 10:52 pm

ROM dumping and checking

 Guides  Comments Off on ROM dumping and checking
May 292016
 

There has been a fair bit of discussion going on in the background recently about how is best to dump ROM’s from a PCB.
This has mainly been centered around dumping with the intent of submitting them for inclusion into MAME but this still applies if you are dumping for your own reasons too.

Obviously the first thing that you need is an EPROM programmer of some kind. The selection available is massive and not really a topic this post will delve into too much.
I myself have 3 programmers available to use.
My main workhorse is a Dataman 48pro2. Its been fantastic ever since I bought it and the support is top notch too. The downside of this programmer is the cost.
My second programmer is a cheap generic Chinese programmer. The software is not too great and the English translation isn’t all that great either but it does the job nicely when my main programmer complains about voltages being out of spec or whatever.
My last programmer is a Needham EMP-20 (actually have two of these). I was given these from a local company that was having a clear out of their old unused equipment. They are really good but their downside is they are parallel port only and the software is DOS based. Apart from that they both work well.

So how do we dump ROM’s?
At first glance we think it isn’t much more than removing an EPROM from a PCB, fitting it into the programmer socket, selecting the correct device and clicking ‘READ’ in the software.
A lot of the time this is fine but how do we do our best to know that the dump was good? What if one of those old thin crusty legs on the EPROM doesn’t make a good connection throughout the read?
The result of the read under these circumstances will be, quite simply put, a useless dump of that EPROM.
Lets look at this a bit more. Say you are dumping with the view of submitting to MAME. You dump the ROM(s), bundle it up in a zip file and send it off.
Then one of the developers takes the time to add it to the source code and do some testing. Now lets say the game doesn’t work or some of the graphics are messed up.
In some circumstances, say for instance the game was a prototype or something, that developer or developers starts looking for errors either in ROM dumps or the emulation itself. Before you know it he/she has invested a few hours of their time.

The other scenario. You dump the EPROM for your own purposes. Some days, weeks, months or years down the line you need to program yourself a new EPROM because the old one has died or suffered from bitrot. You program it up and fit it but it doesn’t work. Is there something else wrong with your PCB? But what if you just didn’t dump it correctly in the first place and you never realised. You never made the dump public so any potential testers out there couldn’t even do the testing on your behalf and notify you. Congratulations, you’ve now got a useless piece of electronics on your hands.

Either way your dump was bad but we could have potentially avoided this whole mess by carrying out some really easy checks. Lets look at it.
When dumping a ROM we want to be extra sure that every time we read the device we get the same data. Every programmer I’ve ever used will display a checksum of the data dumped (although YMMV) like this.
checksum

If you read the device a second time and the checksum is different from the first time then we clearly have an issue but what if it’s the same every time? The data could still be bad so let’s try physically removing the device from the programmer and reinserting it then trying to read it again. Is the checksum still the same? If not then we are probably going to need to investigate further. If they are the same then how about we remove and reseat one more time just to be sure. This may sound like a waste of time but the reality of it is it only takes a few seconds for older EPROM’s to be read out and it could potentially save everyone a lot headache further down the line.

So now we have dumped the ROM (three times) and we are happy that no matter what we do or how we position it in our programmers we get the same dump each and every time. What next?
In the case of an arcade PCB let see if the dump we have compares to anything already dumped and included in MAME.
For this you will need the latest version of MAME available from MAMEDEV
Open a command prompt at the directory where you unzipped/installed MAME and type ‘mame -romident [YOUR-ZIPPED-FILES-LOCATION]’. If you use the 64bit version then type ‘mame64 -romident [YOUR-ZIPPED-FILES-LOCATION]’ instead.

Here is an example using the rbisland romset. I’ve added a random binary file to show what happens when an undumped file is found.
romident

What this shows is each individual file within the .zip file and the filename associated with each other romset.
The “9100.bin” file is the undumped file and you can see it shows “NO MATCH”. This means that the file is unknown to MAME.

If they are all matched then nothing more needs to be done. If they aren’t a match though then we could be looking at something undumped OR we could still be looking at a bad dump.

Included in the MAME package is a tool called ‘ROMCMP.EXE’. This is another command line utility that performs a variety of checks on your files. For example it will tell you if the dump is all 0xFF bytes or if the top and bottom half of the dump are the same. It can also be used to compare your files against the files currently in MAME to see how much of the data matches.

To use this tool we need our file or files in a .ZIP file.
For this example I( have used the Major Title 2 romset ZIP file and have added an extra binary file which I hand made but made bit 1 (second bit) stuck on using a hex editor.
romcmp

The output is simple enough to see. It shows that bit 1 is always ‘1’.
If you have dumped what you believe is a new ROM set then you can use ROMCMP to compare against an existing set.

Here I used two different sets of Major Title 2 to demonstrate.
romcmp2

You can see most files are identical but there are two that aren’t quite the same (these two are the main program ROM’s for Major Title 2). You can also see that they are both over 80% the same as each other. This is a good sign for a different revision of the same game especially as we have already done the previous checks on the ROM’s to confirm their validity as much as possible.

There may be other steps that people like to do on their ROM dumps but the above will give people, whether its yourself or an emulator developer trying to support it, a fighting chance.

 Posted by at 12:20 pm