Another fundraiser..

This fundraiser is multiple lots we have been offered for our museum, most of these are extremely early systems, and many contain unreleased games and history that would other wise be lost.

The goal for this is split into groups, we have awhile to sort this one and lots would be paid as funded. The total includes paypal fee's added and shipping costs included excluding taxes, we put 10% as we're often charged different rates depending on donators locations.
Goal
£4,800.00
Received
£480.36
Latest donor
hekgn hekgn
10%
Custom LBP Developer PS3 containing multiple unreleased games, and multiple alpha builds.
£1,300.00
An early prototype PlayStation 3 dev Kit, in an early shell design which includes a disc filled with build(s? exact contents unknown)
£1,230.00
3x Prototype XBOX's, plus a boxed system believed to be used at E3. + Misc items to be added that are unknown.
£1,230.00
Misc Nintendo systems.
£500.00
The above prices doesn't include paypal fees, please see goal amount for total with 10% added for fee's we're charged.
£0.00
Expenses
Welcome, Guest!

Here are some links you may find helpful

MCD Reverse engineering the Sega Mega CD 315-5540

fabiodl

Member
Original poster
Registered
Sep 22, 2019
18
6
3
The second revision of the Japanese Sega Mega CD is different from the export model.
In more detail, while export model main chip on the logic board is a 315-5548, the Japanese version mounts a different chip, 315-5477. The pinout is really close, but internally there must be some differences that require additional external logic. This is provided by the connector board, which mounts a 315-5540.
Here it is

115158-20181106-093216-jpg


In trying to repair a japanese mega cd, I think I identified the problem in such chip (details are here )

As by this thread,
https://circuit-board.de/forum/inde...-MEGA-CD-1-Reparatur-PEEL-18CV8-PLD-auslesen/
it seems such chip is failing very often.

The same thread shows that there was a first revision which used discrete logic. This is good news for recreating the chip with a CPLD.
Here is the money shot
con-bd1.jpg


There is however one programmable logic chip, the 18CV8-PC, that sega rebranded as 315-5537, whose function is unknown.
The user Xenogears seems to have tried to dump the content of the chip in two occasions,
here
https://circuit-board.de/forum/index.php/Attachment/115748-Mega-CD-JEDEC-txt/
and here

but both seems failures, because by looking at the bit pattern they are either all 0 or a repeating cyclic pattern.

I think this is because the chip was read protected. From the chip's datasheet

The PEELTM18CV8Z provides a special EEPROM security bit that prevents unauthorized reading or copying of designs pro-
grammed into the device. The security bit is set by the PLD programmer, either at the conclusion of the programming cycle or as a
separate step, after the device has been programmed. Once the security bit is set it is impossible to verify (read) or program the
PEELTM until the entire device has first been erased with the bulk-erase function.


Internally, maximum 8 flip flops are used, so with some educated guesses I believe it would be possible to reverse engineer it.

Does anyone have a working 315-5537 / 315-5540 / board with them on willing to sell/lend it to me?
I plan to design a replacement board and release anything as open source.
I believe Xenogears over circuit-board.de was attempting to do the same. I'd like to join the effort, if he is willing to, but I am unable to contact him because I cannot get my account activated on that forum.
 
Last edited:
  • Like
Reactions: Americandad

fabiodl

Member
Original poster
Registered
Sep 22, 2019
18
6
3
Hello, I traced the schematic
(See this schematic)
I also dumped data from the peel

By analyzing the transitions, I could determine the following:
output 6 is ~ras2
output cdcas0 is !~cas0

The following transitions are observed.The notations is use is the following. Each row is an output. For each row there's a list of transitions of inputs (in the form inputname - r or f, where r stands for rise and f for fall) and the corresponding transition of the output (r for rise and f for fall). When the transition occurs any time there's simply r or f. When the transition occurs only some times (depending on other inputs/internal state) there's an *.

output tr_dir: ~fdc-f->r* ~fdc-r->f* ~rom-f->r* ~rom-r->f* ~ras2-f->r* ~ras2-r->f* ~cas2-r->f* ~cas0-f->r* ~cas0-r->f
output ~tr_ce: ~ras2-f->r* ~ras2-r->f* ~cas2-f->r* ~cas2-r->f* ~cas0-f->r* ~cas0-r->f
output ff_cp: asel-r->r* ~cas2-f->f* ~cas2-r->r ~cas0-f->f* ~cas0-r->r wr-r->r
output ~ff_oe: ~ras2-f->f* ~ras2-r->r* ~cas2-f->f* ~cas2-r->r* ~cas0-f->f* ~cas0-r->r
output o7: asel-r->f* asel-r->r* wr-r->r
output o8: ~ras2-f->f* ~ras2-r->r* ~cas2-r->r*

Unluckly it seems the async clear and/or sync set terms of the peel's flip flops are used, so it is not possible to retrieve the complete internal state even by rising the clock.
Is there anyone that knows the megacd signals well enough to guess what those signals could be?
 
Last edited:

Xrider

Well-known member
Registered
Apr 19, 2020
54
67
18
AGName
Xrider
AG Join Date
19/05/2020
Thanks for that :)
 

Surteesf1

New member
Nov 28, 2021
1
0
1
The second revision of the Japanese Sega Mega CD is different from the export model.
In more detail, while export model main chip on the logic board is a 315-5548, the Japanese version mounts a different chip, 315-5477. The pinout is really close, but internally there must be some differences that require additional external logic. This is provided by the connector board, which mounts a 315-5540.
Here it is

115158-20181106-093216-jpg


In trying to repair a japanese mega cd, I think I identified the problem in such chip (details are here )

As by this thread,
https://circuit-board.de/forum/inde...-MEGA-CD-1-Reparatur-PEEL-18CV8-PLD-auslesen/
it seems such chip is failing very often.

The same thread shows that there was a first revision which used discrete logic. This is good news for recreating the chip with a CPLD.
Here is the money shot
con-bd1.jpg


There is however one programmable logic chip, the 18CV8-PC, that sega rebranded as 315-5537, whose function is unknown.
The user Xenogears seems to have tried to dump the content of the chip in two occasions,
here
https://circuit-board.de/forum/index.php/Attachment/115748-Mega-CD-JEDEC-txt/
and here

but both seems failures, because by looking at the bit pattern they are either all 0 or a repeating cyclic pattern.

I think this is because the chip was read protected. From the chip's datasheet

The PEELTM18CV8Z provides a special EEPROM security bit that prevents unauthorized reading or copying of designs pro-
grammed into the device. The security bit is set by the PLD programmer, either at the conclusion of the programming cycle or as a
separate step, after the device has been programmed. Once the security bit is set it is impossible to verify (read) or program the
PEELTM until the entire device has first been erased with the bulk-erase function.


Internally, maximum 8 flip flops are used, so with some educated guesses I believe it would be possible to reverse engineer it.

Does anyone have a working 315-5537 / 315-5540 / board with them on willing to sell/lend it to me?
I plan to design a replacement board and release anything as open source.
I believe Xenogears over circuit-board.de was attempting to do the same. I'd like to join the effort, if he is willing to, but I am unable to contact him because I cannot get my account activated on that forum.
Hi,
Any news?
Someone managed to reproduce 315-5540?
I have the same problem here!
It's a simple fix and not having this ci is frustrating.
 

l_oliveira

Member
Registered
May 31, 2019
12
15
3
This might be interesting for you.

The main board with MCE1 ASIC (315-5477) and straight connect BD (bodge-less connect bd) gives this result.

It means the bodge is a fix for WORD RAM accesses from MD side.

TV2022021702045500.jpgTV2022021702054200.jpgTV2022021702060300.jpg
 

Chrissy

New member
May 19, 2022
1
0
1
Hi, i am also interested in this project along with l_oliveira .

I made my own PCB recreation and converted the logic code Xenogears had made on circuit-board.de (waiting for registration) into GALasm so i could use a GAL22V10 and it sort of work.

The progress i have made was over on Retro Tinkering Discord.

Video Link to what it currently does
MegaCD using GAL22V10 on the bridge board
 

Another fundraiser..

This fundraiser is multiple lots we have been offered for our museum, most of these are extremely early systems, and many contain unreleased games and history that would other wise be lost.

The goal for this is split into groups, we have awhile to sort this one and lots would be paid as funded. The total includes paypal fee's added and shipping costs included excluding taxes, we put 10% as we're often charged different rates depending on donators locations.
Goal
£4,800.00
Received
£480.36
Latest donor
hekgn hekgn
10%
Custom LBP Developer PS3 containing multiple unreleased games, and multiple alpha builds.
£1,300.00
An early prototype PlayStation 3 dev Kit, in an early shell design which includes a disc filled with build(s? exact contents unknown)
£1,230.00
3x Prototype XBOX's, plus a boxed system believed to be used at E3. + Misc items to be added that are unknown.
£1,230.00
Misc Nintendo systems.
£500.00
The above prices doesn't include paypal fees, please see goal amount for total with 10% added for fee's we're charged.
£0.00
Expenses