Looked tempting but 120$ for something incomplete, with with unknown state was not acceptable. So I started googling and found some info with internal photos of this thing on the internet (http://j02.nobody.jp/game/h1/famil.html)
Label says:
Code: Select all
ファミリー·エースの使用方法
1.上ののカセットのソケットに、ダビングしたいゲームカセットを完全に差しこんで下さい。
2.下のの力セットのソケットに、ダビング用の生力セットを完全に差しこんで下さい。
3.電源プラグを差しこみ、 スタートボタンを押して下さい。WRITEランプが消えたらできあがりです!
(御注意)本器は営業を目的として使用したり、ダビングしたカセットを販売することは法律で禁じられています。
Which translates to:
How to use a family ace
1. Completely insert the game cassette you want to dub to the cassette socket above.
2. Fully insert the dubbing fully settlement socket.
3. Pay the power plug and press the start button. Write The lamp disappears!
(Caution) The law is prohibited by law to use this unit for business purposes or sell dubbed cassettes.
After a huge effort of trying to restore the schematic, I finally succeded. So we have
* Z80CPU, clocked 4MHz with 4kB EPROM (no access to the device so can't dump it, but lack of RAM means that the program need to be quite simple). They should've used 6502 to make it consistent with the 6502 in Famicom.
For those that are not familiar with Z80, it has two separate 16 bit address spaces (40000-$ffff). One for program memory (/MREQ) and the other for I/O mapped devices (/IOREQ). Z80's program memory is enabled for the whole $0000-$ffff Z80 program address area
* 8255 + 74273 + 74174 - latches for interfacing with cartridge connector (CPU/PPU address buses) - both data and address buses of CPU & PPU are connected in parallel.
Look what a fancy decoder built with inverter, buffer, pull-up and or-gate
* TL497 step-up voltage generator that generates high voltage (VH) needed for EPROM programming.
- When T4 is on, output voltage (VH) is set by R11|R12 (lower)
- When T4 is ooff, output voltage (VH) is set by R11 (higher)
As a result, the software can set one of two pre-adjusted VHs (probably higher for older eproms and lower for newer)
* WHen transistor T3 is turned ON, extra current from the power supply (+10V) is sourced to charge the C11 cap. No idea what it is used for
So the IO address space of the device is:
Code: Select all
$0000: [DDDD DDDD] - 8255's PA: read/latch CPU/PPU D7..D0
$0001: [LLLL LLLL] - 8255's PB:
|||| |||| Always:
++++ ++++-------------- latch CPU/PPU A7..A0 with it
|||| ||||
|||| |||| When rising edge of $0002.6:
||+ ++++---------------latch CPU/PPU A12..A8
++---------------------latch CPU-A14..A13
|| ||||
|| |||| When rising edge of $0002.7
|| |||+-------------- 0=VH set with R30 (higher), 1=VH set with R30|R29 (lower)
|| ||+--------------- 0=turn led2 on
|| |+---------------- 0=apply VH to target cartridge's /IRQ
|| +----------------- 0=preload C11 through R26=33R (what's the function of that?)
|+------------------- connected to IC3A.1 (not used)
+-------------------- 0=apply VH to target cartridge's PPU/WE
$0002: [VVVV VVVV] - 8255's PC:
|||| |||+-------------- latch target cartridge's M2
|||| ||+--------------- latch target cartridge's PPU A13
|||| |+---------------- latch target cartridge's /ROMSEL
|||| +----------------- latch source cartridge's /ROMSEL
|||+------------------- latch source cartridge's PPU A13
||+-------------------- latch target cartridge's CPU R/W
|+--------------------- strobe 1
+---------------------- strobe 2
$0003 [MMMM MMMM] - mode configuration for the 8255 PA/PB/PC
$0004 [B... ....] - read state of the button (0=pressed)
One 74368, but all of its six gates are permanently enabled, so it is used just as an inverter
One 53206P (basically the same as 7406) - hex high voltage inverter with open collector outputs. Only 4/6 gates are used
One 74125 - non inverting buffer - only 2/4 gates are used
Conclusion:
The whole program is probably:
* Wait until a button is pressed
* Then, for every CPU address from $8000..$ffff;
- latch CPU A14..A0 on source (and target) cartridge with that address
- assert source cartridge /ROMSEL to 0
- assert target cartridge /ROMSEL to 1
- read PRG byte from source cartridge
- assert source cartridge /ROMSEL to 1
- assert target cartridge /ROMSEL to 0
- set the TL494 to generate lower VH voltage
- program target cartridge memory cell with previously read value. Verify.
- if verification fails, set TL494 to generate gigher VH voltage
- repeat programming.
* Do the same with CHR mamoery
*/IRQ and PPU /WE are probably used as VPP and write pulse).
*no idea what M2 and CPU R/W is used for. Probably at first, the lower voltage is applied. Ff the byte is not programmed properly, higher voltage is tried.
Because high voltage is applied to /IRQ and PPU/WE pins, when a ordinary cartridge is inserted into the target slot, it might get damaged
No idea what is exactly present inside the "target" cartridge
Here I found some photos, but it might be different model as well:
But /IRQ and CPU-R/W pins are wired in this one.