Famicom Network System
From NESdev Wiki
Jump to navigationJump to search
System Overview
The Famicom Network System is a complicated device with its own memory mapping system and internal CPU. The RF5C66 chip provides the main mapper functionality, delegating its own registers at $40A0, RF5A18 Famicom registers at $40D0, an internal Kanji ROM at $5000, an internal 8kByte W-RAM at $6000. It also controls the bank of a built-in 16kByte CHR-RAM.
The RF5A18 contains CPU2, which is a 65C02 processor with its own independent CPU clock. It has a built-in 4kByte ROM. This chip is responsible for controlling the modem communications. It communicates with the Famicom CPU through four bidirectional registers at $40Dx.
The Famicom Network System plugs into the Famicom through its cartridge connector and provides the user a ZIF style slot to insert a "card". The card is similar to a normal cartridge but does not have access to any PPU signals. Commercial cards are observed to have their own MMC1 memory mapper, which does not interfere with any of the registers of the Famicom Network System. The CPU data bus is routed through the RF5C66 chip before making it to the card, possibly acting just as a bidirectional buffer / signal conditioner. It is unknown what other reason the data bus would be passed through the RF5C66 like that. Older revisions of Famicom Network System buffered the Famicom address bus with 74HC541 chips, so it is plausible that this function is literally just a bidirectional buffer integrated into the RF5C66.
LH5323M1 Kanji Graphic ROM
The LH5323M1 is a 256kByte graphics ROM containing primarily Kanji data that is mapped at $5000-5FFF. Each index in this range is a 32-byte space containing 16x16 1bpp graphics, usually for a single character, and each read automatically advances to the next byte in the sequence. There are 2 128kByte banks, and the low bank is default at power-on. Writing 1 to $40B0.0 selects the high bank. Reading from $40B0 resets to the beginning of the 32-byte sequence. Writing $40B0 does not reset the sequence however. No values written to $40B0 have been observed to arbitrarily change or reset the position in the sequence.
Expansion Audio
The Famicom Network System does have expansion audio capabilities. The Famicom audio is routed through the modem module, but nowhere directly to either of the large ASICs. Dial tones have been observed through the television speakers. It is unlikely but unknown if there are other possible sources of sound.
Disk Drive Support
According to a block diagram with potentially dubious origins, the RF5C66 chip contains a disk drive controller. Similar design in several ways to the Famicom Disk System, it is suspected that a disk drive can be connected to the expansion port and controlled by the RF5C66. Since this feature was never used, it is unknown how to use or activate it, or even if that feature is fully implemented. The original FDS has a large DRAM that is not present as a discrete chip in the Famicom Network System. It is unknown if such a DRAM could be already integrated into the RF5C66, or could be attached externally and simply not populated, or if a special card was to be constructed containing this RAM. All original FDS registers are notably absent and all discovered registers start immediately after where the FDS registers would normally be. There is no obvious path to produce FDS expansion audio. This remains a mystery presently.
One possibility if the RF5C66 follows a similar pinout to the FDS RP2C33:
79 / -> Exp P3-2 (reg unknown) Serial Out (observed 95.95kHz)
78 / <- Exp P3-3 (reg unknown) Serial In
77 / -> Exp P3-4 (!$40A4.2) Read / Write
76 / -> Exp P3-5 (!$40A4.1) Reset Transfer Timing
75 / -> Exp P3-6 ($40A3.0) Turn on Motor
74 / <- Exp P3-7 ($40A5.2) Write Protect
73 / <- Exp P3-8 ($40A5.1) Disk Not Ready
72 / <- Exp P3-9 ($40A5.0) Disk Missing
71 / <- Exp P3-11 ($40A5.7) Battery Health
Memory Map
+================+ $0000 - NES internal RAM | NES internal | | RAM | +----------------+ $0800 | (Mirrors of | | $0000-$07FF) | +================+ $2000 - NES PPU Registers | NES PPU | | Registers | +----------------+ $2008 | (Mirrors of | | $2000-$2007) | +================+ $4000 - NES APU, IO, and Test Registers | NES APU and IO | | Registers | +----------------+ $4018 | NES Test Mode | | Registers | +----------------+ $4020 | (Open Bus) | +================+ $40A0 - Famicom Modem Registers | Famicom Modem | | RF5C66 | | Registers | +----------------+ $40D0 | Famicom Modem | | RF5A18 | | Registers | +----------------+ $40D8 | (Mirror of | | $40D0-$40D7) | +----------------+ $40E0 | (Open Bus) | +----------------+ $4100 | (Open Bus) | +----------------+ $41A0 | (Mirror of | | $40A0-$40FF) | +----------------+ $4200 | (Mirrors of | | $4100-$41FF) | +================+ $5000 - Famicom Modem Kanji ROM | Famicom Modem | | LH5323M1 | | Kanji ROM | +================+ $6000 - Famicom Modem Internal RAM | Famicom Modem | | Internal RAM | +================+ $8000 - Famicom Modem Card Space | | | Card Space | | | +================+ $10000
Known Registers
Note: All registers available to the Famicom ignore address bits 8-11 because those bits are not physically connected to the RF5C66. Therefore, register $4xA0 has mirrors that exist at $40A0, $41A0 ... $4FA0. For simplicity, this page shows all registers as the $40xx mirror.
| Address | Read Has Effect |
Read Has Data |
Write | Owner | Function |
|---|---|---|---|---|---|
| $40A1 | Unknown | Yes | Unknown | RF5C66 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown
|
| $40A2 | Yes | Yes | Unknown | RF5C66 | IRQ Acknowledge, similar to FDS register $4030
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Timer Interrupt (1: an IRQ occurred) ||||||+--- Bit exists but function is unknown ||||++---- Bits not shown to exist ++++------ Bits exist but function is unknown
|
| $40A3 | Unknown | No | Yes | RF5C66 | Unknown Function.
Write 76543210 |||||||+-- EXP 6 = $40A3.0 (POR value = 0) +++++++--- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40A4 | Unknown | No | Yes | RF5C66 | Expansion Port Control
Write 76543210 |||||||+-- (unknown) ||||||+--- EXP 5 = !($40A4.1) (POR value = 0) |||||+---- EXP 4 = !($40A4.2) (POR value = 0) +++++----- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40A5 | Unknown | Yes | Unknown | RF5C66 | Expansion Port Input Data
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Input value of EXP 9 ||||||+--- Input value of EXP 8 |||||+---- Input value of EXP 7 |++++----- Bits not shown to exist +--------- Input value of EXP 11
|
| $40A6 | Unknown | Yes | Yes | RF5C66 | M2 Cycle Counter LSB, similar to FDS register $4020
Write 76543210 ++++++++-- Cycle counter reload value (LSB) Read 76543210 ++++++++-- Cycle counter present value (LSB)
|
| $40A7 | Unknown | Yes | Yes | RF5C66 | M2 Cycle Counter MSB, similar to FDS register $4021
Write 76543210 ++++++++-- Cycle counter reload value (MSB) Read 76543210 ++++++++-- Cycle counter present value (MSB)
|
| $40A8 | Unknown | No | Yes | RF5C66 | IRQ Control, similar to FDS register $4022
Write 76543210 |||||||+-- IRQ Repeat Flag ||||||+--- IRQ Enable ++++++---- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40A9 | Yes | Yes | Unknown | RF5C66 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown
|
| $40AA | No | Yes | Unknown | RF5C66 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown
|
| $40AB | Yes | No | Yes | RF5C66 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40AC | Yes | No | Unknown | RF5C66 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40AD | Unknown | Yes | Yes | RF5C66 | Mirroring Control
Write
76543210
|+++++++-- (unknown)
+--------- Mirroring (POR value = 0)
0 = Vertical Mirroring (CIRAM A10 = PPU A10)
1 = Horizontal Mirroring (CIRAM A10 = PPU A11)
Read
76543210
|+++++++-- Bits not shown to exist
+--------- Present value of CIRAM A10
|
| $40AE | Unknown | No | Yes | RF5C66 | Unknown Function.
Write 76543210 |||||||+-- Built-in RAM /CE control (POR value = 1) ||||||| 1 = Built-in RAM /CE enabled to go low for reads and writes in the range $6000-7FFF. ||||||| Pin 5C66.28 = 1 at all address ranges. (This pin normally n/c.) ||||||| 0 = Built-in RAM /CE is always high, preventing all reads and writes of the built-in RAM. ||||||| Pin 5C66.28 = 0 at all address ranges. (This pin normally n/c.) +++++++--- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40B0 | Yes | No | Yes | RF5C66 | Kanji Graphic ROM Control
Write 76543210 |||||||+-- Kanji ROM Bank Select (POR value = 0) +++++++--- (unknown) Read 76543210 ++++++++-- Bits not shown to exist
|
| $40B1 | Unknown | Yes | Yes | RF5C66 | Modem Control
Write 76543210 |||||||+-- Modem Module pin 29 = $40B1.0, rises slowly, goes low fast (POR value = 1) ||||||+--- Modem Module pin 32 = $40B1.1, rises slowly, goes low fast (POR value = 1) |||||+---- Modem Module pin 31 = $40B1.2, rises slowly, goes low fast (POR value = 1) ||||+----- Pin 5C66.68: CPU2 Reset on new revision Famicom Network Systems (POR value = 1) |||| CPU2 /Reset = !($40B1.3) |||| CPU2 runs when $40B1.3 = 0. |||| See also $40C0.2. |||+------ Exp 15 = $40B1.4, rises slowly, goes low fast (POR value = 1) ||+------- Exp 14 = $40B1.5, rises slowly, goes low fast (POR value = 1) |+-------- Exp 13 = $40B1.6, rises slowly, goes low fast (POR value = 1) +--------- Exp 12 = $40B1.7, rises slowly, goes low fast (POR value = 1) Read 76543210 |||||||+-- Input value of Modem Module pin 29 ||||||+--- Input value of Modem Module pin 32 |||||+---- Input value of Modem Module pin 31 ||||+----- Input value of 5C66 pin 63 (normally n/c) |||+------ Input value of EXP 15 ||+------- Input value of EXP 14 |+-------- Input value of EXP 13 +--------- Input value of EXP 12
|
| $40C0 | Unknown | Yes | Yes | RF5C66 | CIC Status, CHR Bank, and RAM Control
Write
76543210
|||||||+-- Pin 5C66.35 = $40C0.0 (POR value = 0)
||||||| RAM +CE Enable (1 = enabled, 0 = disabled)
||||||+--- Pin 5C66.36 = $40C0.1 (POR value = 0)
|||||| (This pin normally n/c)
|||||+---- Pin 5C66.37 = $40C0.2 (POR value = 0)
||||| Old Revision Famicom Network System: CPU2 /Reset (This pin n/c on newer revisions)
||||| CPU2 runs on old revisions when $40C0.2 = 1.
||||| See also $40B1.3.
||||+----- Pin 5C66.38 = $40C0.3 (POR value = 0)
|||| CHR-RAM Bank Select
++++------ (unknown)
Read
76543210
|||||||+-- Input value of pin 5C66.31:
||||||| Host CIC /Reset
||||||+--- Input value of pin 5C66.32:
|||||| Host CIC /Fail
|||||+---- Input value of pin 5C66.33:
||||| CPU2 /Reset
||||+----- Input value of pin 5C66.34:
|||| Selected CHR RAM Bank
|+++------ Bits not shown to exist
+--------- Input value of pin 5C66.29:
Filtered Host CIC +Start
|
| $40D0 | Unknown | Yes | Yes | RF5A18 | Famicom CPU <-> CPU2 Interface, Data Byte 0
Write 76543210 ++++++++-- 8-bit value written here can be read by CPU2 from register $4123. Read 76543210 ++++++++-- 8-bit value read here was written by CPU2 to register $4123.
|
| $40D1 | Unknown | Yes | Yes | RF5A18 | Famicom CPU <-> CPU2 Interface, Data Byte 1
Write 76543210 ++++++++-- 8-bit value written here can be read by CPU2 from register $4124. Read 76543210 ++++++++-- 8-bit value read here was written by CPU2 to register $4124.
|
| $40D2 | Unknown | Yes | Yes | RF5A18 | Famicom CPU <-> CPU2 Interface, Data Byte 2
Write 76543210 ++++++++-- 8-bit value written here can be read by CPU2 from register $4125. Read 76543210 ++++++++-- 8-bit value read here was written by CPU2 to register $4125.
|
| $40D3 | Unknown | Yes | Yes | RF5A18 | Famicom CPU <-> CPU2 Interface, Data Acknowledge
Write 76543210 |||+++++-- (unknown) +++------- 3-bit value written here can be read by CPU2 from register $4122. Read 76543210 |||+++++-- Bits not shown to exist +++------- 3-bit value read here was written by CPU2 to register $4122.
|
| $40D4 | Unknown | Yes | Yes | RF5A18 | Unknown Function.
Write 76543210 |||||||+-- RF5A18 Pin 65 (Exp 17) = $40D4.0 (enables internal pull-up?) ||||||+--- RF5A18 Pin 67 (Exp 19) = $40D4.1 (output value is driven) |||||+---- RF5A18 Pin 66 (Exp 18) = $40D4.2 (enables internal pull-up?) +++++----- (unknown) Read 76543210 |||||||+-- $40D4.0 = input value of RF5A18 Pin 65 (Exp 17) ||||||+--- $40D4.1 = output value of RF5A18 Pin 67 (Exp 19) |||||+---- $40D4.2 = input value of RF5A18 Pin 66 (Exp 18) ||||+----- $40D4.3 = input value of RF5A18 Pin 69 (Tone Rx D1) |||+------ $40D4.4 = input value of RF5A18 Pin 70 (Tone Rx D2) ||+------- $40D4.5 = input value of RF5A18 Pin 71 (Tone Rx D4) |+-------- $40D4.6 = input value of RF5A18 Pin 72 (Tone Rx D8) +--------- $40D4.7 = input value of RF5A18 Pin 73 (Tone Rx DV)
|
| $40D5 | Unknown | Yes | Unknown | RF5A18 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ||++++++-- Bits exist but function is unknown ++-------- Bits not shown to exist
|
| $40D6 | Unknown | Yes | Unknown | RF5A18 | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||+++-- Bits exist but function is unknown ||||+----- Bit 3 = A complicated logic involving at least 3 of the bits written by CPU2 to $4113 |||+------ Bit 4 = Inverse of value written by CPU2 to $4113.7 ||+------- Bit 5 = Inverse of value written by CPU2 to $4113.6 ++-------- Bits not shown to exist
|
RF5A18 Internal 65C02 CPU
The RF5A18 contains its own CPU, termed "CPU2" on this page. It is a 65C02 supporting bitwise set/clear/branch instructions. Note that CPU2 has its own parallel execution with its own address and data busses that are not available to the Famicom's CPU. CPU2 also has its own clock source, so it does not execute synchronously with the Famicom CPU. This section describes CPU2's own memory mapping and its own internal registers.
CPU2 /Reset is controlled 2 different ways depending on the revision of Famicom Network System. To support all revisions when enabling CPU2, both of these bits should be written:
- $40B1.3 = 0 (new revisions Famicom Network System, and old revisions with J1 closed)
- $40C0.2 = 1 (old revisions Famicom Network System with J2 closed)
CPU2 Memory Map
+================+ $0000 | CPU2 RAM | | (U6) | +================+ $2000 | (Returns | | last fetch) | +================+ $4100 | CPU2 Control | | Registers | +================+ $4140 | (Returns | | last fetch) | +================+ $C000 | (Open Bus) | | | +================+ $E000 | RF5A18 | | Internal ROM | +================+ $10000
CPU2 Known Registers
| Address | Read Has Effect |
Read Has Data |
Write | Function |
|---|---|---|---|---|
| $4100 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4101 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4102 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 |||||||+-- (unknown) ||||||+--- Bit exists but function is unknown. ++++++---- (unknown) Read 76543210 ++++++++-- (unknown)
For reference:
|
| $4103 | Yes | Yes | Unknown | NMI Acknowledge
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown +++++++--- (unknown)
For reference:
|
| $4104 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4105 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4106 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4107 | Yes | Yes | Unknown | IRQ Acknowledge
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- (unknown) ||||||+--- Bit exists but function is unknown ++++++---- (unknown)
For reference:
|
| $4110 | Unknown | Yes | Yes | Modem Rx/Tx Data Byte
Write 76543210 ++++++++-- Modem Tx Data Byte Read 76543210 ++++++++-- Modem Rx Data Byte
For reference:
|
| $4111 | Unknown | Yes | Yes | Unknown Function.
Write 76543210 |+++++++-- (unknown) +--------- Pin 90 (Modem TXD) = !($4111.7) Read 76543210 ++++++++-- Bits exists but function is unknown For reference:
|
| $4112 | Unknown | Yes | Yes | Unknown Function.
Write 76543210 |||||||+-- Bit exists but function is unknown |++++++--- (unknown) +--------- $4112.7 = $4110 Modem Rx Data IRQ Acknowledge, 1 = Acknowledge IRQ. Read 76543210 |||||||+-- $4112.0 = $4110 Modem Rx Data IRQ Flag, 1 = IRQ Pending. ||||||+--- $4112.1 = $4110 Modem Tx Ready Flag, 1 = byte can be written. ++++++---- Bits exist but function is unknown
For reference:
|
| $4113 | Unknown | Yes | Yes | Unknown Function.
Write 76543210 ||++++++-- (unknown) ++-------- Bits exist but function is unknown Read 76543210 ++++++++-- Bits exist but function is unknown
For reference:
|
| $4114 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4120 | Unknown | Yes | Yes | Unknown Function.
Write 76543210 |||||||+-- Pin 39 (Modem AD0) = $4120.0 ||||||+--- Pin 38 (Modem AD1) = $4120.1 |||||+---- Pin 37 (n/c) = $4120.2 ||||+----- Pin 36 (Modem /RD) = $4120.3 |||+------ Pin 35 (Modem /WR) = $4120.4 ||+------- Pin 34 (Modem EXCLK) = $4120.5 |+-------- Pin 32 (Modem Data): Direction = $4120.6: 1 = input, 0 = output (refer to $4121.0) +--------- (unknown) Read 76543210 |+++++++-- Bits exist but function is unknown +--------- $4120.7 = Pin 33 (Modem /INT) For reference:
|
| $4121 | Unknown | Yes | Yes | Unknown Function.
Write 76543210 |||||||+-- Pin 32 (Modem Data) = $4121.0 when set as output (refer to $4120.6) +++++++--- (unknown) Read 76543210 ++++++++-- Bits exist but function is unknown For reference:
|
| $4122 | Unknown | Yes | Yes | Famicom CPU <-> CPU2 Interface, Data Acknowledge
Write 76543210 |||+++++-- (unknown) +++------- 3-bit value written here can be read by Famicom CPU from register $40D3. Read 76543210 |||+++++-- (unknown) +++------- 3-bit value read here was written by Famicom CPU to register $40D3.
For reference:
|
| $4123 | Unknown | Yes | Yes | Famicom CPU <-> CPU2 Interface, Data Byte 0
Write 76543210 ++++++++-- 8-bit value written here can be read by Famicom CPU from register $40D0. Read 76543210 ++++++++-- 8-bit value read here was written by Famicom CPU to register $40D0.
For reference:
|
| $4124 | Unknown | Yes | Yes | Famicom CPU <-> CPU2 Interface, Data Byte 1
Write 76543210 ++++++++-- 8-bit value written here can be read by Famicom CPU from register $40D1. Read 76543210 ++++++++-- 8-bit value read here was written by Famicom CPU to register $40D1.
For reference:
|
| $4125 | Unknown | Yes | Yes | Famicom CPU <-> CPU2 Interface, Data Byte 2
Write 76543210 ++++++++-- 8-bit value written here can be read by Famicom CPU from register $40D2. Read 76543210 ++++++++-- 8-bit value read here was written by Famicom CPU to register $40D2.
For reference:
|
| $4126 | Unknown | Yes | Unknown | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- $4126.0 = Pin 47 (+5V) ||||||+--- $4126.1 = !(Pin 48) (+5V) |||||+---- $4126.2 = Pin 49 (from 5C66-69) ||||+----- $4126.3 = Pin 51 (Switch SW1-2) |||+------ $4126.4 = Pin 52 (Switch SW1-4) ||+------- $4126.5 = Pin 53 (Modem P4-25) |+-------- $4126.6 = Pin 54 (Modem P4-28) +--------- $4126.7 = Pin 55 (Modem P4-23) For reference:
|
| $4127 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 |||||||+-- Pin 56 (Modem Reset) = $4127.0 ||||||+--- Pin 57 (Red LED) = $4127.1 |||||+---- Pin 58 (Green LED) = $4127.2 ||||+----- Pin 59 (n/c) = $4127.3 |||+------ Pin 60 (Modem P4-27) = $4127.4 ||+------- Pin 61 (Modem Audio Enable) = $4127.5 |+-------- Pin 62 (Modem P4-21) = $4127.6 +--------- Pin 63 (Modem P4-19) = $4127.7 Read 76543210 ++++++++-- (unknown) For reference:
|
| $4128 | Unknown | Yes | Yes | Unknown Function.
Write 76543210 |||||||+-- Pin 68 (Tone Rx GT) = $4128.0 +++++++--- (unknown) Read 76543210 |||||+++-- (unknown) ||||+----- $4128.3 = Pin 69 (Tone Rx D1) |||+------ $4128.4 = Pin 70 (Tone Rx D2) ||+------- $4128.5 = Pin 71 (Tone Rx D4) |+-------- $4128.6 = Pin 72 (Tone Rx D8) +--------- $4128.7 = Pin 73 (Tone Rx DV) For reference:
|
| $4129 | Unknown | Unknown | Yes | P5 Expansion Port
Write 76543210 ||||++++-- Data nybble written to device attached to P5 connector. ||++------ Used for sequencing writes to the device. ++-------- (unknown) Read 76543210 ||++++++-- Controlled by device attached to P5 connector, though the ROM code never reads it. ++-------- Not used
For reference:
|
| $412F | Unknown | Yes | Yes | Unknown Function.
Write 76543210 |||||||+-- Bit exists but function is unknown, related to interrupt. ||+++++--- (unknown) ++-------- Bits exist but function is unknown Read 76543210 |||||||+-- Bit exists but function is unknown |||||++--- (unknown) ||||+----- Bit exists but function is unknown |||+------ $412F.4 = !(Pin 33) (Modem /INT) ||+------- Bit exists but function is unknown |+-------- $412F.6 is an IRQ flag. 1 = IRQ pending. +--------- Bit exists but function is unknown
For reference:
|
| $4130 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4131 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4132 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4133 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4134 | Unknown | Yes | Unknown | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown +++++++--- (unknown) For reference:
|
| $4135 | Unknown | Yes | Unknown | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 |||||||+-- Bit exists but function is unknown +++++++--- (unknown) For reference:
|
| $4136 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
| $4137 | Unknown | Unknown | Yes | Unknown Function.
Write 76543210 ++++++++-- (unknown) Read 76543210 ++++++++-- (unknown) For reference:
|
Communication Between Famicom and CPU2
Registers $40D0, $40D1, $40D2, and $40D3 are used for communication between Famicom and CPU2. One would tend to expect the Famicom to receive the same value from any of these four registers if read back right after writing. However, each register is actually a separate register in each direction. The Famicom only controls the value read by CPU2, and CPU2 only controls the value read by the Famicom. It may be that CPU2 echoes the value back in some cases, but don't be fooled.
Data packets are sent in both directions between the Famicom and CPU2 using these registers. The data flow is controlled by status and acknowledge flags in $40D3, and data is sent 3 bytes at a time using registers $40D0, $40D1, and $40D2. When CPU2 receives each 3-byte chunk, it buffers it in its RAM starting at address $0401 until the full message has been received. The maximum message length is at most 255 bytes, possibly less.
Each message starts with a command byte, followed by a byte count. The byte after the byte count is not used and not counted towards the byte count in most commands. There are a total of 25 command bytes, which are stored in a lookup table at CPU2 ROM address $FB52. The index of this lookup table corresponds to the index of a function pointer table at address $FBB2, and a command mode support bitfield table at address $FB6B. This is how CPU2 efficiently directs to a unique message handler function for each command byte. The mode bitfield checks against the mode byte at $0051. It is probably used for enforcing the correct sequence of commands, as the command handlers themselves seem to be a major contributor changing the mode. It seems there are 6 possible modes: 0, 1, 2, 3, 4, and 5, though command $03 is set to support modes 6 and 7 as well. The mode may actually represent a global state machine, such as 0 = disconnected, 1 = dialing, etc.
CPU2 Commands
Commands Read by the Famicom from CPU2
| Command Byte |
Description |
|---|---|
| $80 | This command is received by the Famicom in response to writing to command $00. (See next section for details.) |
| $83 | This command is received by the Famicom in response to writing to command $03. (See next section for details.) |
| $92 | This command is received by the Famicom in response to writing to command $12. (See next section for details.) |
| $C0 | [$C0] [count=N] [parameter] [...N bytes...]
|
| $C1 | Tone Rx Data Packet.
When the packet only contains 1 nybble: [$C1] [count=$01] [$80] [tone Rx nybble]
[$C1] [count=N] [parameter] [tone Rx bytes]
|
| $E1 | This command indicates that CPU2 had a failure receiving a command from the Famicom.
Command from Famicom that failed due to invalid command byte, or a command not supported in the present mode: Message from Famicom: [invalid command] [count] [byte 0] [byte 1] ... Response back to Famicom: [$E1] [count=$03] [?] [$00] [invalid command] [byte 1]
Message from Famicom: [command] [invalid count] [byte 0] [byte 1] ... Response back to Famicom: [$E1] [count=$03] [$00] [$01] [command] [byte 1] |
| $F0 | This command is received by the Famicom in response to writing to command $7C. (See next section for details.) |
Commands Written by the Famicom to CPU2
Note that most descriptions are incomplete.
| Command Byte |
CPU2 Handler Address |
Byte Count Expected |
Modes Supported |
Description |
|---|---|---|---|---|
| $00 | $F43A | >= 0 <= 60 |
0 | Unknown Function.
Message Bytes: [$00] [count=N] [xx] [...N bytes...] Response: [$80] [count=$01] [$00] [status byte]
Response:
|
| $01 | $F46C | 1 | 2 | Unknown Function.
Message Bytes: [$01] [count=$01] [xx] [parameter]
|
| $02 | $F48A | 2 | 0 | Unknown Function.
Message Bytes: [$02] [count=$02] [xx] [parameter 0] [parameter 1]
|
| $03 | $F4BB | 0 | 0,1,2,3, 4,5,6,7 |
Unknown Function.
Message Bytes: [$03] [count=$00] Response: [$83] [count=$0A] [$00] [ROM revision] [ROM checksum MSB] [ROM checksum LSB] [byte 4] ... [byte 10]
|
| $10 | $F71A | 40 | 0,2,5 | Unknown Function.
Message Bytes: [$10] [count=$28] [parameter] [...40 bytes...]
|
| $11 | $F75C | 127 | 0,2,5 | Unknown Function.
Message Bytes:
[$11] [count=$7F] [...5 byte chunk...] [...41 byte chunk 0...]
[...41 byte chunk 1...] [...41 byte chunk 2...]
|
| $12 | $F773 | >= 3 <= 252 |
0,2,5 | CRC Calculator
Message Bytes: [$12] [count=N] [key 0] [key 1] [key 2] [...N-2 bytes...] Response: [$92] [count=$02] [$00] [CRC 2] [CRC 1]
|
| $40 | $F7AF | >= 1 <= 252 |
2 | Unknown Function.
Message Bytes: [$40] [count=N] [xx] [...N-1 bytes...]
|
| $41 | $F7D0 | >= 1 <= 100 |
5 | Unknown Function.
Message Bytes: [$41] [count=N] [xx] [...N bytes...]
|
| $60 | $F829 | 6 | 0 | Unknown Function.
Message Bytes: [$60] [count=$06] [...6 data bytes...]
|
| $61 | $F839 | 0 | 1,3,4 | Disconnect
Message Bytes: [$61] [count=$00]
|
| $62 | $F849 | 1 | 0,2,5 | Unknown Function.
Message Bytes: [$62] [count=$01] [xx] [parameter]
|
| $63 | $F887 | 0 | 0,1,2,3, 4,5 |
NOP Command
Message Bytes: [$63] [count=$00]
|
| $64 | $F88D | 1 | 0,2,5 | Modem P4-27 Control
Message Bytes: [$64] [count=$01] [xx] [P4-27 mode]
|
| $65 | $F89D | 2 | 0,2,5 | Modem P4-21 and P4-19 Control
Message Bytes: [$65] [count=$02] [xx] [P4-21 mode] [P4-19 mode]
|
| $66 | $F8B7 | 2 | 0,2,5 | LED Control
Message Bytes: [$66] [count=$02] [xx] [red LED mode] [green LED mode]
|
| $67 | $F8D1 | 2 | 0,5 | Unknown Function.
Message Bytes: [$67] [count=$02] [xx] [parameter 0] [parameter 1]
|
| $68 | $F912 | 1 | 0,5 | Unknown Function.
Message Bytes: [$68] [count=$01] [xx] [parameter]
|
| $69 | $F951 | 10 | 0 | Unknown Function.
Message Bytes: [$69] [count=$0A] [xx] [...10 data bytes...]
|
| $6A | $F96F | 80 | 0,2,5 | Unknown Function.
Message Bytes: [$6A] [count=$50] [xx] [...40 byte chunk 0...] [...40 byte chunk 1...]
|
| $7B | $F994 | No Check |
0,1,2,3, 4,5 |
Software Reset
Message Bytes: [$7B] [count=xx] [xx]
|
| $7C | $F9AC | 5 | 0,1,2,3, 4,5 |
Arbitrary Memory Read
Message Bytes: [$7C] [count=$05] [key 0] [key 1] [key 2] [address MSB] [address LSB] [read count N] Response: [$F0] [read count N] [$00] ...N bytes from memory...
|
| $7D | $F9D9 | >= 5 | 0,1,2,3, 4,5 |
Arbitrary Memory Write
Message Bytes: [$7D] [count=N] [key 0] [key 1] [key 2] [address MSB] [address LSB] [...N-4 bytes...]
.org $0104
.dd2 T0109 ;Wrote over Main Super-loop Function Pointer, now executes code below.
.dd2 TE006 ;Wrote over IRQ Handler Function Pointer, now immediately exits IRQ.
.dd1 $16 ;Satisfy periodic checksum of bytes $102-109.
T0109 ldx #$90 ;Arbitrary code inserted.
lda $29
beq L0115
cmp #$ff
bne L0117
ldx #$01
L0115 stx $29
L0117 jmp $f420 ;Continue to original main super-loop.
; Code Below Existing In CPU2 ROM:
.org $e006
TE006 jmp TE502
.org $e502
TE502 ply ;Return from IRQ.
plx
pla
rti
|
| $7E | $F9FE | 5 | 0,1,2,3, 4,5 |
Unknown Function.
Message Bytes: [$7E] [count=$05] [key 0] [key 1] [key 2] [parameter 0] [parameter 1] [parameter 2]
|
| $7F | $FA16 | 5 | 0,1,2,3, 4,5 |
Unknown Function.
Message Bytes: [$7F] [count=$05] [key 0] [key 1] [key 2] [parameter 0] [parameter 1] [parameter 2]
|
CPU2 Commands with CRC key bytes
CPU2 Commands $12, $7C, $7D, $7E, and $7F use CRC key bytes [key 0], [key 1], and [key 2] to validate the message. The same chunk of code used for verifying the key bytes can also be used to generate them, given that [key 0] = $00. Command $7F is unique in that [key 0] may need to be a value other than $00.
CPU2 has 5 internal bytes that work together with the key bytes. When beginning a CRC calculation, these bytes are seeded as follows:
crc1 = #$35 crc2 = #$AC crc3 = #$43 crc4 = #$83
Then crc0 is loaded directly from the last byte of the message, which is referenced via the [count] byte. The crc function is run, which updates crc1 and crc2. This process is repeated leftwards for each byte in the message, up to and including [key 0]. Once completed with [key 0], the result is successful if crc1 and crc2 both = #$00.
It is simple to generate the correct [key 1] and [key 2] values given that [key 0] = #$00. Running the same same exact process and simply stopping before proceeding to [key 2], the values of crc1 and crc2 are the correct values for [key 1] and [key 2], respectively. This behavior is in common with standard CRC computations.
Here is the the crc function, directly from CPU2 ROM:
CRC_CALC: pha ; Byte from message is passed in through A.
phx
sta CRC_0
ldx #$08
next_bit lda CRC_0
eor CRC_2
lsr A
lda CRC_3
bcs LE095
lda #$00
LE095 eor CRC_1
sta CRC_1
lda CRC_4
bcs LE09F
lda #$00
LE09F eor CRC_2
sta CRC_2
ror CRC_1
ror CRC_2
lsr CRC_0
dex
bne next_bit
plx
pla
rts
Here is the function rewritten in C:
void crc_calc(uint8_t crc0)
{
uint32_t shifty;
for (int i = 0; i < 8; i++)
{
if ((crc0 ^ crc2) & 1)
{
shifty = 1u << 16;
crc1 ^= crc3;
crc2 ^= crc4;
}
else
{
shifty = 0;
}
shifty |= ((uint32_t)crc1) << 8;
shifty |= (uint32_t)crc2;
crc1 = (uint8_t)(shifty >> 9);
crc2 = (uint8_t)(shifty >> 1);
crc0 >>= 1;
}
}
It is possible that this can all be represented with a standard CRC computation and polynomial but that has not yet been confirmed or discovered.
Pinouts
RF5C66 Mapper and Disk Drive Controller
_____
/ \
CPU A0 -> / 1 100 \ -- +5Vcc
CPU A1 -> / 2 99 \ -- n/c
CPU A2 -> / 3 98 \ <> CPU D0
CPU A3 -> / 4 97 \ <> CPU D1
CPU A4 -> / 5 96 \ <> CPU D2
CPU A5 -> / 6 95 \ <> CPU D3
CPU A6 -> / 7 94 \ <> CPU D4
CPU A7 -> / 8 93 \ <> CPU D5
CPU A12 -> / 9 92 \ <> CPU D6
CPU A13 -> / 10 91 \ <> CPU D7
CPU A14 -> / 11 90 \ -- GND
/ROMSEL -> / 12 89 \ <> Card D0
CPU R/W -> / 13 88 \ <> Card D1
M2 -> / 14 87 \ <> Card D2
P6-1 Lid Switch, Card R/W <- / 15 86 \ <> Card D3
(20k resistor to 5Vcc) ? -> / 16 85 \ <> Card D4
/IRQ <- / 17 84 \ <> Card D5
+5Vcc -- / 18 83 \ <> Card D6
n/c -- / 19 82 \ <> Card D7
21.47727MHz Xtal -- / 20 81 \ -- +5Vcc
Xtal -- / 21 \
n/c -- / 22 O /
GND -- / 23 80 / -- n/c
(n/c) Xtal Osc Out <- / 24 79 / -> Exp P3-2
n/c -- / 25 78 / <- Exp P3-3
ToneRx Xin, CIC Clock <- / 26 Nintendo RF5C66 77 / -> Exp P3-4
n/c -- / 27 Package QFP-100, 0.65mm pitch 76 / -> Exp P3-5
(n/c) $40AE.0 <- / 28 75 / -> Exp P3-6
Filt'd HostCIC +Start -> / 29 Mapper and 74 / <- Exp P3-7
Host CIC-12 <- / 30 Disk Drive Controller 73 / <- Exp P3-8
/ O 72 / <- Exp P3-9
\ 71 / <- Exp P3-11
Host CIC /Reset -> \ 31 70 / -- GND
Host CIC /Fail -> \ 32 69 / -> 5A18-49
CPU2 /Reset -> \ 33 68 / -> CPU2 /Reset (new rev)
CHR RAM /CE (input) -> \ 34 67 / <> Exp P3-12 Orientation:
RAM +CE <- \ 35 66 / <> Exp P3-13 --------------------
(n/c) $40C0.1 <- \ 36 65 / <> Exp P3-14 80 51
CPU2 /Reset (old rev: J2) <- \ 37 64 / <> Exp P3-15 | |
CHR RAM /CE <- \ 38 63 / <- $40B1.3 (n/c) .-----------.
GND -- \ 39 62 / <> Modem P4-31 81-|O Nintendo |-50
Built-in RAM /CE ($6000-7FFF) <- \ 40 61 / <> Modem P4-32 | RF5C66 |
(n/c) ? /CE ($4xE0-4xEF) <- \ 41 60 / <> Modem P4-29 100-| GCD 4R O|-31
5A18-85 /CE ($4xD0-4xDF) <- \ 42 59 / -- +5Vcc \-----------'
(GND) ? -> \ 43 58 / -- n/c | |
(GND) ? -> \ 44 57 / -> Kanji ROM A17 01 30
(GND) ? -> \ 45 56 / -> Kanji ROM A4
(GND) ? -> \ 46 55 / -> Kanji ROM A3 Legend:
CIRAM A10 <- \ 47 54 / -> Kanji ROM A2 ------------------------------
PPU A11 -> \ 48 53 / -> Kanji ROM A1 --[RF5C66]-- Power
PPU A10 -> \ 49 52 / -> Kanji ROM A0 ->[RF5C66]<- RF5C66 input
Kanji ROM /CE ($5000-5FFF) <- \ 50 51 / -- n/c <-[RF5C66]-> RF5C66 output
\ / <>[RF5C66]<> Bidirectional
\ / f Famicom connection
\ / r ROM chip connection
V R RAM chip connection
Notes:
- +5Vcc pins 18, 59, 81, 100 are all connected together internally.
- GND pins 23, 39, 70, 90 are all connected together internally.
- 43, 44, 45, 46 are GND on the PCB, but have internal protection diodes from GND, suggesting they are logic pins.
- 24, 28, 36, 37, 41, 63 are n/c on the PCB, but have protection diodes from GND, suggesting they may have a function.
- Pins 41 and 42 ranges shown are duplicated at $Cxxx (i.e. ignores /ROMSEL).
- It is unknown how the 5A18 prevents bus conflict at $Cxxx range when it has no known access to /ROMSEL.
- Pins 45-46, when pulled high, causes oscillation on pin 56.
- Pin 29 (CIC-11) observed only high (with or without card inserted).
- Seems to be a /reset because it sets pins 52-57 low when this pin is low, and possibly lots of other things.
- Pin 31 (CIC-10) observed only high (with or without card inserted).
- Pin 32 (CIC-15) observed high with card inserted and low with no card inserted or when hot-removed.
- Does not go high when hot-inserted or Famicom reset in low state, only high when card is present at power-on.
- Pin 16 Pull-up of 20k to 5V is also required in order to avoid triggering reset.
- Pin 16 seems to be related to pin 29. With pin 29 floating and pin 16 pulled high at power on, the chip runs for 5 seconds, then enters reset.
- Tested 10k instead of 20k (per original PCB) on pin 16, found no difference in time or function.
- Pin 69 has a high pulse of 11.9085 usec at any time that register $4xAC has not been read for 12.4892 seconds.
- Each additional 12.4892 seconds generates another pulse.
- It has very repeatable precision, at least 6 figures on each.
- It is not synchronized to M2 or any other inputs.
- Note that 12.4892 sec * 21.47727 MHz = 2^28, with an error of 0.075%. (Nominal would be 12.4986 sec.)
- Note that 11.9085 usec * 21.47727 MHz = 2^8, with an error of 0.093%. (Nominal would be 11.9196 usec.)
- Pins 52-56 drive the address pins of the Kanji ROM. (See notes below the LH5323M1 pinout.)
- Pin 15 (Card R/W) is a non-inverted buffer of CPU R/W. This signal connects through the lid switch.
- Pin 26 puts out a 3.58 MHz square wave, ~50% duty. This corresponds to 21.47727 MHz / 6.
- Pin 79 (Exp 2) puts out a 95.95 kHz square wave, 93.7% duty. Clock source unknown.
- Note that this seems similar to FDS serial bitrate.
- Standalone chip can get into a 341.2 kHz mode when touching pin 80, though pulling 80 high or low doesn't correlate.
- Either frequency, the negative pulse width is 650 nsec.
- Pins 71-79 appear strikingly similar to an FDS interface.
- CIRAM A10 follows PPU A10 by default.
RF5A18 CPU2 / Modem Controller
_____
/ \
CPU2 A0 <- / 1 100 \ -- GND
CPU2 A1 <- / 2 99 \ <> CPU2 D0
CPU2 A2 <- / 3 98 \ <> CPU2 D1
CPU2 A3 <- / 4 97 \ <> CPU2 D2
CPU2 A4 <- / 5 96 \ <> CPU2 D3
CPU2 A5 <- / 6 95 \ <> CPU2 D4
CPU2 A6 <- / 7 94 \ <> CPU2 D5
CPU2 A7 <- / 8 93 \ <> CPU2 D6
+5Vcc -- / 9 92 \ <> CPU2 D7
CPU2 A8 <- / 10 91 \ -- +5Vcc
CPU2 A9 <- / 11 90 \ -> Modem TXD
CPU2 A10 <- / 12 89 \ <- Modem RXD
CPU2 A11 <- / 13 88 \ <- CPU A2
CPU2 A12 <- / 14 87 \ <- CPU A1
(n/c) CPU2 A13 <- / 15 86 \ <- CPU A0
(n/c) CPU2 A14 <- / 16 85 \ <- /CE (5C66-42)
(n/c) CPU2 A15 <- / 17 84 \ <- P6-1 Lid Switch, Card R/W
GND -- / 18 83 \ <- M2
(2.4576 MHz) (n/c) CPU2 M2 <- / 19 82 \ <> Card D7
CPU2 R/W <- / 20 81 \ <> Card D6
RAM /CE ($0000-1FFF) <- / 21 \
(n/c) ROM /CE ($C000-DFFF) <- / 22 O /
P5 /CE ($4129 Only) <- / 23 80 / <> Card D5
(GND) CPU2 +Reset 1 -> / 24 79 / <> Card D4
(GND) CPU2 +Reset 2 -> / 25 78 / -- GND
(GND) CPU2 +IRQ -> / 26 Nintendo RF5A18 77 / <> Card D3
(5C66-68) CPU2 /Reset -> / 27 Package QFP-100, 0.65mm pitch 76 / <> Card D2
(10k up) ? -> / 28 75 / <> Card D1
(10k up) CPU2 /NMI -> / 29 Modem Controller 74 / <> Card D0
n/c -- / 30 CPU2 73 / <- Tone Rx DV
/ O 72 / <- Tone Rx D8
\ 71 / <- Tone Rx D4
+5Vcc -- \ 31 70 / <- Tone Rx D2
Modem DATA <> \ 32 69 / <- Tone Rx D1
Modem /INT -> \ 33 68 / -> Tone Rx GT Orientation:
Modem /RD <- \ 34 67 / -> Exp P3-19 --------------------
Modem /WR <- \ 35 66 / <- Exp P3-18 80 51
Modem EXCLK <- \ 36 65 / <- Exp P3-17 | |
(n/c) $4120.2 <- \ 37 64 / -- +5Vcc .-----------.
Modem AD1 <> \ 38 63 / -> Modem P4-19 81-|O RF5A18 |-50
Modem AD0 <> \ 39 62 / -> Modem P4-21 | Nintendo |
CPU2 D0 <- \ 40 61 / -> Modem Audio Enable 100-| GCD 8C O|-31
(n/c) ? <- \ 41 60 / -> Modem P4-27 \-----------'
(4.9152 MHz) Exp P3-16 <- \ 42 59 / -> $4127.3 (n/c) | |
GND -- \ 43 58 / -> Green LED, active low 01 30
19.6608MHz Xtal -- \ 44 57 / -> Red LED, active low
1k to Xtal -- \ 45 56 / -> Modem Reset Legend:
GND -- \ 46 55 / <- Modem P4-23 ------------------------------
(+5Vcc) $4126.0 -> \ 47 54 / <- Modem P4-28 --[RF5A18]-- Power
(+5Vcc) !($4126.1) -> \ 48 53 / <- Modem P4-25 ->[RF5A18]<- RF5A18 input
5C66-69 -> \ 49 52 / <- Switch SW1-4 <-[RF5A18]-> RF5A18 output
n/c -- \ 50 51 / <- Switch SW1-2 <>[RF5A18]<> Bidirectional
\ / ??[RF5A18]?? Unknown
\ / f Famicom connection
\ / r ROM chip connection
V R RAM chip connection
Notes:
- This chip contains its very own 65C02 CPU, with built-in ROM.
- +5Vcc pins 9, 31, 64, 91 are all connected together internally.
- GND pins 18, 43, 46, 78, 100 are all connected together internally.
- 24, 25, 26 are GND on the PCB, but have internal protection diodes from GND, suggesting they are logic pins.
- 47, 48 are +5Vcc on the PCB, but have internal protection diodes to +5Vcc, suggesting they are logic pins.
- 15, 16, 17, 19, 22, 37, 40, 41, 59 are n/c on the PCB, but have protection diodes from GND, suggesting they may have a function.
- Pin 42 (Exp 16) puts out a 4.92 MHz square wave, ~50% duty. This is 19.6608 MHz / 4.
- CPU2 /Reset comes from RF5C66 pin 68 on new revisions and selectable with J1, J2 on old revisions:
- J2 closed = RF5C66 pin 37 (default)
- J1 closed = RF5C66 pin 68
LH5323M1 Kanji Graphic ROM
_____ Note: Flat spot does not correspond to pin 1.
/ \
n/c -- / 12 11 \ -- n/c
(5C66-52) A0 -> / 13 10 \ -- n/c
CPU D0 <> / 14 9 \ <- A1 (5C66-53)
CPU D1 <> / 15 8 \ <- A2 (5C66-54)
CPU D2 <> / 16 7 \ <- A3 (5C66-55)
GND -- / 17 6 \ -- GND
CPU D3 <> / 18 5 \ <- A5 (CPU A0)
CPU D4 <> / 19 4 \ -- n/c
CPU D5 <> / 20 3 \ <- A6 (CPU A1)
CPU D6 <> / 21 2 \ <- A7 (CPU A2)
CPU D7 <> / 22 Nintendo LH5323M1 1 \ -- n/c
/ Package QFP-44 \
\ 0.8mm pitch /
n/c -- \ 23 44 / <- A8 (CPU A3)
n/c -- \ 24 Kanji Graphic 43 / <- A13 (CPU A8)
(GND) /OE -- \ 25 ROM 42 / <- A16 (CPU A11)
(CPU A6) A11 -> \ 26 41 / <- A4 (5C66-56) Orientation:
(5C66-50) /CE -> \ 27 40 / -- n/c --------------------
GND -- \ 28 39 / -- n/c 33 23
(CPU A7) A12 -> \ 29 38 / -- +5Vcc | |
(CPU A5) A10 -> \ 30 37 / <- A17 (5C66-57 Bankswitch) .-----------.
n/c -- \ 31 36 / <- A15 (CPU A10) 34-| Nintendo O|-22
n/c -- \ 32 35 / -- n/c | CCR-01 |
(CPU A4) A9 -> \ 33 34 / <- A14 (CPU A9) | LH5323M1 |
\ / 44-|O 9528 D |-12
\ / '-----------/
\ / | |
V 01 11
Notes:
- 6 & 28 are connected together internally.
- 17 has no measurable connection to 6 & 28.
- All logic pins have protection diode from pin 17, suggesting this is the true GND.
- Pin 25 also appears as a logic pin with respect to pin 17.
- When pins 25 and 27 are both driven low, the data bus becomes an output. Otherwise it is hi-z.
- Pins 13, 9, 8, 7, 41, 37 are controlled by the RF5C66.
- Pins 13, 9, 8, 7, 41 are controlled with auto-increment function.
- The value of these pins increments each M2 falling edge when the CPU is in range $5000-5FFF.
- Pin 37 is a bankswitch, controlled by register $40B0.0
- At reset and when reading from register $40B0, these pins reset to 0.
- The conditions resetting or maintaining the bankswitch pin to 1 are still unknown.
8633 CIC Host
_______ _______
| \_/ |
(Guest CIC-2) Data 0 <> | 1 18 | -- +5Vcc
(Guest CIC-1) Data 1 <> | 2 O 17 | -- n/c
n/c -- | 3 8633 16 | -- n/c
n/c -- | 4 15 | -> /Fail (5C66-32)
n/c -- | 5 CIC 14 | -- n/c
n/c -- | 6 Host 13 | -- n/c
(5C66-26) Clock -> | 7 12 | <- 5C66-30
(Guest CIC-11) /Reset -> | 8 U8 11 | -> +Start (5C66-29)
GND -- | 9 10 | -> /Reset (5C66-31)
|_______________|
8634A CIC Guest
_______ _______
| \_/ |
(Host CIC-2) Data 0 <> | 1 18 | -- +5Vcc
(Host CIC-1) Data 1 <> | 2 O 17 | -- n/c
n/c -- | 3 8634A 16 | ?? GND
n/c -- | 4 15 | -- n/c
n/c -- | 5 CIC 14 | -- n/c
n/c -- | 6 Guest 13 | ?? +5V
(5C66-26) Clock -> | 7 12 | ?? Card-33, n/c in Famicom Network System
(Cap to 5V) /Reset -> | 8 11 | -> +Start (Host CIC-8)
GND -- | 9 10 | -- n/c
|_______________|
- Note: Some assumptions made on CIC chips based on similarity to F411A from Super NES.
8kByte CHR-RAM
_______ _______
| \_/ |
n/c? -- | 1 28 | -- +5Vcc
PPU A12 -> | 2 O 27 | <- PPU /WR
PPU A7 -> | 3 26 | <- +CE: U3=RF5C66 34/38, U4=PPU /A13
PPU A6 -> | 4 25 | <- PPU A8
PPU A5 -> | 5 LH5268 24 | <- PPU A9
PPU A4 -> | 6 CHR 23 | <- PPU A11
PPU A3 -> | 7 RAM 22 | <- /OE: PPU /RD
PPU A2 -> | 8 U3/U4 21 | <- PPU A10
PPU A1 -> | 9 20 | <- /CE: U3=PPU A13, U4=RF5C66 34/38
PPU A0 -> | 10 19 | <> PPU D7
PPU D0 <> | 11 18 | <> PPU D6
PPU D1 <> | 12 17 | <> PPU D5
PPU D2 <> | 13 16 | <> PPU D4
GND -- | 14 15 | <> PPU D3
|_______________|
8kByte W-RAM
_______ _______
| \_/ |
n/c? -- | 1 28 | -- +5Vcc
CPU A12 -> | 2 O 27 | <- /WR: Card R/W (P6-2 Lid Switch)
CPU A7 -> | 3 26 | <- +CE: RAM +CE
CPU A6 -> | 4 25 | <- CPU A8
CPU A5 -> | 5 LH5268 24 | <- CPU A9
CPU A4 -> | 6 Built-in 23 | <- CPU A11
CPU A3 -> | 7 W-RAM 22 | <- /OE: GND
CPU A2 -> | 8 U5 21 | <- Card A10
CPU A1 -> | 9 20 | <- /CE: Built-in RAM /CE
CPU A0 -> | 10 19 | <> Card D7
Card D0 <> | 11 18 | <> Card D6
Card D1 <> | 12 17 | <> Card D5
Card D2 <> | 13 16 | <> Card D4
GND -- | 14 15 | <> Card D3
|_______________|
8kByte CPU2 RAM
_______ _______
| \_/ |
n/c? -- | 1 28 | -- +5Vcc
CPU2 A12 -> | 2 O 27 | <- /WR: CPU2 R/W
CPU2 A7 -> | 3 26 | <- +CE: +5Vcc
CPU2 A6 -> | 4 25 | <- CPU2 A8
CPU2 A5 -> | 5 LH5268 24 | <- CPU2 A9
CPU2 A4 -> | 6 CPU2 23 | <- CPU2 A11
CPU2 A3 -> | 7 RAM 22 | <- /OE: GND
CPU2 A2 -> | 8 U6 21 | <- CPU2 A10
CPU2 A1 -> | 9 20 | <- /CE: CPU2 RAM /CE
CPU2 A0 -> | 10 19 | <> CPU2 D7
CPU2 D0 <> | 11 18 | <> CPU2 D6
CPU2 D1 <> | 12 17 | <> CPU2 D5
CPU2 D2 <> | 13 16 | <> CPU2 D4
GND -- | 14 15 | <> CPU2 D3
|_______________|
P4: Modem Module Edge Connector
Famicom | Modem | Famicom
Network System | Module | Network System
__________
| |
+5Vcc -- | 1 19 | <- 5A18-63
Modem Reset -> | 2 20 | <- Tone Rx GT
Modem AD0 <> | 3 21 | <- 5A18-62
GND -- | 4 22 | -> Tone Rx DV
Modem AD1 <> | 5 23 | -> 5A18-55
Modem RXD <- | 6 24 | <- Tone Rx Xin, from 5C66-26
Modem DATA <- | 7 25 | -> 5A18-53
Modem TXD -> | 8 26 | -- GND
Modem /WR -> | 9 27 | <- 5A18-60
Modem EXCLK -> | 10 28 | <- 5A18-54
Modem /RD -> | 11 29 | <> 5C66-60
+5Vcc -- | 12 30 | <- Modem Audio Enable, 1 = enable
Tone Rx D1 <- | 13 31 | <> 5C66-62 __________________________
Modem /INT <- | 14 32 | <> 5C66-61 | Modem Module |
+5Vcc -- | 15 33 | -- Audio from 2A03 | Orientation |
Tone Rx D2 <- | 16 34 | -- Audio to RF | |
Tone Rx D8 <- | 17 35 | -- GND | 19 _____________ 36 |
Tone Rx D4 <- | 18 36 | -- GND | 1 |___________| 18 |
|________| |________________________|
Note: The modem module uses modem chip Oki MSM6827L and Dual Tone Receiver MC14LC5436P.
P2: Game Card Connector
Card | | Famicom Network System
-----+--+-------------------------
1 |--| +5Vcc
2 |--| +5Vcc
3 |??| n/c in host
4 |??| n/c in JRA-PAT, Host has 10k pull-up only.
5 |<>| Card D0
6 |<>| Card D1
7 |<>| Card D2
8 |<>| Card D3
9 |<>| Card D4
10 |<>| Card D5
11 |<>| Card D6
12 |<>| Card D7
13 |<-| Card R/W (P6-2 Lid Switch)
14 |<-| M2
15 |<-| /ROMSEL
16 |<-| CPU A0
17 |<-| CPU A1
18 |<-| CPU A2
19 |<-| CPU A3
20 |<-| CPU A4
21 |<-| CPU A5
| |
| |
22 |<-| CPU A6
23 |<-| CPU A7
24 |<-| CPU A8
25 |<-| CPU A9
26 |<-| CPU A10
27 |<-| CPU A11
28 |<-| CPU A12
29 |<-| CPU A13
30 |<-| CPU A14
31 |??| n/c in JRA-PAT, Host has 10k pull-up only.
32 |??| n/c in JRA-PAT, Host has 10k pull-up only.
33 |??| connected to Guest CIC-12 in JRA-PAT, n/c in host
34 |??| n/c in JRA-PAT, n/c in host
35 |->| Guest CIC-11 -> Host CIC-8
36 |<>| Guest CIC-1 <> Host CIC-2
37 |<>| Guest CIC-2 <> Host CIC-1
38 |<-| CIC Clock
39 |??| n/c in JRA-PAT, Host has 10k pull-up only.
40 |<-| RAM +CE (n/c in JRA-PAT)
41 |--| GND
42 |--| GND
P3: Expansion Connector
Outside | FNS | Outside _____________________
_________ / Orientation /|
| | /____________________/ |
/IRQ -> | 1 20 | -- +5Vcc |o|_| == |_||_|o|/
(95.94kHz Clock) 5C66-79 <- | 2 19 | -> 5A18-67 \_ _ _ _||_ _ _ _/|
5C66-78 -> | 3 18 | -> 5A18-66 |-| | || HVC-050| |
5C66-77 <- | 4 17 | -> 5A18-65 |-|_| || | |
5C66-76 <- | 5 16 | -> 5A18-42 (4.92MHz Clock) | || | |
5C66-75 <- | 6 15 | <> 5C66-64 | 20 __/__\__ 11 | |
| | |o 1 |______| 10 o| |
5C66-74 -> | 7 14 | <> 5C66-65 | ________________ | |
5C66-73 -> | 8 13 | <> 5C66-66 |/_______________/|| |
5C66-72 -> | 9 12 | <> 5C66-67 ||______________|/ | |
GND -- | 10 11 | <- 5C66-71 | | |
|_______| | ______ | |
|o | | | o| |
\_____|/ |_____|/
P5: Expansion Connector
Note: This connector only exists on old revisions of Famicom Network System. Expansion P5 /CE is activated low specifically at CPU2 address $4129.
Outside | | Famicom Network System
--------+--+-------------------------
9 |--| GND
8 |<>| CPU2 D5
7 |<>| CPU2 D4
6 |<>| CPU2 D3
5 |<>| CPU2 D2
4 |<>| CPU2 D1
3 |<>| CPU2 D0
2 |<-| Expansion P5 /CE
1 |--| +5V
