Saturday, April 04, 2015

Hantarex MTC 900E

I'm posting this here for anyone restoring a Hantarex MTC 900E monitor with the PE 07 input board.

This input board requires a different set of capacitors to some of the existing cap-kits available on the internet.

PE 07 Input Board Capacitors:

C4 10uF 50V
C5 10uF 50V
C6 10uF 50V
C7 100uF 25V
C8 100uF 25V
C9 100uF 25V
C11 330uF 200V
C18 4.7uF 16V
C19 4.7uF 16V
C20 4.7uF 16V
C21 10uF 50V
C22 10uF 50V
C25 47uF 50V
C27 10uF 50V
C29 10uF 50V
C36 22uF 40V
C38 10uF 16V
C39 10uF 50V
C83 47uF 50V

Note: some max working voltages have been increased. For example, the original C4 was 16V working.

For those wondering what I'm upto at the moment, I'm still restoring my OutRun cabinet. Follow the thread here

Saturday, February 14, 2015

CannonBoard: Latest Hardware Iteration

Colin has populated the new version of the board (apart from the motion control 90’ connector). Click on the image for a larger version.

It's looking pretty awesome, don't you think? 

Monday, January 05, 2015

Space Harrier Protection Mechanism

The Sega Enhanced package has been updated with a fix for a protection issue when running the game on Enduro Racer hardware. Sega protected the original game code, to prevent it from running on hardware without the i8751 microcontroller.

It was previously thought that the protection was defeated, however an interesting bug surfaced. Interestingly, MAME did not correctly support the protection either. This resulted in Space Harrier being flawed on MAME, with the life counter incorrectly incremented.

More details from the UKVAC post are below:

This all came to light when Space Harrier world champion and fine upstanding member of the UKVAC community Jodo mentioned in the discussion that there was a *bug* in Space Harrier when played on Enduro Racer hardware whereby occasionally your lives remaining would NOT decrease when you got hit by an enemy, or in some cases your lives remaining would actually *increase* when you got hit by an enemy.  He posted a video of it in action and I then also confirmed that the issue existed using both patched and unpatched SH roms in MAME.

Well this fascinated me and, as I've become rather adept at fixing Sega code bugs in the past few years, I thought I'd look into it deeper to hopefully resolve it.

As you may be aware it's possible to play Space Harrier on an Enduro Racer board set.  The only difference between an SH board set and an ER board set is the inclusion of an i8751 protection MCU on SH.

It was originally thought that the only purpose of the MCU was to check the main cpu roms at boot time, generate a vblank interrupt for the main cpu and process analog inputs/pass them to the main cpu.

It now turns out that this is not the case and the MCU does further protection on the game code.  This is the *bug* (it isn't actually a bug, it's protection code).

The protection routine starts at address $4aae in the main cpu code.  It works by querying the in-game timer (the timer that starts when you start a new game) and if the timer is a multiple of $200 (512) seconds it adds 1 to the word value @ $400f0 in memory.

This value is then copied, every vblank, to $124306 (in shared ram) by the code @ $4e86.  This is the trigger for bad things to start happening.

The value at $124306 is queried whenever you lose a life by the code @ $75ca and the following happens, based on the value held in that memory location at that time :-

if the value is 0 then nothing further happens (this is what the value should ALWAYS be)

if the value is 1 (i.e. after 512 seconds of gameplay) then the in-game frame counter is ANDed with a value of 1 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that, after 512 seconds of gameplay, you've got a 50/50 chance of NOT losing a life when you get hit by a bad guy.

if the value is 2 (i.e. after 1024 second of gameplay) then the in-game frame counter is ANDed with a value of 3 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that, after 1024 seconds of gameplay, you've got a 25% chance of losing a life, a 25% chance of NOT losing a life, a 25% chance of GAINING a life or a 25% chance of GAINING 2 lives, when hit by a bad guy.

if the value is 3 or higher (i.e. after 1536 seconds of gameplay) then the in-game frame counter is ANDed with a value of 7 and the result is ADDED to your lives remaining count.  The routine which subtracts 1 from your lives remaining count is then called and the game continues.  What this means, in effect, is that you're now swimming in extra lives, to the point that the game will eventually crash if you keep getting hit by the bad guys (as you've accumulated so many lives by this point).

Long serving and well respected MAME dev team member Chris Hardy (Junofirstman on here) has confirmed my initial findings.  He believes the MCU writes a value of zero to address $400f0 every vblank, so the absence of this simulated code in SH running on ER hardware or in MAME meant that the above phenomenon was happening after 512 seconds of gameplay.

Chris has updated the MAME driver and submitted it and also suggested a patch to the roms for playing on ER hardware which will eliminate the problem.

So, taking a step back, I think this was a pretty crafty protection scheme by Sega.  Time delayed protections are usually very effective and the most difficult to find as they often don't start kicking in until a long time after the game has booted (as is the case here, ~8.5 minutes of gameplay until the effect is noticed).  This means that the bootleggers (was there ever a bootleg of SH?) may have thought that they'd overcome the MCU protection if they managed to clone the functionality of it sufficiently to get the game to boot.  They may not then have proceeded to test it sufficiently long enough to notice the time delayed protection effects kicking in.

What this would mean though is that, if SH was bootlegged and the bootleggers didn't overcome the time based protection and arcade operators bought a bootleg board instead of a genuine Sega board then the operators would likely have been losing money as the players would have been getting much longer gameplay for their 10/20p due to all the extra lives they'd have been getting.  So Sega's idea was to hit the operators where it hurt, in the pocket.

Thanks go out to Chris Hardy, Jodo, Mark Haysman and Ordyne for all chipping in with info and to Sega for making awesome games with semi-awesome protection. 

Monday, December 22, 2014

The Ultimate Way To Play OutRun

The Force Dynamics team have ported CannonBall to run on their 401cr motion simulator. It's particularly cool to see the terrain data is used to adjust the height of the simulator! 

It's fantastic to see CannonBall running on everything from Android phones through to military grade hardware! Check out the video below. 

Wednesday, November 19, 2014

Restoration - Boardset

I pulled the PCB out of the machine and connected it with my test harness to a CRT TV. After sitting in a garage unused since the 90s it was surely never going to work?

I couldn't believe my eyes - it booted up and everything seems ok. Maybe I won't need that spare PCB after all. There's a bit of an audio hiss under the sounds but that's it. I'm going to leave it running for a bit to see if it explodes. ;)

Saturday, November 15, 2014

OutRun Mini Restoration

Back in 1997, I bought an OutRun Mini cabinet. It cost £200 and had been in use in a youth club. It worked, but had been well used and seen better days.

When I left London and headed to university in 1999 the cabinet remained in my parent's garage. It's resided there for the past 15 years gathering dust.

Most of the cabinet was unwisely painted black at some point and the red side art covered. The black paint had started to flake off, taking the red stencilled side art with it; it looked pretty awful as you can see below. 

I got in touch with a chap called Rudy who has reproduced the side art. This is in the post and will serve as a nice motivational reminder of the way things should be. 

The control panel has also been painted black, the sticker ripped and the start button replaced. Everything works fine however. There are no broken cogs and the original OutRun steering wheel emblem is present. 

I have a replacement control panel in great condition, so I have a few options here for the restoration, so it should be one of the easier parts to get right. Some of the chipboard is in particularly poor condition at the base of the cabinet. 

The insides of the cabinet are dusty, but thankfully not rusty. I was quite concerned that storing the cabinet in a drafty garage for 15 years would have caused more obvious problems. 

Even the PCB shows no obvious signs of corrosion which is pleasing.  I doubt it still works, but I will check it in my test harness at some point. 

The bottom interior of the cabinet is filthy. As a bonus, I found 20p amongst the dust. Evidence below. 

It's nice to find out when the cabinet was born; 22nd July 1987. It was last serviced in 1996, a year before I bought it. 

There's a lengthy task ahead, and I will be stripping the cabinet down for a full refurbishment over the coming months. Hopefully I can restore this cabinet to its former glory and learn something along the way. 

Tuesday, November 11, 2014

CannonBall 0.3 - Widescreen Tilemaps & Freeplay

This is a version of CannonBall I meant to release a while ago, but moving house and family commitments ended up causing me to sit on it for a while. I suspect there may be some new bugs as there was a gap between coding and release, so please report anything found.

I also spoke with Colin who is going to carry on with CannonBoard work soon. Behind the scenes a lot is done and ready to go from a software point of view.

- Widescreen tilemap support for music selection screen.

- Widescreen support for map screen. The sea on the left now extends further.

- Freeplay Mode (enabled in config.xml for now)

- Optional Timing Fixes (enabled in config.xml for now)


Also of note is the following project, which is a port of CannonBall to Android phones, tablets and other devices. There are some bugs and suggestions I have for the author, but overall it runs nicely!

You will need to enable the installation of APK files from unknown sources in the Settings -> Security section of your device to use it.

The author has kindly released the source code, which is available here.

Cabinet Restoration

One benefit of moving is that I finally have space for my OutRun cabinet. It needs a lot of restoration work, so I will be devoting a lot of free time to this project in the coming months as well as supporting Colin with his CannonBoard work. I'll post some pictures once I get going.