Document Title: [Battlezone NVRAM.html (html file)]
Subject: Battlezone high score upgrade (LONG)
Date: 23 Jun 1994 12:06:29 GMT
Organization: Texas Instruments
Lines: 365
Distribution: world
Message-ID: <2ubts5$94c@osage.csc.ti.com>
NNTP-Posting-Host: bugs.tiuk.ti.com
Well I finally got my Battlezone permanent high score fix working,
thanks to the 48Z02 datasheet that Clive Bittlestone sent (the chip
has 2 chip enables that do not behave the same, and I was using
the wrong one, so I swapped a couple of wires and bingo).
Also thanks go to Doug Jefferys and all the other folks that sent
me ideas for future improvements and alternative ways to preserve
the high scores.
I'd be interested in any feedback folk have.
Problems? Praise? .... whatever, so I can make adjustments to
this document.
Regards, John.
* John Keay ! Texas Instruments Ltd. *
* keay@tiuk.ti.com ! Bedford, U.K. *
* Disclaimer: All opinions expressed herein are personal. etc etc *
-----------------------------------------
UPGRADE: Battlezone Permanent high score.
-----------------------------------------
AUTHOR: John Keay
WRITTEN: June 1994
DISCLAIMER
----------
The opinions expressed within this document are those of the
author only and not necessarily those of the author's employer. This
document is provided for informational purposes only. Although the
author has made every effort to provide accurate information, he cannot
guarantee the accuracy or usefulness of any of the information contained
herein due to the complexity of the issues involved. The author takes
no responsibility for anything arising as a result of anyone using the
information provided in this document, and the reader hereby absolves
the author of any and all liability arising from any activities
resulting from the use of any information contained herein.
THE UPGRADE
-----------
This upgrade will allow Battlezone high scores to be remembered
while the machine is switched off. Simple as that.
The upgrade needs no special intervention by the user after the
upgrade has been installed and the machine has been powered up
once. The upgrade has been designed so the machine only saves the top
5 highscores (so mere-mortals can get on the score sheet occasionally).
It has also been designed so that the saved high scores can be cleared
out by reseting the machine with one of the coin switches held down.
The fix is implemented by replacing Battlezone's existing program
RAM with battery-backed-ultra-lower-power-CMOS-SRAM. Then a new
EPROM can be blown that will convince Battlezone not to initialize
the area of this RAM that is used for the high scores (unless the operator
wants this to happen). The batteries in the zero-power replacement SRAM
we are going to use should last about 10 or 20 years, so your highscores
will be safe for quite a while.
Read these detail through a couple of times, if you plan to do
the fix, because I haven't always got things in exactly the correct order.
"...and now Sir Launcelot, Sir Galahad and I jump out of the rabbit....." :-)
THE DETAILS
-----------
I rate this upgrade "easy-ish" on a scale of "trivial" to "impossible",
but please take infinite care when upgrading, Battlezone is a machine
that is close to my heart (number 2 on the all-time greats list IMHO) and
I'd hate to hear about *ONE* functional machine not recovering from
the "upgrade".
As half the fix is a software patch there is enless scope for different
variations, but I will stick to just one example with more patches to
follow later. This means you will need access to an EPROM programmer
to use the upgrade. Here is the parts list:
Number Part list
------ ---------
1 2716 - 2K x 8 EPROM
1 MK48Z02 - 2K x 8 Zero power (TM) SRAM.
1 24-pin DIL socket
2 18-pin DIL socket
The most expensive part was the zero powered SRAM cost which
me about 6 pounds ($9).
First I'll describe the hardware change and then I'll talk about
the software change.
HARDWARE
--------
Firstly we need to disable the two static RAMs that Battlezone currently
uses as program RAM (as we are going to install some more and we don't
want them fighting it out).
1) Socket H2 & J2.
The 2 RAMs in question are 2114s at locations H2 & J2 on the Battlezone
CPU board (the larger one with the reset button). I desoldered these
chips and installed sockets (but you can disable them anyway you like).
Remember to be very careful desoldering chips from these old boards
because the wire tracks on the board have a tendency to peel away
from the board (as I rediscovered to my horror and I had to add a jumper
wire or two). This is the hardest stage of the fix so take your time so
you don't damage the board.
You will need access to pins 8 & 10 at either H2 or J2 later so if
you disable the chips some other way bare that in mind.
Once you have removed the 2114s solder in 2 new 18 pin sockets, insert
the original 2114s and re-test your board in the machine. Everything OK?
This might be a good time to ensure the Battlezone power supply is
producing greater than 4.75V. Adjust the small trim pot of the Audio card
if it isn't. The new SRAM we are going to install will protect itself
if the voltage is too low.
2) Piggy-back socket on EPROM.
The next stage is to solder a socket to the back of the replacement
2716 eprom chip that we are going to use to replace the PROM at location
N1 (it should be labelled 036-409 or something). It is best if the ROM
has already been programed with the new data as detailed below. Not all
the pins on the socket should be connected to the EPROM. Also find a socket
with a hole in the centre (or you wont be able erase the EPROM to change to
patch without de-soldering things). If your EPROM eraser has enough head
room you should have no problem erasing and programming the EPROM even with
the socket attached.
Socket from above
1 |O|---U---|O| 24 Socket and eprom from side
2 |O|-------|O| 23
3 |O| |O| 22 +--------------+
4 |O| |O| 21 R/W | | socket
5 |O| Hole |O| 20 Gbar +--------------+
6 |O| here |O| 19 A10 |||||||||||| Solder most pins together
7 |O| |O| 18 Ebar +--------------+
8 |O| |O| 17 | | eprom
9 |O| |O| 16 +-||||||||||||-+
10 |O| |O| 15 ||||||||||||
11 |O|-------|O| 14
12 |O|-------|O| 13
Blow-up of socket to eprom connection
.......----------+
|
|Socket
|
.......----++----+
||
.......----||----+
\/ |
Solder here------> __ | EPROM
| | |
.......---\ /---+
||
||
\/
Pins 18/19/20/21 on the socket are not soldered straight through. Bend these
pins up before you solder the rest to their corresponding EPROM pin. I
used some connection wire to connect pins 19 and 20 round (not over) to
pin 12 (GND) on the socket. I also used 2 lengths of single core wire (so I could
insert one end into a socket) to connect pins 18 and 21 to one of the now
vacant 2114 sockets at H2 or J2.
In summary:
Socket pin Connected to
---------- ------------
18 (Ebar) pin 8 on socket H2 or J2 (this is the RAM select).
19 (A10) ground
20 (GBar) ground
21 (R/W) pin 10 on socket H2 or J2 (this is the read/write signal).
3) Plug and play.
Assuming you have patched the EPROM, all you have to do now is plug and play.
- Carefully remove the PROM in socket N1.
- Plug the EPROM with a socket on its back into N1.
- Connect the 2 single core jumper wires to the vacant H2 or J2 sockets.
- Insert the 48Z02 into the socket (on the back of the EPROM) at N1.
- Hold down the right coin slot switch (to reset the scores) and switch
the machine on.
Is it still working?
- Wait for the monitor to warm up. :-)
Is it working?
The patch described in this release of the document, should start off
with a high score of 0000 and the entire high score table should
be blank. If that seems OK have a few games and check things still
work OK and that the top few scores are remembered when the power is
off. Put the old 2114's and/or the EPROM back in if you have
any problems to help isolate the problem.
SOFTWARE
--------
Now for the software fix. Fortunately all the code that needs patching
is in one ROM. Unfortunately I have no intentions of broadcasting ATARI
code across the net (for the obvious reasons), so you will have to make do with
just the changes, and find a way to edit them into your own binary file
of the ROM.
OK here is the patch, in a weird format I just invented. :-)
7800
7FFF
7b58 {
A2 00 AD 00 08 29 01 F0 02 A2 3C A9 00 9D 00 03 E8 D0 FA A2
0F 9D 0E 03 9D 2C 03 CA D0 F7 20 1F 53 4C 00 50
}
7AE6 {
EA EA EA
}
There are several ways you can patch the binary image, once it has been
read from the original 036-409. I loaded the code into a memory monitor
tool and edited the changes in by hand then saved it out, but it is
simple enough to write a simple perl or C program to automatically do
the changes (and I have code in both those languages available if you
get completely stuck). Some editors also allow you to edit binary
data in hex, this is also an ideal way to do the change.
ROM 409 represents the code between addresses 0x7800 - 0x7FFF, so
the new data needs to be entered starting at 0x7B58 and 0x7AE6 (which
is therefore 0x358 and 0x2E6 bytes from the start of the file).
e.g
0x7B58 needs to be set to 0xA2
0x7B59 needs to be set to 0x00
etc....
The first 2 lines contain the start and end addresses of the 036-409
ROM. Next is a list of bytes to be placed at certain locations.
------------- patch for 036-409 ---------------------
7800 <---- start location for ROM 409
7FFF <---- end location for ROM 409
7b58 { <---- 1st lot of changes start here.
A2 00 AD 00 08 29 01 F0 02 A2 3C A9 00 9D 00 03 E8 D0 FA A2
0F 9D 0E 03 9D 2C 03 CA D0 F7 20 1F 53 4C 00 50
}
7AE6 { <---- another lot of changes start here
EA EA EA
}
-----------------------------------------------------
That is about all you need to know about the patch. However here are
all the gory details for those that are interested.
7ae6 ea NOP ; don't clear page 3
7ae7 ea NOP ; don't clear page 3
7ae8 ea NOP ; don't clear page 3
7b58 a2 00 LDX #$00
7b5a ad 00 08 LDA SWITCH
7b5d 29 01 AND #$01 ; Is right coin switch down?
7b5f f0 02 BEQ L7b63 ; branch if is
7b61 a2 3c LDX #$3c
7b63 a9 00 L7b63 LDA #$00
7b65 9d 00 03 L7b65 STA hiscore,X ; clear all or most of page 3
7b68 e8 INX
7b69 d0 fa BNE L7b65
7b6b a2 0F LDX #$0F ; number of bytes to clear
7b6d 9d 0E 03 L7b6d STA D30E,X ; clear score
7b70 9d 2C 03 STA D32C,X ; clear initial
7b73 ca DEX
7b74 d0 f7 BNE L7b6d
7b76 20 1f 53 JSR init34X ; carry on as before
7b79 4c 00 50 JMP L5000 ; carry on as before
....
....
7b9d Free space down to this location (inclusive).
The top ten scores are each stored in 3 BCD bytes starting at location 0x0300
in the RAM (the score is multiplied by 1000 when it is displayed). This
section is then followed by the top ten initials (3 bytes each).
0x300 Score 1
0x303 Score 2
0x306 Score 3
....
0x31B score 10
0x31E Initials 1
0x321 Initials 2
....
0x339 Initials 10
KNOWN PROBLEMS
--------------
The main problem with this patch is that I haven't had a look at the test mode
code yet, and because the data in ROM 409 has been changed the Battlezone
test mode spots this and complains. This will not effect normal operation
but if you put the ROM into test mode you will have problems.
I may just be a case of juggling the checksums for the ROM so they match
the original ones, or it may be more complicated. Also the test mode
might mess with our score locations (while it is testing the RAM).
I'll be looking into this problem and will post a new patch that will
pass test mode when I've figured it out (or someone has beaten me to it).
Until then simply don't enter testmode. If you really need to check things
out then put the original ROM (and SRAM) back in first.
BATTERY LIFETIME
----------------
The 48Z02 spec says the lifetime of the battery is almost independent
of the amount of time the chip is its backup mode. The lifetime is dependent
solely on the temperature. An average chip will have a battery lifetime of
20 years at 70 degrees C. Also 99% of chips will have a lifetime of 11 years
at 70 degress C.
THE FUTURE
----------
There are loads of possibilities for future enhancements that I have discussed
with various folks.
*) I still had about 30 bytes ROM space left over after the fix, and it would
be possible to use this space to initialize the lower scores to something
other than zero. I quite liked the blank zero entries so I left it that way.
*) Rather than the top 5 scores being reset, the user could select how many
scores are saved using the DIP switches. Unfortunately there aren't enough
spare switches in Battlezone, but we could hi-jack the language setting
switches (which would also free up buckets of ROM space).
*) As *ALL* the Program RAM is saved, it might be possible in implement a pause
game feature. You could switch your machine off and then resume when
it was switched back on again.
*) Remember the address line A10 on the new SRAM? We tied it to gnd? Well
it is probably possible to tie the pin straight through and double
the amount of program RAM available for future patches. The decode appears
to be alright and there appears to be room in the memory map but I
haven't tried it yet.
*) What other games could do with a similar fix? Well if you send me the
schematics :-) who knows what we might be able to do. I tried to make
the fix described above as general as possible by explaining each stage
in detail, but it's not easy to do when describing a specific fix.
Hopefully there may be very similar fixes for other boards. I for one
would be interested to hear what other boards people manage to apply
this principle to.
"Share and enjoy"
* John Keay ! Texas Instruments Ltd. *
* keay@tiuk.ti.com ! Bedford, U.K. *
* Disclaimer: All opinions expressed herein are personal. etc etc *
> I recently acquired an upright BattleZone and was wondering if you had made
>any updates to the BattleZone high score memory conversion before I start on
>it.
Go nice and easy on your board and remember to make it so it can simply
be removed.
I did post an upgrade that got around the problems with test mode, I
suspect you may have the version of the modification without the upgrade.
Good luck, let me know how things go.
-----------------------------------------------
> KNOWN PROBLEMS
> --------------
>
> The main problem with this patch is that I haven't had a look at the test mode
> code yet, and because the data in ROM 409 has been changed the Battlezone
> test mode spots this and complains. This will not effect normal operation
> but if you put the ROM into test mode you will have problems.
>
> I may just be a case of juggling the checksums for the ROM so they match
> the original ones, or it may be more complicated. Also the test mode
> might mess with our score locations (while it is testing the RAM).
> I'll be looking into this problem and will post a new patch that will
> pass test mode when I've figured it out (or someone has beaten me to it).
>
> Until then simply don't enter testmode. If you really need to check things
> out then put the original ROM (and SRAM) back in first.
Anyway here is a version of the patch that will remember the top 3
scores, pass test mode and not corrupt your scores during test mode.
7800 <---- Starting address for ROM 036-409
7FFF <---- End address for ROM 036-409
7b58 { <- location of 1st part of patch
A2 3C A9 00 9D 00 03 E8 D0 FA A0 0A AD 00 08 29 01
F0 02 A0 07 A2 1B A9 16 9D 1E 03 9D 1F 03 9D 20 03
A9 05 9D 00 03 A9 00 9D 02 03 9D 01 03 CA CA CA 88
D0 E2 20 1F 53 4C 00 50 7D
}
7AE6 { <- location of 2nd part of patch
EA EA EA
}
7C71 { <- location of 3rd part of patch
03
}
Here are the details:
This version permanently preserves the top 3 high scores, and
initailizes the others to "5000 AAA" (unless the right coin
switch is held down during powerup/reset, when it will set all
10 entries to "5000 AAA").
All the bytes in a each Battlezone ROM need to XOR to 0xFF for the ROM
to pass test mode (This is what the 0x7D does at the end of the 1st
section above).
I have prevented the code from checking page 3 (addresses
0x300-0x3FF) during test mode because this scribbles over
the high score locations. But all the checks for the other
areas of RAM are still in there.
Regards, John.
* John Keay ! TMS320C80 design *
* work: keay@tiuk.ti.com ! Texas Instruments Ltd. *
* home: john@keay.demon.co.uk ! Northampton, U.K. *
* Disclaimer: All opinions expressed herein are personal. etc etc *
