Sony DTL-H2000 Mechacon Firmware

BIOS, Controllers, Memory Cards, Serial I/O, Parallel I/O, etc.
Post Reply
User avatar
Admin / PSXDEV
Admin / PSXDEV
Posts: 2673
Joined: Dec 31, 2012
I am a: Shadow
PlayStation Model: H2000/5502

Sony DTL-H2000 Mechacon Firmware

Post by Administrator » December 11th, 2017, 2:06 am

Sony DTL-H2000 CD-ROM Mechacon 'Fujitsu 27C256A-15' EPROM dumped 11/DEC/2017 by Trimesh.

This is the EPROM that was dumped exactly.

Two EPROM's from two H2000's to ensure good valid dumps (one EPROM is from my (Shadows) H2000).
The 'Micro-SD Card' was used as a wedge to help press the EPROM into the socket since it had a poor connection.


You do not have the required permissions to view the files attached to this post.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

User avatar
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » December 13th, 2017, 12:33 pm

Having had a chance to look at this dump, here are a few observations:

1) Although it's a 32K EPROM, only the upper 16K is being used and the lower 16K is filled with 0xff - this is consistent with the socket on the piggyback chip being wired to take either a 27128 or a 27256.
2) Unlike the production units, the CPU is not a 68HC05 - the instruction set seems to match the Sony SPC700 core (same CPU used in the SNES audio system)
3) The correct origin for the code seems to be 0xc000 (once you strip the inital 16K of 0xffs) - the last locations in ROM seem to be the reset vector and they point to 0xc000, which contains plausible looking initialization code.
4) All the interrupt vectors seem to point to the same address - 0xd7a8 - which just contains a reti instruction, so it appears that this code (like the HC05 code) doesn't use interrupts at all and operates purely on polling.

User avatar
PSX Aficionado
PSX Aficionado
Posts: 574
Joined: Nov 12, 2012

Post by nocash » October 26th, 2022, 10:46 am

Thanks for dumping!
I am a bit late... but I just had a look at the EPROM contents.

It's almost 1:1 identical to the early HC05 versions with the same logic & program flow, just using SPC700 opcodes instead of HC05 opcodes.
There are a couple of minor differences, like checking (or not checking) this or that bits for error handling, and oddly, a different error code when reaching lead-out.
And some different features, some of them are related to using the DTL-H2010 cdrom drive, viewtopic.php?f=59&t=604

Minute Table
The SPC700 verson is using a 71-minute table for sector seeking. The HC05 versions do also have that 71-minute table, but they do never use it, and are instead using a 77-minute table.
I had assumed that the different tables are matched to different disc-types (with tighter spiral windings), but then why is the SPC700 version expecting different discs? Maybe it does actually do so because it's for CDR's. Or maybe the tables are matched to different drives with different stepping motors.

There seems to be no SCEx check, so it't region free and works with CDRs. The test command for reading the 4-letter SCEx string seems to return four 00h bytes.

Eject Button
The DTL-H2010 is a front-loading drive with Eject button, and the SPC700 firmware contains some code for handling that. Apart from internal handling, it's also allowing to read an eject-related bit via Test command:

Code: Select all

19h,21h --> INT3(flags)
Returns the current status of the POS0 and DOOR switches.
  Bit0   = HeadIsAtPos0 (0=No, 1=Pos0)
  Bit1   = DoorIsOpen   (0=No, 1=Open)
  Bit2   = EjectButtonOrOutSwOrSo? (DTL-H2000 only) (always 0 on retail)
  Bit3-7 = AlwaysZero
I am not sure what is in Bit2. The drive should have four switches/buttons: POS0, IN SW, OUT SW, and EJECT.
But the Test command returns only 3 of those 4 bits.

8-button Keyboard
There seems to be support for an 8-button keyboard, with (I think) these functions: FastFwd, FastRev, PrevTrack, NextTrack, Stop, Pause, Play, Eject.
Is that a known DTL-H2000 feature? Does it include a keyboard, or an external connector for such keyboards?

The SNES CDROM prototype did have a (somewhat) similar 6-button keyboard.

As for the DTL-H2000 keyboard, I am not sure how it is supposed to be wired up, but I've two theories:
  • Analog input: Each button having a different pull-up/down resistor (the controller input function looks as if it's reading Analog values in that fashion... though the code is confusing... it seems to read 6 analog channels, compare all of them against the expected button values... and then ignores most of the results and recurses only 1 of the 6 channels).
  • Infra-red: The CXP82316/82320/82324 datasheet mentions support for Remote control receiver circuit with "On-chip 6 stage FIFO 8-bit pulse measurement counter" (maybe the supposed 6 analog channels are actually those 6 fifo stages... but the controller function doesn't really look like an IR signal handler... unless it's a weird IR protocol that encodes the buttons as "number of pulses" instead of as specific "bit sequences").
Either way, a possibly existing keyboard connector would require only 1 pin for the "analog-or-infrared" signal (plus 1-2 supply pins).

The version test command returns: 94h,11h,28h,01h (28 Nov 1994, version v01). The 01h is a bit odd (other/retail versions are C0h and up).
And that SPC700 date is slighly newer than early HC05 retail firmwares. On the other hand, the DTL-H2000 MIPS kernel looks older than retail BIOSes (it lacks memory card support).
So, I guess the SPC700 EPROM was updated on 28 Nov 1994, and there must have been older versions before then. Are there any DTL-H2000 boards with dates other than '94 11/28 on the EPROM sticker?

RAM Read
The SPC700 version allows to read the whole 64Kbyte memory space (without mirroring everything to first 300h bytes as happening in HC05 versions). I/O Ports and Variables are at:

Code: Select all

  000h..0DFh   RAM Part 1 (C0h bytes)
  0E0h..0FFh   I/O Area
  100h..1DFh   RAM Part 2 (C0h bytes)
  1E0h..1FFh   I/O Area
  200h..2DFh   RAM Part 3 (100h bytes)
  2E0h..7FFFh  Unknown
  8000h-BFFFh  Unknown  (lower 16K of 32K EPROM) (or unused?)
  C000h-FFFFh  Firmware (upper 16K of 32K EPROM)
In so far, it should be possible to dump the firmware "per software" without needing an EPROM reader (of course, using an EPROM reader may be much easier than writing and using a custom "raw software" dumping program for ISA bus PCs).

7-segment Display
This firmware can display "Track MM SS FF" on a 7-segment display with 8 digits. The digit pairs are output at CF93h, and then later translated to actual segments using this table:

Code: Select all

                ;---                     ;           _______
                @@seven_segment_table:   ;        . / bit8  \..
C1FC C0 1B       dw   1BC0      ;0       ;       / \\_______// \.
C1FD C0 00       dw   00C0      ;1       ;      |   |       |   |
C1FF 80 1D       dw   1D80      ;2       ; bit9 |   |       |   | bit7
C201 C0 15       dw   15C0      ;3       ;      |   |_______|   |
C203 C0 06       dw   06C0      ;4       ;       \.// bit10 \\./
C205 40 17       dw   1740      ;5       ;       / \\_______// \.
C207 40 1F       dw   1F40      ;6       ;      |   |       |   |
C209 C0 01       dw   01C0      ;7       ; bit11|   |       |   | bit6
C20B C0 1F       dw   1FC0      ;8       ;      |   |_______|   |
C20D C0 07       dw   07C0      ;9       ;       \.// bit12 \\./
C20F C0 0F       dw   0FC0      ;A       ;          \_______/
The function at C11Ah displays "-HELLOUU" on power-up... Hello Uu?

There is a CXP82300 datasheet (that merely contains the EPROM pinout) and a CXP82316/82320/82324 datasheet (that contains a few more details about the supported hardware features, like mentioning the Analog and Infrared inputs).
But none of those datasheets is describing the exact bits & addresses of the hardware registers... is there a separate Programmer's Manual or software devkit somehwere?

User avatar
PSX Aficionado
PSX Aficionado
Posts: 574
Joined: Nov 12, 2012

Post by nocash » December 9th, 2022, 12:59 pm

Real-Time Clock
Neither me nor TriMesh have found RTC support in the CDROM firmware (the "GetClock/SetClock" commands aren't implemented in the EPROM) (and there seems to be no other RTC related code in the EPROM either).

So, I've instead looked into the DTL-H2000 MIPS Kernel today. The functions marked "_DTLH2000_ONLY_xxx !!" in the table below have been still unknown (until now).

Code: Select all

BFC0A600 BFC0B12C dd CdAsyncSeekL(src)                                   A(78h)
BFC0A604 BFC0B234 dd _DTLH2000_ONLY_CdAsyncSeekP(src)                 !! A(79h)
BFC0A608 BFC0B33C dd _DTLH2000_ONLY_CdAsyncGetlocL(dst?)              !! A(7Ah)
BFC0A60C BFC0B404 dd _DTLH2000_ONLY_CdAsyncGetlocP(dst?)              !! A(7Bh)
BFC0A610 BFC0B4CC dd CdAsyncGetStatus(dst)                               A(7Ch)
BFC0A614 BFC0B540 dd _DTLH2000_ONLY_CdAsyncGetParam(dst?)             !! A(7Dh)
BFC0A618 BFC0B5B4 dd CdAsyncReadSector(count,dst,mode)                   A(7Eh)
BFC0A61C BFC0B6CC dd _DTLH2000_ONLY_CdAsyncReadWithNewMode(mode)      !! A(7Fh)
BFC0A620 BFC0B7BC dd _DTLH2000_ONLY_CdAsyncReadFinalCount1(r4)  ???   !! A(80h)
BFC0A624 BFC0B8BC dd CdAsyncSetMode(mode)                                A(81h)
BFC0A628 BFC0B958 dd _DTLH2000_ONLY_CdAsyncMotorOn()                  !! A(82h)
BFC0A62C BFC0B9BC dd _DTLH2000_ONLY_CdAsyncPause()                    !! A(83h)
BFC0A630 BFC0BAA4 dd _DTLH2000_ONLY_CdAsyncPlayOrReadS()              !! A(84h)
BFC0A634 BFC0BB2C dd _DTLH2000_ONLY_CdAsyncStop()                     !! A(85h)
BFC0A638 BFC0BC14 dd _DTLH2000_ONLY_CdAsyncMute()                     !! A(86h)
BFC0A63C BFC0BCDC dd _DTLH2000_ONLY_CdAsyncDemute()                   !! A(87h)
BFC0A640 BFC0BDA4 dd _DTLH2000_ONLY_CdSetAudioVolume(src) ;4-byte src !! A(88h)
BFC0A644 BFC0BE24 dd _DTLH2000_ONLY_CdAsyncSetSession1(dst)           !! A(89h)
BFC0A648 BFC0BF40 dd _DTLH2000_ONLY_CdAsyncSetSession(session,dst)    !! A(8Ah)
BFC0A64C BFC0C060 dd _DTLH2000_ONLY_CdAsyncForward()                  !! A(8Bh)
BFC0A650 BFC0C108 dd _DTLH2000_ONLY_CdAsyncBackward()                 !! A(8Ch)
BFC0A654 BFC0C1B0 dd _DTLH2000_ONLY_CdAsyncPlay()                     !! A(8Dh)
BFC0A658 BFC0C258 dd _DTLH2000_ONLY_CdAsyncGetStatSpecial(r4,r5)      !! A(8Eh)
BFC0A65C BFC0C300 dd _DTLH2000_ONLY_CdAsyncGetID(r4,r5)               !! A(8Fh)
But none of those is doing RTC related stuff. In fact they are just allowing to send some "standard cdrom commands" (without DTL-H2000 specific things like managing the Eject button).

Anyways, going by the Dallas datasheet, the RTC chip pinout should be as so:

Code: Select all

U40 Dallas DS1302 Real Time Clock Pin-out
  1 VCC2 (power)
  2 X1   (32.768kHz)
  3 X2   (32.768kHz)
  4 GND
  5 /RST (serial start/stop)
  6 I/O  (serial data)
  7 SCLK (serial clk)
  8 VCC1 (battery)
Can somebody trace where Pin 5,6,7 are wired to?
First place to look at would be the Mechacon chip (in case the RTC was used by older Mechacon firmwares).
And otherwise, if it's wired to the Altera chips or whatever... that could mean anything... the signals could be forwared to Mechacon or MIPS or even to ISA bus.

Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests