Monday, June 27, 2016

Victor Video Titler JX-T500

Let's continue our MSX and video production series. We already saw that the MSX2 had a video processor with nice A/V resources and it was not uncommon use it to create openings, scene transitions, subtitles, etc. Then, we showed two video titlers from Sony and one from Panasonic.

Besides Sony and Panasonic, other companies did MSXs with A/V features: Pioneer, Philips and Victor. Even without being present in Wikipedia's list, there is a good chance that those companies did some A/V equipment using MSX technology.

Victor/JVC advertising from MSX Magazine 1987-04

AFAIK, the MSX community did have some "inside sources" in Philips, so I guess that if this kind of equipment existed, it would be already known to us. But who knows? Maybe, sometime, we still can find a "hidden" MSX from Philips.

Pioneer is a promising source, the UC-V102 shows that the company continued the relationship with MSX after their two MSX1 models (PX-V60 and PX-7). However I didn't saw any video titler or digitizer from Pioneer. Maybe a better research could change this situation, but, by now, we know nothing. Our last hope is in appliances from Victor.

And Victor had many video equipment in the 80s and 90s. And some of this equipment looked very good to the purpose of this blog. So, let's try one of those machines.

Victor Video Titler Model JX-T500
The 日本ビクター株式会社 means "Japan Victor Company" (JVC)

Victor JX-T500


The Victor JX-T500 have a good design. The highlight is the drawing surface at center. At top we have many "touch" functions as the keyboard, color selector and the many drawing tools. The tablet and the functions at top are operated using a ugly stylus (which I have and don't know where it is now to be pictured). At both sides the video titler have other controls, as the video transitions and the fade selectors.

A good look of Victor JX-T500

The color selector, some drawing tools and a partial view of the keyboard.

The color selector is a 4x4 grid with 15 colors and, in the last spot, the option to "create" your own color with RGB values.

In the rear of this unit the audio and video inputs and outputs and the power cord.

And what's inside JX-T500?


The JX-T500 have, at least, five circuit boards. In the the top half we can see two holding the side controls and the one that handles the drawing board and the other "touch" controls. The bottom half have the power supply, the digital board and the video board. Those boards are connected by a lot of wires.

I hate when we have to disconnect a lot of wires

But we can see a familiar IC in the digital board

Here we can see the power supply, the video board and the digital board.

After disconnecting a dozen of these wires, we can have a clear view of the circuit boards in the bottom half of JX-T500. The digital board is very clean, we can see a Mask ROM, an empty IC slot, the Yamaha V9958 and some VRAMs.

Close view of JX-T500's digital board.
At top left we have a buzzer, then a Mask ROM and,
at right, the Yamaha V9958 and the VRAMs

The Yamaha video chip, and... 192KB of VRAM!?!?

Some VRAMs? No, a lot of VRAM. The V9958 is connected to 192KB of VRAM. While the VDP supports this amount of VRAM natively, it is a bit tricky the use of this additional VRAM in some MSX video modes. But it can be used to store additional pages on some screen modes.

As we said in the posts about Panasonic VW-KT300, to have the same chips of a MSX computer didn't means the machine follows the MSX architecture. We need to investigate a bit more. And there was more ICs on the other side of digital board that we want to see.
The other side of JX-T500's digital board

The first IC that we see is a Fujitsu MB621974, a gate-array. Nice! This can be the MSX-Engine of this video titler.

Fujitsu MB621974 gate-array

At center of digital board, there is two RAM chips from Mitsubishi, which totals 64KB of RAM.

2 x Mitsubishi M5M5255BFP

Ok. By now JX-T500 have a MaskROM, one MSX2+ video processor, 192KB of VRAM, a gate-array, 64KB of RAM. To have all required components to be a MSX, we need that this gate-array is a MSX-Engine equivalent and a Z80 compatible processor. Then...

Motorola MC68HC11

OUCH! How this can be? The main processor inside of JX-T500 isn't a Z80 compatible, but a 6800 compatible. This is a huge disappointment. After that, I lost the interest in this appliance, so I didn't dumped the Mask ROM contents of JX-T500, and tagged this appliance as a "Not MSX". We were so close... : (

More luck next time.

Monday, June 13, 2016

Panasonic Video Titler VW-KT300 - part 2



In previous post we show the Panasonic VW-KT300 and its internals. We saw that it have a Yamaha V9958 videochip and a Z80 compatible CPU, but we still couldn't say it's a hidden MSX: there is a lot of machines that shares the same CPU and VDP of MSX1 and aren't MSXs, this could be the case here (but with MSX2+ components). So, there is a need to look the ROM contents to see if this video titler follows the MSX architecture and not only makes use of MSX's related LSIs.

The FS-VA1 ROM placement have the
"Program ROM" label on PCB

Tabajara did read the ROM identified as FS-VA1 and sent to me the output file. Running "strings" on this ROM file, we didn't found any of the MSX character strings: no "Microsoft", nor "MSX", not even a "Copyright" notice. That file wasn't an MSX BIOS, but I still did need to determine what it was and how it works. How this ROM program drives the video titler hardware.

The VW-KT300 "BIOS"


The ROM dump had 256KB, as the Z80 have a 64KB address space, usually the disassemblers processes files with 64KB maximum size. So, the first thing that I did was to split the original 256KB file in many 16KB chunks. That size choice wasn't a technical one, it was more related with my bias towards MSX architecture, so I guessed that the MSX page size would be a good size to split the file. The next steps proved that, this time,  I did a good choice :)

I ran "hexdump" on the first chunk and got this (removed spaces so it can fit on screen):

00000000 c3e0400000000000 0000000000000000 |Ãà@.............|
00000010 4544495430000000 0000000000000000 |EDIT0...........|

Hey, there is something different here. A label. I did the same in the other files and I found many labels. Some of the 16KB blocks didn't have any label, but most have. And one of them have a MSX cartridge header!

00000000 414232404d400000 0000000000000000 |AB2@M@..........|
00000010 0000000000000000 0000000000000000 |................|

After checked the labels in all 16 files, I made this map of the original ROM (the "size" is calculated with the distance to the next label):

00000000  |EDIT0...........| 16KB
00004000  |EDIT1...........| 16KB
00008000  |EDIT2...........| 32KB

00010000  |SYSTEM1.........| 16KB
00014000  |VA1DATA.........| 16KB
00018000  |AB2@M@..........| 32KB

00020000  |DESIGN..........| 32KB
00028000  |DEMO............| 32KB

00030000  |SYSTEM0.........| 16KB
00034000  |SAMPLE0.........| 16KB
00038000  |SAMPLE1.........| 32KB

A place with SYSTEM0 label seems to be a very promising place to begin the disassembler. And, indeed, it was a nice place to begin, the first bytes are:

l0000h:
        di            ;0000   f3              .
        jp l0134h     ;0001   c3 34 01        . 4 .

So, first the interrupts are disabled and the next step is a jump to address 0134h. And what is in 0134h?

l0134h:
        in a,(0f4h)   ;0134   db f4  
        and 080h      ;0136   e6 80
        jr z,l0153h   ;0138   28 19 

Hey! This is a check of bit 7 from port F4h! The MSX2+ BIOS check this bit to see if it was the boot was cold or warm. Following this code we have:

        ld a,000h     ;013a   3e 00       
        out (0ffh),a  ;013c   d3 ff  
        ld a,001h     ;013e   3e 01  
        out (0feh),a  ;0140   d3 fe  
        ld a,002h     ;0142   3e 02  
        out (0fdh),a  ;0144   d3 fd  
        ld a,003h     ;0146   3e 03  
        out (0fch),a  ;0148   d3 fc

Ports FCh, FDh, FEh and FFh are the ports to control the Memory Mapper in MSX. And if we still had doubts about the VW-KT300 architecture, the next code ends with them. It sets the slot map:

        ld a,0fch     ;014a   3e fc  
        out (0a8h),a  ;014c   d3 a8
        ld a,000h     ;014e   3e 00
        ld (0ffffh),a ;0150   32 ff
ff

There is nothing more MSX than those page-slot-subslot mapping.

The code that we read until now does: if it's a cold boot, initialize the memory mapper registers, activate page 0 on slot 0 and pages 1, 2, 3 in slot 3.0. The disassembled code follows the boot sequence and shows the PSG and VDP initialization, the filling of system variables in page 3 with the expected values, etc.

With this information, we can say the Panasonic VW-KT300 is a MSX compatible machine with a very customized BIOS. Tabajara confirmed that assumption using the Expert 1.3 ROM (MSX1 + Mapper initialization) and we can see the results on this video:


As we saw in the video, the boot runs OK and we end with the MSX-BASIC prompt on screen.

While the confirmation of this machine being MSX compatible is good news, it raises some questions about why it was built this way. We have good signs that this machine was designed and released in 1989/1990.

You can see the "MADE IN JAPAN - 1989" silk on PCB.
And in FS-VA1 ROM the year of "1990"

All the last MSX models from Panasonic (FS-A1FM, FS-A1FX, FS-A1WX, FS-A1WSX, FS-A1ST and FS-A1GT) uses versions of Toshiba T9769 MSX-Engine, which integrates the PSG, PPI, Mapper, glue logic and a high speed Z80. Why not use it in VW-KT300?

The inside machine looks like a mishmash of stuff that Matsushita had lying in their warehouse (the reused ROMs talks a story here). But, at same time, the VW-KT300 doesn't use the common platform of all last MSX models from Panasonic: it uses a Z80B from Zilog with a custom gate array instead of the T9769, and have a full rewritten BIOS! Why not follows the Sony's path and uses the MSX BIOS and the titler software over it?

Well, continuing our journey to understand this machine's BIOS, next step was to find the slot layout to boot this machine in MSX2+ mode :). First we modified the CBIOS to include a small subroutine to look each page in each slot and show the contents of the first bytes on screen. We got that chart:

        PAGE0   PAGE1   PAGE2   PAGE3
SLOT0   SYSTEM0 SAMPLE0 -
SLOT1   -       -       -
SLOT2   -       -       -
SLOT3.0 RAM     RAM     RAM     RAM
SLOT3.1 SAMPLE1 DEMO    -
SLOT3.2 -       -       -
SLOT3.3 EDIT0   EDIT0   EDIT0

Probably I did something wrong in my page switching code and the test hangs when reading data from PAGE3. Well, at least, with the chart we rebuild the EPROM with the ROMs from  A1FX, the BIOS+BASIC in place of SYSTEM0 and SAMPLE0, MSX2+ SUBROM instead of SAMPLE1 and KANJI-ROM Driver where we have DEMO in original ROM.

And... that new ROM doesn't works :(

The layout of SLOT3.3, with all pages mapped to EDIT0, is a clue that there is a custom mapper that needs to be configured somehow. No ideas here. Need to go back to disassembler to search for exotic code, like the one that begins in 0221h which sends some data to switching ports (comments and label names by me):

CMP_PORT45_DATA:
  ld hl,STRING1 ;0221 21 7e 06 Set pointer
                ;              to STRING1 (067e)
  ld c,000h     ;0224 0e 00 
RDPORT45_START:
  ld a,010h     ;0226 3e 10    10h ->
                ;              0001 0000b -> 16d
  out (043h),a  ;0228 d3 43    Switched port 43
  xor a         ;022a af       00h ->
                ;              0000 0000b -> 00d
  out (044h),a  ;022b d3 44    Switched port 44
  ld a,030h     ;022d 3e 30    30h ->
                ;              0011 0000b -> 48d
  out (045h),a  ;022f d3 45    Switched port 45

  ld b,(hl)     ;0231 46       Read how many bytes
  xor a         ;0232 af       needs to be read
                ;              from port 45
  cp b          ;0233 b8
  jr z,l0258h   ;0234 28 22    If EOF (00)

After this ports configuration, it reads N bytes from port 45, comparing it with two strings: 'MOUF1' and FFhFFh'GOT48'. I didn't found those strings in main ROM, maybe that read from port 45 reads one of the Kanji-ROMs or the dictionary?

Then the things got even weirder, this is what we have in 0258h:

l0258h:
  ld a,000h             ;0258   3e 00
  ld (0ed00h),a         ;025a   32 00 ed
  ld h,040h             ;025d   26 40
                                ;      
  ld (0ed03h),hl        ;025f   22 03 ed
  ld a,0a0h             ;0262   3e a0
  ld (0ed01h),a         ;0264   32 01 ed
CHPAGES_TOSLOT3:
  ld a,(0ed01h)         ;0267   3a 01 ed
  cp 0a0h               ;026a   fe a0
  jp c,CHPAGES01_SLOT3  ;026c   da d8 02
  inc a                 ;026f   3c     
  ld (0ed02h),a         ;0270   32 02 ed
  ld a,(0ee2fh)         ;0273   3a 2f ee
  and a                 ;0276   a7
  jr z,CHPAGES12_SLOT3  ;0277   28 08
  ld a,(0ed01h)         ;0279   3a 01 ed
  cp 0c0h               ;027c   fe c0
  jp nc,CHPAGES01_SLOT3 ;027e   d2 d8 02
CHPAGES12_SLOT3:
  call PAGE12SLOTBLOCK  ;0281   cd 69
0b

These jumps and subroutine calls shuffles the ROM's pages between the  frames and subslots of SLOT3, writing in not usual memory locations inside these subroutines. After the initial shuffle, the BIOS reads the N bytes from 4010h and compares with some strings:

CMP_BLOCK_HEADERS:
  ld hl,STRING3      ;0284 21 8d 06
  ld ix,0edf4h       ;0287 dd 21 f4 ed
RDHEADER_START:
  ld de,04010h       ;028b 11 10 40  

  ld b,(hl)          ;028e 46    Read how many  
                     ;           characters
  xor a              ;028f af      
  cp b               ;0290 b8      
  jr nz,l029dh       ;0291 20 0a If NOT EOF (00)

  ld a,(0ed01h)      ;0293 3a 01 ed  
  inc a              ;0296 3c      
  inc a              ;0297 3c      
  ld (0ed01h),a      ;0298 32 01 ed
  jr CHPAGES_TOSLOT3 ;029b 18 ca    

The character strings to be compared are SYSTEM0, SYSTEM1, VA1DATA, EDIT0, EDIT1, EDIT2, EDIT3, SAMPLE0, SAMPLE1, SAMPLE2, SAMPLE3, SAMPLE4, SAMPLE5, SAMPLE6, SAMPLE7, SAMPLE8, SAMPLE9, DEMO, DESIGN, AUTOSTART and SCENARIO. Some of those strings are the labels that we found in the ROM blocks. And others... are from the IC Card? The SRAM? From other equipment?

Just below the labels, there are a few more strings that doesn't seem to be used by or called anywhere in the code:

ASOH HIRONAKA NAKATA HAYASHI FURUKI

My guess is that these are the names of creators of this machine and BIOS.

At the end, this code to scramble and reallocate the pages left me very confused. After many attempts, I threw in the towel and stopped my efforts to understand what is happening in this code. If you want to try to continue, the tarball with all the ROMs (the full dump and split in blocks) can be downloaded from here, you can also download SYSTEM0 already disassembled and partially commented by me. Maybe it helps.

I hope someone can understand this page mapping code. It would be nice to boot this machine in MSX2+ mode and read games from the IC Card :D

Friday, June 10, 2016

Panasonic Video Titler VW-KT300 - part 1

Matsushita was one of the first companies to join the consortium MSX (some say M is Matsushita) and, as Panasonic, was the one who released the latest official model of MSX (MSX Turbo R FS-A1GT). Between the beginning and the end of the standard, Panasonic (and National) launched many different models and MSX's peripherals. Even some models with AV capabilities, such as the National FS-5500:

National FS-5500's advertising in MSX Magazine 1986-01,
it's an amazing machine with AV capabilities, one or
two floppy disk drives and a trackball integrated in
keyboard. The downside is the amount of RAM, only 64KB.

Like Sony did before, Panasonic used their know-how in MSX and Video applications to build their own videotitler: The VW-KT300. This equipment is not totally unknown by MSX users; it had a full-page article on the MSX Magazine (but without the word "MSX" in the text):

First section of the article on news from Panasonic in
MSX Magazine 1990-03. As you can see, no "MSX" in this section

And, in an other article from 1990, the VW-KT300 is already identified as based on MSX technology:

Panasonic VW-KT300 in MSX Magazine 1990-04.
The same article lists Sony XV-J770 as MSX based.

It's no surprise that this Panasonic appliance is in Wikipedia's list of MSX based hardware (The text in red says "VW-KT300 from Matsushita Electric Industrial"):

"特にビデオタイトラーでは、ソニーのXV-J550/J770/T55Fシリーズや松下電器産業のVW-KT300などの家庭用タイトラーのハードウェ ア構成は明らかにMSXを応用・流用したものである。ただし、これらの機種では基本はMSXシステムをベースとしていても独自の実装がなされており、特に BIOSなどは大幅に簡略化されMSXとしての機能は望めないなど、簡単な加工程度では汎用のMSXシステムとして使うことは不可能である。"

With that information, and some news and forums posts about XV-T550, I bought this machine, with the hope to easily boot it in MSX mode. The VW-KT300 was the first equipment that I bought in my search for hidden MSXs. It was not featured in the first post in this blog because:
  1. Other machines (Aucnet NIA-2001 and Pioneer UC-V102) have a lot more impact and
  2. The story of how I found this VW-KT300 is very boring: "I saw the name of this machine in an article in Wikipedia, I bid on an auction and won."
I bought it and, while waiting the package arrival from Japan, I began a more serious research about hidden MSX (which gave very good results). I expected to see something like the Sony XV-T550, with a full MSX BIOS, a known MSX engine and a nice cartridge slot to do some tests. When the package arrived and I put my hands on this machine, I found that I am not a good guesser.

But, even without meeting all my expectations, the machine is very interesting!

From outside it have a good design; with some inputs and outputs for video and sound, an IC card slot, a custom keyboard and a mouse.

Panasonic VW-KT300: a very clean visual in front panel,
polluted by a big colorful sticker.

Rear of VW-KT300, with many S-VIDEO and RCA connectors

The mouse is the Panasonic FS-JM1, the same that are sold for MSX computers:

The VW-KT300 mouse. The only place where you can see the MSX
logo without open the appliance.

All videotitler functions, besides the point and click, can be controlled using the small keyboard:

The control keyboard
(image from a Y!J auction. I'll change it when I (hopefully)
find where is my own keyboard)

In the front panel, we have the power button, the keyboard and mouse connectors, the IC card slot and S-video and RCA inputs. It seems that the IC cards were a common media for appliances in Japan:

As said in main text, the front panel have a power button,
power LED, keyboard and mouse connectors and IC card slot

The big sticker advertises the key features of VW-KT300.
The first line of japanese text says: "Easy and Beautiful
Kanji Titles - MACLORD Video Titler", the line below talks
about the font resolution, sample titles, characters per
screen, and transition effects. Finally we have the Input-2
connectors with S-Video and RCA

Input-1 connectors: S-VIDEO and RCA. Next the selector
for Black&White or Color output

The two sets of Output connectors. Both with S-Video and RCA

The knob to adjust the superimposer hue, then a power
outlet and the power cable connector

What is inside Panasonic VW-KT300?

When I opened the VW-KT300, I already did saw a few pictures of the mainboard on this site (in japanese) and knew that the cartridge slot was not there. But still thought that would be a MSX engine somewhere at PCB's other side and a full MSX BIOS would be waiting for me. However, as I said before, I am not a good guesser.

Half of the logic board. At top center, the NEC gate array;
at top right you can see a Z80B from Zilog.
The bottom row are the ROMs

The other half of logic board. At top left the VRAMs;
at picture's center, a CR2032 battery and an Yamaha V9958
(the chip with the heat sink). At bottom row we can see
more RAMs and the ROMs.

Talking about  the good stuff: the machine has an Yamaha V9958 with 128KB VRAM, a Z80B (faster than usual) as main processor, 64KB RAM  and many Kanji-ROMs from Panasonic's MSX equipment (computers, cartridges, printers, etc).

First we can see 64KB RAM (2 x MN41464A), then a Fujitsu
MB834200 512KB MaskROM (24-dot Kanji-Fonts), a 32KB SRAM
(Fujitsu 84256), the program ROM (FS-VA1) and another
Fujitsu 512KB MaskROM (now is a MB834000) identified in
the PCB's silk as "ROM Jisho", which means "Dictionary ROM".

After an empty IC placement there are two ROMs. The first
one is from FS-PK1 printer and the other one looks to be
the Kanji-Font of the A1FX MSX computer.

Excluding the RAMs and ROMs, the main ICs inside the VW-KT300 are:

  • Zilog Z0840006PSC: Z80 processor with 6.17Mhz clock
  • NEC D65042GD405: NEC gate array
  • Yamaha V9958: MSX2+ VDP

As we can see, no stock MSX engine in this list. But we know many MSX computers that doesn't have a engine from Yamaha or Toshiba, those machines have discrete components or a custom gate array to do the MSX engine's job,  the big NEC gate array is a good candidate to fill this role.

The NEC gate array

I took this device to Alexandre Tabajara's lab, so we can take a better look in this NEC IC and dump the program ROM. But that is a talk for our next post.