Jump to content

Photo

Test Cartridges Information

Intellivision Test Cartridge MTE-201 Video Test Cartridge

23 replies to this topic

#1 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • 3,911 posts

Posted Sat Mar 30, 2019 9:20 PM

Mattel Test Cartridges

 

Test Cartridges.jpg

 
Mattel's test cartridges were used by Mattel and others to diagnose malfunctioning Intellivision consoles.  This is an attempt to document the various Mattel Test Cartridges out there.  This information is likely incomplete.  As folks contribute more info, this original post will be updated.
 
Note that freewheel's "FW Diagnostics" cartridge is not listed here but is a modern homebrew test cartridge.
 
Known Cartridges
There are 7 known Mattel test cartridges.  They vary by 2 things:

  •  
  • Version of the test code
  • Whether a game plays at the end

They are:

Version   Displayed   Successful
Name      Version     Ending                      Original Label
-------   ---------   ----------                  --------------
v1.0      <none>      no game, "PASS-PASS-PASS"   VIDEO TEST CARTRIDGE
v1.0a     V1A         no game, "PASS-PASS-PASS"   ?
v3        V3          Baseball                    MTE 201 TEST CARTRIDGE
v3b       V3          Night Stalker               ?
v3.3      V3.3        blank green screen          ?
v4.1a     V4.1        blank green screen          ?
v4.1b     V4.1        Night Stalker               ?

"Version Name" is the common name given to ROM files.  For example, v4.1a and v4.1b have identical testing code and only differ by whether the game Night Stalker runs at the end of successful tests.  Note that v3 is also commonly called "MTE-201" but will be mostly referred to as V3 for naming consistency with the other cartridges.
"Displayed Version" is shown in the lower left corner (except for v1.0).

Test Cart v.1.0a Displayed Version.gif

 
Confusing the issue of labels is that even among cartridges that are otherwise exactly identical, the printed labels vary.  However, most of label variations appear to be non-original labels (ex: someone printed a new label with a name they picked) and some of these non-original labels are easy to spot.  For example, in the photo below, the left label is fortunately correct but it uses a modern font that on paper with rounded corners only on the top half.  Some non-original labels with different text look somewhat similar.

2016-09-25 15.01.38 - shrunk.jpg

 
Most of this document will use the Displayed Version to differentiate between the cartridges since the test code, not the game, is the focus.  The exception is the "Video Test Cartridge" that will simply be called V1.
 
Results on Various Systems
Most of the cartridges will pass a functioning original Mattel Intellivision (includes Tandyvision One and GTE Sylvania).  However, the Sears Intellivision, Intellivision II, and Tutorvisions have differences that will cause the early versions to incorrectly report a failure.
 
The later cartridges attempt identify what system they are on and print it in the lower left corner with an "M" or "O" sometimes followed by the number "1" or "2".

Test Cart v.4.1a Displayed Version.gif

 
One exception is V3.3, which was intended to only test the Intellivision II.  Oddly, it incorrectly identifies the Intellivision II as "O" rather than the expected "M" or "M2" due to a bug in the code (thanks to JoeZ for the analysis).  However, it will correctly test the Intellivision II.
 
In the table below, each system lists 3 things:

  • What system was displayed in the lower left corner (or n/a if nothing was displayed)
  • What tests failed, identified by letter (ex: B)
  • What chips failed, identified by the circuit board's name of the chip (ex: U09)
Version  INTV 1 Results         Sears Results                  INTV II Results
-------  --------------         -------------                  ---------------
V1       n/a | Pass             n/a | Pass                     n/a | Fail B, C, J | U03, U06, U09
V1A      n/a | Pass             n/a | Pass                     n/a | Fail B, C, J | U03, U06, U09
V3       n/a | Pass             n/a | Fails L, M | U03, U09    n/a | Fail B, J, M | U03, U06, U09
V3.3     O   | Fails B | U03    O   | Fails B | U03            O   | Pass
V4.1     M1  | Pass             O1  | Pass                     O2  | Pass

Tutorvision results are missing from above since Lathe26's TutorPro's already damaged RCA jack broke off.  :(
 
Failure Codes
So far, only full service manuals for V1 / V1A, and V3 (MTE-201) have been found that list failure letters (ex: V1 reports test B failed) and which chips they map to (ex: V1 identifies U9 as bad).  These come from the "Sylvania Intellivision Service Manual", from the "Intellivision Service Manual", and from Papa Intellivision's "CCF10232011_00012".  Both documents are attached to this post below but the relevant tables are here.
 

V1 / V1A Failure Table

Test Cart v1.0 Failure Codes.png

 

V3 Failure Table

Test Cart v3 Failure Codes.jpg

 

V3 Failure Table (alternative)

STIC IMI Error Codes.png

 

Note that Lathe26 has a "Sylvania Intellivision Service Manual" and eventually plans to scan it in color.  This includes a separate addendum that apparently has never been scanned before that the covers differences from the first Intellivisions (serial numbers <4000) from later serial numbers.
 
Acronyms

  • IMI = Incoming Material Inspection
  • MTE = ??

1+7 Test Menu
At the controller testing screen, if the user presses 1+7 at the same time, the user is presented with a Test Menu on the later test cartridges.  It allows the user to run individual tests one at a time.  This menu is operated with the right controller only.  Simply type in the test's number and press Enter.  Type in "00" and Enter to exit the menu.

Version  Test Menu
-------  ---------
V1       no
V1A      no
V3       Yes
V3.3     Yes
V4.1     Yes

There is some variation in the menus, mostly notably because the V3.3 cartridge test the Intellivision II which has slightly different chips.
 

V3 Test Menu

Test Cart v.3 Test Menu.gif

 

V3.3 Test Menu

Test Cart v.3.3 Test Menu.gif

 

V4.1 Test Menu

Test Cart v.4.1a Test Menu.gif

 
2+8 Checksum Screen and Games
At the controller testing screen, if the user presses 2+8 at the same time, checksums of any game code will be displayed.  The checksum is displayed for all test cartridges even though only some of the test cartridges will play the game after a successful test pass.  Only the later test cartridges will play a game if the tests are successful by jumping to code starting at the $5000 address range.  Earlier test cartridges lack code to jump to a game, even though they will calculate the checksums.
 
Further, there 2 slightly different ways the checksum is calculated.  In all cases, the checksum is simply a 16-bit of various memory ranges.

  • Older test carts display 2 numbers in octal format called "CART CHECKSUM LO" and "CART CHECKSUM HI".  These correspond to checksums calculated for the 2K word ranges of $5000-$57FF and $5800-$5FFF, respectively.  The checksum is displayed whether or not a game is present.  When a game is not present, 00777774000 is displayed (the sum of 2K's worth of the value $FFFF).
  • Newer test carts display a list of memory ranges by displaying a list of hexadecimal numbers in the left column (ex: "5" means the 4K memory range of $5000-$5FFF) and then display a checksum in octal next to it.  This displays multiple memory ranges from 5xxx through Fxxx.  Checksums are only displayed if code is present.  These cartridges always skip 1 number in the 5xxx through Fxxx range (V3.3 skips 7xxx while V4.1 skips Cxxx).

Below are the known cartridges:

Version   Low Chksum   Hi Chksum    Checksum 5   Game
-------   ----------   ---------    ----------   ----
v1.0      00777774000  00777774000  n/a          none
v1.0a     00777774000  00777774000  n/a          none
v3        00002371677  00003372642  n/a          Baseball
v3b       00001014317  00002732341  n/a          Night Stalker
v3.3      n/a          n/a          n/a          none
v4.1a     n/a          n/a          n/a          none
v4.1b     n/a          n/a          00003746660  Night Stalker

Note that for the 2 cartridges with Night Stalker that adding the checksum values of 00001014317 with 00002732341 results in 00003746660.
 
Most games can be used with the test cartridges.  As an experiment, the game Brickout, which was never released by Mattel, was added to each of the test cartridges.  This game was chosen so the ROMs would never be confused with legitimate ROMs from real test cartridges.  This game is <2K so the HI checksum is 00000000000 and the LO checksum is 00001604524.  Later test cartridges also display the same 00001604524 value.
 
The below table also shows that V1 and V1A don't play the game.

Version     Game Appended   Low Chksum   Hi Chksum    Checksum 5   Game plays?
-------     -------------   ----------   ---------    ----------   -----------------
V1          Brickout        00001604524  00000000000  n/a          No
V1A         Brickout        00001604524  00000000000  n/a          No
V3          Brickout        00001604524  00000000000  n/a          Yes
V3.3        Brickout        n/a          n/a          00001604524  Yes
V4.1        Brickout        n/a          n/a          00001604524  Yes

Using Brickout, the checksum displays are:

V1, V1A, and V3 Checksum Screen

Test Cart v.1.0 with Brickout Checksum.gif

 

V3.3 Checksum Screen

Test Cart v.3.3 with Brickout Checksum.gif

 

V4.1 Checksum Screen

Test Cart v.4.1a with Brickout Checksum.gif

 
Interestingly, V4.1 is compatible with the ECS and will display checksums of the ECS ROMs as well.  This only occurs for the real v4.1 test cartridges.  The LTO FLASH disables the ECS ROMs so a V4.1 ROM running from the LTO FLASH will not see it (likely changeable via an LTO setting).

Test Cart v4.1a Checksum on Real ECS - Small.jpg

 
The Brickout versions of the various Test Cartridges are attached at the bottom of post.  Also, a Unix Bash script is included that will compute checksums for any game or other ROMs such as from the ECS (script tested under the Cygwin shell).
 
Memory Ranges and ECS Compatibility
The test cartridges code (excluding any game code), use the following address ranges.

Version     Size    Memory Ranges               
-------     ----    ----------------------------
V1          8KB     $7000 - $7FFF
V1A         8KB     $7000 - $7FFF               
V3          8KB     $7000 - $7FFF               
V3.3        16KB    $4000 - $4FFF, $C000 - $CFFF
V4.1        12KB    $4800 - $4FFF, $C000 - $CFFF

Note that only the V4.1 is compatible with the ECS.  Older cartridges either conflict with the ECS's $7000-$7FFF range or with the ECS's RAM at $4000-$47FF.
 
Cartridge Internals
Some of the test cartridges have been opened up and photographed.  This shows what the chip numbers and manufacturing dates were.  What's interesting is that some of the cartridges show that the test code was on one chip while the game code was from same chip that was used in the normal game's cartridge.

 

v1.0 (no game)

shield is soldered onto the board, two chips are visible underneath

Video Test Cartridge Board 1 (1).jpg

 

v1.0a (no game)

no photo

 

v3 (Baseball)

MTE-201 Board 1 (1).jpg

 

v3 (Night Stalker)

board appears to be a standard Night Stalker board that the 994 chip was added at a later time

(solder work on underside of board for 994 chip is noticeably different)

MTE-201 Night Stalker Board (1).jpg

 

v3.3 (no game)

no photo

 

v4.1a (no game)

Test Cartridge 4.1a Board (1).jpg

 

v4.1b (Night Stalker)

no photo

 
IMI Tester-MTE 100
Briefly, there is a portable Intellivision diagnostic system that enables testing individual chips.  It is called the IMI Tester-MTE 100.  It comes with what appears to be an MTE-201 (i.e. a V3) built into it.  More information on this system is available at http://www.intvfunho...ardware/mte100/

MTE-100-01.jpg

 

Acknowledgement
While small parts of this was from my own investigations, the vast majority of this information was many other people who scanned, photographed, dumped, and analyzed the cartridges long before my involvement.  Most of this documentation stands on their shoulders.

Attached Files



#2 JasonlikesINTV OFFLINE  

JasonlikesINTV

    Quadrunner

  • 9,747 posts
  • Location:Midwest

Posted Sat Mar 30, 2019 9:47 PM

Wow! Thanks for documenting all of this! Excellent resource.

#3 intellivotion ONLINE  

intellivotion

    Intellivoted

  • 2,960 posts
  • Time Zone Traveller
  • Location:Italy... sometimes

Posted Sat Mar 30, 2019 10:16 PM

Impressive! Amazing dissertation with academic-like approach.
I'm proud to be part of this community

#4 cmart604 OFFLINE  

cmart604

    Intellivision Hoarder

  • 12,400 posts
  • Running out of things to buy.
  • Location:Vancouver

Posted Sat Mar 30, 2019 10:28 PM

Impressive! Amazing dissertation with academic-like approach.
I'm proud to be part of this comunity


You understand that Rev is part of the community too right? You may want to reconsider your statement. 😂

#5 intellivotion ONLINE  

intellivotion

    Intellivoted

  • 2,960 posts
  • Time Zone Traveller
  • Location:Italy... sometimes

Posted Sat Mar 30, 2019 11:01 PM

You understand that Rev is part of the community too right? You may want to reconsider your statement.

Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty.

#6 cmart604 OFFLINE  

cmart604

    Intellivision Hoarder

  • 12,400 posts
  • Running out of things to buy.
  • Location:Vancouver

Posted Sun Mar 31, 2019 12:50 AM

Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty.


Hahahahaha!

#7 Intymike ONLINE  

Intymike

    River Patroller

  • 3,410 posts
  • Location:Rhine Valley

Posted Sun Mar 31, 2019 1:19 AM

Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty.


But probably noisy and smelly. :D

#8 the1hatman OFFLINE  

the1hatman

    Stargunner

  • 1,270 posts
  • Location:Ohio, USA

Posted Sun Mar 31, 2019 11:27 AM

Victoria's Secret angels also have to fart sometimes. That doesn't make them less pretty.


This may be the post of the century.

#9 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Sun Mar 31, 2019 2:48 PM

 

The LTO FLASH disables the ECS ROMs

 

You can control this via one of two mechanisms:

  • Add an "ecs_compat = 2" statement to the [vars] section of the config to say that the cartridge is "enhanced by" the ECS.  Or change the corresponding ROM property in the LTO Flash GUI. (Screen shots below.)
  • Change the LTO Flash ECS ROM enable policy to "Always" or "Compatible".

I prefer to change the ROM properties.  If you set the LTO Flash ECS ROM enable policy to "Always" or "Compatible," then you have to navigate through that ECS title screen when playing other games such as, say, Astrosmash.  I prefer to leave it set to "ECS Games," and then edit the ROM properties of specific titles as needed.

 

Here's what the ROM features screen looks like on Mac:

Screen Shot 2019-03-31 at 1.46.25 PM.png

Screen Shot 2019-03-31 at 1.40.29 PM.png

 

And here's where you can change LTO Flash's overall policy:

Screen Shot 2019-03-31 at 1.47.19 PM.png

Screen Shot 2019-03-31 at 1.44.25 PM.png



#10 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Sun Mar 31, 2019 3:09 PM

Also, digging up a comment I made awhile back on Facebook.  V3 seems to have code that anticipated the Intellivision III:

 

 

OK... for the sleuths out there, I found the test in MTE-201.

It looks for $28 in location $2FFC, and $CA in $10EB. I'm not quite sure what it does with that info, but that's the check it performs.


$2FFC does not contain $0028 in either the WBEXEC or the ECS ROMs at this location. The only other hardware I know of at $2xxx is Coffee's EXEC.

The test appears starting at $75EC in MTE-201 V3.

 

Here's the code:

.

        SDBD                                    ; 75EB   0001
        MVII    #$2FFC, R3                      ; 75EC   02BB 00FC 002F
        MVII    #$00A8, R0                      ; 75EF   02B8 00A8
        CMPI    #$0028, R3                      ; 75F1   037B 0028
        BNEQ    L_75F7                          ; 75F3   020C 0002

        MVII    #$00CA, R0                      ; 75F5   02B8 00CA
L_75F7:
        SDBD                                    ; 75F7   0001
        MVII    #$10EB, R5                      ; 75F8   02BD 00EB 0010
        CMP@    R5,     R0                      ; 75FB   0368
        BNEQ    L_7645                          ; 75FC   020C 0047

.

Also, the MTE failure codes are also documented in one of the procurement specifications on PapaIntellivision: (CCF10232011_00012.pdf)

Screen Shot 2019-03-31 at 2.05.54 PM.png


Edited by intvnut, Sun Mar 31, 2019 3:15 PM.


#11 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Sun Mar 31, 2019 3:12 PM

BTW, that customer procurement specification I linked above also has a STIC specification that's pretty detailed, along with specifications for other chips.  It's a huge, fascinating document.

 

The system test cartridge description starts on page 174 and is dated 5/7/1982.



#12 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Sun Mar 31, 2019 3:23 PM

Also:  According to the customer procurement specification, IMI stands for "Incoming Material Inspection."  I'd never noticed that before!

 

Screen Shot 2019-03-31 at 2.21.51 PM.png

 

intvsteve has one of the described IMI units.  It's a bizarre metal suitcase.



#13 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • Topic Starter
  • 3,911 posts

Posted Sun Mar 31, 2019 5:08 PM

Regarding the suitcase, I find the 3-way switch interesting. Test vs Checksum seems easy to figure out (short controller pins to look like 2+8 was pressed) but it sounds like there way also a way to bypass the tests and go straight to the game.

"I haven't traced the three-way Checksum/Game/Test switch circuitry in detail yet. I can say that in Checksum mode, one controller's pins are shorted such that the MTE-201 is forced into the Checksum test. It does not appear that a new test ROM variation is to be found here... A dump is necessary! The Checksum/Game/Test switch also seems capable of switching which cart is used by shorting (or not) pin 37 of the MTE-201's cartridge port edge connector to pin 38 of the main connector. I haven't quite figured this out yet."

If someone knows how this was done, that would be interesting to know...

#14 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Sun Mar 31, 2019 5:51 PM

Regarding the suitcase, I find the 3-way switch interesting. Test vs Checksum seems easy to figure out (short controller pins to look like 2+8 was pressed) but it sounds like there way also a way to bypass the tests and go straight to the game.

"I haven't traced the three-way Checksum/Game/Test switch circuitry in detail yet. I can say that in Checksum mode, one controller's pins are shorted such that the MTE-201 is forced into the Checksum test. It does not appear that a new test ROM variation is to be found here... A dump is necessary! The Checksum/Game/Test switch also seems capable of switching which cart is used by shorting (or not) pin 37 of the MTE-201's cartridge port edge connector to pin 38 of the main connector. I haven't quite figured this out yet."

If someone knows how this was done, that would be interesting to know...

 

Just a hunch here, but my guess is that they're selectively connecting or disconnecting the BDIR pin to prevent the ROM in a plugged-in cartridge from seeing the DTB and ADAR bus phases, effectively "deselecting" it.  (I'd guess there's a pullup when BDIR isn't connected.)

 

Pins 37 and 38 are the two copies of BDIR on the cartridge port.  For the curious, this page describes the bus phases and the cartridge port wiring.


Edited by intvnut, Sun Mar 31, 2019 5:53 PM.


#15 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • Topic Starter
  • 3,911 posts

Posted Mon Apr 1, 2019 12:16 AM

Also:  According to the customer procurement specification, IMI stands for "Incoming Material Inspection."  I'd never noticed that before!

 

attachicon.gifScreen Shot 2019-03-31 at 2.21.51 PM.png

 

intvsteve has one of the described IMI units.  It's a bizarre metal suitcase.

 

I recall knowing what IMI stood for at one time but total forgot recently.  Thanks for reminding me.  I added it above.

 

Any ideas on what MTE stands for?  I have guesses but documentation would be better.

 

I'll have to add the suitcase above later.  It's not a cartridge, but the MTE100 should be mentioned.

Edit: added the MTE 100



#16 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • Topic Starter
  • 3,911 posts

Posted Mon Apr 1, 2019 12:51 AM

Also, digging up a comment I made awhile back on Facebook.  V3 seems to have code that anticipated the Intellivision III:

 

 

Here's the code:

.

        SDBD                                    ; 75EB   0001
        MVII    #$2FFC, R3                      ; 75EC   02BB 00FC 002F
        MVII    #$00A8, R0                      ; 75EF   02B8 00A8
        CMPI    #$0028, R3                      ; 75F1   037B 0028
        BNEQ    L_75F7                          ; 75F3   020C 0002

        MVII    #$00CA, R0                      ; 75F5   02B8 00CA
L_75F7:
        SDBD                                    ; 75F7   0001
        MVII    #$10EB, R5                      ; 75F8   02BD 00EB 0010
        CMP@    R5,     R0                      ; 75FB   0368
        BNEQ    L_7645                          ; 75FC   020C 0047

.

Also, the MTE failure codes are also documented in one of the procurement specifications on PapaIntellivision: (CCF10232011_00012.pdf)

attachicon.gifScreen Shot 2019-03-31 at 2.05.54 PM.png

 

That is really awesome.  I had no idea this was hidden in there.

 

I did some poking around and...

  1. Only the V3 has this code.  It was removed in V3.3 and V4.1.
  2. I tried to decode what the code is doing but didn't figure it out in the limit time I had.
  3. As an alternative, I fed in data that the code expected.  I extended MTE-201 ROM image to have a $2xxx with $2FFC set to $0028.  Only making this change caused test M to fail (somewhat expected).  Then I tried modifying $10EB to $00CA (and modified another value to offset the change in checksum value) but that resulted in test L failing (surprising).  Then I changed $10EB back and then changed $1FFC to $0028 (and another value to compensate for the checksum) and this worked.  By worked, I just mean that V3 simply stopped reporting failing tests and chips.
    1. Edit: I realized something as I stepped through the code in jzintv... the CMPI #$0028, R3 is not comparing $28 to what is stored at the address in R3, its comparing $28 to the value in R3 which is $2FFC.  The BNEQ will always be taken.  I was fooled by this as well.  It looks like this is the remnants of left over dead code.
    2. Edit: The $2FFC check is done right in a 2nd place just a little bit below in what originally thought was dead code.  However, setting a breakpoint at $761C works does hit the address.  After inspecting the stack, what appears to be going on is that a separate block of code is loading an address from a table into R0 and then MOVR R0, R7 (MOVR is at address $7ABB, table at $7FEA to $7FFA) which is how the below code is even reached.
        PSHR    R5                              ; 7616   0275
        MVII    #$004D, R0                      ; 7617   02B8 004D
        MVO     R0,     G_033F                  ; 7619   0240 033F
        SDBD                                    ; 761B   0001
        MVII    #$2FFC, R5                      ; 761C   02BD 00FC 002F
        MVI@    R5,     R3                      ; 761F   02AB
        CLRR    R0                              ; 7620   01C0
        CMPI    #$0028, R3                      ; 7621   037B 0028
        BNEQ    L_7627                          ; 7623   020C 0002

        MVII    #$0028, R0                      ; 7625   02B8 0028
L_7627:
        SDBD                                    ; 7627   0001
        MVII    #$1FFC, R5                      ; 7628   02BD 00FC 001F
        CMP@    R5,     R0                      ; 762B   0368
        BNEQ    L_7645                          ; 762C   020C 0017

At this point, I'm not ready to add this information above, unless you think adding the speculation on Coffee (Intellivision III) is strong enough.  As an alternative explanation, do you think the checks might have been for an early internal version of the Intellivision II?



#17 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • Topic Starter
  • 3,911 posts

Posted Mon Apr 1, 2019 2:35 AM

 

Just a hunch here, but my guess is that they're selectively connecting or disconnecting the BDIR pin to prevent the ROM in a plugged-in cartridge from seeing the DTB and ADAR bus phases, effectively "deselecting" it.  (I'd guess there's a pullup when BDIR isn't connected.)

 

Pins 37 and 38 are the two copies of BDIR on the cartridge port.  For the curious, this page describes the bus phases and the cartridge port wiring.

 

I think I see where I goofed: I overlooked that the MTE 100 has a cartridge slot.  Thus, I misinterpreted that the "Game" position of the switch caused the built-in MTE-201 board to jump to the Baseball code.

 

Dumber yet, I spent a couple hours looking at the V3 assembly code trying to find a way for some magic button combo on the controller to trigger jumping straight to the game.  :roll: :dunce:



#18 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Mon Apr 1, 2019 3:01 AM

Any ideas on what MTE stands for?  I have guesses but documentation would be better.

 

I do not know.  If I had to guess, I'd say "Mattel Test Equipment" or "Manufacturing Test Equipment."

 

 

 

I think I see where I goofed: I overlooked that the MTE 100 has a cartridge slot.  Thus, I misinterpreted that the "Game" position of the switch caused the built-in MTE-201 board to jump to the Baseball code.

 

Now that would be a real trick!  You'd have to prevent address $7xxx from getting sent to the cart, while allowing $5xxx.

 

 

 

That is really awesome.  I had no idea this was hidden in there.

 

I did some poking around and...

  1. Only the V3 has this code.  It was removed in V3.3 and V4.1.
  2. I tried to decode what the code is doing but didn't figure it out in the limit time I had.
  3. As an alternative, I fed in data that the code expected.  I extended MTE-201 ROM image to have a $2xxx with $2FFC set to $0028.  Only making this change caused test M to fail (somewhat expected).  Then I tried modifying $10EB to $00CA (and modified another value to offset the change in checksum value) but that resulted in test L failing (surprising).  Then I changed $10EB back and then changed $1FFC to $0028 (and another value to compensate for the checksum) and this worked.  By worked, I just mean that V3 simply stopped reporting failing tests and chips.
    1. Edit: I realized something as I stepped through the code in jzintv... the CMPI #$0028, R3 is not comparing $28 to what is stored at the address in R3, its comparing $28 to the value in R3 which is $2FFC.  The BNEQ will always be taken.  I was fooled by this as well.  It looks like this is the remnants of left over dead code.
    2. Edit: The $2FFC check is done right in a 2nd place just a little bit below in what originally thought was dead code.  However, setting a breakpoint at $761C works does hit the address.  After inspecting the stack, what appears to be going on is that a separate block of code is loading an address from a table into R0 and then MOVR R0, R7 (MOVR is at address $7ABB, table at $7FEA to $7FFA) which is how the below code is even reached.
        PSHR    R5                              ; 7616   0275
        MVII    #$004D, R0                      ; 7617   02B8 004D
        MVO     R0,     G_033F                  ; 7619   0240 033F
        SDBD                                    ; 761B   0001
        MVII    #$2FFC, R5                      ; 761C   02BD 00FC 002F
        MVI@    R5,     R3                      ; 761F   02AB
        CLRR    R0                              ; 7620   01C0
        CMPI    #$0028, R3                      ; 7621   037B 0028
        BNEQ    L_7627                          ; 7623   020C 0002

        MVII    #$0028, R0                      ; 7625   02B8 0028
L_7627:
        SDBD                                    ; 7627   0001
        MVII    #$1FFC, R5                      ; 7628   02BD 00FC 001F
        CMP@    R5,     R0                      ; 762B   0368
        BNEQ    L_7645                          ; 762C   020C 0017

At this point, I'm not ready to add this information above, unless you think adding the speculation on Coffee (Intellivision III) is strong enough.  As an alternative explanation, do you think the checks might have been for an early internal version of the Intellivision II?

 

Oh wow, thank's for the additional sleuthing!  I had dug into this particular weird $2FFC check before—I had detected it by doing a "read watch" on $2000 - $2FFF in jzIntv's debugger—but apparently I had found the "b0rken" version of the check when I looked at the disassembly.  I first noticed this several years ago, and then sorta forgot about it until Don Daglow posted about overseeing Coffee's development on FB.

 

It's weird that both versions—the b0rken test and a working test—are in the final ROM.

 

Based on all of the memory maps I've seen from Papa Intellivision across a range of dates, I'm pretty certain that $2xxx was always reserved for Coffee and Lucky.  The Intellivision II's revised EXEC did not ever occupy any of $2xxx. 



#19 Intymike ONLINE  

Intymike

    River Patroller

  • 3,410 posts
  • Location:Rhine Valley

Posted Mon Apr 1, 2019 5:43 AM

The German service manual, including usage of the MTE-201.

 

I know of two of these to exist - one is mine, from where the PDF is made of and one is owned by another Intellivision Brotherhood member.

 

https://www.dropbox....nual German.pdf



#20 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Mon Apr 1, 2019 9:40 AM

 

Then I tried modifying $10EB to $00CA (and modified another value to offset the change in checksum value) but that resulted in test L failing (surprising). 

 

I hadn't gone back to see what "test L" was in the lists last night.  When I did just now, I realized it wasn't in any of the lists.

 

I did some further digging though:  This looks to be an incorrectly written test for the Sears EXEC.  The Sears EXEC has $28 at $1FFC, and $CA at $10EB.



#21 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Mon Apr 1, 2019 10:13 AM

 

I hadn't gone back to see what "test L" was in the lists last night.  When I did just now, I realized it wasn't in any of the lists.

 

I did some further digging though:  This looks to be an incorrectly written test for the Sears EXEC.  The Sears EXEC has $28 at $1FFC, and $CA at $10EB.

 

OK, so I went and changed the $2FFCs to $1FFCs, and I manually made the b0rken test at $75F1 succeed.  Now MTE-201 passes 100% when provided the Sears EXEC.

 

This wasn't a check for Intellivision III.  It was an incorrectly implemented check for the Sears EXEC.



#22 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • Topic Starter
  • 3,911 posts

Posted Mon Apr 1, 2019 10:36 AM

 

I hadn't gone back to see what "test L" was in the lists last night.  When I did just now, I realized it wasn't in any of the lists.

 

I did some further digging though:  This looks to be an incorrectly written test for the Sears EXEC.  The Sears EXEC has $28 at $1FFC, and $CA at $10EB.

 

 

 

OK, so I went and changed the $2FFCs to $1FFCs, and I manually made the b0rken test at $75F1 succeed.  Now MTE-201 passes 100% when provided the Sears EXEC.

 

This wasn't a check for Intellivision III.  It was an incorrectly implemented check for the Sears EXEC.

 

Nice work!

 

While you were writing the 2nd post, I went looking around in V4.1 and found that the 2nd block of code ($7627) was corrected for the Sears EXEC but the 1st block ($75F7) was completely removed.  In a nutshell, I was about to post the same conclusion that V3's code was an incorrectly written test for the Sears EXEC.  ;)

 

V4.1's code:

        SDBD                                    ; 4E24   0001
        MVII    #$10EB, R5                      ; 4E25   02BD 00EB 0010
        MVI@    R5,     R3                      ; 4E28   02AB
        CLRR    R0                              ; 4E29   01C0
        CMPI    #$00A8, R3                      ; 4E2A   037B 00A8
        BEQ     L_4E30                          ; 4E2C   0204 0002

        MVII    #$0028, R0                      ; 4E2E   02B8 0028
L_4E30:
        SDBD                                    ; 4E30   0001
        MVII    #$1FFC, R5                      ; 4E31   02BD 00FC 001F
        CMP@    R5,     R0                      ; 4E34   0368
        BNEQ    L_4E1A                          ; 4E35   022C 001C
        PULR    R7                              ; 4E37   02B7


#23 Lathe26 OFFLINE  

Lathe26

    River Patroller

  • Topic Starter
  • 3,911 posts

Posted Mon Apr 1, 2019 10:48 AM

Joe probably already knows this, but I'll add the following for other readers.  When looking at the disassembly for all the versions of the Test Cartridges, the code for all the versions is closely-related.  It looks like the source code was handed down from version to version, with only some modifications and additions being added along the way (which makes business sense if you have the source code).  Even V1 and V4.1 still have good-sized sections that look identical, once you ignore the shift address offsets for the branch and jump instructions.



#24 intvnut OFFLINE  

intvnut

    River Patroller

  • 3,373 posts
  • Location:@R6 (top of stack)

Posted Mon Apr 1, 2019 11:36 AM

Joe probably already knows this, but I'll add the following for other readers.  When looking at the disassembly for all the versions of the Test Cartridges, the code for all the versions is closely-related.  It looks like the source code was handed down from version to version, with only some modifications and additions being added along the way (which makes business sense if you have the source code).  Even V1 and V4.1 still have good-sized sections that look identical, once you ignore the shift address offsets for the branch and jump instructions.

 

Indeed.  If you look over the customer procurement specifications (CPS), they refer to various "patterns" that were to be delivered by GI for testing various components (and IIRC they were assigned numbers, perhaps CPS spec numbers).  I can't find them just now. 

 

I do remember seeing notes in one of the PapaIntellivision docs indicating that the pattern #x tests the AY-3-8914, but needed to be revised to pattern #y which can test both AY-3-8914 and AY-3-8914A.  (This makes sense:  They removed one of the bits in each volume register.)

 

I suspect these were all intended to be assembly modules that could then be linked together to form the whole.

 

It makes a lot of sense to me to structure the software this way.







Also tagged with one or more of these keywords: Intellivision, Test Cartridge, MTE-201, Video Test Cartridge

0 user(s) are browsing this forum

0 members, 0 guests, 0 anonymous users