EEPROM games...

For anything related to cart (SRAM, SF2 mapper, audio, CD mode 1, ...)

Moderator: BigEvilCorporation

TmEE co.(TM)
Very interested
Posts: 2440
Joined: Tue Dec 05, 2006 1:37 pm
Location: Estonia, Rapla City
Contact:

EEPROM games...

Post by TmEE co.(TM) » Thu Jul 12, 2007 10:23 am

I've wondered recently about the games that use EEPROMs, and I thought, that maybe we should make a list of them. I know few games only:

"Rockman Megaworld"/"Megaman - The Wily Wars" - 24Cxx ?
If I'm not mistaken, 8BitWizard's RPG - 24Cxx
And my "CA the Meowian" - 93C66
Mida sa loed ? Nagunii aru ei saa ;)
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Thu Jul 12, 2007 10:43 am

During my testing, I listed those games which seems to use a serial EEPROM for backup:

X24C01 (128 bytes):
Wonder Boy in Monster World
Megaman - The Wily Wars

X24Cxx (can be emulated all the same way)
NBA Jam serie
NFL Quarterback Club
Frank Thomas Big Hurt Baseball
College Slam
Blockbuster World Video Game Championship II
HardBall '95


all of them use 0x200000 and 0x200001 addresses for SCL and SDA lines

TmEE co.(TM)
Very interested
Posts: 2440
Joined: Tue Dec 05, 2006 1:37 pm
Location: Estonia, Rapla City
Contact:

Post by TmEE co.(TM) » Fri Jul 13, 2007 6:28 pm

Eke, will you be willing to emulate my EEPROM mapper ? All required info here: http://www.spritesmind.net/_GenDev//for ... .php?t=180
if anything is unclear, just ask me. This is very simple mapper, thus cartridge price is very cheap if someone wants to get his/her stuff into production...
Mida sa loed ? Nagunii aru ei saa ;)
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen

8bitwizard
Very interested
Posts: 159
Joined: Sat Feb 24, 2007 11:35 pm
Location: San Antonio, TX

Post by 8bitwizard » Sat Jul 14, 2007 2:12 am

Here's my own list so far: (so that I know which games have chips that I can re-use!)

Serial EEPROM:
* EA - NHLPA '93 - 24C01 (mode 1)
* EA - Rings of Power - 24C01 (mode 1)
* Pete Sampras Tennis - 24C02 (mode 2)
* NBA Jam - 24C02 (mode 2)
* NFL Quarterback Club - 24C02 (mode 2)
* 32X NFL Quarterback Club - 24C02 (mode 2)
* NFL Quarterback Club '96 - 24C16 (mode 2)
* Frank Thomas Big Hurt Baseball - 24C65 (mode 3)
* College Slam - 24C65 (mode 3)
* ??? Wonder Boy in Monster World - 24C01 ???
* ??? 32X NBA Jam - 24C02 ???
(I don't have the games with ??? to open up, but have reason to believe they use a 24Cxx)

Parallel EEPROM:
* Accolade - Barkley Shut Up and Jam 2 - 28C16
* Accolade - Unnecessary Roughness '95 - 28C16

I have found no released games using 93Cxx serial EEPROM.
And my copy of Hardball '95 uses a 256kbit (32Kbyte) battery RAM.

Emulating a 28C16 shouldn't be any different than battery RAM.

One big problem about emulating 24Cxx: there are three modes that the chips use, and almost no way to tell #2 and #3 apart from the 68000 view. 24Cxx most definitely can not be "emulated all the same way".

Mode 1 (7-bit) - the chip takes a single byte with a 7-bit memory address and a R/W bit (24C01)
Mode 2 (8-bit) - the chip takes a 7-bit device address and R/W bit followed by an 8-bit memory address; the device address may contain up to three more memory address bits (24C01 - 24C16). You can also string eight 24C01, four 24C02, two 24C08, or various combinations, set their address config lines correctly, and the result appears exactly the same as a 24C16
Mode 3 (16-bit) - the chip takes a 7-bit device address and R/W bit followed by a 16-bit memory address (24C32 and larger)

Note that some 24C01 are mode 1 and some 24C01 are mode 2!

Modes #2 and #3 are very difficult to tell apart from the 68000 view (see US patent 6334165), but it should be possible for an emulator to determine which type is being used. Download a bunch of assorted 24Cxx data sheets to find the details. They are almost compatible if you emulate mode 3 and use the device address if no high address byte is sent, but writing could be broken if you get it wrong.

Modes #2 and #3 can be safely emulated as a 24C16 and 24C512 respectively.

Also, while most 24Cxx are addressed at 200000-2FFFFF, I have found two different ways of mapping the control lines. EA uses SDA on D7 (read/write) and SCL on D6 (write only), and I have found boards using different mapping (I think Accolade) which uses D1-read=SDA, D0-write=SDA, D1-write=SCL. Accolade also has a custom-chip mapper which may even use a third method.

Really, the best way for an emulator to decide how to emulate the chip would be to check the game catalog number information in the header and have a table of the less than 20 games which need 24Cxx emulation.

My own board addresses the 24Cxx at /TIME using D6 and D7, but my game is set up to fool an emulator into thinking it wants battery RAM, and uses battery RAM if found. In other words, it's designed to work on an emulator as a battery RAM game, but if it finds a 24Cxx will use that instead.

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Sat Jul 14, 2007 11:53 am

8bitwizard wrote: One big problem about emulating 24Cxx: there are three modes that the chips use, and almost no way to tell #2 and #3 apart from the 68000 view. 24Cxx most definitely can not be "emulated all the same way".
you are right, I only want to say that I was actually emulating 24C02+ (ie everything not 24C01) all the same way, but I didn't tested all games so they may be errors

actually, I'm doing like this: every roms that is marked as having external eeprom (detected when external RAM address range between 200000 and 200001 in rom header) and write to 0x200000 is emulated like being mode2 (use 2 lines) , otherwise it is mode 1 (use only one line)... this seems not to be the most accurate way to do and i'm missing mode3 :roll:

thank you for all these precisions again, it showed me that my implementation was not working with Rings of Power (and most EA games using eeprom I think) and that eeprom detection need some rewrite (a lot of games don't have the correct header with 'RA' and external ram address start/end)

a game database seems the best way to do indeed

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Thu Jul 19, 2007 10:22 am

8bitwizard wrote: Mode 1 (7-bit) - the chip takes a single byte with a 7-bit memory address and a R/W bit (24C01)
Mode 2 (8-bit) - the chip takes a 7-bit device address and R/W bit followed by an 8-bit memory address; the device address may contain up to three more memory address bits (24C01 - 24C16). You can also string eight 24C01, four 24C02, two 24C08, or various combinations, set their address config lines correctly, and the result appears exactly the same as a 24C16
Mode 3 (16-bit) - the chip takes a 7-bit device address and R/W bit followed by a 16-bit memory address (24C32 and larger)
After reading some datasheets, I think that your statement did indeed resume the situation pretty good.

As my previous code was not very accurate (it was in fact supporting only 24C01 type 1 and 24C02, with fixed line SCL/SDA lines mapping), i'm trying to code a generic read/write function set to support any 24Cxx eeprom in the emulator:

It relies on some predetermined parameters (and so need a game database) which should be:

- eeprom type (7bit address, 8bit address or 16bit address)
- eeprom size
- SCL bit address and position
- SDA bit address and position

It also seems that even for a given type and a given size, there is still some differences between chips: for example, in a single write cycle, we could transfer up to 64 bytes of data to 24C65 but only up to 32 bytes to some 24C64... it depends of the size of the internal write buffer (or cache if it exists), so I need an extra parameter to correctly handle eeprom writes:

- pagewrite_size


I will put here links to all three modes datasheets for further reading:

MODE1 (X24C01 only):
http://www.icmic.com/datasheets/X24C01.pdf

MODE2 (24C01 - 24C16):
http://www.atmel.com/dyn/resources/prod ... oc0180.pdf

MODE3 (24C32 and more):
http://www.phys.hawaii.edu/~bryce/compo ... 65-ISM.pdf


But I still need a list of games that have internal eeprom and which one they are using.
Are there games that have "chained" eeprom chips ? In theory, we could have up to 64Kbytes for backup data (eight 24C65 for example)

8bitwizard
Very interested
Posts: 159
Joined: Sat Feb 24, 2007 11:35 pm
Location: San Antonio, TX

Post by 8bitwizard » Thu Jul 19, 2007 1:52 pm

Eke wrote:It also seems that even for a given type and a given size, there is still some differences between chips: for example, in a single write cycle, we could transfer up to 64 bytes of data to 24C65 but only up to 32 bytes to some 24C64... it depends of the size of the internal write buffer (or cache if it exists), so I need an extra parameter to correctly handle eeprom writes:
I don't think you should worry about page size. Until you find someone doing the extremely lame trick of taking advantage of page size wraparound to write data in a non-sequential order, you shouldn't waste any time on that.

Seriously, it's a rather pointless trick, especially when different chips of the same size can potentially have different page sizes. I can't see transfer routines doing anything but writing a big block of data in sequential order. Just put a comment in the code where the address auto-increments and leave it at that.

The only time it should really matter is someone coding a new game using an emulator as their only means of testing the code, in which case they probably should stick with something easy to understand like battery RAM. Page size is a limitation to be worked around, not a feature to be taken advantage of.

If you actually do find a game that takes advantage of it (there's only like 20 to test), then feel free to tell the world how stupid the programmers at (insert company here) were.
Are there games that have "chained" eeprom chips ? In theory, we could have up to 64Kbytes for backup data (eight 24C65 for example)
Why would they? First, 2K bytes really is a LOT of data, and second, that means they need to make another circuit board, which is a lot more expensive than two smaller chips instead of one larger chip. They could put an I2C temperature sensor or voice synthesizer on the board too, but that doesn't mean that you should try to emulate one.

As for finding out which games might use them, I'd look for MOVE.W #xxxx,$200000 (33FC xxxx 0020 0000) or MOVE.B #xx,$200001 (13FC 00xx 0020 0001) instructions in the whole GoodSet. While you're at it, you could look for "00A1 3100" to see who might be using /TIME.

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Thu Jul 19, 2007 4:24 pm

I don't think you should worry about page size. Until you find someone doing the extremely lame trick of taking advantage of it to write data in a non-sequential order, you shouldn't waste any time on that.
You are probably right but since the datasheets specify that the address rolls over when the maximal number bytes have been written and since it is not really hard to implement, I try to emulate it right :wink:
As for finding out which games might use them, I'd look for MOVE.W #xxxx,$200000 (33FC xxxx 0020 0000) or MOVE.B #xx,$200001 (13FC 00xx 0020 0001) instructions in the whole GoodSet. While you're at it, you could look for "00A1 3100" to see who might be using /TIME.
thank for the tips
what is the purpose of /TIME signal exactly ?


Anyway, I implemented my new generic code and Rings of Power now load&save fine :)
Let's go testing some other eeprom types :twisted:

Actually, the hard part will be to determine where SDA and SCL are mapped : you were right about EA games, Rings of Power use 0x200000 with bit7 for SDA (read & write) and bit6 for SCL whereas Wonderboy use 0x200001 and bit0 for SDA, bit1 for SCL
some sport games seem also to use different addresses for SCL and SDA :roll:

Jorge Nuno
Very interested
Posts: 374
Joined: Mon Jun 11, 2007 3:09 am
Location: Azeitão, PT

Post by Jorge Nuno » Thu Jul 19, 2007 10:39 pm

I think TIME is a signal that reflects a state of an internal register

like if you write 1 to it TIME will go high, 0 TIME will go low

8bitwizard
Very interested
Posts: 159
Joined: Sat Feb 24, 2007 11:35 pm
Location: San Antonio, TX

Post by 8bitwizard » Thu Jul 19, 2007 10:55 pm

/TIME is a cartridge signal which is an address select for the $A13000-$A130FF address range. It is thought that it got its name because Sega thought it might be useful to have a real-time-clock chip on a cartridge.

TmEE co.(TM)
Very interested
Posts: 2440
Joined: Tue Dec 05, 2006 1:37 pm
Location: Estonia, Rapla City
Contact:

Post by TmEE co.(TM) » Fri Jul 20, 2007 10:23 am

My EEPROM mapper is totally controlled by reading and writing A13000-A130FF address range.
Mida sa loed ? Nagunii aru ei saa ;)
http://www.tmeeco.eu
Files of all broken links and images of mine are found here : http://www.tmeeco.eu/FileDen

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Fri Jul 20, 2007 3:13 pm

really ?
I thought that it was impossible to read A130xx , only write to it

So, if I understand well, writing at any address in this range will drive the /TIME signal and controls any device connected to it ?

what about the $A13100 address you were talking about ? Is that also a valid address ?

8bitwizard
Very interested
Posts: 159
Joined: Sat Feb 24, 2007 11:35 pm
Location: San Antonio, TX

Post by 8bitwizard » Fri Jul 20, 2007 4:32 pm

Eke wrote:really ?
I thought that it was impossible to read A130xx , only write to it

So, if I understand well, writing at any address in this range will drive the /TIME signal and controls any device connected to it ?

what about the $A13100 address you were talking about ? Is that also a valid address ?
I got the address range wrong that time.

/TIME is the address select for $A130xx. You have to use it with WR_H/WR_L for writes.

I think I even tried accessing memory on both sides of $A130xx and found that it locked up (no DTACK) outside that 256-byte range.

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Sat Jul 21, 2007 11:13 am

Strangely, there seems to be a weird thing with NBA Jam rom (version 1.0) when accessing EEPROM, I wonder if backup ever worked with the original card:

The game use a type2 eeprom (slave + word_low address) and is doing this when starting a random READ operation:
SDA SCL
START received
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x01 --> 0x200000 1 0
write8 eeprom 0x03 --> 0x200000 1 1
SLAVE CYCLE ++ -> CYCLE = 1
write8 eeprom 0x01 --> 0x200000 1 0
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x02 --> 0x200000 0 1
SLAVE CYCLE ++ -> CYCLE = 2
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x01 --> 0x200000 1 0
write8 eeprom 0x03 --> 0x200000 1 1
SLAVE CYCLE ++ -> CYCLE = 3
write8 eeprom 0x01 --> 0x200000 1 0
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x02 --> 0x200000 0 1
SLAVE CYCLE ++ -> CYCLE = 4
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x02 --> 0x200000 0 1
SLAVE CYCLE ++ -> CYCLE = 5
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x02 --> 0x200000 0 1
SLAVE CYCLE ++ -> CYCLE = 6
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x02 --> 0x200000 0 1
SLAVE CYCLE ++ -> CYCLE = 7
write8 eeprom 0x00 --> 0x200000 0 0
write8 eeprom 0x01 --> 0x200000 1 0
write8 eeprom 0x03 --> 0x200000 1 1
SLAVE CYCLE ++ -> CYCLE = 8
write8 eeprom 0x01 --> 0x200000 1 0
write8 eeprom 0x01 --> 0x200000 1 0
SEND ACK
read16 eeprom 0x200000 --> 0x0
write8 eeprom 0x03 --> 0x200000 1 1
SLAVE CYCLE ++ -> CYCLE = 9
SLAVE_ADR END: READ CYCLE @0x0
write8 eeprom 0x01 --> 0x200000 1 0
SEND ACK
read16 eeprom 0x200000 --> 0x0
write8 eeprom 0x03 --> 0x200000 1 1
READ CYCLE ++ -> CYCLE = 1
write8 eeprom 0x01 --> 0x200000 1 0
SEND DATA bit 7 from 0x0 = 0
read16 eeprom 0x200000 --> 0x0
write8 eeprom 0x03 --> 0x200000 1 1
READ CYCLE ++ -> CYCLE = 2


...
As you can see, it indeed try to read the ACK that should follow the receive of the 8bits SLAVE ADDRESS but does the reading between the 8th and 9th cycle (SCL still low), which is normally not correct according to the specification ... same thing is done later for each bit READ

may I be wrong when interpreting a new cycle start as LOW to HIGh transition ?

Eke
Very interested
Posts: 884
Joined: Wed Feb 28, 2007 2:57 pm
Contact:

Post by Eke » Mon Jul 23, 2007 2:56 pm

I finally get a generic code that seems to work with all games I tested (for most games, I've only traced read/write sequences that are executed at startup and checked that my code would handle them correctly)

From my testings, here's the current list of games using EEPROM as external ram and their caracteristics

-------------------------------------------------------
ACCLAIM (81)
-------------------------------------------------------


NBA Jam (UE)
NBA Jam (J)

------------
T-081326
T-81033
header OK ($200001-$200001)

TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0xFF (24C02)
PAGE_MASK: 0x03
SDA_IN : 0x200000 (0)
SDA_OUT: 0x200000 (1)
SCL : 0x200000 (1)

Note: this game uses a different EEPROM mapper than other Acclaim games.


Blockbuster World Video Game Championship II (U)
NBA Jam Tournament Edition (JUE)

------------------------------------------------
T-81406
header KO

TYPE: TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0xFF (24C02)
PAGE_MASK: 0x03
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200000 (0)

Note: Rev 00 of the game has buggy eeprom support (incorrect data written), game backup only work with Rev01 version (released apparently in 2002, eight years later !)


NFL Quarterback Club (JUE)
-----------------------------
T-081276
header OK ($200000-$200001)

TYPE: TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0xFF (24C02)
PAGE_MASK: 0x03
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200000 (0)


NFL Quarterback Club 96 (UE)
-----------------------------
T-081586
header OK ($200000-$200001)

TYPE: TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0x7FF (24C16)
PAGE_MASK: 0x07
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200000 (0)


College Slam (U)
----------------
T-81576
header OK ($200001-$200001)

TYPE: 16BITS WORD ADDRESS
SIZE_MASK: 0x1FFF (24C64)
PAGE_MASK: 0x07
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200000 (0)


Frank Thomas Big Hurt Baseball (UE)
----------------
T-81476
header OK ($200000-$200001)

TYPE: 16BITS WORD ADDRESS
SIZE_MASK: 0x1FFF (24C64)
PAGE_MASK: 0x07
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200000 (0)



-------------------------------------------------------
CAPCOM (12)
-------------------------------------------------------


Megaman - The Wily Wars (E)
Rockman Mega World (J) [alt]

----------------
T-12046
T-12053 (checksum = 0xEA80)
header OK ($200001-$200001)

TYPE: 7BITS WORD ADDRESS
SIZE_MASK: 0x7F (24C01)
PAGE_MASK: 0x03
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200001 (1)

NOTE: the original version of Rockman Mega World (J) uses traditional SRAM, header gives $200000-$203FFF range
the alternate version uses a 128bytes serial EEPROM (X24C01)
the two versions share the same GAME NAME and PRODUCT ID




-------------------------------------------------------
Electronic Arts (50)
-------------------------------------------------------


NHLPA Hockey 93 (UE)
----------------
T-50396
header KO

TYPE: 7BITS WORD ADDRESS
SIZE_MASK: 0x7F (24C01)
PAGE_MASK: 0x03
SDA_IN : 0x200000 (7)
SDA_OUT: 0x200000 (7)
SCL : 0x200000 (6)


Rings of Power (UE)
----------------
T-50176
header KO

TYPE: 7BITS WORD ADDRESS
SIZE_MASK: 0x7F (24C01)
PAGE_MASK: 0x03
SDA_IN : 0x200000 (7)
SDA_OUT: 0x200000 (7)
SCL : 0x200000 (6)



-------------------------------------------------------
SEGA
-------------------------------------------------------


Evander 'Real Deal' Holyfield's Boxing (JUE)
----------------------------------
MK-1215
header OK ($200001-$200001)

TYPE: 7BITS WORD ADDRESS
SIZE_MASK: 0x7F (24C01)
PAGE_MASK: 0x03
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200001 (1)


Greatest Heavyweights of the Ring (U)
Greatest Heavyweights of the Ring (J)
Greatest Heavyweights of the Ring (E)

-----------------------------
MK-1228
G-5538
PR-1993
header OK ($200001-$200001)

TYPE: 7BITS WORD ADDRESS
SIZE_MASK: 0x7F (24C01)
PAGE_MASK: 0x03
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200001 (1)


Wonder Boy in Monster World (UE)
Wonder Boy V - Monster World III (J)

----------------
G-4060
header OK ($200001-$200001)

TYPE: 7BITS WORD ADDRESS
SIZE_MASK: 0x7F (24C01)
PAGE_MASK: 0x03
SDA_IN : 0x200001 (0)
SDA_OUT: 0x200001 (0)
SCL : 0x200001 (1)



-------------------------------------------------------
CODEMASTERS
-------------------------------------------------------


Micro Machines 2 - Turbo Tournament (E) (J-Cart)
------------------------------------------------
T-120096-50
header KO

TYPE: TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0x3FF (24C08)
PAGE_MASK: 0x0F
SDA_IN : 0x300000 (0)
SDA_OUT: 0x380001 (7)
SCL : 0x300000 (1)

Note: this game needs the EEPROM to be initially fullfilled with the string
"PETETEST01234567" otherwise it won't initialize memory with correct data.



Micro Machines Military (E) (J-Cart)
------------------------------------
00000000-00 (checksum = 0x168B or 0xCEE0)
header KO

TYPE: TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0x3FF (24C08)
PAGE_MASK: 0x0F
SDA_IN : 0x300000 (0)
SDA_OUT: 0x380001 (7)
SCL : 0x300000 (1)


Micro Machines Turbo Tournament 96 (E) (J-Cart)
------------------------------------------------
00000000-00 (checksum = 0x165E or 0x2C41)
header KO

TYPE: TYPE: 8BITS WORD ADDRESS
SIZE_MASK: 0x7FF (24C16)
PAGE_MASK: 0xF
SDA_IN : 0x300000 (0)
SDA_OUT: 0x380001 (7)
SCL : 0x300000 (1)
As you can see, this confirms 8bitwizard's real observations, except that I didn't see any code in Pete Sampras Tennis that try to access EEPROM area.
Last edited by Eke on Fri Aug 17, 2007 2:32 pm, edited 16 times in total.

Post Reply