Sega "X-Board" hardware notes (2004-12-03)

From Sega Retro

Logo-txt.svg
This is a copy of an "unofficial" document containing original research, for use as a source on Sega Retro. This page likely exists for historical purposes - the contents should ideally be copy-edited and wikified to make better use of Sega Retro's software.
Original source: http://cgfm2.emuviews.com/txt/loftech.txt


 Sega "X-Board" hardware notes
 by Charles MacDonald
 WWW: http://cgfm2.emuviews.com

 Unpublished work Copyright 2004 Charles MacDonald

 This document is in a very preliminary state and is subject to change.
 Most everything within has been tested and verified on the X-Board hardware,
 but please be aware that my testing methods or interpretations of
 results could be flawed. I can't guarantee that everything is 100% accurate.

 Last updated: 12/03/04

 Table of contents

 - Overview
 - System timing and interrupts
 - Main CPU memory map
 - Sub CPU memory map
 - 315-5248
 - 315-5249
 - 315-5250
 - Timer overview
 - Palette
 - Sprites
 - I/O hardware
 - I/O chip #1
 - I/O chip #2
 - Analog inputs
 - Sound hardware
 - Miscellaneous
 - 315-5290
 - 315-5291
 - 315-5278
 - Video priority mixer
 - 315-5280
 - Assistance Needed
 - Credits and Acknowledgements
 - Disclaimer

 ----------------------------------------------------------------------------
 Overview
 ----------------------------------------------------------------------------

 Processors
                MC68000 (Main CPU)
                MC68000 (Sub CPU)
                Z80
 Video hardware
                315-5197  - Tilemap generator
                315-5211A - Sprite generator
                315-5242  - Color encoder
                315-5275  - Road generator
 Others
                315-5248  - Hardware multiplier (x2)
                315-5249  - Hardware divider (x2)
                315-5250  - 68000 / Z80 interface, hardware comparator
           Sony CXD1095Q  - I/O chip (x2)
                ADC0801   - Single channel ADC
 Sound
                YM2151
                315-5218 (16 channel stereo PCM controller)
 PALs
                315-5290  - Main CPU address decoding
                315-5291  - Main CPU address decoding
                315-5278  - Sprite ROM bank control
                315-5304  - Video priority mixer (LOF)
                315-5279  - Video priority mixer (AB,AB2)
                315-5280  - Z80 address decoding

 Description

 The "X-Board" hardware is an interesting mix between different platforms.
 It has two CPUs and a road generator like Enduro Racer, the System 16B
 tilemap chip, and a new sprite system that is programmed similar to the
 line sprites from both systems, but is actually framebuffer based like
 the later "Y-Board" and System 24 hardware.

 ----------------------------------------------------------------------------
 System timing and interrupts
 ----------------------------------------------------------------------------

 Clock speeds

 68000          12.5 MHz
 68000          12.5 MHz
 Z80             4.0 MHz
 YM2151          4.0 MHz
 315-5218       16.0 MHz
 ADC0801         1.25 MHz

 The 315-5218 may actually run at some fraction of the input clock, it is
 directly connected to a 16 MHz oscillator.

 Display timing

 - Pixel clock: 6.25 MHz
 - Horizontal scan rate: 15.720 KHz
 - 60 frames per second
 - 262 lines per frame

 Interrupts

 The main CPU has the following connections:

 /IPL2 = /GXINT from 315-5275 (Vertical blank)
 /IPL1 = /68KINT0 from 315-5230 (Timer)
 /IPL0 = +5V

 The vertical blank interrupt occurs at the start of scanline 223 and does
 not have to be acknowledged.

 The timer interrupt is explained in more detail later.

 When the vertical blank and timer interrupts occur at the same time, a
 level 6 interrupt is triggered.

 ----------------------------------------------------------------------------
 Main CPU memory map
 ----------------------------------------------------------------------------

 Address bits A23 through A22 are unused.

 000000-03FFFF : ROM (IC58,63)
 040000-07FFFF : ROM (IC57,62)
 080000-09FFFF : Work RAM #2 (16K) (IC60, 55)
 0A0000-0BFFFF : Work RAM #1 (16K) (IC61, 56)
 0C0000-0CFFFF : Tile RAM (64K) (IC135,34)
 0D0000-0DFFFF : Text RAM (4K) (IC133,132)
 0E0000-0E3FFF : Hardware multiplier (315-5248, IC107)
 0E4000-0E7FFF : Hardware divider    (315-5249, IC108)
 0E8000-0EBFFF : Hardware comparator, timer, Z80 communication (315-5250, IC53)
 0EC000-0FFFFF : Unused. Lockup on read or write.
 100000-10FFFF : Sprite RAM (4K accessible of 8K total)
 110000-11FFFF : 315-5211A render trigger (w/o, lockup on read)
 120000-12FFFF : Color RAM (16K)
 130000-13FFFF : ADC
 140000-14FFFF : I/O chip #1 (IC160)
 150000-15FFFF : I/O chip #2 (IC159)
 160000-16FFFF : I/O control (w/o) (w/o, lockup on read)
 170000-17FFFF : (Unmapped, no DTACK) (w/o, lockup on read)
 180000-1FFFFF : Unused. Lockup on read or write.
 200000-23FFFF : ROM (IC20,29)
 240000-27FFFF : ROM (IC21,30)
 280000-29FFFF : RAM (16K) (IC31,22)
 2A0000-2BFFFF : RAM (16K) (IC32,23)
 2C0000-2DFFFF : Unused. Reads return "open bus" value of the sub CPU.
 2E0000-2E3FFF : Hardware multiplier (315-5248, IC107)
 2E4000-2E7FFF : Hardware divider (315-5249, IC108)
 2E8000-2EBFFF : Hardware comparator (315-5250, IC53)
 2EC000-2EDFFF : Road RAM (4K accessible of 8K total) (IC39,38)
 2EE000-2EFFFF : Road generator internal register(s) (315-5275, IC42)
 2F0000-2F3FFF : Expansion connector. If nothing attached, reads return "open bus" value of the sub CPU and writes do nothing.
 2F4000-2FFFFF : Unused. Reads return "open bus" value of the sub CPU.
 300000-3F7FFF : Unused. Lockup on read or write.
 3F8000-3FBFFF : Work RAM #2 (16K) (mirror)
 3FC000-3FFFFF : Work RAM #1 (16K) (mirror)

 ----------------------------------------------------------------------------
 Sub CPU memory map
 ----------------------------------------------------------------------------

 Address bits A23 through A20 are unused.

 000000-03FFFF : ROM (IC20,29)
 040000-07FFFF : ROM (IC21,30)
 080000-09FFFF : RAM (16K) (IC31,22)
 0A0000-0BFFFF : RAM (16K) (IC32,23)
 0C0000-0DFFFF : Unused(Unmapped, reads return garbage, writes unused)
 0E0000-0E3FFF : Hardware multiplier (315-5248, IC107)
 0E4000-0E7FFF : Hardware divider (315-5249, IC108)
 0E8000-0EBFFF : Hardware comparator (315-5250, IC53)
 0EC000-0EDFFF : Road RAM (8K, accessible in two 4K banks mirrored twice) (IC39,38)
 0EE000-0EFFFF : Road generator internal register(s) (315-5275, IC42)
 0F0000-0F3FFF : /EXCS (CN I)
 0F4000-0FFFFF : (Unmapped, lock if r/w)

 ----------------------------------------------------------------------------
 315-5248 - Hardware multiplier
 ----------------------------------------------------------------------------

 The 315-5248 performs a fast 16x16 signed multiply with a 32-bit result.
 It has four registers:

 $0000 : Operand A
 $0002 : Operand B
 $0004 : Result (bits 31-16)
 $0006 : Result (bits 15-0)

 The operands can be written to in any order to produce a correct result,
 and the result is updates as soon as either register is written to.

 Byte writes to $0000 or $0002 loads the high and low bytes with bits 7-0 of
 the data written.

 Byte writes to $0001 or $0003 does nothing and the existing value is not
 modified.

 Word and byte reads from any address are valid.

 ----------------------------------------------------------------------------
 315-5249
 ----------------------------------------------------------------------------


 ----------------------------------------------------------------------------
 315-5250
 ----------------------------------------------------------------------------

 This chip has several functions:

 - Provides interface for main CPU to access sub CPU memory map.
 - Communication with the Z80.
 - Has a 12-bit timer.
 - Has two sets of registers for performing comparisons.

 Main CPU registers:

 Address    Acc.    Description

 $0E8000    r/w     Bound #1
 $0E8002    r/w     Bound #2
 $0E8004    r/w     Value
 $0E8006    r/o     Status
 $0E8008    r/w     History (write to clear history)
 $0E800A    r/o     Bound #2 (mirror)
 $0E800C    r/w     Value (mirror, writes do not update history)
 $0E800E    r/o     Result
 $0E8010    w/o     Timer frequency
 $0E8012    r/w     Timer interrupt acknowledge
 $0E8014    w/o     Timer start/stop
 $0E8016    w/o     Z80 sound command
 $0E8018    w/o     Timer frequency (mirror)
 $0E801A    r/w     Timer interrupt acknowledge (mirror)
 $0E801C    w/o     Timer start/stop (mirror)
 $0E801E    w/o     Z80 sound command (mirror)

 (Repeats every 16 words)

 Sub CPU registers:

 $0E8000    r/w     Bound #1
 $0E8002    r/w     Bound #2
 $0E8004    r/w     Value
 $0E8006    r/o     Status
 $0E8008    r/w     History (write to clear history)
 $0E800A    r/o     Bound #2 (mirror)
 $0E800C    r/w     Value (mirror, writes do not update history)
 $0E800E    r/o     Result

 (Repeats every 8 words)

 ----------------------------------------------------------------------------
 Timer overview
 ----------------------------------------------------------------------------

 The 315-5250 contains a 12-bit up-counter clocked by the EXCK pin.
 Jumpers S15 through S17 allow this pin to be connected to the following
 sources:

 Jumper  Pin   Source                              Frequency
 S15     V0    315-5275 scanline counter, bit 0    131 pulses per frame
 S16     V1    315-5275 scanline counter, bit 1    65.5 pulses per frame
 S17     V2    315-5275 scanline counter, bit 2    32.75 pulses per frame

 Typically jumper S15 is shorted, giving the timer a granularity of 127.22us.
 Most games use a value of $FE0 to cause an interrupt ever 4ms.

 Registers are

 $0E8010 : Timer count

 MSB             LSB
 ---- nnnn nnnn nnnn

 n = Timer count (0= slowest, 1= fastest)
 - = Not used

 $0E8012 : Timer interrupt acknowledge

 Reading or writing this register (byte or word access OK) will acknowledge
 the timer interrupt.

 $0E8014 : Timer enable

 MSB             LSB
 ---- ---- ---- ---e

 e = Timer enable (0= off, 1= on)
 - = Not used

 Timer quirks

 If the timer count value is $FFF, it will generate interrupts at the same
 rate as the input clock regardless of the timer enable bit.

 Assuming V0 was used as the clock source, this would give 131 interrupts
 per frame.

 ----------------------------------------------------------------------------
 Palette
 ----------------------------------------------------------------------------

 Color RAM is 16K, organized as 8K 16-bit entries:

 D15 : Shadow/hilight (0= off, 1= on)
 D14 : Blue component, bit 0
 D13 : Green component, bit 0
 D12 : Red component, bit 0
 D11 : Blue component, bit 4
 D10 : Blue component, bit 3
 D9  : Blue component, bit 2
 D8  : Blue component, bit 1
 D7  : Green component, bit 4
 D6  : Green component, bit 3
 D5  : Green component, bit 2
 D4  : Green component, bit 1
 D3  : Red component, bit 4
 D2  : Red component, bit 3
 D1  : Red component, bit 2
 D0  : Red component, bit 1

 Color RAM is divided up as follows (preliminary)

 0000-1FFF : Sprites (256 16-color palettes)
 2000-2FFF : Road layer
 2F00-2FFF : Road line color table (128 entries)
 3000-3FFF : Text layer (256 8-color palettes) (not correct)

 See the section on the video priority mixing detail for a more in-depth
 look at how color RAM is accessed by the rest of the video hardware.

 Color RAM access

 Access to color RAM is shared beteween the video hardware and CPU. Accesses
 by the CPU take precendence, so if color RAM is written to or read during
 the active display period, whatever value that was written or read is also
 displayed as the color for the currently displayed pixel.

 ----------------------------------------------------------------------------
 Sprites
 ----------------------------------------------------------------------------

 The 315-5211A has acess to 8K of RAM divided into two 4K banks, and 512K 
 of RAM divided into two 512x256 16-bit framebuffers. The 315-5211A controls
 selection of which 4K bank is available.

 Generally speaking the 315-5211A parses one list while giving the CPU access
 to the other, and renders to one framebuffer while displaying the other.
 Writing to $110000 triggers the rendering sequence and further writes are
 ignored until rendering stops.

 The only indicator the 315-5211A gets about the display state is the
 VBlank interrupt, so it most likely stops rendering at that point.

 Each 4K bank of sprite RAM contains 256 16-byte entries describing a single
 sprite. The sprites are rendered to the framebuffer in the same order they
 appear in the list, so sprite #255 overwrites sprite #0.

 With enough sprites displayed it is possible to have the render process
 aborted due to a lack of time, in which case the last sprite being drawn
 may only be partially drawn to the framebuffer.

 Sprites are clipped when drawn to the framebuffer; any portion of a sprite
 that exceeds the 512x256 framebuffer space is not drawn.

 Sprite ROM data is arranged as 256K banks (64Kx32-bits) Each 32-bit word
 read from sprite ROM holds eight 4-bit pixels. The pitch is added to the
 16-bit offset after each line rendered, much like System 16B.

 For pixel data, $0 is transparent, $A is a shadow/hilight pen when a sprite's
 shadow/hilight enable bit is set, and $F is an end marker (also transparent).

 The format of each entry in sprite RAM is:

 Offset $00

     D15 : End of sprite list (1= stop, 0= continue)
     D14 : Hide sprite (1= hide, 0= visible)
     D13 : ?
     D12 : Hide sprite (1= hide, 0= visible)
 D11-D10 : Sprite ROM bank select (fed to a PAL)
   D7-D0 : Starting line in framebuffer ($0000 = line 0)

 Offset $02

 D15-D0  : Sprite ROM bank offset

 Offset $04

 D15-D9  : Sprite pitch
 D8-D0   : Starting pixel in framebuffer ($00B8 = pixel 0)

 OFfset $06

 D15     : ?
 D14     : Shadow/hilight enable (1= Pen $A is shadow/hilight, 0= Pen $A is normal)
 D13-D12 : Sprite priority (relating to tilemaps only)
 D11-D0  : Sprite vertical zoom:
           $0000 = 8x tall
           $0080 = 4x tall
           $0100 = 2x tall
           $0200 = Normal height
           $03FF = 1/2 tall
     $0400-$05FF = 1/2 tall (all settings are the same as $400)
     $0600-$0700 = Normal height (doubled)
           $0780 = 2x tall (doubled)
           $07C0 = 4x tall (doubled)

 The zoom value is only valid for $0000-$03FF. Values of $0400-$05FF are
 identical, and from $0600-$7FF the sprite gradually becomes taller again
 but the wrong lines are doubled. I think this is unintentional and these
 values are not supposed to be used.

 Shadow/hilight mode is controlled by the tilemap chip, so I'm not sure
 how the road layer is affected.

 Offset $08

 D15     : Render vertical direction (1= start line going upwards, 0= start line going downwards)
 D14     : Sprite flip (1= flip, 0= normal) Relates to order in which end codes are parsed.
 D13     : Render horizontal direction (1= start pixel going left, 0= start pixel going right)
 D12     : Unknown. May disable or change end code pixel value.
 D11-D0  : Sprite horizontal zoom:
           $0000 = 8x wide
           $0080 = 4x wide
           $0100 = 2x wide
           $0200 = Normal width
           $0300 = 1/2 wide
           $0400 = 1/4 wide
     $0400-$0FFF = Invalid

 Bits 15 and 13 change the direction data is rendered to the framebuffer;
 e.g. setting bit 13 renders pixels in a line from the starting pixel going
 backwards, setting bit 15 renders pixels from the starting line going upwards.

 This does not change how the end codes are parsed; bit 14 is a true
 horizontal flip bit in that sense. (data still rendered in the order specified
 by bits 15, 13)

 Much like the Y-zooming, X-zoom values of $0400-$0FFF start off at 1/4th
 wide and gradually expand to reach 8x wide at the end ($0FFF). However these
 values are invalid and while the sprite shrinks down to something like 1/8th
 or 1/16th, there are many rendering errors (end codes skipped, all sorts of
 garbage) probably due to the wrong data being returned.

 Offset $0A

 D15-D12 : ?
 D11-D0  : Sprite height in framebuffer.

 The framebuffer is only 256 lines tall, so values larger than that are
 clipped.

 Offset $0C

 D15-D8  : ?
 D7-D0   : Sprite palette.

 Offset $0F

 Does nothing.

 ----------------------------------------------------------------------------
 I/O hardware
 ----------------------------------------------------------------------------

 Two Sony CXD1095Q I/O chips are used. Each has the following capabilities:

 - Five I/O ports; A through D are 8 bits and E is 4 bits.
 - Pin direction can be set for bit groups 7-4 or 3-0 for ports A through D.
 - Pin direction can be set for bits 3-0 individually for port E.
 - Output-disable pin to force input mode for ports A through D.

 Each port consists of an output latch which is loaded when the port
 is written to, and an input buffer. When in output mode, reading a port
 returns the latch contents. When in input mode, the latch does nothing
 (though it can still be written to) and reading a port returns the input
 buffer data.

 Commonly used addresses are:

 $140000-$14000F : I/O chip #1
 $150000-$15000F : I/O chip #2
 $160000         : I/O chip output control

 Each chip has eight internal registers:

 $0001 - Port A data (r/w)
 $0003 - Port B data (r/w)
 $0005 - Port C data (r/w)
 $0007 - Port D data (r/w)
 $0009 - Port E data (r/w)
 $000B - Unused      
 $000D - REG1 (w/o)
 $000F - REG2 (w/o)

 The upper 4 bits of port E, the unused register, and REG1, REG2 return zero
 when read.

 REG1 has the following layout:

 Bit 7 : Port D bits 7-4 pin direction (0= output, 1= input)
 Bit 6 : Port D bits 3-0 pin direction (0= output, 1= input)
 Bit 5 : Port C bits 7-4 pin direction (0= output, 1= input)
 Bit 4 : Port C bits 3-0 pin direction (0= output, 1= input)
 Bit 3 : Port B bits 7-4 pin direction (0= output, 1= input)
 Bit 2 : Port B bits 3-0 pin direction (0= output, 1= input)
 Bit 1 : Port A bits 7-4 pin direction (0= output, 1= input)
 Bit 0 : Port A bits 3-0 pin direction (0= output, 1= input)

 REG2 has the following layout:

 Bit 7 : Unused
 Bit 6 : Unused
 Bit 5 : Unused
 Bit 4 : Unused
 Bit 3 : Bit 3 pin direction (0= output, 1= input)
 Bit 2 : Bit 2 pin direction (0= output, 1= input)
 Bit 1 : Bit 1 pin direction (0= output, 1= input)
 Bit 0 : Bit 0 pin direction (0= output, 1= input)

 For the X-Board hardware these should be initialized to $03 and $FF,
 respectively.

 Default states

 When the ports are inputs (by /ODEN==L or REG1=$FF), their values
 (as read by the CPU) are:

 $140001 = $00
 $140003 = $00
 $140005 = $00
 $140007 = $00
 $140009 = $00

 $150001 = $FF
 $150003 = $FF
 $150005 = $FF
 $150007 = $FF
 $150009 = $00

 Output disable control

 Each I/O chip has an input called /ODEN. When pulled low, ports A through D
 become inputs in all eight bits.

 Writing to ports A-D will update the internal latch, but the pin state
 is unchanged. Reading ports A-D will return their input data, just as
 if REG1 = $FF (though REG1 hasn't changed).

 Accessing any location within $160000-$16FFFF latches bit 0 of the data
 bus and outputs it to the /ODEN pin of both I/O chips. When /ODEN is low,
 all pins of ports A through D become inputs. When /ODEN is high, the ports
 are programmable through REG2.

 Port E is unaffected by /ODEN, and none of the internal registers are
 modified while /ODEN is low; furthermore changes to registers are
 accepted though direction changes are not noticable until /ODEN is high.

 ----------------------------------------------------------------------------
 I/O chip #1
 ----------------------------------------------------------------------------
 
 Port A

 D7: (Not connected)
 D6: /INTR of ADC0804
 D5: CN C pin 24 (switch state 0= open, 1= closed)
 D4: CN C pin 23 (switch state 0= open, 1= closed)
 D3: CN C pin 22 (switch state 0= open, 1= closed)
 D2: CN C pin 21 (switch state 0= open, 1= closed)
 D1: CN C pin 20 (switch state 0= open, 1= closed)
 D0: CN C pin 19 (switch state 0= open, 1= closed)

 Port B

 D7: CN C pin 17
 D6: CN C pin 15
 D5: CN C pin 13
 D4: CN C pin 11
 D3: CN C pin 9
 D2: CN C pin 7
 D1: CN C pin 5
 D0: CN C pin 3

 Output state (to rest of hardware) when port is an input is $FF.

 Port C

 D7: (Not connected)
 D6: (/WDC)
 D5: Screen display (1= blanked, 0= displayed)
 D4: (ADC2)
 D3: (ADC1)
 D2: (ADC0)
 D1: (CONT)
 D0: Sound section reset (1= normal operation, 0= reset)

 CONT is connected to the sprite generator. When set to '1', the rendering
 time seems to be reduced. Normally left at '0'.

 /WDC is the output to the watchdog clock. Depending on the positions of
 jumpers S35 and S36, /WDC either needs to be pulsed or the watchdog clock
 is automatically pulsed by the V-Blank interrupt.

 Bit 0 is a common reset line to the Z80, YM2151, YM3012, and 315-5218.

 Output state (to rest of hardware) when port is an input is $00.

 Port D

 D7: Amplifier mute control (1= sounding, 0= muted)
 D6: CN D pin A17 (output level 1= high, 0= low)
 D5: CN D pin A18 (output level 1= high, 0= low)
 D4: CN D pin A19 (output level 1= high, 0= low)
 D3: CN D pin A20 (output level 1= high, 0= low)
 D2: CN D pin A21 (output level 1= high, 0= low)
 D1: CN D pin A22 (output level 1= high, 0= low)
 D0: CN D pin A23 (output level 1= high, 0= low)

 Output state (to rest of hardware) when port is an input is $00.

 Port E

 D3: (Not connected)
 D2: (Not connected)
 D1: (Not connected)
 D0: (Not connected)

 ----------------------------------------------------------------------------
 I/O chip #2
 ----------------------------------------------------------------------------

 Port A

 D7: CN D pin A1 (switch state 1= open, 0= closed)
 D6: CN D pin A2 (switch state 1= open, 0= closed)
 D5: CN D pin A3 (switch state 1= open, 0= closed)
 D4: CN D pin A4 (switch state 1= open, 0= closed)
 D3: CN D pin A5 (switch state 1= open, 0= closed)
 D2: CN D pin A6 (switch state 1= open, 0= closed)
 D1: CN D pin A7 (switch state 1= open, 0= closed)
 D0: CN D pin A8 (switch state 1= open, 0= closed)

 Port B

 D7: CN D pin A9  (switch state 1= open, 0= closed)
 D6: CN D pin A10 (switch state 1= open, 0= closed)
 D5: CN D pin A11 (switch state 1= open, 0= closed)
 D4: CN D pin A12 (switch state 1= open, 0= closed)
 D3: CN D pin A13 (switch state 1= open, 0= closed)
 D2: CN D pin A14 (switch state 1= open, 0= closed)
 D1: CN D pin A15 (switch state 1= open, 0= closed)
 D0: CN D pin A16 (switch state 1= open, 0= closed)

 Port C (DIP switch A)

 D7: Switch 1 (1= off, 0= on)
 D6: Switch 2 (1= off, 0= on)
 D5: Switch 3 (1= off, 0= on)
 D4: Switch 4 (1= off, 0= on)
 D3: Switch 5 (1= off, 0= on)
 D2: Switch 6 (1= off, 0= on)
 D1: Switch 7 (1= off, 0= on)
 D0: Switch 8 (1= off, 0= on)

 Port D (DIP switch B)

 D7: Switch 1 (1= off, 0= on)
 D6: Switch 2 (1= off, 0= on)
 D5: Switch 3 (1= off, 0= on)
 D4: Switch 4 (1= off, 0= on)
 D3: Switch 5 (1= off, 0= on)
 D2: Switch 6 (1= off, 0= on)
 D1: Switch 7 (1= off, 0= on)
 D0: Switch 8 (1= off, 0= on)

 Port E

 D3: (Not connected)
 D2: (Not connected)
 D1: (Not connected)
 D0: (Not connected)

 ----------------------------------------------------------------------------
 Analog inputs
 ----------------------------------------------------------------------------

 An ADC0801 (single channel ADC) is used along with a multiplexer to provide
 eight (six usable) analog inputs.

 The ADC is typically accessed at any odd address within $130001-$13FFFF.
 Writing to it will start the conversion process; /INTR will remain high
 until the conversion has finished. Then /INTR will remain low until the ADC
 is read, returning an 8-bit value.

 Bits 5-3 of I/O chip #1 port C select one of eight analog inputs to be
 sampled. Inputs 6 and 7 are tied to ground, and their digitized
 representation is always zero.

 With nothing connected to a given input, it tends to be at a mid-range level
 ($50-$80) after power-up and decay over several minutes to values in the
 range of $08-$1F.

 The ADC0801 is clocked by the E output of the main 68000; this gives it
 an effective rate of 1.25 MHz.

 ----------------------------------------------------------------------------
 Sound hardware
 ----------------------------------------------------------------------------

 Timing

 Z80 @ 4 MHz
 YM2151 @ 4 MHz
 315-5218 @ 16MHz (input clock, operating frequency unknown)

 Z80 memory map

 0000-EFFF : ROM (IC17)
 F000-F7FF : 315-5218 memory (256 bytes) (IC10, IC9)
 F800-FFFF : Work RAM (IC16)

 The upper 4K of ROM is inaccessible.

 Z80 port map

 00-3F : YM2151 register status and data
 40-7F : Sound command
 80-FF : Unused

 There is no hardware mapped to port $C0, though some games will write to
 it during their startup routine.

 Interrupts

 /INT - From the YM2151 timers
 /NMI - Triggered when a sound command is issued by the main CPU.

 Overview

 The 315-5218 can play back 16 channels of 8-bit PCM data in stereo. It
 has no internal registers, instead it is connected to 4K of RAM (only 256
 bytes are accessible) that stores settings for each channel.

 Sample banking (preliminary)

 The sample ROM address bus is 16 bits wide, and multiplexed so the lower
 16 bits are output when /GL is high, and the upper 16 bits are output when
 /GL is low.

 External hardware manages ROM selection based on the upper bits, which
 are used as follows when /GL is asserted:

 DD15 (SA31) - Unused
 DD14 (SA30) - Unused
 DD13 (SA29) - Unused
 DD12 (SA28) - Unused
 DD11 (SA27) - Unused
 DD10 (SA26) - Unused
 DD9  (SA25) - Unused
 DD8  (SA24) - Unused
 DD7  (SA23) - Unused
 DD6  (SA22) - ROM select bit 1
 DD5  (SA21) - ROM select bit 0
 DD4  (SA20) - Sample ROM(s) A16
 DD3  (SA19) - Unused
 DD2  (SA18) - Unused
 DD1  (SA17) - Unused
 DD0  (SA16) - Unused

 The select bit values are:

 DD6 DD5
  0   0     IC11
  0   1     IC12
  1   0     IC13
  1   1     None selected (data returned is always $FF)

 Sample address         ROM     ROM offset

 $00000000-$000FFFFF    IC11    $000000-$00FFFF
 $00100000-$001FFFFF    IC11    $100000-$01FFFF
 $00200000-$002FFFFF    IC12    $000000-$00FFFF
 $00300000-$003FFFFF    IC12    $100000-$01FFFF
 $00400000-$004FFFFF    IC13    $000000-$00FFFF
 $00500000-$005FFFFF    IC13    $100000-$01FFFF

 Sound output

 The 315-5218 output has a resolution of 12 bits; however only the upper 10
 bits are sent to a 10-bit DAC and the lower 2 are unused.

 ----------------------------------------------------------------------------
 Miscellaneous
 ----------------------------------------------------------------------------

 The main CPU can access the sub CPU address space at any time, the sub CPU
 is halted while an access occurs.

 On power-up, the sub CPU is running. To synchronize with the main CPU, it
 typically enters a loop waiting for RAM to change.

 The main CPU can reset the sub CPU at by executing a RESET instruction at
 any time.

 When reading "open bus" locations on the sub CPU side through the main CPU,
 using an instruction that performs consecutive memory accesses allows the
 data bus of the sub CPU to be read at each cycle.

 For example, here is a program the main CPU would execute:

 move.l   #'SEGA', $29C000
 reset                          ; Reset sub CPU
 movem.l  $2F0000, d0-d7/a0-a7  ; Read memory continuously
 movem.l  d0-d7/a0-a7, buffer   ; Store result

 The sub CPU has the following vector table and startup code sequence in
 this example:

 SP:      $000A4000                         ; 000000 00 0A 40 00
 PC:      $00000406                         ; 000004 00 00 04 06
 MOVE     #$2700,SR                         ; 000406 46 FC 27 00 
 CLR.L    $0009C000                         ; 00040A 42 B9 00 09 C0 00 
 MOVE.L   $0009C000,D0                      ; 000410 20 39 00 09 C0 00 
 CMPI.L   #$44414920,D0                     ; 000416 0C 80 44 41 49 20 
 BNE.S    *-$0C       [00000410]            ; 00041C 66 F2 
 MOVEQ    #$00,D0                           ; 00041E 70 00

 Data read back is:

 FFFF   Internal operation (end of reset)
 000A   Stack pointer high word
 4000   Stack pointer low word
 0000   Program counter high word
 0406   Program counter low word
 46FC   Opcode (move.w #$2700, sr)
 2700   Operand
 42B9   Opcode (clr.l $0009C000)
 42B9   ?
 0009   Operand high word
 C000   Operand low word
 2039   Opcode (move.l $0009C000, d0) (loop start)
 5345   Data @ $09C000 ("SE", should have been cleared?)
 4741   Data @ $09C002 ("GA", should have been cleared?)
 0009   Operand high word
 0000   ?
 0000   ?
 C000   Operand low word
 0C80   Opcode (cmpi.l #$44414920, d0)
 0000   Data @ $09C000 (now zero)
 0000   Data @ $09C002 (now zero)
 4441   Operand high word
 4920   Operand low word
 66F2   Opcode (bne.s loop)
 7000   Prefetch value (moveq #$00, d0)
 2039   Start of loop again

 After the RESET instruction, a single NOP will skip one cycle on the sub
 CPU side, so you can get a detailed view of the sub CPU bus activity down
 to the per-cycle level.

 ----------------------------------------------------------------------------
 315-5290
 ----------------------------------------------------------------------------

                +----v----+
           MA21 |01 i   20| VCC
           MA20 |02 i o 19| /DTAP0
           MA19 |03 i o 18| /COLOR
           MA18 |04 i o 17| /MMCS
           MA17 |05 i o 16| /MCCS
           MA16 |06 i o 15| /RAM_1
           MA15 |07 i o 14| /RAM_0
           MA14 |08 i o 13| /ROM_1
           /MAS |09 i o 12| /ROM_0
            GND |10   i 11| /RESET
                +---------+

 /ROM_0 asserted when /MAS low for $000000-$03FFFF.
 /ROM_1 asserted when /MAS low for $040000-$07FFFF.
 /RAM_0 asserted when /MAS low and /RESET high for $0A0000-$0BFFFF and $3FC000-$3FFFFF..
 /RAM_1 asserted when /MAS low and /RESET high for $080000-$09FFFF and $3F8000-$3FBFFF..
 /MCCS asserted when when /MAS low for $0E8000-$0EBFFF.
 /MMCS asserted when when /MAS low for $0E0000-$0E3FFF.
 /COLOR asserted when when /MAS low for $120000-$12FFFF.
 /DTAP0 asserted when /MAS and:
    /RESET low for $000000-$07FFFF, $0E0000-$0E3FFF, $0E8000-$0EBFFF, $120000-$12FFFF,
    /RESET high for $080000-$0BFFFF and $3F8000-$3FFFFF.         

 - RAM is disabled during a reset.
 - DTACK is generated for both ROMs, 315-5248 registers, 315-5250 registers, color RAM, and work RAM.

 ----------------------------------------------------------------------------
 315-5291
 ----------------------------------------------------------------------------

                +----v----+
           MA21 |01 i   20| VCC
           MA20 |02 i o 19| /OTHER
           MA19 |03 i o 18| /MDCS 
           MA18 |04 i o 17| /MSCS
           MA17 |05 i o 16| /VRAM
           MA16 |06 i o 15| /OBJ  
           MA15 |07 i o 14| /ADC  
           MA14 |08 i o 13| /OBJBK 
           /MAS |09 i o 12| /IO   
            GND |10   i 11| MRD  
                +---------+

 /IO asserted when /MAS low for $140000-$17FFFF
 /OBJBK asserted when /MAS low and MRD low for $110000-$11FFFF.
 /ADC asserted when /MAS low for $130000-$13FFFF
 /OBJ asserted when /MAS low for $100000-$10FFFF.
 /VRAM asserted when /MAS low for $0C0000-$0DFFFF.
 /MSCS asserted when /MAS low for $200000-$2FFFFF.
 /MDCS asserted when /MAS low for $0E4000-$0E7FFF.
 /OTHER asserted for: $0C0000-$0DFFFF, $100000-$10FFFF, $120000-$17FFFF,

 - The range $170000-$17FFFF is unused.
 - /OTHER enables buffers on data bus MDC.

 ----------------------------------------------------------------------------
 315-5278
 ----------------------------------------------------------------------------

                +----v----+
           SD16 |01 i   20| VCC
           SD17 |02 i o 19| A16/BOE     
           SD18 |03 i o 18| AOE/B16     
           SD19 |04 i o 17| C16/DOE     
          ADLCH |05 i o 16| COE/D16     
            A/B |06 i o 15| /CG_0       
            C/D |07 i o 14| /CG_1       
        A16/BOE |08 i o 13| /CG_2       
         (N.C.) |09 i o 12| /CG_3       
            GND |10   o 11| /CG_3      
                +---------+

 /CG_0 is /CE for IC102, IC98, IC94, IC90
 /CG_1 is /CE for IC103, IC99, IC95, IC91
 /CG_2 is /CE for IC104, IC100, IC96, IC92
 /CG_3 is /CE for IC105, IC101, IC97, IC93

 A16/BOE goes to ROM pin 24 for IC102, IC98, IC94, IC90, IC103, IC99, IC95, IC91
 AOE/B16 goes to ROM pin 2 for IC102, IC98, IC94, IC90, IC103, IC99, IC95, IC91
 C16/DOE goes to ROM pin 24 for IC104, IC100, IC96, IC92, IC105, IC101, IC97, IC93
 COE/D16 goes to ROM pin 2 for IC104, IC100, IC96, IC92, IC105, IC101, IC97, IC93

 Pins 11,12 are tied together.
 Pin 8 is an input from pin 19.

 Pin A/B is connected to a jumper to select the type of data output
 on the A16/BOE and AOE/B16 pins:

 A/B    A16/BOE     AOE/B16
  1     ROM A16     ROM /OE     MASK pinout (A16 and /OE swapped)
  0     ROM /OE     ROM A16     JEDEC pinout (standard)

 C/D    C16/DOE     COE/D16
  1     ROM A16     ROM /OE     MASK pinout (A16 and /OE swapped)
  0     ROM /OE     ROM A16     JEDEC pinout (standard)

 ----------------------------------------------------------------------------
 Video priority mixer
 ----------------------------------------------------------------------------

 IC127 is the video priority mixer. I'll discuss the general connections to
 this chip that apply to 315-5279, 315-5304, etc.

                +----v----+
            /6M |01 i   20| VCC
           CCS1 |02 i o 19| CAD10   
           CCS2 |03 i o 18| /OBJ    
           /FIX |04 i o 17| /SCR    
            /SA |05 i o 16| CAD11   
            /SB |06 i o 15| CAD12   
            RC3 |07 i x 14| (N.C.)  
            RC4 |08 i o 13| /RCAD   
          OBJ15 |09 i x 12| (N.C.)  
            GND |10     11| GND
                +---------+

 /6M   - Pixel clock
 CCS1  - Tilemap background priority
 CCS2  - Tilemap foreground priority
 /FIX  - Tilemap text layer opacity
 /SA   - Tilemap foreground opacity
 /SB   - Tilemap background opacity
 RC3   - Road layer priority
 RC4   - Road layer priority
 OBJ15 - Sprite framebuffer data bit 15
 /RCAD - Enables pixel bus output from 315-5275; and disables pixel bus
         output from 315-5197.
 CAD12 - Color RAM address bit 12
 CAD11 - Color RAM address bit 11
 CAD10 - Color RAM address bit 10
 /OBJ  - Enables output of OBJ8-OBJ15 to CAD4-10
 /SCR  - Enables output of CA4-7 to CAD4-7

 Part of the tilemap and road generator pixel bus are tied together, however
 only one or the other can be enabled.

 The tilemap chip has a pixel bus input which was originally used to accept
 data from the System 16B sprite line buffers. Here are it's connections
 for that platform and from the X-Board framebuffer:

 Signal     System 16B          X-Board
                 
 CD0        OBJ0 (Pixel 0)      OBJ0 (Pixel 0)
 CD1        OBJ1 (Pixel 1)      OBJ1 (Pixel 1)
 CD2        OBJ2 (Pixel 2)      OBJ2 (Pixel 2)
 CD3        OBJ3 (Pixel 3)      OBJ3 (Pixel 3)
 CD4        OBJ4 (Palette 0)   !OBJ0 (Pixel 0)    
 CD5        OBJ5 (Palette 1)    OBJ1 (Pixel 1)    
 CD6        OBJ6 (Palette 2)   !OBJ2 (Pixel 2)    
 CD7        OBJ7 (Palette 3)    OBJ3 (Pixel 3)    
 CD8        OBJ8 (Palette 4)    OBJ6 (?)
 CD9        OBJ9 (Palette 5)    OBJ6 (?)
 CD10       OBJ10 (Priority 0)  OBJ4 (?)
 CD11       OBJ11 (Priority 1)  OBJ5 (?)

 The tilemap generator outputs the shadow/hilight enable signal.
 For System 16B this happens when the sprite palette is $3F (OBJ4-9 are set).

 Sprites have their own shadow/hilight enable bit and a specific pen used
 for this mode. Based on the above, the sprite pixel stream has to be:

 MSB             LSB
 xxxx xxxx ?1xx 1010

 This assigns the shadow/hilight color to pen $A. We can therefore assume
 the following layout:

 OBJ3-OBJ0      Pixel data from ROM
 OBJ5-OBJ4      Sprite priority (bits 13-12 of word $3) (priority between sprites and tilemaps ONLY; not counting purpose of OBJ15)
 OBJ6           Sprite shadow/hilight control (bit 14 of word $3, 0=normal, 1=shadow/hilight)
 OBJ7           Not used
 OBJ15-OBJ8     Sprite palette (bits 7-0 of word $7)

 Normally OBJ15 would drive the most significant bit of the color RAM bus,
 instead this is fed to IC127 which does the same thing. So OBJ15 may
 double as a priority bit or have some additional function.

 The tilemap chip has a second bus for outputting mixed tilemap and sprite
 data, which was used to directly address color RAM for System 16B:

            System 16B      System 16B      X-Board     X-Board 
            Tilemap         Sprite          Tilemap     Sprite
 CA0        Pixel 0         Pixel 0         Pixel 0     Pixel 0
 CA1        Pixel 1         Pixel 1         Pixel 1     Pixel 1
 CA2        Pixel 2         Pixel 2         Pixel 2     Pixel 2
 CA3        Palette 0       Pixel 3         Palette 0   Pixel 3
 CA4        Palette 1       Palette 0       Palette 1   ?
 CA5        Palette 2       Palette 1       Palette 2   ?
 CA6        Palette 3       Palette 2       Palette 3   ?
 CA7        Palette 4       Palette 3       Palette 4   ?
 CA8        Palette 5       Palette 4       Palette 5   ?
 CA9        Palette 6       Palette 5       Palette 6   ?
 CA10       Fixed '0'       Fixed '1'       Fixed '0'   ?

 The color RAM bus is composed of the following:

 CAD = Tilemap/Object generator pixel bus (was CA from the tilemap pixel bus output)
 MC  = Road generator pixel bus
 OBJ = Object generator pixel bus

 CAD0       CA0 or MC0
 CAD1       CA1 or MC1
 CAD2       CA2 or MC2
 CAD3       CA3 or MC3
 CAD4       OBJ8  (/OBJ) or CA4 (/SCR) or MC4 (/RCUL) or fixed '1' (pull-up resistor)
 CAD5       OBJ9  (/OBJ) or CA5 (/SCR) or MC5 (/RCUL) or fixed '1' (pull-up resistor)
 CAD6       OBJ10 (/OBJ) or CA6 (/SCR) or MC6 (/RCUL) or fixed '1' (pull-up resistor)
 CAD7       OBJ11 (/OBJ) or CA7 (/SCR) or MC7 (/RCUL) or fixed '1' (pull-up resistor)
 CAD8       OBJ12 (/OBJ) or CA8 (/SCR) or MC8 (/RCUL) or fixed '1' (pull-up resistor)
 CAD9       OBJ13 (/OBJ) or CA9 (/SCR) or MC9 (/RCUL) or fixed '1' (pull-up resistor)
 CAD10      OBJ14 (/OBJ) or fixed '1' (pull-up resistor)
 CAD11      From IC127 pin 14
 CAD12      From IC127 pin 15

 * Line of Fire doesn't have the pull-up resistor, the values tend to always
   be zero though they technically are floating.

 ----------------------------------------------------------------------------
 315-5280
 ----------------------------------------------------------------------------

                +----v----+
             A6 |01 i   20| VCC
             A7 |02 i o 19| /ZCS          
            A11 |03 i i 18| DD4           
            A12 |04 i o 17| SA16          
            A13 |05 i o 16| /DACS         
            A14 |06 i o 15| /FMCS         
            A15 |07 i o 14| /RAMCS        
          /MREQ |08 i o 13| /ROMCS        
          /IORQ |09 i i 12| /GL           
            GND |10   i 11| /M1           
                +---------+

 /FMCS is asserted for I/O ports $00-$3F. (YM2151)
 /ZCS is asserted for I/O ports $40-$7F. (Sound command latch from 315-5250)
 /RAMCS is asserted for memory $F800-$FFFF. (2K work RAM)
 /ROMCS is asserted for memory $0000-$EFFF. (64K program ROM)
 /DACS is asserted for memory $F000-$F7FF. (315-5218)

 SA16 follows DD4 when /GL is low, else SA15 is high.

 ----------------------------------------------------------------------------
 Assistance Needed
 ----------------------------------------------------------------------------

 The Line of Fire manual says IC127 (video priority mixer) is a custom part,
 and it seems to be different for each game. Here's a list of what I have
 so far:

 Game               Part No.
 After Burner       315-5279
 Line of Fire       315-5304
 GP Rider           ?
 Super Monaco GP    ?
 AB Cop             ?
 Thunder Blade      ?
 Last Survivor      ?

 I'd like to get better quality scans of the After Burner schematics,
 particularly of sheet 9.

 ----------------------------------------------------------------------------
 Board information
 ----------------------------------------------------------------------------

 "Line of Fire" (Japan version)

 Main CPU: FD1094 (315-0134)
 Sub CPU:  68000

 Board numbers:

 834-7218 (label)
 834-6335 (silkscreen)

 Jumper settings

 S1  = Open
 S2  = Closed

 S3  = Resistor
 S4  = Open

 S5  "MASK"  = Resistor         IC20,29 pin 24 is SA17      (27C100)
 S6  "JEDEC" = Open             IC20,29 pin 24 is /CE_0     (27C010)
 S7  "MASK"  = Resistor         IC20,29 pin 2 is /CE_0      (27C100)
 S8  "JEDEC" = Open             IC20,29 pin 2 is SA17       (27C010)

 S9  "MASK"  = Resistor         IC21,30 pin 24 is SA17      (27C100)
 S10 "JEDEC" = Open             IC21,30 pin 24 is /CE_0     (27C010)
 S11 "MASK"  = Resistor         IC21,30 pin 2 is /CE_0      (27C100)
 S12 "JEDEC" = Open             IC21,30 pin 2 is SA17       (27C010)

 S13 = Open                     IC40 pin 1 to +5V                  (27C256)
 S14 = Resistor                 IC40 pin 1 to 315-5275 pin (H2) 15 (27C512)

 S15 = Resistor         
 S16 = Open             
 S17 = Open             

 S18 "MASK"  = Resistor         IC58,63 pin 24 is MAB17     (27C100)
 S19 "JEDEC" = Open             IC58,63 pin 24 is /ROM_0    (27C010)
 S20 "MASK"  = Resistor         IC58,63 pin 2 is /ROM_0     (27C100)
 S21 "JEDEC" = Open             IC58,63 pin 2 is MAB17      (27C010)

 S22 "MASK"  = Resistor         IC57,62 pin 24 is MAB17   (27C100)
 S23 "JEDEC" = Open             IC57,62 pin 24 is /ROM_0  (27C010)
 S24 "MASK"  = Resistor         IC57,62 pin 2 is /ROM_0   (27C100)
 S25 "JEDEC" = Open             IC57,62 pin 2 is MAB17    (27C010)

 S26 = Open                     315-5278 A/B to GND
 S27 = Open                     315-5278 C/D to GND
 S28 = Resistor                 315-5278 A/B to +5V
 S29 = Resistor                 315-5278 C/D to +5V

 S30 = Resistor

 S31 = Open
 S32 = Resistor

 S33 = Resistor         
 S34 = Open             

 S35 = Open                     MB3773 CK from /WDC (I/O chip #1 port C bit 6)
 S36 = Resistor                 MB3773 CK from /GXINT (V-Blank interrupt)

 MOV-SW (IC80 "F373")
 Resistors across all 8 pads

 MOV-SW (IC81 "F373")
 Resistors across all 8 pads

 ROMs

 Part Number    Pos.    Type                            Purpose

 EPR-12775      IC93    Mitsubishi M5M27C100K-2         Object
 EPR-12779      IC92    Mitsubishi M5M27C100K-2         Object
 EPR-12783      IC91    Mitsubishi M5M27C100K-2         Object
 EPR-12787      IC90    Mitsubishi M5M27C100K-2         Object
 EPR-12776      IC97    Mitsubishi M5M27C100K-2         Object
 EPR-12780      IC96    Mitsubishi M5M27C100K-2         Object
 EPR-12784      IC95    Mitsubishi M5M27C100K-2         Object
 EPR-12788      IC94    Mitsubishi M5M27C100K-2         Object
 EPR-12777      IC101   Mitsubishi M5M27C100K-2         Object
 EPR-12781      IC100   Mitsubishi M5M27C100K-2         Object
 EPR-12785      IC99    Mitsubishi M5M27C100K-2         Object
 EPR-12789      IC98    Mitsubishi M5M27C100K-2         Object
 EPR-12778      IC105   Mitsubishi M5M27C100K-2         Object
 EPR-12782      IC104   Mitsubishi M5M27C100K-2         Object
 EPR-12786      IC103   Mitsubishi M5M27C100K-2         Object
 EPR-12790      IC102   Mitsubishi M5M27C100K-2         Object

 OPR-12791      IC154   Texas Instruments 27C512-2      Fix
 OPR-12792      IC153   Texas Instruments 27C512-2      Fix
 OPR-12793      IC152   Texas Instruments 27C512-2      Fix

 EPR-12794      IC58    Mitsubishi M5M27C100K-2         Main program
 EPR-12795      IC63    Mitsubishi M5M27C100K-2         Main program
 Unused         IC57    "1M-EP" on silkscreen           Main program
 Unused         IC62    "1M-EP" on silkscreen           Main program

 EPR-12798      IC17    Texas Instruments 27C512-15     Sound program

 EPR-12799      IC11    Mitsubishi M5M27C100K-2         Sound data
 EPR-12800      IC12    Mitsubishi M5M27C100K-2         Sound data
 EPR-12801      IC13    Mitsubishi M5M27C100K-2         Sound data

 EPR-12802      IC21    Mitsubishi M5M27C100K-2         Sub program
 EPR-12803      IC30    Mitsubishi M5M27C100K-2         Sub program
 EPR-12804      IC20    Mitsubishi M5M27C100K-2         Sub program
 EPR-12805      IC29    NEC D27C1000A-12                Sub program

 Unused         IC40    "27C512" on silkscreen          Road

 ----------------------------------------------------------------------------
 Credits and Acknowledgements
 ----------------------------------------------------------------------------

 - B.Moto for generously donating a "Line of Fire" board.
 - Spies Wiretap Archive for the After Burner schematics.

 ----------------------------------------------------------------------------
 Disclaimer
 ----------------------------------------------------------------------------

 If you use any information from this document, please credit me
 (Charles MacDonald) and optionally provide a link to my webpage
 (http://cgfm2.emuviews.com/) so interested parties can access it.

 The credit text should be present in the accompanying documentation of
 whatever project which used the information, or even in the program
 itself (e.g. an about box).

 Regarding distribution, you cannot put this document on another
 website, nor link directly to it.

 ----------------------------------------------------------------------------

 TO DO:
 - Divide chip (read/write order seems important)
 - Road layer (switch lists on VBlank)
 - Tilemaps (scroll registers latched in VBlank, what about row/col tables?)
 - How are sample address bits 15-0 selected? What values are actually
   used for the upper 16 bits?
 - Can't display a sprite using entry #255? Any kind of list flow control?
 - OBJ15 relating to priority. (road?)
 - Is CAD10 an output or an input? (if input, either '1' or driven by OBJ14)