SP-60 famiclone with interesting WRAM access issue

krzysiobal · Post by **krzysiobal** » Sat Sep 27, 2025 4:04 am

Lately I was notified by one of the owners of my KrzysioCart flashcart that it refuses to work properly in his SP-60 console:
//box.jpeg
//shell-top.jpg
//shell-bottom.jpg

It shows only the first entry in file list and trying to enter that folder, fat loading cluster error happens indicating some trouble in accessing filesystem from micro sd card.
//kc1.jpg
//kc2.jpg

I dont remember any of the consoles (except Retron 5) to have any problems with it. And this particular issue seems to be so bizarre, because console has also problems with some other games, like in SMB3, those weird black boxes appear and the level is so corrupted it resembles completley different map

//smb3_1.jpg
//smb3_2.jpg
//smb3_3.jpg
//smb3_movie.gif

smb3_movie.gif

Though many other games works fine. CPU-RAM/PPU-RAM test of the console also passes without errors.

Console's internals look interesting. It has three epoxy blobs, suggesting NesOnChip + PRG and CHR with built-in games?
//internals.jpg

Weirdly there is also second cartridge connector underneath, populated with 200-in-1 cartride:
//rev-en-200in1\200in1-scr-menu.jpg

And now the biggest surprise - if you remove that 200-in-1 cartridge, KrzysioCart and SMB3 starts to works fine.
So my hypothesis is that 200-in-1 causes some troubles when main cartridge tries to accesss its internal WRAM at $6000. KrzysioCart uses taht WRAM as extra RAM for storing sectors that are read from SD card, SMB3 uses it to store the map.
And without main cartridge and without 200-in-1, console does not show any other "hidden" game.

Let's analyze the console PCB.
//rev-en-console\top_corr1.jpg
//rev-en-console\bottom_corr1.jpg
//rev-en-console\console-sch.png

Those two epoxy blobs are CPU-RAM and PPU-RAM and the NOC blob has pinout of 1818 (SP-80) chip, not the more common UM6561. That would make sense as 1818 requires external CPU and PPU RAM indeed. It has also single clock input, not XTAL1/XTAL2 like UM6561.
viewtopic.php?p=247482#p247482

Quite interesting find as the we spotted this NOS only either in piggyback or SMD version, with external DIP RAMs:
//80p_piggyback.jpg
//80p_smd.jpg

SLAVE CIRAM-A10, SLAVE PPU /RD, SLAVE PPU /WR and SLAVE CPU /ROMSEL are switched by 7432 OR gate and MASTER-31 (VCC) is used as the switching pin. Diode + resistor involved in CIRAM-A10 switch is clever:
//console-slot-sw.png

The pinout of the ribbon cable connecting main pcb with joysticks/power/reset pcbs also does not look like the most popular one. It is like the the "weird rinco I spotted once:

Code: Select all

   | WEIRD RINCO | GREY CONSOLE | Most consoles   | IQ 502 rev3   | SUPER SMART
   |             | Terminator   | GLK2004         |               | GENIUS COMP.
   +-------------+--------------+-----------------+---------------+-------------
 1 | VCC (*)     | +5V 7805     | +5V 7805        | VCC           | VCC
 2 | +5V 7805    | VCC          | VCC             | +5V 7805      | $4017 CLK
 3 | $4016 D0    | $4017 CLK    | $4017 CLK       | $4016 D0      | OUT2
 4 | OUT0        | $4017 D4     | OUT2            | OUT0          | OUT1
 5 | OUT1        | OUT0         | OUT1            | $4016 CLK     | $4017 D4
 6 | OUT2        | $4017 D3     | $4017 D4        | $4016 D1      | OUT0
 7 | $4017 CLK   | $4016 CLK    | OUT0            | OUT1          | $4017 D3
 8 | GND         | $4017 D0     | $4017 D3        | OUT2          | $4017 D2
 9 | AUDIO       | $4016 D0     | $4016 D1        | GND           | $4016 CLK
10 | !IRQ        | !RESET       | $4017 D2        | AUDIO         | $4017 D1
11 | $4017 D4    | GND          | $4016 CLK       | !IRQ          | $4017 D0
12 | $4017 D3    | AUDIO (*)    | $4017 D1        | $4017 D4      | $4016 D0
13 | $4017 D2    |              | $4017 D0        | $4017 D3      | !RESET
14 | $4017 D1    |              | $4016 D0        | $4017 D2      | GND
15 | $4017 D0    |              | !RESET          | $4017 D1      | VIDEO
16 | VCC         |              | GND             | $4017 D0      | AUDIO
17 | $4016 CLK   |              | !IRQ            | $4017 CLK     |
18 | $4016 D1    |              | AUDIO           | AUDIO         |
19 | !RESET      |              |                 | !RESET        |
20 | GND (*)     |              |                 | GND           |

I don't see anything particularry wrong with the console itself co let's move onto the analysis of underneath cartridge.
//200in1-scr-menu.jpg
//200in1-scr-intro.jpg
//200in1-pcb-top.jpg
//200in1-pcb-bottom.jpg
//200in1_sch.png

It is popular 200-in-1 (Unchained Melody)[p1][!] / Mapper 212 NROM multicart. This cartridge could easily be done with signle latch (like 74161/74273/74174) plus one 74153 for mirroring and NROM16/32K switch. Though they decided to implement that mapper in epoxy blob.
That's not very common.

Code: Select all

[fedcba9876543210] @ 6000-7fff
 1v..........MPPp
  |          |+++-- 16kB PRG bank (p not used in 32k MODE)
  |          |+++-- 8kB CHR bank
  |          +----- mirroring: 0=V, 1=H
  +---------------- PRG mode: 0=16K, 1=32K

               BLOB pinout
                  +--+
PRG A15/CHR A14 <-|  |-- VCC
PRG A16/CHR A15 <-|  |-> PRG-A14
PRG A17/CHR A16 <-|  |-> CHR A13
        CPU A14 ->|  |-> CHR /CE
        CPU A13 ->|  |<- PPU A13
             M2 ->|  |<- PPU A11
         CPU A4 ->|  |<- PPU A10 
         CPU A3 ->|  |-> CIRAM A10
         CPU A2 ->|  |<- PPU /RD
         CPU A1 ->|  |-- GND
         CPU A0 ->|  |<- CPU R/W
         CPU D7 <-|  |<- CPU /ROMSEL
                  +--+

CPU A4 and CPU D7 does not seem to be used in forementioned mapper logic.
Though there is no extra discrete logic like RESET circuit that would add significant load to the M2 signal, resulting in WRAM decoding problem. But mapper description claims that:

Code: Select all

Mask: $E010
Read: $6000: [1... ....]
 reads from these addresses return a value with the most significant bit set, while all other addresses and bits are open bus.

It is not true. Reading from the $6000-$7fff results in that 32-byte repeating pattern:

Code: Select all

     00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f     
     -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --     
6000 FF FF FF FF 7F FF FF FF 7F FF 7F FF FF FF FF FF     
6010 7F FF 7F FF FF FF FF FF 7F FF FF FF 7F FF 7F FF     
.... .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..

or to be more precise, like that because only D7 is implemented. That would explain the need of CPU A4 and CPU D7.

Code: Select all

     0 1 2 3 4 5 6 7 8 9 a b c d e f
     - - - - - - - - - - - - - - - -
6000 1 1 1 1 0 1 1 1 0 1 0 1 1 1 1 1
6010 0 1 0 1 1 1 1 1 0 1 1 1 0 1 0 1
.... . . . . . . . . . . . . . . . .

This is required by the menu cartridge code, without it, it would be stuck in the waiting loop:

Code: Select all

 00:F980: AD 00 60  LDA $6000 ;expects $80..$FF
 00:F983: 10 FE     BPL $F983
 00:F985: AD 10 60  LDA $6010 ;expects $00..$7F
 00:F988: 30 FE     BMI $F988
 00:F98A: 4C 00 C0  JMP $C000

This pattern seems to be hard-coded and not modificable by any of the distinct recognizable writes at:
$6000..$601f, $8000..$801f, $a000..$a01f, $d000..$c01f, $e000..$e01f

Though the cartridge writes once $00 at $6000 after power-up:

Code: Select all

00:C1D2: A9 00     LDA #$00
00:C1D4: 8D 00 60  STA $6000

I initially thought this patter is used to determine how many games should be shows in the list, but cartridge reads only $6000 and $6010 in the above check and never anything more. Though there are indeed different variants of this multicart, they differ in the PRG code:
//variants.PNG

That everything explains the trouble with cartridges in main slot that require to access WRAM. This 200-in-1 drives D7 at 6000-7fff with the above pattern, even if the main cartridge is present because there is no circuit that would notify this cartridge it should not do it. If slave's M2 would be 0 when it is disabled, that would to the job, for example:

Code: Select all

M2 ------------------------+
                  VCC      |
                   |       |
                   4k7    1k 
                   +----|<-+- SLAVE M2
                   |
MASTER-31---10k---|< NPN
                   |
                  GND

On the other hand, involing transistor logic into clock signal is not a good idea especially if the third logic level state (high impedance) is used for reset circuit. Also, because M2 is shorted in both slots in that PCB and the track first goes to the slave slot, then master and is passed underneath slots, I didnt want to cut any traces and add wires and circuit just to support this one particular built-int multicart.
//fix1.jpg

so what I did was just a quick-fix: I added 1k resistor between mapper blob and CPU-D7 line in the built-in cartridge
//fix2.jpg

Now it works fine.

PAL/NTSC switch improvement:
The pinout of 1818 epoxy NOC matches the one of SMD/piggyback board but during analysis of the console's PCB I had some trouble in assigning pins to its corresponding signals with proper order in that region, especially because of that weird roundabout trace coming out and then in again the blob. I was wondering if the signal going to P8 is $4016.D2 or PAL/NTSC switch.
After analysis it turned out to be PAL/NTSC jumper and $4016.D2 is read by the CPU as 1.
//console_jumper.jpg

So the natural approach was to add PAL/NTSC switch. This console has single clock input, generated by external transistor
//console_clk.png

I added my crystal switch board with 74HCU04 generator that allows clock changing with external toggle switch.

The last formality was just to add wrong polarity power supply protection and replace those fragile 18-pin ribbon cable with goldpin+properly crimbed BLS connector. Also, ugly 4-pin thick cable was replaced with more gentle one.
//final1.jpg
//final2.jpg