Programming TImekeeper RAM chip

[lilshawn]

I'm having some issues related to my earlier thread about replacing the timekeeper Ram chip.

I have the data it needs inserted, i have a USB programmer but cannot for the life of me get the info in there.

the datasheet for the timekeper ram (m48t58y-70pc1) states that it's stanadrd JEDEC 8K X 8 SRAM chip. while i dont have this particular chip (m48t58y-70pc1) in the program there are several 8K x 8 chips in there.

I can read the chip no problems there. starting at "0000", I can't write to the chip past memory space "0c00" where it errors out. (end is 7FFF) Sometimes if I read back the info i can read it back okay, others its scrambled or blank again.

any ideas?

[lilshawn]

I have experimeted  with 3 different RTC chips (same family) found some more stuff out. 2 of the chips I have hacked to be powered by an external battery, the 3rd i bought on ebay sold as "new". (they all behave identically)

The clock inside the RTC is disabled by default. The last memory area (7ff0 to 7fff) contains a bit that when it's set to "1" (FF) it disables the clock. (to save power) when set to 0 ("00") it is enabled and begins counting seconds.

the sram by default is all F's (1's) RTC is disabled.

i can usually write all 0's to the chip without too much trouble. This causes the bit that controls the RTC imbedded in the chip to begin counting. i can reload the contents of the SRAM over and over and see the seconds being counted. meanwhile, the rest of the zeros are beginning to get corrupted. removing the chip and re-inserting it to the programmer usually results in the chip being blanked (all F's) or being corrupted further.

perhaps the chip is standard 8Kx8 SRAM when being read, but requires something else to be written properly.

[MonMotha]

The interface on most timekeepers is usually "SRAM-like" meaning that all the handshaking, etc. will be like SRAM.  As you've noted, there's some reserved register space for the time, calendar, and other configuration.  You should generally be able to write to and read from all locations as though it were plain ol' SRAM.  Some considerations are needed upon power down to ensure you don't lose data.  In particular, you must make absolutely certain that the /WE pin remains high until power is completely lost.

[lilshawn]

thanks for that bit of info, i'll have to give it a try on Monday when i get back to work.

[lilshawn]

naw, still no luck.

i'm able to partially program the chip. the first line of the game SRAM is "47 4b 39 33 31 00 00 00 19 99 45 41 41 00 af a6" which translates to  "GK931.....EAA..." the system version (GK931) the copyright date (1999) and revision number (EAA)

now, after i program just this and read it back right away it's fine, but after about 1 second the first byte has flipped. it becomes "FF 4b 39 33 31..."

 

[MonMotha]

Silent Scope 2, eh?

I dunno about Hornet, but the other Konami games from that era will initialize the RTC RAM on their own.  Sometimes you have to hold down the service button while the game is booting.

[lilshawn]

i thought so too...I tried but no workey.

Apparently there is a small chip near the RTC that contains the sram dump. it sits unpopulated in this machine. 

[retrorepair]

Try shorting pin 28 and 26. On this timekeeper it needs this to enable read/write.

Don't worry if you get an error upon verify right at the end, this is normal since that's the current time

I'm looking for the JA version of this if you have any leads?

[lilshawn]

thanks, i found that tidbit of info too. but still no luck. i contacted a few places like hobbyroms.com, but even they don't have a writer capable of writing these chips. and i contacted a fella at jammarcade who has fixed these and he won't supply or program a chip at all for me.

the people at hobbyroms suggested that it the same pinout as a standard JEDEC 2764 eprom...
 

However, since it's on-board programmable ram
which only needs a 5V to program  ( rather than 12.5V,  21V , or 25V for an Eprom)
you likely want to try programming it as 2864 (or 28c64)  EEPROM.

tried this and still no dice.  well, it's back burnered for the time being until i can get this sorted out. I have my eye on a 3x/4x  programmer from mcumall.com. it's supposed to be able to program these chips.

open up your box and check the top board... bottom left corner (if the i/o connector where on the right side) for a sticker. it should have a version# and region code on there that will ID it. you may have a 931EA version too. i think all the non-north american versions where EA region. take a look, it looks like a price tag. if it's something else, i'll see if i can track it down someplace. getting the rom data is 1/2 the battle. getting it on there is the other half. 

[retrorepair]

Yeah the GQ-4X can do it, I've done a load of Racing Jam timekeepers on it.

Did you try just buring the data to a 27c64? It won't save settings (and may not initialize) but at least you could see if the dump you have is correct.

BTW, UA would be US, EA is Europe and JA is Japan

I've been messing around with the hex bytes but it seems region isn't enough, there's a security code after the region code which needs to match too, though I think I'm getting close to figuring it out.

[lilshawn]

yeah i thought about trying that, i haven't found a 27c64 kicking around. We've probably thrown out tons of that old stuff...

hell i had to buy a 2732 rom off ebay to try and fix an old bally pinball.

never throw anything away.


the data in the ram is checksummed. you would need to rewrite the checksum to get it to work. it IS as simple as that.

some info i have found that may come in handy:

http://www.jammarcade.net/silent-scope-rtc-data-information/

http://www.jammarcade.net/silent-scope-2-repair-log/

[retrorepair]

I'm not sure that's the case though. Checksum of what, the timekeeper? It constantly changes so it'll never be the same twice. Maybe the checksum of the main program rom?

I'll drop Porchy a line and see if he can shed some light. Thanks for the heads up though, I read his blog all the time and still forgot he posted that 

[lilshawn]

by the looks of it, only some of the data is checksummed.

the stuff at the end of the ram space (last 8 bytes of data) are the time/date info, which will change. this will not be checked since it's always different.

likely all they do is check sum the first 8 bytes, since that has the region and version info.

[retrorepair]

That being the case then the last byte in that string would in fact be the "security code" since it's part of the 8 bytes. Either way I still need to figure that bit out. I think I'm getting closer to it anyway. If we get it working I'll post it here.

[lilshawn]

i'm not entirely sure. i loaded the rom info in a hex editor to help explain what i know...



you can see on the left the first 8 bytes at 00000000 is the version/region data... apparently this is the first thing that gets checked. if the region is wrong it refuses to boot. (-11 error)

then later dont through the rom (after high score data and system options settings) at nearly the end of the dataset is the string again. at 00001F40

80 bytes after that string is the time data. in this case i've selected the "time/date" portion (seconds minutes hours day month year) in the 09 0A 0B 0C 0D 0E byte locations.

as far as the check summing that is performed...i have no idea. perhaps they are lazy as all hell and just compare 00000000 to 00001F40 and see if they match. 

[retrorepair]

Yeah see I think the security code I'm taking about is the two values at 0000000E and 0000000F. On a US board they are 9F A6 and on a Euro board AF A6. If you change them at all MAME throws up a 11p error.

The MAME emulation has no idea what the game or region is though even with a valid dump so it's not all that helpful.

[lilshawn]

i dont have the mame romset, but i imagine one of the other chip dumps has that as part of it's code.

the cpu would basically check and if it matches x then continue otherwise error. (in a nutshell) but it must be somewhere else. (perhaps the ds2401, which is an electronic serial number semiconductor) it has 48 bits. My guess is it could have some data regarding the region it's supposed to be used in.

[porchy]

first off, hello all

Now about the data.
Only the first 14 bytes are checksummed. The checksum is 2 bytes (word) in length and is found directly after the first 14 bytes of data.
The checksum itself is a simple bit sum and nothing fancy.

I never got around to doing any proper testing with SS2, only with SS1 so im not completely sure what the data further on in the chip is, I just make sure that checksum matches too.

As in SS1, bytes at 0x08 and 0x09 are actually the year. This can be anything you want as long as the checksum is changed to match.

Jon

[retrorepair]

Hey Porchy

So where is the checksum held? This is the bit that's been confusing me.

[porchy]

Taking the above hex code as an example. The checksum is AF A6
The code in the program roms calculates this from the data at the start of the timekeeper then compares it against the checksum also held in the timekeeper. It does other checks too I'm sure but I never went too far into the code.
I was originally going to modify the program to bypass any 11p errors but lost interest once I sold my SS stuff

[lilshawn]

ahh, welcome porchy!

I figured as much. Programmers seem to be inherently lazy, I didn't think they would go through a big huge convoluted setup. something easy and quick to employ are the targets they shoot for.

maybe there is no "decode" code programmed in there. if they are in fact lazy as all hell, maybe they just check region/version contained in the timekeeper RAM VS whats contained in ROM  and if it matches, goes.

if thats the case, simply signing the timekeeper with the proper region (probably just JAA) and fixing the checksum bits to make the addition add up could work.

[porchy]

ahh, welcome porchy!

I figured as much. Programmers seem to be inherently lazy, I didn't think they would go through a big huge convoluted setup. something easy and quick to employ are the targets they shoot for.

maybe there is no "decode" code programmed in there. if they are in fact lazy as all hell, maybe they just check region/version contained in the timekeeper RAM VS whats contained in ROM  and if it matches, goes.

if thats the case, simply signing the timekeeper with the proper region (probably just JAA) and fixing the checksum bits to make the addition add up could work.

I do believe that to be the case although haven't fully tested it.

[Francis2013]

Hello
I have 2 PCB board, that I bought (one SS1  and 1 SS2)
And the two of them have the 11P error. event If I replace the timekeeper.
(I didnt know we have to reprogramme the timekeeper tough)

Do you have any update on that issue. What is the code we need to program for each of them.

Regards

[lilshawn]

these are the images of the RTC i have. I still haven't been able to successfully program the RTC at all. I believe this is due to my programmer. I may or may not revisit this issue at a later time if i manage to get ahold of a programmer that can program these chips properly.

maybe you will have better luck than I did with them. Perhaps if you can successfully program them, I'll pay you to do one up for me. 

[Francis2013]

Ok I'll let you know

Here is what I figure out from your previous post
(see Attachement)

[lilshawn]

can you figure out how the checksum is created? i tried adding the values together but couldn't match the existing checksum.

i belive that first line and the matching one later on are the only one that matter.

[WindDrake]

That's weird as hell that Porchy (JammaArcade.net) wouldn't help you with the SS2 NVRAM problem.

I'd try posting over at the KLOV forums and see if you can get some of the aces like RJ to respond on this issue. I know it can be fixed, I think most of the headache comes from figuring out how they are checksumming the first 14 bytes.

Per this post: http://forums.arcade-museum.com/showthread.php?t=266721&page=2

With a socket adapter, apparently you can program the SRAM as a 2764 EPROM. You'll just have issues reading it (as read timings will be WAY off.)

Hope this helps.

[lilshawn]

With a socket adapter, apparently you can program the SRAM as a 2764 EPROM. You'll just have issues reading it (as read timings will be WAY off.)

Hope this helps.

hmm. what kind of adapter are we talking about? i assume we might just have to hold a pin high while we write the data.

and it would  make sense for the timing. i can get the first set of bytes to write (like up to 0800h then error out. i could read it back a few times but the data would get more and more corrupted)

[WindDrake]

Just a heads up, in talking with my coworker about all this.

The checksum isn't a checksum, it's a magic number. Specifically, FFFF.

You sum the first 14 Bytes as Words in Little Endian. Then add the "Checksum Word" to it in Little Endian.

In the dumps, if you do this, you'll get the magic number, FFFF.

So, all you need to do is take FFFF and subtract each word from it in Little Endian. This will give you your "Checksum" to complete the magic number.

Edit: Verified the math with SS2 UAA+EAA, as well as the SS1 GK830EA dump. The eagle has landed, as so my coworker said.

[lilshawn]

huh, wadda you know.     all it takes is someone who's seen something like this before to recognise it to figure it out.

i probably could have stared at that for hours (and did for a while) and never figured it out....then again i'm not really great a sudoku. 

now all we have to do is figure out a way to get this data onto the RTC and we are laffin'! 

[WindDrake]

When I get another free few minutes, I'll look into that EPROM>SRAM adapter.

[porchy]

That's weird as hell that Porchy (JammaArcade.net) wouldn't help you with the SS2 NVRAM problem.

I'd try posting over at the KLOV forums and see if you can get some of the aces like RJ to respond on this issue. I know it can be fixed, I think most of the headache comes from figuring out how they are checksumming the first 14 bytes.

Per this post: http://forums.arcade-museum.com/showthread.php?t=266721&page=2

With a socket adapter, apparently you can program the SRAM as a 2764 EPROM. You'll just have issues reading it (as read timings will be WAY off.)

Hope this helps.

I never said I wouldnt help with the issue. I originally said (loooooong ago) that I wouldnt program chips and post them abroad. My reason? ive lost over £30gbp of my own money by these chips apparently never arriving. Now the people I tried to help may be genuine but I just couldnt afford to do it anymore, plus there now seem to be some crazy restrictions on sending lithium batteries abroad.
Now for my apology, I havent looked at this thread for ages, mainly because Ive stopped getting emails when the thread is updated so all the posts ive missed since my last update may have been construed as ignorance, so I do apologise, I wasnt being an ass.

So anyway, yes WindDrake. The actual code for the game does something like this: ( VB code )

For count = 0 To 10 Step 2
            r4 = key(count + 1)
            r3 = key(count)

            r4 = r4 << 8
            r4 = r4 And &HFFFFFF00
            r0 = r0 + (r3 Or r4)
            r0 = r0 And &HFFFF

        Next count

Exactly what your friend said really.

Ive thought about offering all the different timekeeper data for download but I am led to believe that Konami are still offering to do the replacement (for a lot of cash), so I wouldnt want to incur any wrath!

[WindDrake]

Porchy: Good to see some confirmation. I was hoping we were right. And hey, no worries. I figured it was something along those lines. I'm just trying to help, not point fingers. This stuff's just getting older, and I hate seeing dead boards.

So, some datasheets.

2764 EPROM: http://www.downloads.reactivemicro.com/Public/Electronics/ROM/2764%20EPROM.pdf
Timekeeper RAM: http://www.jameco.com/Jameco/Products/ProdDS/1392835.pdf

More later. Work's busy today.

[porchy]

If anyone is interested here is a little VB app I wrote to check the checksum of these files.
It gives the expected checksum and the calculated one
What it doesn't do is write a new one should the 2 not match.

http://www.jammarcade.net/files/Progs/silentscope.exe
(probably best you copy and paste the link as hotlinking protection usually kicks in)

Click the "CHECK" button and search for the file. Thats pretty much it.
It needs .net installed.

I know channelmaniac has programmed these chips before and hes also well known so may be a better option for some people. Sure as hell beats the $400 Konami is alleged to be charging

[lilshawn]

My reason? ive lost over £30gbp of my own money by these chips apparently never arriving. Now the people I tried to help may be genuine but I just couldnt afford to do it anymore, plus there now seem to be some crazy restrictions on sending lithium batteries abroad.

no worries, you got burned, and your smart enough to keep your hand out of the fire.  Much more than i can say about some people. 

as for the adapter, i recall seeing something someplace on another forum where a particular pin had to be held high to enable write. mind you, this was with some kind of a home built LPT programmer. This solved the issue the person had with programming.

Now i had assumed that my programmer already put the appropriate pins high to do the write enable, but for a quick test, i just inserted a jumper wire in with the RTC legs on the programmer ZIF socket and tried to write the chip with no success.

I can try to dig up that link if need be when i get back to the shop computer.

[WindDrake]

Back on break. Took a moment to look over the datasheets - the EPROM + SRAM have the same pinout exactly outside Pin 1 - VPP on the EPROM, and FT on the SRAM. To program the part, all you should have to do is either wire it 1:1 and exclude Pin1, or put the device into your programmer with Pin 1 bent out so it doesn't make contact. VPP on the FT pin will cause some drama of the fire variety.

[Francis2013]

Hello everybody
I have send my new timekeeper to hobbyroms and he successfully burn it with the dump that lilshawn posted in this forum. (silent scope 1 UA)
I don’t have the error 11p anymore but some other issue that I think are not related.

When the machine boot, there is 4 scenario possible
1.   The machine boot with error 9F
2.   The machine do all the test  with no error, and then simply reboot
3.   The machine boot with “backup data error” and no switch are working
4.   The machine boot with “backup data error” and the switch are working, I set the time, and adjust the scope, and the game start, I insert coin, and then it reboot

I have read on a forum that the “backup data error” was related to the 5Voltage. I check on the power supply and the 5V is reading 5V and the 12 V is reading around 10V.
I check the voltage from the coin door, and the 12V is showing 12V and the 5V around 4,7 V (weird hum!)
Anyway I order another power supply from happs.
P.S. for those of you, who are good observers, Yes I have put a SS1 pcb in a SS2 machine.  (I have 1 ss1 PCB and 2 SS2 pcb)

[Francis2013]

Image in attachement:

[lilshawn]

it seems like that power supply is a tad bit weak. it might be throwing off the testing because of fluctuations (as evidenced by the randomness of the issues you get when you try to boot it up.)

Yes, try another power supply.

[porchy]

these boards are really power hungry, i would suggest giving it a little more on the 5v line, but not too much