Welcome, Guest!

Here are some links you may find helpful

MCD Reverse engineering the Sega Mega CD 315-5540

fabiodl

Registered
Registered
Joined
Sep 22, 2019
Messages
18
Reaction score
5
Points
3
The second revision of the Japanese Sega Mega CD is different from the export model.
In more detail, while export model main chip on the logic board is a 315-5548, the Japanese version mounts a different chip, 315-5477. The pinout is really close, but internally there must be some differences that require additional external logic. This is provided by the connector board, which mounts a 315-5540.
Here it is

115158-20181106-093216-jpg


In trying to repair a japanese mega cd, I think I identified the problem in such chip (details are here )

As by this thread,
https://circuit-board.de/forum/inde...-MEGA-CD-1-Reparatur-PEEL-18CV8-PLD-auslesen/
it seems such chip is failing very often.

The same thread shows that there was a first revision which used discrete logic. This is good news for recreating the chip with a CPLD.
Here is the money shot
con-bd1.jpg


There is however one programmable logic chip, the 18CV8-PC, that sega rebranded as 315-5537, whose function is unknown.
The user Xenogears seems to have tried to dump the content of the chip in two occasions,
here
https://circuit-board.de/forum/index.php/Attachment/115748-Mega-CD-JEDEC-txt/
and here

but both seems failures, because by looking at the bit pattern they are either all 0 or a repeating cyclic pattern.

I think this is because the chip was read protected. From the chip's datasheet

The PEELTM18CV8Z provides a special EEPROM security bit that prevents unauthorized reading or copying of designs pro-
grammed into the device. The security bit is set by the PLD programmer, either at the conclusion of the programming cycle or as a
separate step, after the device has been programmed. Once the security bit is set it is impossible to verify (read) or program the
PEELTM until the entire device has first been erased with the bulk-erase function.


Internally, maximum 8 flip flops are used, so with some educated guesses I believe it would be possible to reverse engineer it.

Does anyone have a working 315-5537 / 315-5540 / board with them on willing to sell/lend it to me?
I plan to design a replacement board and release anything as open source.
I believe Xenogears over circuit-board.de was attempting to do the same. I'd like to join the effort, if he is willing to, but I am unable to contact him because I cannot get my account activated on that forum.
 
Last edited:

Awbacon

Registered
Registered
Joined
May 31, 2019
Messages
612
Reaction score
442
Points
63
the cruelty of read protected chips :(
 

megavolt85

DreamShell Developer
Registered
Joined
Jun 17, 2019
Messages
199
Reaction score
547
Points
93
Location
Russia
Website
www.dc-swat.ru
AG User Name
megavolt85
AG Join Date
01.09.2015
Reverse engineering needs start from drawing schematic diagram
 

fabiodl

Registered
Registered
Joined
Sep 22, 2019
Messages
18
Reaction score
5
Points
3
Hello, I traced the schematic
(See this schematic)
I also dumped data from the peel

By analyzing the transitions, I could determine the following:
output 6 is ~ras2
output cdcas0 is !~cas0

The following transitions are observed.The notations is use is the following. Each row is an output. For each row there's a list of transitions of inputs (in the form inputname - r or f, where r stands for rise and f for fall) and the corresponding transition of the output (r for rise and f for fall). When the transition occurs any time there's simply r or f. When the transition occurs only some times (depending on other inputs/internal state) there's an *.

output tr_dir: ~fdc-f->r* ~fdc-r->f* ~rom-f->r* ~rom-r->f* ~ras2-f->r* ~ras2-r->f* ~cas2-r->f* ~cas0-f->r* ~cas0-r->f
output ~tr_ce: ~ras2-f->r* ~ras2-r->f* ~cas2-f->r* ~cas2-r->f* ~cas0-f->r* ~cas0-r->f
output ff_cp: asel-r->r* ~cas2-f->f* ~cas2-r->r ~cas0-f->f* ~cas0-r->r wr-r->r
output ~ff_oe: ~ras2-f->f* ~ras2-r->r* ~cas2-f->f* ~cas2-r->r* ~cas0-f->f* ~cas0-r->r
output o7: asel-r->f* asel-r->r* wr-r->r
output o8: ~ras2-f->f* ~ras2-r->r* ~cas2-r->r*

Unluckly it seems the async clear and/or sync set terms of the peel's flip flops are used, so it is not possible to retrieve the complete internal state even by rising the clock.
Is there anyone that knows the megacd signals well enough to guess what those signals could be?
 
Last edited:

Xrider

Registered
Registered
Joined
Apr 19, 2020
Messages
43
Reaction score
65
Points
18
AG User Name
Xrider
AG Join Date
19/05/2020
Thanks for that :)
 
shape1
shape2
shape3
shape4
shape5
shape6
Top