Hummer DTV FAQ
Part 1: Intro
__________
1.1 Credits
Part 2: Hummer DTV Background
Part 3: Websites
__________
3.1 Personal
__________
3.2 Other
Part 4: Standard Hardware
Part 5: Game Mode (standard startup mode)
Part 6: Test Mode (unmodified unit)
Part 7: Basic-Language Mode
__________
7.1 Intro
__________
7.2 Entering Basic Mode
__________________
Table 1 Basic Screen
__________
7.3 "Warm" reset (RESTORE & RUN/STOP)
__________
7.4 Loading the flash directory "scan":
Part 8: Key Mapping
__________________
Table 2 Keys
Part 9: Hardware -- Pin outs
__________
9.1 Labeled Pins
__________________
Table 3 Test Pins (from REV 2 Schematic):
__________________
Table 4 Other labeled pins
__________
9.2 Other Hackable pins: Userport
__________________
Table 5 Userport Addr
__________
9.3 Paddle Pot
__________________
Table 6 Paddle
__________
9.4 Video Initialization
__________________
Table 7 Video Init
__________________
Table 8 Video-Settings Pins
__________
9.5 RS-232
__________________
Table 9 RS-232 and Handshakeing from Userport (CIA)
__________
9.6 Hacking the Userport
__________
9.7 Other info on Pins:
Part 10: Keyboard interface
__________________
Table 10 Keyboard Connections
Part 11: IEC Serial Port
__________________
Table 11 IEC Connections
Part 12: S-Video Mod
Part 13: On-Board Power Regulator
__________
13.1 General info
__________
13.2 To do.
__________
13.3 Device specs
__________________
Table 12 Component Power Requirements
Part 14: Significant Memory Addresses
Part 15: DTVLOAD
Part 16: Flash Memory directory "list" format
Part 17: Flash Memory file format
Part 18: Reflashing ROM
Part 19: New CPU opcodes
__________
19.1 Symbolic names (Mnemonic):
__________________
Table 13 Opcode names
Part 20: Bugs and Patches
__________
20.1 Save Bug
__________
20.2 Fixes: (to do)
__________
20.3 Patching Start Mode
__________
20.4 Patching Video mode
__________
20.5 Video Fix
__________
20.6 Audio Fix
Part 21: Hummer-Specific Software
Part 22: PCB
Part 23: TIPS
Part 24: Footnotes
Last Revision (US/Eastern): Friday 24th of March 2006 09:37:31 AM
This document: Hummer DTV MOD FAQ
Part 1, Section 1 :
Credits
Thanks to (in no particular order):
Jeri, Adrian, Robin, Six, Daniel Kahlin, David Murray, Jeff Ledger, Jim Brain, Sean Cross, markco, Golan Klinger, pyrofer, MadModder, Roland, macbthpsw, suschman, axxis42,....
March, 2006
Compiled by D. Garmon
This material was largely culled from the DTVHacking forum at:
http://jledger.proboards19.com/index.cgi?board=dtvhacking&page=1
I have edited some content (usually concatenating several bit of info together), but not all. You may recognize your own words here. I have tried to give a "global shout-out" to everyone who contributed. If you've been left out, contact me and I'll gladly add your name to the list. And if you'd prefer real or screen name.
The Hummer game was sold in the USA by "Radio Shack" for the 2005 Christmas season. This NTSC-configured unit is a simple driving game, with a steering wheel connected to a pot and two buttons for additional control. The Hummer can be converted to PAL with some hardware and/or software mods.
This console is based on Rev 3 of the DTV ASIC (Application-Specific Integrated Circuit), which emulates the function of a Commodore 64 computer. The chip, designed primarily by Jeri Ellsworth, has also appeared in other "video-game-in-a-joystick" products, most notably the C64 DTV. All the chips, including custom chips (6510, SID, VIC-II, CIA, RAM & ROM addressing) of a c64 are emulated on the DTV ASIC. The actual RAM and ROM are external to the ASIC.
The C64 DTV was released in two versions, the first (2004) a landmark but somewhat less modable unit. The Rev 2 C64 DTV (2005) is very similar to the Hummer, but the Hummer has a slight edge in hardware sophistication. The C64 DTV arguably has an edge in gameplay hackability, as both joystick ports can be tapped. The Hummer has better flash memory, capable of many more write/erase cycles than the C64 DTV. And the Hummer has bidi userport lines and one paddle port (emulated w/an A/D conv.)
The unit is powered by 4 AA batteries (6V), which is stepped down to ~3.3v by the onboard regulator. Most modders replace battery power with a regulated 5V supply, which can supply both the main board and an add-on PS/2 keyboard.
For the price, they do a remarkable job of emulating C64 hardware. The ASIC, in fact, was designed in much greater depth than is required for the "joygame" market. This has enabled modders to add keyboards, C64 diskdrives, external joysticks and paddles, I/O devices and more.
Adding to the original c64 functionality are several additional hardware and software features. These include DMA transfer, Blitter, Additional CPU registers, extended CPU instructions, greater color depth, etc.
The unit is not without flaws, however. Cost-cutting during production led to quality issues in the video, audio and power supply circuitry. Despite this, the product functions quite well even without modification.
Originally selling for about $30 US, at this writing (Mar 2006) they have been discounted to $20. Further future discounts are possible (rumoured only.) The future is uncertain for the Hummer, the C64 DTV and the DTV ASIC.
Part 3, Section 1 :
Personal
DTVHacking in the PETCII forums:
http://jledger.proboards19.com/index.cgi?board=dtvhacking
DTV hacking forum in German:
http://www.forum-64.de/wbb2/board.php?boardid=155
DTV group on Yahoo!
http://games.groups.yahoo.com/group/DTVTalk/
David Murray:
http://galaxy22.dyndns.org/misc/hummerdtv/index.html
Daniel Kahlin:
http://www.kahlin.net/daniel/dtv/index.php
Mr. Latch-up:
http://www.geocities.com/dtvhacking/
DTVhacking:
http://www.dtvhacking.info/
The "DTVprogramming" PDF:
http://www.orrville.net/dtvhacking/DTVprogramming.pdf
http://galaxy22.dyndns.org/misc/hummerdtv/DTVprogramming.pdf
Disassembly of the Hummer kernal (DTV changes to stock kernal)
http://www.kahlin.net/daniel/dtv/flash/hummer_kernal.txt
Six's port guide (C64DTV specific, but very helpful):
http://thedarkside.ath.cx/dtv/ports.html
Part 3, Section 2 :
Other
Wikipedia
C64 DTV:
http://en.wikipedia.org/wiki/C64_Direct-to-TV
The designer:
http://en.wikipedia.org/wiki/Jeri_Ellsworth
NYTimes story on designer (cached)
http://www.theonelab.com/files/mirrors/c64_joystick_girl.html
Mammoth Toys (this site doesn't play well with Firefox)
http://www.mammothtoys.com/
Toy:Lobster:
http://www.c64dtv.co.uk/
DC-Studios (game designers):
http://www.dc-studios.com/
Game unit includes:
Yellow plastic body
Start switch
LED "ON" indicator
Reset Button (Hard Reset)
Steering Wheel with Two control buttons
Battery compartment
Hokey stickers on front
On powerup, the unit will boot automatically into the "Hummer Off-Road Racing" game.
On powerup, hold button A. The screen will pause, while displaying a rotating Hummer in each corner of the screen. Pressing button B loads the next screen, the test diagnostic.
TEST includes a color scale on the left side, and on the right side a diagnostic of the wheel potentiometer and buttons. As you turn the wheel, a series of numbers are displayed. Also on the right is a test grid for buttons (the grid could accomodate a full joystick, though no is connected to the hummer.)
Concurrently, a RAM test program runs at the bottom of the screen. When it's done, the unit locks up. A cold reset or cycling the power is needed to restore function.
TEST can be run from Basic mode also, see below.
Part 7, Section 1 :
Intro
The Hummer can be forced into a modified C64 Basic mode quite easily, although not without modification (See Keyboard mod.) This mode begins with an automatic file-loading routine, DTVLOAD. The DTVLOAD must be cancelled with a keypress to enter Basic.
Part 7, Section 2 :
Entering Basic Mode
Holding down TAB, LEFT or RIGHT CTRL during startup brings up the DTVLOAD/Basic screen:
Table 1 : Basic Screen
**** COMMODORE 64 BASIC V2 ****
64K RAM SYSTEM 38911 BASIC BYTES FREE
WAITING FOR DTVLOAD. ANY KEY FOR BASIC
If you release the key within a certain period, the unit will wait for a DTVLOAD transfer. Any subsequent keypress will drop into Basic Mode. So leaving the above keys pressed during startup will (generally) result in the READY prompt and flashing cursor which denote Basic Mode.
Sometimes the unit locks up and won't display READY or enter Basic. In these cases, a quirk of the keyboard input has fooled the unit into believing that a DTVLOAD has been initiated. Reset and try again.
When initialized in this way, the opening screen will be monocromatic. This can be fixed by reflashing the ROM, or using David Murray's tips below.
Occasionally the keyboard output will not match the keypress. Pressing SHIFT or Caps-Lock will usually solve the problem.
Part 7, Section 3 :
"Warm" reset (RESTORE & RUN/STOP)
Hold down ESC, and hit PAUSE/BREAK
Unit can be "warm reset" at any point in Game Mode--opening credits, user entry mode or help screens, even during the game itself. This will drop you into basic, with full color. However, any additional drives (devices 8,9) will not be recognized.
DG NOTE: Reset unit and Hold "DEL" key (joy A). When TEST prog starts, press Esc & Pause/Break. There is no hurry, TEST begins with the "rotating cars" screen, and it stays there until RETURN (joy B) is pressed. Hummer unit will now display full color in Basic Mode, but this bypasses the standard DTVLOAD opening screen (again, no IEC drives.) Once TEST moves to color pallet/sound/IO testing screen, it cannot be exited without hard reset (reset button.)
From the BASIC prompt, load and run "HUMMER", which runs the default-mode hummer game. A modder can also load and run "TEST", which produces the factory test that is run when Joy A is held down at start.
The TEST routine is machine-lang and coded into the kernal, it's not a stand-alone program loaded from flash memory (of course, the kernal itself is loaded from flash.)
Part 7, Section 4 :
Loading the flash directory "scan":
load "$"
list
You'll get a dir list of all the accessible flash mem programs, followed by the ROM REV NO.:
2005 08 22 03:16:34
In the Hummer, all the files are part of the console game (except for TEST, which is a jump vector to kernalROM test routine.)
LOAD "$" doesn't really scan the dir, as a true file system doesn't exist on the flash memory. Instead it loads a file named "$" which contains a listing of the available files. The flash memory routines have replaced the old tape routines in the kernal, so the default device (1) is now the flash.
Table 2 : Keys
Keys mapped as Joystick buttons:
Enter Joystick A button
Delete Joystick B button
other Keys:
RT ALT SHIFT/COMMODORE (toggle upper/lower char banks)
ESC & PAUSE/BREAK RESTORE & RUN/STOP
Keybd LEDs:
The num-lock key turns on the associated Keybd LED indicator. Caps-Lock and Scroll-lock do not.
Part 9, Section 1 :
Labeled Pins
Table 3 : Test Pins (from REV 2 Schematic):
TP1 IECAtn IEC Serial
TP2 KeyboardData PS/2 Keyboard
TP3 KeyboardClk PS/2 Keyboard
TP4 PAL_nNTSC TMODE
TP5 AudioOut audio
TP6 TestPort3 CPUAddressEn
TP7 TestPort2 Clk1mhzEn
TP8 IECClk IEC Serial
TP9 IECData IEC Serial
TP10 TestPort1 PA2 (userport)
TP11 CompositeOut video
Table 4 : Other labeled pins
JoyB0 Joystk B0 Joystick $DC01
JoyB1 Joystk B1 Joystick $DC01
JoyA0 Joystk A0 Joystick $DC00
Bat+ powerin + (unregulated +6v)
Bat- powerin -
LED LED anode To switch daughter board
DIS cap discharge (pwr off) To switch daughter board
GND Board ground To switch daughter board
L- LED cathode To switch daughter board
Rs Reset (to GND) To switch daughter board
Part 9, Section 2 :
Other Hackable pins: Userport
Table 5 : Userport Addr
Address
Addr $DD01
Part 9, Section 3 :
Paddle Pot
Table 6 : Paddle
PB0 User0 Unmarked, but verified (see photo)
PB1 User1 Unmarked, but verified (see photo)
PB2 User2 Unmarked, but verified (see photo)
The "paddle" ADC (Analog-to-Digital Converter) hardware uses these three lines. They are connected to unused solder pads as well as the ADC.
The small epoxy blob on the topside is the ADC. Next to it are through-vias labeled cad1 and cad2. A larger trace from that epoxy blob runs to the center pin of the potentiometer. The endpins of the pot are soldered to Vcc and GND, and together with the center pin they form a voltage divider for the ADC.
"It's using an ADC equivalent to a Sonix SNAD01C. It's a serial ADC, and the 3 wires (START, CLK, DIO) are hooked up to USR2-0."
The "paddle" circuit on the Hummer is radically different from the paddle section in the DTV Rev 2 schematic.
Part 9, Section 4 :
Video Initialization
Table 7 : Video Init
PB0-7 User0-7 Unmarked, but verified (see photo)
The user port inputs are also hard-wired to indicate to the unit which video mode and timing to use at startup (so that NTSC or PAL video can be set at the factory by switching resistors.) But this information can be kernal-patched, which frees all the port lines for other uses.
Table 8 : Video-Settings Pins
Pin: PAL: NTSC: Function:
-------------------------
USR[0] 1 0 Pal-Ntsc
USR[1] 1 0 PhaseAlt
USR[2] 0 0 Sat0
USR[3] 1 1 Sat1
USR[4] 0 0 BurstLock
USR[5] 0 0 Lockmode
USR[6] 0 0 Tune
USR[7] 1 0 PalBurst
-------------------------
(Daniel Kahlin)
Part 9, Section 5 :
RS-232
Table 9 : RS-232 and Handshakeing from Userport (CIA)
PA2 TP10 UserPA2
FLAG2 missing
NOTE: Either nIRQ or nNMI might function as FLAG2 on userport (don't count on it--they have different functions.) nIRQ and nNMI probably correspont to IRQ and NMI lines on 65xx processor. FLAG2 is IRQ line for CIA 2.
C64 hardware specs CIA IRQ as output only (CIA1, $DC00-$DCFF), FLAG2 as input only (CIA2, $D000-$D0FF.)
User5 (PB5) isn't assigned for RS232 operations.
However, the kernal RS-232 code might currently work in "3 line" (no handshakeing) rather than "X line" mode. Frankly, the C-64 documentation indicates that both FLAG2 and PA2 are needed for kernal rs-232 routines. 1 Of course, custom-coded RS-232 routines could always be applied to the port (and using the interrupt lines is an option to replace FLAG.)
It is pointed out (prominently) in the DTV programming guide that nIRQ and nNMI are bidi....
Part 9, Section 6 :
Hacking the Userport
Once the Hummer's video-initialization routines are patched to ROM, the resistors can be removed from the userport lines (add photo.) If all 8 userport lines are needed, the paddle ADC traces can also be cut (free up PB0-2.)
The userport is fully bidirectional, so there are few limits on its usage....
David Murray has wired the user port connections to a joystick to get all the needed input lines (5 total--4 direction and one button.) Will this become the standard Hummer joystick port? Time will tell.....
The core of this issue is that the joystick addr must be altered in games for DTV, and Hummers need a different addr than the C64 DTV.
Part 9, Section 7 :
Other info on Pins:
TLR : "...it says in the V2 manual that, among others, JoyA0-A5 / JoyB0-B5 / USR0-7 are bi-dir 5V-tolerant pins with internal pullups. Further down it is stated that all of those are open-collector pins. This is actually open-drain as the process most probably is CMOS, but it works the same way."
There are 26 bidi pins (not counting data and address busses--used together they would need some kind of latch.)
Although a keyboard was never planned for any product releases, one was certainly useful during development. The interface hardware/code remains in the ASIC. To make it sweeter, any standard PS/2 keyboard will work. And no extra components are needed; only a DIN jack for the connection. This is usually the first mod for any DTV device.
Table 10 : Keyboard Connections
Signal Board miniDIN (ps/2) DIN (PC/AT)
----------------------------------------------------------------------
KeyboardClk TP3 5 1
KeyboardData TP2 1 2
GND common 3 4
Vcc +5v 4 5
The on-board +3.3v is generally inadequate for keyboard, and +6v from
batteries will likely kill most keyboards.
Most modders feed the board with a regulated +5V supply and tap it for keybd also.
The Hummer also has a fully-implemented CBM-style serial port interface, so standard diskdrives such as the 1541, 1541II, 1571, 1581, etc. are supported!
Four connections are necessary:
Table 11 : IEC Connections
Signal Board DIN (6pin)
-----------------------------------------------------------------------
IECAtn TP1 3
IECClk TP8 4
IECData TP9 5
GND common 2
http://galaxy22.dyndns.org/misc/hummerdtv/svideo.html
Part 13, Section 1 :
General info
The Hummer (and C64 DTV) unit's on-board power regulator is much-maligned for it's design and current consumption (although it functions fine and I've never heard of one failing.) One thing is clear from the V2 schematic--the design specs called for an efficient IC regulator, not the discrete component version.
Part 13, Section 2 :
To do.
Include:
Jim Brain's photo of V1 discrete component schem
Switch/gnd issue
Discharge line
LED wired to replace zener
Part 13, Section 3 :
Device specs
DG: My Hummer draws ~140 mA. If the LED's drawing 15 mA, that's close to 11% of the total current. If the LED draws 20 mA (it's bright!) that's about 14%!
Table 12 : Component Power Requirements
AT49BV163A (flash mem) ~12 mA when fully active.
IS42S16100C1-7T (SDRAM) 70 to 170 mA when active, depending on the mode (seems like alot...)
(oops. 170 > 140. I guess it's not using that mode...)
SNAD01C ~500 uA (not even 1 mA. Assuming that's what's there...)
The DTV ASIC-- ?
Joysticks
JoyA $DC00
JoyB $DC01
The Hummer is wired with only two input lines for the joystick, which are used as control buttons in the game.
User Port $DD01
To do.
The "$" file (fake directory scan) is in the following format:
Directory Format
----------------
The directory is located at $010000-$013fff.
Each entry is 32 bytes long:
---
$00-$17 Filename max 24 bytes, padded with $00
$18-$1a Location of the file in flash.
$1b-$1d Load address of file in RAM.
$1e-$1f unused, always $00.
---
Directory scanning stops when the first byte of the entry is $00.
(Daniel Kahlin)
The contents of the flash (file-portion) don't match the entries in "$".
(David Murray)
The files stored in the Flash device are compressed with a simple run-length encoding scheme (similar to GIF files.)
(Although the Hummer encoding scheme is has been reported as different from the C64DTV, Daniel includes the same algorythm in the "hummer_kernal.txt" file.)
File Format
-----------
The files are compressed using a simple equal-sequence compression algorithm.
Every chunk of data starts with a code-byte.
If the code is $01-$7f, that number of bytes follow.
If the code is $80-$ff, then len=code & $7f, and a second byte follows
this copies len bytes of data from the current destination-$0100+secondbyte.
If the code is $00, then we are done.
To just store the data without any compression, put an $7f byte before every
127 bytes, and terminate with a $00 byte.
(Daniel Kahlin)
ROM write info (much credit to Daniel Kahlin on this issue):
http://jledger.proboards19.com/index.cgi?board=dtvhacking&action=display&thread=1133731077
Link to flashing utility (beta)
http://www.kahlin.net/daniel/dtv/flash.php
---------------------
From Adrian (dw):
Thought I'd drop a quick note on this subject. I wrote the flasher we used during the development of the PAL DTV.
The prototype used a diffferent kind of flash chips though: 4 x Winbond 29c040 (256-byte sectors, 512KB per chip). The Atmel used on the production units has 64KB sectors, except for the first or last 64k, depending on wether the part # ends on T (top) or B (bottom).
The principle is exactly the same though... unlock the flash chip with a 'magic' write sequence, issue an erase sector command, unlock again, issue a write command, write sector, wait for the chip to finish, verify, repeat till done (the winbond chips didn't need the erase sector part).
One suggestion though, and you probably already know this but just in case: copy your charset to ram and use it from ram. You really don't want the asic reading char/bitmap/etc data from the flash while you're trying to write to it.
We were led to believe all the production units would have flash, but I truly have no idea if the AT47 series is OTP or not. Best bet would be to try to write to one of the small unused 8K sectors at the end of the chip (SA38/39, $1fc000/1fe000, assuming a 'T' chip) and see what happens.
I wish I had a production unit to tinker with :)
If it does prove to be OTP, there's some interesting stuff in the reset routine that could be the next best thing to flashing your DTV.. I'm surprised nobody has noticed that ;)
--------------------
Part 19, Section 1 :
Symbolic names (Mnemonic):
Table 13 : Opcode names
Opcode Mnemonic Operand Description
---------------------------------------------------
$12 BRA (BRanch Always)
$32 SAC # (Set ACcumulator mapping)
$42 SIR # (Set Index Register mapping)
(Naming adopted by Daniel Kahlin and used in DTVMON)
The "DTVprogramming" PDF is the best source of hardware and low-level programming information specific to the DTV.
Part 20, Section 1 :
Save Bug
Discussion of bug
http://jledger.proboards19.com/index.cgi?board=dtvhacking&action=display&thread=1136228960
Part 20, Section 2 :
Fixes: (to do)
Part 20, Section 3 :
Patching Start Mode
Direct To Basic:
http://jledger.proboards19.com/index.cgi?board=dtvhacking&action=display&thread=1135883752
Part 20, Section 4 :
Patching Video mode
(and converting NTSC<->PAL) to do
Part 20, Section 5 :
Video Fix
http://galaxy22.dyndns.org/misc/hummerdtv/video.html
Part 20, Section 6 :
Audio Fix
http://galaxy22.dyndns.org/misc/hummerdtv/audio.html
--------------------
DTVMON -- machine lang monitor
http://www.kahlin.net/daniel/dtv/dtvmon.php
FLASH -- reflashing utility
http://www.kahlin.net/daniel/dtv/flash.php
256DRAW, DIREDIT -- and more
http://galaxy22.dyndns.org/misc/hummerdtv/software.html
dtvencoder -- utility for encoding files (C64 DTV)
http://www.d-schmidt.onlinehome.de/dtvencoder.zip
--------------------
Part 22:
PCB
1) Topside plane is GND
2) Bottom side plane is Vcc
Part 23:
TIPS
------------------------------------------
From David Murray
How to turn the color on - If you are in the USA, which you probably are if you have one of these. You can get proper NTSC color by typing the following at a BASIC prompt:
POKE 53311,1 Enable extended VIC instructions
POKE 53313,28 Set high bit of Fout
POKE 53314,0 Set middle bit of Fout
POKE 53315,0 Set low bit of Fout
POKE 53326,7 set exact timing (try other numbers between 0 and 15, see which makes your monitor happy)
POKE 53327,2 Set Saturation, usually a 1 or 2, whichever looks best on your monitor
------------------------------------------
There are no easter eggs in the Hummer game. The C64 DTV included several hardware shortcuts and other nuggets such as photos of the development team.
Easter egg example:
Output of "dtvteam" program - Adrian Gonzales (programmer), Jeri Ellsworth (hardware), and Robin Harbron (programmer)
[1] Commodore 64 Programmers Reference Guide, First Edition, Fifth printing (1983), pg. 355