Welcome, Guest!

Here are some links you may find helpful

MCD Reverse engineering the Sega Mega CD 315-5540

fabiodl

Member
Original poster
Registered
Sep 22, 2019
20
7
3
The second revision of the Japanese Sega Mega CD is different from the export model.
In more detail, while export model main chip on the logic board is a 315-5548, the Japanese version mounts a different chip, 315-5477. The pinout is really close, but internally there must be some differences that require additional external logic. This is provided by the connector board, which mounts a 315-5540.
Here it is

115158-20181106-093216-jpg


In trying to repair a japanese mega cd, I think I identified the problem in such chip (details are here )

As by this thread,
https://circuit-board.de/forum/inde...-MEGA-CD-1-Reparatur-PEEL-18CV8-PLD-auslesen/
it seems such chip is failing very often.

The same thread shows that there was a first revision which used discrete logic. This is good news for recreating the chip with a CPLD.
Here is the money shot
con-bd1.jpg


There is however one programmable logic chip, the 18CV8-PC, that sega rebranded as 315-5537, whose function is unknown.
The user Xenogears seems to have tried to dump the content of the chip in two occasions,
here
https://circuit-board.de/forum/index.php/Attachment/115748-Mega-CD-JEDEC-txt/
and here

but both seems failures, because by looking at the bit pattern they are either all 0 or a repeating cyclic pattern.

I think this is because the chip was read protected. From the chip's datasheet

The PEELTM18CV8Z provides a special EEPROM security bit that prevents unauthorized reading or copying of designs pro-
grammed into the device. The security bit is set by the PLD programmer, either at the conclusion of the programming cycle or as a
separate step, after the device has been programmed. Once the security bit is set it is impossible to verify (read) or program the
PEELTM until the entire device has first been erased with the bulk-erase function.


Internally, maximum 8 flip flops are used, so with some educated guesses I believe it would be possible to reverse engineer it.

Does anyone have a working 315-5537 / 315-5540 / board with them on willing to sell/lend it to me?
I plan to design a replacement board and release anything as open source.
I believe Xenogears over circuit-board.de was attempting to do the same. I'd like to join the effort, if he is willing to, but I am unable to contact him because I cannot get my account activated on that forum.
 
Last edited:

Awbacon

Well-known member
Registered
Top Poster Of Month
May 31, 2019
1,032
656
113
the cruelty of read protected chips :(
 

fabiodl

Member
Original poster
Registered
Sep 22, 2019
20
7
3
Hello, I traced the schematic
(See this schematic)
I also dumped data from the peel

By analyzing the transitions, I could determine the following:
output 6 is ~ras2
output cdcas0 is !~cas0

The following transitions are observed.The notations is use is the following. Each row is an output. For each row there's a list of transitions of inputs (in the form inputname - r or f, where r stands for rise and f for fall) and the corresponding transition of the output (r for rise and f for fall). When the transition occurs any time there's simply r or f. When the transition occurs only some times (depending on other inputs/internal state) there's an *.

output tr_dir: ~fdc-f->r* ~fdc-r->f* ~rom-f->r* ~rom-r->f* ~ras2-f->r* ~ras2-r->f* ~cas2-r->f* ~cas0-f->r* ~cas0-r->f
output ~tr_ce: ~ras2-f->r* ~ras2-r->f* ~cas2-f->r* ~cas2-r->f* ~cas0-f->r* ~cas0-r->f
output ff_cp: asel-r->r* ~cas2-f->f* ~cas2-r->r ~cas0-f->f* ~cas0-r->r wr-r->r
output ~ff_oe: ~ras2-f->f* ~ras2-r->r* ~cas2-f->f* ~cas2-r->r* ~cas0-f->f* ~cas0-r->r
output o7: asel-r->f* asel-r->r* wr-r->r
output o8: ~ras2-f->f* ~ras2-r->r* ~cas2-r->r*

Unluckly it seems the async clear and/or sync set terms of the peel's flip flops are used, so it is not possible to retrieve the complete internal state even by rising the clock.
Is there anyone that knows the megacd signals well enough to guess what those signals could be?
 
Last edited:

Xrider

Well-known member
Registered
Apr 19, 2020
65
71
18
AGName
Xrider
AG Join Date
19/05/2020
Thanks for that :)
 

Surteesf1

New member
Nov 28, 2021
1
0
1
The second revision of the Japanese Sega Mega CD is different from the export model.
In more detail, while export model main chip on the logic board is a 315-5548, the Japanese version mounts a different chip, 315-5477. The pinout is really close, but internally there must be some differences that require additional external logic. This is provided by the connector board, which mounts a 315-5540.
Here it is

115158-20181106-093216-jpg


In trying to repair a japanese mega cd, I think I identified the problem in such chip (details are here )

As by this thread,
https://circuit-board.de/forum/inde...-MEGA-CD-1-Reparatur-PEEL-18CV8-PLD-auslesen/
it seems such chip is failing very often.

The same thread shows that there was a first revision which used discrete logic. This is good news for recreating the chip with a CPLD.
Here is the money shot
con-bd1.jpg


There is however one programmable logic chip, the 18CV8-PC, that sega rebranded as 315-5537, whose function is unknown.
The user Xenogears seems to have tried to dump the content of the chip in two occasions,
here
https://circuit-board.de/forum/index.php/Attachment/115748-Mega-CD-JEDEC-txt/
and here

but both seems failures, because by looking at the bit pattern they are either all 0 or a repeating cyclic pattern.

I think this is because the chip was read protected. From the chip's datasheet

The PEELTM18CV8Z provides a special EEPROM security bit that prevents unauthorized reading or copying of designs pro-
grammed into the device. The security bit is set by the PLD programmer, either at the conclusion of the programming cycle or as a
separate step, after the device has been programmed. Once the security bit is set it is impossible to verify (read) or program the
PEELTM until the entire device has first been erased with the bulk-erase function.


Internally, maximum 8 flip flops are used, so with some educated guesses I believe it would be possible to reverse engineer it.

Does anyone have a working 315-5537 / 315-5540 / board with them on willing to sell/lend it to me?
I plan to design a replacement board and release anything as open source.
I believe Xenogears over circuit-board.de was attempting to do the same. I'd like to join the effort, if he is willing to, but I am unable to contact him because I cannot get my account activated on that forum.
Hi,
Any news?
Someone managed to reproduce 315-5540?
I have the same problem here!
It's a simple fix and not having this ci is frustrating.
 

l_oliveira

Member
Registered
May 31, 2019
12
15
3
This might be interesting for you.

The main board with MCE1 ASIC (315-5477) and straight connect BD (bodge-less connect bd) gives this result.

It means the bodge is a fix for WORD RAM accesses from MD side.

TV2022021702045500.jpgTV2022021702054200.jpgTV2022021702060300.jpg
 

Chrissy

New member
May 19, 2022
1
0
1
Hi, i am also interested in this project along with l_oliveira .

I made my own PCB recreation and converted the logic code Xenogears had made on circuit-board.de (waiting for registration) into GALasm so i could use a GAL22V10 and it sort of work.

The progress i have made was over on Retro Tinkering Discord.

Video Link to what it currently does
MegaCD using GAL22V10 on the bridge board
 

fabiodl

Member
Original poster
Registered
Sep 22, 2019
20
7
3
Reverse engineering was completed. I attach the source file for recreating the PEEL.
This is released as CC BY-NC-SA 2.0
Needless to say, donations in hw or whatever are welcome to keep new reverse engineering projects going ;)

TITLE 'MCD'
DESIGNER 'D'
DATE '30 Dec 2019'

PEEL18CV8

CLK pin 1

"I/O CONFIGURATION DECLARATION
"IOC (PIN_NO 'PIN_NAME' POLARITY OUTPUT_TYPE FEEDBACK_TYPE )
FDC Pin 2
ROM Pin 3
RAS2 Pin 4
CAS2 Pin 5
CAS0 Pin 6
WR Pin 7
FRES Pin 8
IOC ( 12 'O8' Pos OutCom Feed_Pin )
IOC ( 13 'O7' Neg OutReg Feed_Reg )
IOC ( 14 'O6' Pos OutCom Feed_Pin )
IOC ( 15 'CD_CAS0' Pos OutCom Feed_Pin )
IOC ( 16 'FF_OE' Pos OutCom Feed_Pin )
IOC ( 17 'FF_CP' Pos OutCom Feed_Pin )
IOC ( 18 'TR_CE' Pos OutCom Feed_Pin )
IOC ( 19 'TR_DIR' Neg OutCom Feed_Pin )

AR NODE 21 "Global Asynchronous Reset
SP NODE 22 "Global Synchronous Preset

DEFINE


EQUATIONS

AR = WR;

SP = 0;

"All Equations must end with semicolons.
"Internal or External output names appended with extensions:
" 1) .COM for Combinatorial Output
" 2) .D for D-type Registered Output
" 3) .OE for Output Enable Control


TR_DIR.Com = CAS0 #
(ROM & FDC & O8);


FF_CP.Com = CAS2 # CAS0 # (O7 & RAS2) # (O7 & !O6) # O8;

FF_OE.Com = CAS0 #
O8 #
(O6 & CAS2) #
(CAS2 & !O7) #
(FF_OE & RAS2 & O7) #
(FF_OE & !O6 & O7);

TR_CE.Com = !FF_OE;


CD_CAS0.Com = !CAS0;
O6.Com = RAS2;
O7.D := (!O7 & FDC & ROM & RAS2) #
(!O7 & FDC & ROM & CAS2 & CAS0) #
(!RAS2 & CAS0 & CAS2);
O8.Com = (CAS2 & RAS2) #
(!CAS2 & O8) #
(!O6 & O8);



TEST_VECTORS
(clk fdc rom ras2 cas2 cas0 wr fres -> tr_dir tr_ce ff_cp ff_oe cd_cas0 o6 o7 o8 )
0 0 0 1 1 1 1 0 -> L L H H L H H H
0 0 0 1 1 1 0 0 -> L L H H L H H H
0 0 0 1 1 0 0 0 -> H L H H H H H H
0 0 0 0 1 1 0 0 -> L L H H L L H L
1 0 0 0 1 1 0 0 -> L L H H L L L L
1 0 0 0 0 0 0 0 -> H H L L H L L L
1 0 0 0 1 0 0 0 -> H L H H H L L L
1 0 0 0 0 0 0 0 -> H H L L H L L L
0 0 0 1 0 0 0 0 -> H H L L H H L L
1 0 0 1 0 0 0 0 -> H H H L H H H L
1 0 0 1 1 0 0 0 -> H L H H H H H H
 

Make a donation