Micro Machines BIC-23 PCB with hardware ROM patch

[Revenant]

Recently, I became aware of some US copies of Micro Machines that lack the "A/B" switch that Camerica carts normally have on the back. The cart shell is the same, but there's a 5x2 edge connector sticking out where the switch normally goes. I wasn't aware of any documentation about this version of the cart, so I picked one up on eBay.

20251012_131644.jpg

20251012_131658.jpg

As the lack of switch suggests, these carts lack most of the CIC "stun" circuitry from the more common revision (and thus may not work on an unmodified frontloader). There's also an added AMD PALCE16V8 next to the BF9093 mapper chip. It turns out that these carts contain a slightly earlier ROM revision containing a pretty severe bug, and the PAL is there to serve as a patch.

In "The Making of Micro Machines", David Darling mentions a pretty nasty bug that was caught and had to be worked around at the last minute:

Famously, the company was on the verge of mass manufacturing its European cartridges when a serious bug was discovered in the code. ‘It turned out that if you pressed brake or reverse on the starting grid the game just crashed,’ says Graham. ‘QA wasn’t what it is now and nobody had ever tried that before. Codemasters had already manufactured tens of thousands of ROMs with this bug in, so in order to get it to work, they put some of the Game Genie hardware into the cartridge which would change the one byte of the code that contained the bug – that’s how they fixed it.’

Although this is a US cartridge, not European as the article suggests, this board was actually made to work around that exact bug. (Calling an off-the-shelf PLD "some of the Game Genie hardware" is stretching it a bit, though.)

Here's how it's wired up in the cart:

Code: Select all

               .----_----.
      CPU A0 ->| 1  P  20|-- +5V
      CPU A1 ->| 2  A  19|-> CPU D2
      CPU A2 ->| 3  L  18|<- PRG D2
      CPU A3 ->| 4  C  17|<- PRG /CE
      CPU A5 ->| 5  E  16|<- PRG A17
      CPU A6 ->| 6  1  15|<- PRG A16
CPU A7 && A8 ->| 7  6  14|<- PRG A15
     CPU A10 ->| 8  V  13|<- CPU A13
     CPU A11 ->| 9  8  12|-x NC
         GND --|10     11|<- CPU A12
               `---------'

(A7/A8 are ANDed through separate diodes)

functions as:
if (addr & 0x3BDEF == 0x001CD)
    data |= 0x04

This technically patches 8 separate addresses due to the incomplete decoding, but only the byte responsible for the bug is actually affected - the other bytes all have D2 high already.

This early bugged ROM has only three bytes differing from the more common US revision on the BIC-48 PCB - one for the bug fix, and two for part of the PRG ROM checksums:

Code: Select all

addr  | early   | early   | later
      | (bugged)| (fixed) |
------+---------+---------+-------
043DD | 0x22    | 0x26    | 0x26
3B2A4 | 0xE5    | 0xE5    | 0xE9
3B2B4 | 0x2A    | 0x2A    | 0x26

And here's the actual affected code:

Code: Select all

 01:83D9:BD 86 03  LDA $0386,X
 01:83DC:30 22     BMI $8400
[...]
 01:83FF:60        RTS -----------------------------------------
 01:8400:A5 E8     LDA $00E8
 01:8402:D0 D5     BNE $83D9
 01:8404:AD 04 01  LDA $0104
 01:8407:D0 0A     BNE $8413

On at least some courses (like "The Breakfast Bends"), mashing the B button to immediately reverse at the start of the race can result in the game hitting an infinite loop. The patch (and later ROM revision) changes the BMI instruction to branch to address 8404 instead.

Aside from that, the (very minimal) CIC-related circuitry is the same as how pin 13 of the mapper is wired up on other Camerica carts. The negative voltage generator is missing, though, so I'm not really sure what the point of keeping the rest of it was.

The small edge connector carries the CIC signals, though a couple of necessary wire jumpers are unpopulated. The CIC clock/reset/NES-to-cart pins aren't connected to anything else on the board. I guess theoretically you could plug in a dongle with the rest of the lockout circuitry in it.

Code: Select all

                          front   back
GND (thru missing jumper) --  1  10 -- CIC clock (thru missing jumper)
                same as 1 --  2   9 -- +5V
                              [key]
                      +5V --  3   8 -- CIC to NES
              CIC to cart --  4   7 -- CIC reset
 BF9093 pin 13 (thru cap) --  5   6 -- NC

[krzysiobal]

Thanks for wonderful description. I am curious was it really much more expensive to re-design pcb for that special purpose and buy thousands of GAL chips instead of re-ordering mask roms with fixed content in the factory.